One year ago, today.

"Why and how we're migrating many of our servers most of our servers from Linux to the BSDs" - aka, "I solve problems"

https://www.youtube.com/watch?v=UnVp25-6Qao

#RunBSD #BSDCan #FreeBSD #OpenBSD #NetBSD #DragonflyBSD

🤗

#NetBSD #Atari #manpage

@moses_izumi @hikari @AnachronistJohn

#NetBSD definitely deserves some love for being one of the very few, and perhaps the most featureful Operating Systems that has a strong #NOAi stance.❤️‍🔥

I definitely want to start supporting them. I need to get on that.

Kinda postmortem:

1) The maximal log size before rotation and count of gzipped logs to store should be increased in the newsyslogd configuration. This should be applied to any service, which is looking into the void^WInternet. So, I will not loss log records, related to the start of attack…

2) Also, Asterisk log should be added to newsyslogd configuration first. It weren't added here, so *.log files became too big (> 1 Gb) and of course fail2ban ate a lot of memory while parsing these big logs. If they were rotated properly, then fail2ban will not eat so much memory, parsing small enough files.

3) Since start of attack in logs were lost, then I could only imagine possible root cause of an attack. By default, any IP, which once failed to provide the proper credentials to login somewhere in my kitchen server, is banned immediately and forever.
But somehow those attackers managed to use just 2 IPs to make an attack and they weren't banned before manual intervention

According to fail2ban logs they were banned, but they were obviously not banned by npf. So, I think, they started attack right in time when my blacklists were successfully updated and npf was reloading — as a result their IPs appeared as "banned" in the fail2ban, but the fail2ban failed to ban them via npf, so "IRL" their IPs still weren't banned. Time to revisit my script to update blacklists

4) Looks like I need to install some Intrusion Detection System (possibly snort since it is mature enough). It isn't good to rely only on one mechanism (fail2ban + blacklists + npf) to protect my precious machine.

#NetBSD #selfhosting #fail2ban #npf

Kinda postmortem:

1) The maximal log size before rotation and count of gzipped logs to store should be increased in the newsyslogd configuration. This should be applied to any service, which is looking into the void^WInternet. So, I will not loss log records, related to the start of attack…

2) Also, Asterisk log should be added to newsyslogd configuration first. It weren't added here, so *.log files became too big (> 1 Gb) and of course fail2ban ate a lot of memory while parsing these big logs. If they were rotated properly, then fail2ban will not eat so much memory, parsing small enough files.

3) Since start of attack in logs were lost, then I could only imagine possible root cause of an attack. By default, any IP, which once failed to provide the proper credentials to login somewhere in my kitchen server, is banned immediately and forever.
But somehow those attackers managed to use just 2 IPs to make an attack and they weren't banned before manual intervention

According to fail2ban logs they were banned, but they were obviously not banned by npf. So, I think, they started attack right in time when my blacklists were successfully updated and npf was reloading — as a result their IPs appeared as "banned" in the fail2ban, but the fail2ban failed to ban them via npf, so "IRL" their IPs still weren't banned. Time to revisit my script to update blacklists

4) Looks like I need to install some Intrusion Detection System (possibly snort since it is mature enough). It isn't good to rely only on one mechanism (fail2ban + blacklists + npf) to protect my precious machine.

#NetBSD #selfhosting #fail2ban #npf

The upgrade went alright. The permissions on /dev/tap0 were rewritten, which took me a minute to realize and fix so virtual machines will work again.

Also had some bad USB issues trying to boot the installer, but it's impossible to say whether the hardware (likely) or NetBSD (unlikely) is to blame.

Alt...

A screencap of neofetch output showing a 3rd-gen i5 with 16GB RAM and an Nvidia 7xx running NetBSD 11_RC4

BSDCan next week.
See you there!

https://www.bsdcan.org/2026/

#OpenBSD #NetBSD #FreeBSD #DragonFlyBSD #BSD #Ottawa

By the way, our first two publications on evaluating #OpenBSD mitigations are out. Both of these papers evaluate some amd64 anti-ROP mitigations: specifically changing the register selection order and semantically equivalent rewriting of instructions that may produce a potential polymorphic gadget instruction. This tracks a paper by mortimer@ back in 2019 at AsiaBSDCon.

The TL;DR is "OpenBSD can shrink binaries a little and gain a little performance without any security loss simply by reverting these mitigations." The mitigations did not hold up to independent evaluation.

The first paper did an exact 1:1 port of these mitigations to FreeBSD and found that register reallocation eliminates only about 0.3% of unique gadgets, for a 0.5% increase in binary size (mortimer@ claimed 6% reduction and "entirely free"). It is useless at best but more likely actively detrimental, as it produces a false sense of security. It also found the instruction rewriting reduces unique gadgets by about 3.5% with a binary size increase of about 1.8% (mortimer@ claimed 5% reduction with 0.15% binary size increase).

We then did a separate implementation of the instruction rewriting mitigation to GCC in the second paper. Our GCC implementation does the older <xchg; op; xchg> dance, as that's what mortimer@'s paper described. This is way worse; producing about a 3% performance hit for no security benefit at all.

The only part of both mitigations worth saving is for basic arithmetic, OpenBSD LLVM now takes advantage of the fact that basic arithmetic has two forms. For example, the newer instruction rewriting mitigation turns
addq %rax, %rbx (48 01 c3)
into
{load} addq %rax, %rbx (48 03 d8)

The new instruction rewriting mitigation is genuinely free in terms of binary size and execution speed, but doesn't move the security needle, so this one can stay as it is harmless. Other rewritings still have the flaw of increasing binary size and reducing performance for no security benefit.

Anyhow feel free to read the papers:
https://ieeexplore.ieee.org/abstract/document/11458911
https://www.researchgate.net/publication/405728967_A_Final_Return_for_OpenBSD_Anti-Return-Oriented_Programming_Mitigations

#BSD #FreeBSD #NetBSD #DragonFlyBSD #Linux #Unix #security #cybersecurity

• small screen, max 10 inch
• runs #OpenBSD or #NetBSD
• has a keyboard
• can connect to Internet
• it works
• price is reasonable

• MNT Reform Pocket (if I will be super rich one day, then I will take entire stock)
• HP Jornada (especially 720, but availability is not great)
• Zaurus machines (availability is almost zero and might not fill condition "it works")

Some graphs from #Munin with LLM-bots attacking my kitchen server.
Graphs spans to the whole week, so on the left there is a normal state of my server. And on the right — attack is happening.

#NetBSD #LLM #AInt #selfhosting

Alt...

Graph of CPU usage, which going high after LLM bots attack (at near 08 Jan Monday). At near 2 CPU cores were used by LLM bots, trying to abuse my PBX as an Web-server.

Alt...

Graph with main network interface bits per minute — before attack there were almost no data receivin/transmitting, only some cron jobs at night. But after attack there are at near 20 Mb per minute both receiving and transmitting.

Alt...

Graph with PostgreSQL connections. Active connections has green color. Before the attack there are almost no active connections, but after attack there are a lot of them, since Asterisk using PostgreSQL as a main backend.

Alt...

Load average for my server. After attack it increased at near 4 times.

RE: https://social.treehouse.systems/@AsahiLinux/116719749555082847

Heads up: This very likely also affects booting other non-Linux OS's on Apple silicon, don't upgrade to the macOS 27 beta.

#OpenBSD #FreeBSD #NetBSD

There is some progress on the matter. Thomas Klausner suggested an OpenSSL patch he had found and Martin Husemann helped fix my `build.sh` problems. Testing it all since yesterday and so far it hasn't crashed! 🤞
#netbsd #openssl #pkgsrc #haproxy

It's been almost 2 days since applying the patch to #NetBSD 11.0_RC4's #OpenSSL and so far #haproxy is still up and running. It'll be pulled up to netbsd-11 branch before the release!

*** Repost on new instance ***

Hello Fediverse,

I'm happy to announce our very own Mastodon instance called "FediBlue", a new friendly place in the Fediverse for all people that are interested in free and open source software, especially Linux, BSD and illumos.

FediBlue is part of our ongoing effort to strengthen the FOSS community by publishing content about it and help projects gaining visibility in a time where many companies try to force their services on users, train AIs with people's data and collect as many data as they could.

Alongside the wonderful BSD Cafe community, where I'm also at, FediBlue should provide another very friendly and welcoming place in the Fediverse. In the next days, the Dark Blue Project presence will move completely to FediBlue.

https://mastodon.fediblue.de

#mastodon #opensource #freesoftware #linux #freebsd #openbsd #netbsd #illumos #darkblueproject #fediblue

As the #FreeBSD pkg of the postgis extension is not tied to a database version and the #NetBSD one seems to be, I moved the geo databases to the former. The rest, to NetBSD.
Zabbix, on the other hand, might need to be a little more performant. We'll see.

1204605:20260608:155730.445 slow query: 6.477221 sec, [...]

Plan is to move Zabbix back to the faster machine when #PostgreSQL18 is set.

(15 minutes down time for export, copy, import, restart).

Alt...

Temperature of a CPU, with a gap for the database switcheroo.

Who was at BSDCan.org 2016?
Remember this?

https://www.cbc.ca/news/canada/ottawa/ten-years-ago-a-sinkhole-tore-up-rideau-street-it-could-have-been-much-worse-9.7224904?cmp=Mastodon

Those of us in Desmarais remember the lights flickering!

Speaking of which, the conference is open to anyone walking in off the street. Might interest some Ottawa natives as well.

#BSD #FreeBSD #OpenBSD #NetBSD #DragonflyBSD #Ottawa

Do you want to come to Brussels, mingle with BSD people, perhaps do a talk, a tutorial or a BOF session?

The Call for papers https://2026.eurobsdcon.org/cfp/ is open until June 20th, for the conference in Brussels September 9-13, 2026.

We also offer pre-submission guidance/mentoring, see within.

Wonder what BSD and the conferences are about? See https://nxdomain.no/~peter/what_is_bsd_come_to_a_conference_to_find_out.html

@EuroBSDCon #freebsd #netbsd #openbsd #freesoftware #libresoftware #brussels #bruxelles

I got the world's cutest little computer over the weekend thanks to @murble! It's a #Vortex86 of some kind, equivalent to a fast #486, and is genuinely #32bit so I shall no longer have to rely on emulation or running 32-bit kernels and libraries on 64-bit hardware for 32-bit testing! Gonna put #NetBSD on there.

But first, because it has no serial port and the only video output is VGA, I need to find a VGA monitor.

No #BananaForScale because I don't like bananas. Have an aniseed twist instead.

Alt...

A photograph of a ridiculously tiny computer sitting on a brown wooden desk. The computer measures 95 by 95 by 20mm. You can see the front, which has 2 USB ports, an SD card slot, pointless audio in/out, and a dinky little power button. The whole of the top surface is a heat sink and there are four screw holes going all the way through, presumably for mounting on the back of a monitor. There is a delicious aniseed twist on top for scale. Modern aniseed twists taste good, but are a pale imitation of the deep red that they used to be back in the good old days before all this woke nonsense about poisoning children with lead-based food colourings. It is ORANGE, which is wrong. And PALE ORANGE at that. I shall write a stern letter to my MP.

Latest 𝗩𝗮𝗹𝘂𝗮𝗯𝗹𝗲 𝗡𝗲𝘄𝘀 - 𝟮𝟬𝟮𝟲/𝟬𝟲/𝟬𝟴 (Valuable News - 2026/06/08) available.

https://vermaden.wordpress.com/2026/06/08/valuable-news-2026-06-08/

Past releases: https://vermaden.wordpress.com/news/

#verblog #vernews #news #bsd #freebsd #openbsd #netbsd #linux #unix #zfs #opnsense #ghostbsd #solaris #vermadenday

Latest 𝗩𝗮𝗹𝘂𝗮𝗯𝗹𝗲 𝗡𝗲𝘄𝘀 - 𝟮𝟬𝟮𝟲/𝟬𝟲/𝟬𝟴 (Valuable News - 2026/06/08) available.

https://vermaden.wordpress.com/2026/06/08/valuable-news-2026-06-08/

Past releases: https://vermaden.wordpress.com/news/

#verblog #vernews #news #bsd #freebsd #openbsd #netbsd #linux #unix #zfs #opnsense #ghostbsd #solaris #vermadenday

@dfloyd888

Au contraire, mon frère!

#FreeBSD has a handbook that covers almost every basic config situation you'd face.
#OpenBSD has man pages covering nearly everything
I haven't gotten very deep into #NetBSD, but I'm sure its documentation is on point.
#9front has... 9front has... 9front has some very nice people on fedi who will tell you turn back now while there's still time 😂

The documentation experience on Linux is various forum posts telling you to try various things, none of which work, and maybe some obtuse documentation text file on kernel.org. Egad.

@MaddieM4

Even easier for those who have learned the modern BSD ftp command. (-:

The BSDs decided that since the tool for fetching files was named ftp, they'd just augment the protocols that it was capable of speaking.

#FreeBSD has an extra fetch command as well. But all of them — #NetBSD, #OpenBSD, and the derivatives of those three — have ftp commands that speak HTTP, originating in a lukemftp (later tnftp) project by Luke Mewburn for NetBSD in the 1990s.

It's also in #Debian.

#ftp #fetch

The NetBSD 🚩 Foundation wrapped up its 2026 AGM! 🚀 Quick recap of milestones & future plans:
📦 NetBSD-11 (RC4) is on the horizon.
🌳 The massive migration from CVS to Git/Mercurial is officially complete!
🎓 #GSoC2026: 5 students onboarded (working on Wi-Fi stack upgrades, porting the #Enlightenment desktop @E , and more).
🛡️ Security: Onboarding as a MITRE CNA, preparing for the EU CRA, and enforcing "Anti-Slop" (no unreviewed AI code) protocols.
🔬 Long-term: Long-term plans to use formal verification tools, with Core open to funding active code audits.

Full log: https://blog.netbsd.org/tnf/entry/annual_general_meeting_2026

#NetBSD #OpenSource #RunBSD #GSoC #Security #Linux #antiaislop #FormalVerifcation

Sitting in on the NetBSD agm IRC, and excited to see that 11.0 release is maybe less than 2 weeks out! This will be my jumping off point into NetBSD.

#NetBSD

Reminder: we have our Annual General Meeting today!

Saturday, June 6th at 14:00 UTC in the #netbsd-agm channel
on irc.libera.chat. You can use your preferred Internet Relay Chat
program, or join directly at: https://web.libera.chat/#netbsd-agm

There will be a series of presentations about #NetBSD followed by a
moderated Q&A session.

http://mail-index.netbsd.org/netbsd-announce/2026/05/17/msg000397.html

Did some yak shaving today.

I want to use a USB to TTL serial adapter to let one Rasbperry Pi handle the serial console of another Raspberry Pi. But I’m using my USB to TTL serial adapter to talk to my Plextor PX-EH25L (SuperH machine) because the IDE disk in it died.

I found a couple of USB / Firewire IDE enclosures, but couldn’t find the PSUs. I tried an old AMD motherboard with IDE (and floppy!), but that POSTed once and never again.

I looked everywhere for something with IDE. My Amigas are busy, so I decided to set up a Cobalt Raq (MIPS). In order to use that to install NetBSD to an IDE disk for the Plextor, I first had to install NetBSD on it. However, NetBSD’s infrastructure was down, so I had to find a copy of the NetBSD Cobalt restore CD ISO elsewhere.

But I finally got #NetBSD installed on the Cobalt, which allowed me to install NetBSD for SuperH on the IDE disk for the Plextor, which freed up the USB to TTL serial for the Raspberry Pis, which I’m finally setting up now :)

SuperH binary pkgsrc building will resume soon!

@smurfd some network outage I think, haven't been able to get to mail for many hours.

#netbsd

#netbsd cdn and wiki maintenance or disturbance?

#NetBSD
Merch

#somafm
Direct donations
Merch

#unix_surrealism
Direct donations
Merch

EuroBSDCon 2025 in Zagreb, Croatia was great!

At NetBSD devsummit I have presented «Running Docker (and more) in NetBSD via Lima». Lima (<https://lima-vm.io/>) permits to run Linux virtual machines (as guests) - with port forwarding and volumes sharing - and I have showed how NetBSD is supported and works as host!

Slides available at <https://www.NetBSD.org/gallery/presentations/leot/eurobsdcon2025-devsummit-lima/lima.pdf>.

I have now also imported Lima in pkgsrc as sysutils/lima.

#EBC25 #netbsd #pkgsrc

This World Environment Day, combat e-waste by recycling your old tech with #NetBSD. Don't let planned obsolescence dictate your hardware's lifespan. Give that old machine a second life as a rock-solid firewall, file server, or lightweight workstation. 🖥️🌱
#WorldEnvironmentDay #NetBSD #RunBSD #RetroComputing #EcoFriendly #FOSS #Linux

I plan on doing more with NetBSD, but I had decided on that long before the AI generated code issue. NetBSD has a policy that forbids AI generated code from being contributed.

#NetBSD #BSD

I just updated my #pkgsrc wip packaging for the #VimClassic 8.3.0 release. It's working just fine on my #NetBSD 11 dev host.

If you want to test it, see the https://pkgsrc.org/wip/ docs here. I'm going to live with for a couple days and see about getting it pulled into main.