gsoc – Jupiter Broadcasting

Swap that Space | BSD Now 314

Wes Payne — Wed, 04 Sep 2019 19:00:20 +0000

Show Notes/Links: https://www.bsdnow.tv/314

The post Swap that Space | BSD Now 314 first appeared on Jupiter Broadcasting.

On the List | BSD Now 87

chris — Thu, 30 Apr 2015 08:51:17 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Coming up this time on the show, we’ll be speaking with Christos Zoulas, a NetBSD security officer. He’s got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We’ve also got answers to your emails and all this week’s news, on BSD Now – the place to B.. SD.

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

New PAE support in OpenBSD

OpenBSD has just added Physical Address Extention support to the i386 architecture, but it’s probably not what you’d think of when you hear the term
In most operating systems, PAE’s main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms – this version isn’t for that
Instead, this change specifically allows the system to use the No-eXecute Bit of the processor for the userland, further hardening the in-place memory protections
Other operating systems enable the CPU feature without doing anything to the page table entries, so they do get the available memory expansion, but don’t get the potential security benefit
As we discussed in a previous episode, the AMD64 platform already saw some major W^X kernel and userland improvements – the i386 kernel reworking will begin shortly
Not all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of W^X that was already there
The AMD64 improvements will be in 5.7, due out in just a couple days as of when we’re recording this, but the i386 improvements will likely be in 5.8

Booting Windows in bhyve

Work on FreeBSD’s bhyve continues, and a big addition is on the way
Thus far, bhyve has only been able to boot operating systems with a serial console – no VGA, no graphics, no Windows
This is finally changing, and a teasing screenshot of Windows Server was recently posted on Twitter
Graphics emulation is still in the works; this image was taken by booting headless and using RDP
A lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)
Not a lot of details on the matter currently, but we’ll be sure to bring you more info as it comes out
Are you more interested in bhyve or Xen on FreeBSD? Email us your thoughts

MidnightBSD 0.6 released

MidnightBSD is a smaller project we’ve not covered a lot on the show before
It’s an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-use
They also have their own, smaller version of FreeBSD ports, called “mports”
If you’re already using it, this new version is mainly a security and bugfix release
It syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versions
You can check their site for more information about the project
We’re trying to get the lead developer to come on for an interview, but haven’t heard anything back yet

OpenBSD rewrites the file utility

We’re all probably familiar with the traditional file command – it’s been around since the 1970s
For anyone who doesn’t know, it’s used to determine what type of file something actually is
This tool doesn’t see a lot of development these days, and it’s had its share of security issues as well
Some of those security issues remain unfixed in various BSDs even today, despite being publicly known for a while
It’s not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running it
When you think about it, file was technically designed to be used on untrusted files
OpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite – this time with modern coding practices and the usual OpenBSD scrutiny
This new version will, by default, run as an unprivileged user with no shell, and in a systrace sandbox, strictly limiting what system calls can be made
With these two things combined, it should drastically reduce the damage a malicious file could potentially do
Ian Darwin, the original author of the utility, saw the commit and replied, in what may be a moment in BSD history to remember
It’ll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future – someone’s already thrown together an unofficial portable version
Coincidentally, the lead developer and current maintainer of file just happens to be our guest today…

Interview – Christos Zoulas – christos@netbsd.org

blacklistd and NetBSD advocacy

News Roundup

GSoC-accepted BSD projects

The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that list
FreeBSD’s list includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. memory compression and deduplication
OpenBSD’s list includes: asynchronous USB transfer submission from userland, ARM SD/MMC & controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it… porting HAMMER FS to OpenBSD
We’ll be sure to keep you up to date on developments from both projects
Hopefully the other BSDs will make the cut too next year

FreeBSD on the Gumstix Duovero

If you’re not familiar with the Gumstix Duovero, it’s an dual core ARM-based computer-on-module
They actually look more like a stick of RAM than a mini-computer
This article shows you how to build a FreeBSD -CURRENT image to run on them, using crochet-freebsd
If anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us

EU study recommends OpenBSD

A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and tools
This is especially important, in all countries, after the mass surveillance documents came out
“[…] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts.”
The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied on
Alongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: “Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways”
Reddit, Undeadly and Hacker News also had some discussion, particularly about corporations giving back to the BSDs that they make use of in their infrastructure – something we’ve discussed with Voxer and M:Tier before

FreeBSD workflow with Git

If you’re interested in contributing to FreeBSD, but aren’t a big fan of SVN, they have a Github mirror too
This mailing list post talks about interacting between the official source repository and the Git mirror
This makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved

Feedback/Questions

Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv – don’t be shy, we’re here to help with any questions you have
We’re always looking for interviews, so feel free to suggest someone you’d like for us to talk to (or volunteer yourself if you’re doing something cool)

The post On the List | BSD Now 87 first appeared on Jupiter Broadcasting.

From the Foundation (Part 2) | BSD Now 78

chris — Thu, 26 Feb 2015 12:57:45 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

This week we continue our two-part series on the activities of various BSD foundations. Ken Westerback joins us today to talk all about the OpenBSD foundation and what it is they do. We’ve also got answers to your emails and all the latest news, on BSD Now – the place to B.. SD.

Thanks to:

Get Paid to Write for DigitalOcean

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

BSDCan 2015 schedule

The list of presentations for the upcoming BSDCan conference has been posted, and the time schedule should be up shortly as well
Just a reminder: it’s going to be held on June 12th and 13th at the University of Ottawa in Canada
This year’s conference will have a massive fifty talks, split up between four tracks instead of three (but unfortunately a person can only be in one place at a time)
Both Allan and Kris had at least one presentation accepted, and Allan will also be leading a few “birds of a feather” gatherings
In total, there will be three NetBSD talks, five OpenBSD talks, eight BSD-neutral talks, thirty-five FreeBSD talks and no DragonFly talks
That’s not the ideal balance we’d hope for, but BSDCan says they’ll try to improve that next year
Those numbers are based on the speaker’s background, or any past presentations, for the few whose actual topic wasn’t made obvious from the title (so there may be a small margin of error)
Michael Lucas (who’s on the BSDCan board) wrote up a blog post about the proposals and rejections this year
If you can’t make it this year, don’t worry, we’ll be sure to announce the recordings when they’re made available
We also interviewed Dan Langille about the conference and what to expect this year, so check that out too

SSL interception with relayd

There was a lot of commotion recently about superfish, a way that Lenovo was intercepting HTTPS traffic and injecting advertisements
If you’re running relayd, you can mimic this evil setup on your own networks (just for testing of course…)
Reyk Floeter, the guy who wrote relayd, came up a blog post about how to do just that
It starts off with some backstory and some of the things relayd is capable of
relayd can run as an SSL server to terminate SSL connections and forward them as plain TCP and, conversely, run as an SSL client to terminal plain TCP connections and tunnel them through SSL
When you combine these two, you end up with possibilities to filter between SSL connections, effectively creating a MITM scenario
The post is very long, with lots of details and some sample config files – the whole nine yards

OPNsense 15.1.6.1 released

The OPNsense team has released yet another version in rapid succession, but this one has some big changes
It’s now based on FreeBSD 10.1, with all the latest security patches and driver updates (as well as some in-house patches)
This version also features a new tool for easily upgrading between versions, simply called “opnsense-update” (similar to freebsd-update)
It also includes security fixes for BIND and PHP, as well as some other assorted bug fixes
The installation images have been laid out in a clean way: standard CD and USB images that default to VGA, as well as USB images that default to a console output (for things like Soekris and PCEngines APU boards that only have serial ports)
With the news of m0n0wall shutting down last week, they’ve also released bare minimum hardware specifications required to run OPNsense on embedded devices
Encouraged by last week’s mention of PCBSD trying to cut ties with OpenSSL, OPNsense is also now providing experimental images built against LibreSSL for testing (and have instructions on how to switch over without reinstalling)

OpenBSD on a Minnowboard Max

What would our show be without at least one story about someone installing BSD on a weird device
For once, it’s actually not NetBSD…
This article is about the minnowboard max, a very small X86-based motherboard that looks vaguely similar to a Raspberry Pi
It’s using an Atom CPU instead of ARM, so overall application compatibility should be a bit better (and it even has AES-NI, so crypto performance will be much better than a normal Atom)
The author describes his entirely solid-state setup, noting that there’s virtually no noise, no concern about hard drives dying and very reasonable power usage
You’ll find instructions on how to get OpenBSD installed and going throughout the rest of the article
Have a look at the spec sheet if you’re interested, they make for cool little BSD boxes

Netmap for 40gbit NICs in FreeBSD

Luigi Rizzo posted an announcement to the -current mailing list, detailing some of the work he’s just committed
The ixl(4) driver, that’s one for the X1710 40-gigabit card, now has netmap support
It’s currently in 11-CURRENT, but he says it works in 10-STABLE and will be committed there too
This should make for some serious packet-pushing power
If you have any network hardware like this, he would appreciate testing for the new code

Interview – Ken Westerback – directors@openbsdfoundation.org

The OpenBSD foundation‘s activities

News Roundup

s2k15 hackathon report: dhclient/dhcpd/fdisk

The second trip report from the recent OpenBSD hackathon has been published, from the very same guy we just talked to
Ken was also busy, getting a few networking-related things fixed and improved in the base system
He wrote a few new small additions for dhclient and beefed up the privsep security, as well as some fixes for tcpdump and dhcpd
The fdisk tool also got worked on a bit, enabling OpenBSD to properly wipe GPT tables on a previously-formatted disk so you can do a normal install on it
There’s apparently plans for “dhclientng” – presumably a big improvement (rewrite?) of dhclient

FreeBSD beginner video series

A new series of videos has started on YouTube, aimed at helping total beginners learn about FreeBSD
We usually assume that people who watch the show are already familiar with basic concepts, but they’d be a great introduction to any of your friends that are looking to get started with BSD and need a helping hand
So far, he’s covered how to get FreeBSD, an introduction to installing in VirtualBox, a simple installation or a more in-depth manual installation, navigating the filesystem, basic ssh use, managing users and groups and finally some basic editing with vi and a few other topics
Everyone’s gotta start somewhere and, with a little bit of initial direction, today’s newbies could be tomorrow’s developers
It should be an ongoing series with more topics to come

NetBSD tests: zero unexpected failures

The NetBSD guys have a new blog post up about their testing suite for all the CPU architectures
They’ve finally gotten the number of “expected” failures down to zero on a few select architectures
Results are published on a special release engineering page, so you can have a look if you’re interested
The rest of the post links to the “top performers” (ones with less than ten failure) in the -current branch

PCBSD switches to IPFW

The PCBSD crew continues their recent series of switching between major competing features
This time, they’ve switched the default firewall away from PF to FreeBSD’s native IPFW firewall
Look forward to Kris wearing a “keep calm and use IPFW” shir- wait

Feedback/Questions

Mailing List Gold

Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv
Some extra emails would be great, since we’ll be recording two episodes next week
Be sure to say hi if you’re at AsiaBSDCon in a couple weeks, maybe we could even interview some listeners too
We talked to the NetBSD foundation back in episode 12 and DragonFlyBSD doesn’t have a foundation, so there won’t be an “official” third part in this series

The post From the Foundation (Part 2) | BSD Now 78 first appeared on Jupiter Broadcasting.

System Disaster | BSD Now 71

chris — Thu, 08 Jan 2015 11:14:34 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

This time on the show, we’ll be talking to Ian Sutton about his new BSD compatibility wrappers for various systemd dependencies. Don’t worry, systemd is not being ported to BSD! We’re still safe! We’ve also got all the week’s news and answers to your emails, coming up on BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

Introducing OPNsense, a pfSense fork

OPNsense is a new BSD-based firewall project that was recently started, forked from the pfSense codebase
Even though it’s just been announced, they already have a formal release based on FreeBSD 10 (pfSense’s latest stable release is based on 8.3)
The core team includes a well-known DragonFlyBSD developer
You can check out their code on Github now, or download an image and try it out – let us know if you do and what you think about it
They also have a nice wiki and some instructions on getting started for new users
We plan on having them on the show next week to learn a bit more about how the project got started and why you might want to use it – stay tuned

Code rot and why I chose OpenBSD

Here we have a blog post about rotting codebases – a core banking system in this example
The author tells the story of how his last days spent at the job were mostly removing old, dead code from a giant project
He goes on to compare it to OpenSSL and the heartbleed disaster, from which LibreSSL was born
Instead of just bikeshedding like the rest of the internet, OpenBSD “silently started putting the beast into shape” as he puts it
The article continues on to mention OpenBSD’s code review process, and how it catches any bugs so we don’t have more heartbleeds
“In OpenBSD you are encouraged to run current and the whole team tries its best to make current as stable as it can. You know why? They eat their own dog food. That’s so simple yet so amazing that it blows my mind. Developers actually run OpenBSD on their machines daily.”
It’s a very long and detailed story about how the author has gotten more involved with BSD, learned from the mailing lists and even started contributing back – he says “In summary, I’m learning more than ever – computing is fun again”
Look for the phrase “Getting Started” in the blog post for a nice little gem

ZFS vs HAMMER FS

One of the topics we’ve seen come up from time to time is how FreeBSD’s ZFS and DragonFly’s HAMMER FS compare to each other
They both have a lot of features that traditional filesystems lack
A forum thread was opened for discussion about them both and what they’re typically used for
It compares resource requirements, ideal hardware and pros/cons of each
Hopefully someone will do another new comparison when HAMMER 2 is finished
This is not to be confused with the other “hammer” filesystem

Portable OpenNTPD revived

With ISC’s NTPd having so many security vulnerabilities recently, people need an alternative NTP daemon
OpenBSD has developed OpenNTPD since 2004, but the portable version for other operating systems hasn’t been actively maintained in a few years
The older version still works fine, and is in FreeBSD ports and NetBSD pkgsrc, but it would be nice to have some of the newer features and fixes from the native version
Brent Cook, who we’ve had on the show before to talk about LibreSSL, decided it was time to fix this
While looking through the code, he also found some fixes for the native version as well
You can grab it from Github now, or just wait for the updated release to hit the repos of your OS of choice

Interview – Ian Sutton – ian@kremlin.cc

BSD replacements for systemd dependencies

News Roundup

pkgng adds OS X support

FreeBSD’s next-gen package manager has just added support for Mac OS X
Why would you want that? Well.. we don’t really know, but it’s cool
The author of the patch may have some insight about what his goal is though
This could open up the door for a cross-platform pkgng solution, similar to NetBSD’s pkgsrc
There’s also the possibility of pkgng being used as a packaging format for MacPorts in the future
While we’re on the topic of pkgng, you can also watch bapt‘s latest presentation about it from ruBSD 2014 – “four years of pkg“

Secure secure shell

Almost everyone watching BSD Now probably uses OpenSSH and has set up a server at one point or another
This guide provides a list of best practices beyond the typical “disable root login and use keys” advice you’ll often hear
It specifically goes in-depth with server and client configuration with the best key types, KEX methods and encryption ciphers to use
There are also good explanations for all the choices, based both on history and probability
Minimal backwards compatibility is kept, but most of the old and insecure stuff gets disabled
We’ve also got a handy chart to show which SSH implementations support which ciphers, in case you need to support Windows users or people who use weird clients

Dissecting OpenBSD’s divert(4)

PF has a cool feature that not a lot of people seem to know about: divert
It lets you send packets to userspace, allowing you to inspect them a lot easier
This blog post, the first in a series, details all the cool things you can do with divert and how to use it
A very common example is with intrusion detection systems like Snort

Screen recording on FreeBSD

This is a neat article about a topic we don’t cover very often: making video content on BSD
In the post, you’ll learn how to make screencasts with FreeBSD, using kdenlive and ffmpeg
There are also notes about getting a USB microphone working, so you can do commentary on whatever you’re showing
It also includes lots of details and helpful screenshots throughout the process
You should make cool screencasts and send them to us

Feedback/Questions

Mailing List Gold

Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv – we’ve highlighted some pretty cool BSD blog posts recently, but you need to tell us if you write one!
Watch live Wednesdays at 2:00PM Eastern (19:00 UTC)

The post System Disaster | BSD Now 71 first appeared on Jupiter Broadcasting.

BSD Now vs. BSDTalk | BSD Now 27

chris — Thu, 06 Mar 2014 23:41:07 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

The long-awaited meetup is finally happening on today\’s show. We\’re going to be interviewing the original BSD podcaster, Will Backman, to discuss what he\’s been up to and what the future of BSD advocacy looks like. After that, we\’ll be showing you how to track (and even cross-compile!) the -CURRENT branch of NetBSD. We\’ve got answers to user-submitted questions and the latest news, on BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

FreeBSD and OpenBSD in GSOC2014

The Google Summer of Code is a way to encourage students to write code for open source projects and make some money
Both FreeBSD and OpenBSD were accepted, and we\’d love for anyone listening to check out their GSOC pages
The FreeBSD wiki has a list of things that they\’d be interested in someone helping out with
OpenBSD\’s want list was also posted
DragonflyBSD and NetBSD were sadly not accepted this year

Yes, you too can be an evil network overlord

A new blog post about monitoring your network using only free tools
OpenBSD is a great fit, and has all the stuff you need in the base system or via packages
It talks about the pflow pseudo-interface, its capabilities and relation to NetFlow (also goes well with pf)
There\’s also details about flowd and nfsen, more great tools to make network monitoring easy
If you\’re listening, Peter… stop ignoring our emails and come on the show! We know you\’re watching!

BSDMag\’s February issue is out

The theme is \”configuring basic services on OpenBSD 5.4\”
There\’s also an interview with Peter Hansteen
Topics also include locking down SSH, a GIMP lesson, user/group management, and…
Linux and Solaris articles? Why??

Changes in bcrypt

Not specific to any OS, but the OpenBSD team is updating their bcrypt implementation
There is a bug in bcrypt when hashing long passwords – other OSes need to update theirs too! (FreeBSD already has)
\”The length is stored in an unsigned char type, which will overflow and wrap at 256. Although we consider the existence of affected hashes very rare, in order to differentiate hashes generated before and after the fix, we are introducing a new minor \’b\’.\”
As long as you upgrade your OpenBSD system in order (without skipping versions) you should be ok going forward
Lots of specifics in the email, check the full post

This episode was brought to you by

Interview – Will Backman – bitgeist@yahoo.com / @bsdtalk

The BSDTalk podcast, BSD advocacy, various topics

Tutorial

Tracking and cross-compiling -CURRENT (NetBSD)

News Roundup

X11 no longer needs root

Xorg has long since required root privileges to run the main server
With recent work from the OpenBSD team, now everything (even KMS) can run as a regular user
Now you can set the \”machdep.allowaperture\” sysctl to 0 and still use a GUI

OpenSSH 6.6 CFT

Shortly after the huge 6.5 release, we get a routine bugfix update
Test it out on as many systems as you can
Check the mailing list for the full bug list

Creating an OpenBSD USB drive

Since OpenBSD doesn\’t distribute any official USB images, here are some instructions on how to do it
Step by step guide on how you can make your very own
However, there\’s some recent emails that suggest official USB images may be coming soon… oh wait

PCBSD weekly digest

New PBI updates that allow separate ports from /usr/local
You need to rebuild pbi-manager if you want to try it out
Updates and changes to Life Preserver, App Cafe, PCDM

Feedback/Questions

espressowar writes in: https://slexy.org/view/s2JpJ5EaZp
Antonio writes in: https://slexy.org/view/s2QpPevJ3J
Christian writes in: https://slexy.org/view/s2EZLxDfWh
Adam writes in: https://slexy.org/view/s21gEBZbmG
Alex writes in: https://slexy.org/view/s2RnCO1p9c

All the tutorials are posted in their entirety at bsdnow.tv
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv
We especially want to hear some tutorial ideas that you guys would like to see, so let us know
Also, if you\’re a NetBSD or DragonflyBSD guy listening, we want to talk to you! We\’d love more interviews related to those, whether you\’re a developer or not
Watch live Wednesdays at 2:00PM Eastern (19:00 UTC)

The post BSD Now vs. BSDTalk | BSD Now 27 first appeared on Jupiter Broadcasting.