Show Notes/Links: https://www.bsdnow.tv/318

The post The TrueNAS Library | BSD Now 318 first appeared on Jupiter Broadcasting.

Show Notes/Links: https://www.bsdnow.tv/313

The post In-Kernel TLS | BSD Now 313 first appeared on Jupiter Broadcasting.

It’s already our two-year anniversary! This time on the show, we’ll be chatting with Scott Courtney, vice president of infrastructure engineering at Verisign, about this year’s vBSDCon. What’s it have to offer in that’s different in the BSD conference space? We’ll find out!

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

Video | HD Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | HD Vid Feed | HD Torrent Feed

– Show Notes: –

Headlines

OpenBSD hypervisor coming soon

• Our buddy Mike Larkin never rests, and he posted some very tight-lipped console output on Twitter recently
• From what little he revealed at the time, it appeared to be a new hypervisor (that is, X86 hardware virtualization) running on OpenBSD -current, tentatively titled “vmm”
• Later on, he provided a much longer explanation on the mailing list, detailing a bit about what the overall plan for the code is
• Originally started around the time of the Australia hackathon, the work has since picked up more steam, and has gotten a funding boost from the OpenBSD foundation
• One thing to note: this isn’t just a port of something like Xen or Bhyve; it’s all-new code, and Mike explains why he chose to go that route
• He also answered some basic questions about the requirements, when it’ll be available, what OSes it can run, what’s left to do, how to get involved and so on

Why FreeBSD should not adopt launchd

• Last week we mentioned a talk Jordan Hubbard gave about integrating various parts of Mac OS X into FreeBSD
• One of the changes, perhaps the most controversial item on the list, was the adoption of launchd to replace the init system (replacing init systems seems to cause backlash, we’ve learned)
• In this article, the author talks about why he thinks this is a bad idea
• He doesn’t oppose the integration into FreeBSD-derived projects, like FreeNAS and PC-BSD, only vanilla FreeBSD itself – this is also explained in more detail
• The post includes both high-level descriptions and low-level technical details, and provides an interesting outlook on the situation and possibilities
• Reddit had quite a bit to say about this one, some in agreement and some not

DragonFly graphics improvements

• The DragonFlyBSD guys are at it again, merging newer support and fixes into their i915 (Intel) graphics stack
• This latest update brings them in sync with Linux 3.17, and includes Haswell fixes, DisplayPort fixes, improvements for Broadwell and even Cherryview GPUs
• You should also see some power management improvements, longer battery life and various other bug fixes
• If you’re running DragonFly, especially on a laptop, you’ll want to get this stuff on your machine quick – big improvements all around

OpenBSD tames the userland

• Last week we mentioned OpenBSD’s tame framework getting support for file whitelists, and said that the userland integration was next – well, now here we are
• Theo posted a mega diff of nearly 100 smaller diffs, adding tame support to many areas of the userland tools
• It’s still a work-in-progress version; there’s still more to be added (including the file path whitelist stuff)
• Some classic utilities are even being reworked to make taming them easier – the “w” command, for example
• The diff provides some good insight on exactly how to restrict different types of utilities, as well as how easy it is to actually do so (and en masse)
• More discussion can be found on HN, as one might expect
• If you’re a software developer, and especially if your software is in ports already, consider adding some more fine-grained tame support in your next release

Interview – Scott Courtney – vbsdcon@verisign.com / @verisign

vBSDCon 2015

News Roundup

OPNsense, beyond the fork

• We first heard about OPNsense back in January, and they’ve since released nearly 40 versions, spanning over 5,000 commits
• This is their first big status update, covering some of the things that’ve happened since the project was born
• There’s been a lot of community growth and participation, mass bug fixing, new features added, experimental builds with ASLR and much more – the report touches on a little of everything

LibreSSL nukes SSLv3

• With their latest release, LibreSSL began to turn off SSLv3 support, starting with the “openssl” command
• At the time, SSLv3 wasn’t disabled entirely because of some things in the OpenBSD ports tree requiring it (apache being one odd example)
• They’ve now flipped the switch, and the process of complete removal has started
• From the Undeadly summary, “This is an important step for the security of the LibreSSL library and, by extension, the ports tree. It does, however, require lots of testing of the resulting packages, as some of the fallout may be at runtime (so not detected during the build). That is part of why this is committed at this point during the release cycle: it gives the community more time to test packages and report issues so that these can be fixed. When these fixes are then pushed upstream, the entire software ecosystem will benefit. In short: you know what to do!”
• With this change and a few more to follow shortly, LibreSSL won’t actually support SSL anymore – time to rename it “LibreTLS”

FreeBSD MPTCP updated

• For anyone unaware, Multipath TCP is “an ongoing effort of the Internet Engineering Task Force’s (IETF) Multipath TCP working group, that aims at allowing a Transmission Control Protocol (TCP) connection to use multiple paths to maximize resource usage and increase redundancy.”
• There’s been work out of an Australian university to add support for it to the FreeBSD kernel, and the patchset was recently updated
• Including in this latest version is an overview of the protocol, how to get it compiled in, current features and limitations and some info about the routing requirements
• Some big performance gains can be had with MPTCP, but only if both the client and server systems support it – getting it into the FreeBSD kernel would be a good start

UEFI and GPT in OpenBSD

• There hasn’t been much fanfare about it yet, but some initial UEFI and GPT-related commits have been creeping into OpenBSD recently
• Some support for UEFI booting has landed in the kernel, and more bits are being slowly enabled after review
• This comes along with a number of other commits related to GPT, much of which is being refactored and slowly reintroduced
• Currently, you have to do some disklabel wizardry to bypass the MBR limit and access more than 2TB of space on a single drive, but it should “just work” with GPT (once everything’s in)
• The UEFI bootloader support has been committed, so stay tuned for more updates as further progress is made

Feedback/Questions

• John writes in
• Mason writes in
• Earl writes in

• Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv
• BSD Now anniversary shirts are no longer available, and should be shipping out very soon (if they haven’t already) – big thanks to everyone who bought one (183 sold!)
• This week is the last episode written/organized by TJ

The post Virginia BSD Assembly | BSD Now 105 first appeared on Jupiter Broadcasting.

We\’ve got an interview with Henning Brauer about OpenBSD\’s pf firewall, a tutorial on how to follow the -STABLE and -CURRENT branches of FreeBSD, a recap of what happened at vBSDCon this year and.. As always, lots of news to cover, so stay tuned to BSD Now – the place to B.. SD.

Direct Download:

Video | HD Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | HD Vid Feed | HD Torrent Feed

– Show Notes: –

Headlines

Managed services using FreeBSD

• New York Internet, a huge ISP and service provider, details how they use FreeBSD
• Mentions using BSD technologies: pf, pfsync, carp, haproxy, zfs, jails and more
• Explains FreeBSD\’s role in commercial workloads on a massive scale
• Lots of cool graphs and info, check out the full write-up

OpenBSD boot support for keydisk-based crypto volumes

• So far, only passphrase-based crypto volumes were bootable
• Full disk encryption with key disks required a non-crypto partition to load the kernel
• The bootloader now scans all BIOS-visible disks for RAID partitions and automatically associates key disk partitions with their crypto volume
• No need to re-create existing volumes. Moving the root partition onto the crypto disk and running \”installboot\” is all that\’s needed

More Dragonfly SMP speedups

• Matthew Dillon has been committing lots of various SMP improvements
• Using dports builds on a 48-processor machine as a test
• The machine’s now building more than 1000 packages an hour
• Super technical details in the show notes, check \’em out

Getting to know portmgr

• Start of an ongoing series profiling members of the FreeBSD Ports Management Team
• In the first interview, they talk to longest serving member of the team, Joe Marcus Clarke
• In the second, Bernhard Frölich (who\’s also the creator of redports.org)
• Future segments will include the other members
• Topics include their inspiration for using FreeBSD, first time using it, lots of other interesting stuff

BSD Now at the top of iTunes

• BSD Now is on the front-and-center page of iTunes\’ technology podcast section
• We\’re better than everyone else and Leo is fat

Interview – Henning Brauer – henning@openbsd.org / @henningbrauer

OpenBSD\’s pf firewall, privilege separation, various topics

Tutorial

Tracking -STABLE and -CURRENT

• The BSDs have development branches you can follow
• This guide shows the differences between FreeBSD -RELEASE, -STABLE and -CURRENT
• Will do OpenBSD and NetBSD versions in the future, their methods are all pretty different

News Roundup

OpenBSD gets XBox360 controller support

• Adds support for Microsoft XBox 360 controller as a uhid
• Will make things easier for emulators in OpenBSD
• Are there people who regularly play games on BSD? Email us, might do a segment on it

PCBSD 10-STABLE ISOs available

• Early cut of the new stable/10 branch, not recommended for everyone
• A pkgng repository is available, but is missing a number of packages
• AMD KMS, new text installer, UEFI loader support, much more

Switching from Linux to BSD

• Yet another Linux user switching to BSD makes a thread about it
• Asks the community what some differences and advantages are
• Good response from the community, worth reading if you\’re a Linux guy

Unattended OpenBSD installations

• Unattended installations possible using DHCP and a \”response\” file
• The system gets an IP via DHCP, then fetches a config file with key=value pairs
• Can do automatic network setup, SSH, passwords, etc
• Still a work in progress

Feedback/Questions

• Kjell-Aleksander writes in: https://slexy.org/view/s21hxDpzjO
• Alex writes in: https://slexy.org/view/s21ibNDb5y
• Chad writes in: https://slexy.org/view/s20D6K2NUe
• Joshua writes in: https://slexy.org/view/s20UZLFHAg
• Craig writes in: https://slexy.org/view/s20S15bbZ4

• All the tutorials are posted in their entirety at bsdnow.tv
• Send questions, comments, show ideas/topics, etc to feedback@bsdnow.tv
• We don’t check YouTube comments, JB comments, Reddit, etc. If you want us to see it, send it via email (the preferred way) or Twitter (also acceptable)
• Watch live Wednesdays at 2:00PM Eastern (18:00 UTC)

The post -CURRENT Events | BSD Now 9 first appeared on Jupiter Broadcasting.

We’ll look back at 10 years of Patch Tuesday, then the shutdown of Lavabit and Silkroad.

Plus a big batch of your questions, our answers, and much much more!

Thanks to:

— Show Notes: —

Microsoft Patch Tuesday turns 10

• On Oct. 9, 2003, Microsoft announced its new security patching process, it ended up changing the entire industry
• Microsoft promised:
• “Improved patch management processes, policies and technologies to help customers stay up to date and secure.”
• “Global education programs to provide better guidance and tools for securing systems.”
• “Our goal is simple: Get our customers secure and keep them secure. Our commitment is to protect our customers from the growing wave of criminal attacks.”
• Microsoft started blogging about security issues and also embarked on serious outbound communication campaigns to educate users
• Even Microsoft’s security bulletin text format and sections were delivered in a consistent format that security professionals have come to rely upon
• Today public disclosure of serious Microsoft security holes is now the exception

2 new vulnerabilities bypass Java ‘Click2Play’ security system

• A new variant of the \”Kore-ish\” Cool Exploit Kit appears to make use of two new zero-day exploits in Java7u21
• CVE-2013-2460
• CVE-2013-2472
• It appears this vulnerability may have originally been discovered by VUPEN and solid to governments and used for an indeterminate amount of time, until it was fixed by Oracle in Java7u25
• The current version of Java is Java7u40
• The latest version of Java includes a new ‘deployment rule set’ feature, that allows enterprise customers to create a whitelist of allowable applications, preventing drive-by attacks

Barclay’s hit by KVM attack, 1.3 million GBP stolen

• An person pretending to be an IT admin, walked in to the branch and installed an IP-KVM connected to a 3G Router, then later used it to take over the workstation it was connected to
• Barclays claims to have recovered “a significant amount” of the stolen money
• When police raided a number of properties to arrest the perpetrators, they found thousands of credit cards and other personal data, plus drugs, jewellery and cash
• This is not the first time Barclay’s has been hit. “We have been working closely with the Metropolitan Police following a security breach at our Swiss Cottage branch in April 2013. We identified the fraud and acted swiftly to recover funds on the same day,” said Alex Grant, managing director of fraud prevention at Barclays.

Feedback

[asa]B00457X7XQ[/asa]

• Zero Day: A Jeff Aiken Novel Audiobook | Mark Russinovich | Audible.com

• Co-located server connected to home server + 6 screens problem

• proXPN VPN | Checkout Code: JBLIVE for 20% off for Life

• Why use services like LastPass instead of directly generating passwords using e.g. PBKDF2?

• ZFS and Virtualization

• ZFS Distributed FS

• Follow up to the TechSNAP 128 Bank Job

• Ethernet over power!

• BSD Conference and vBSDcon 2013 – Verisign

Round Up:

• Edward Snowden\’s E-Mail Provider Defied FBI Demands to Turn Over Crypto Keys, Documents Show
• FIMail – Graphical Email client for DOS
• Silk Road Shutdown, Owner Arrested. FBI Says Simple Mistake Led to his Arrest
• Internet of Things Demands New Social Contract To Protect Privacy
• Rocket Researches bypass US GPS limits
• Lackluster broadband hurting adoption of ‘the cloud’
• Former NSA CTO Prescott Winter says enterprise IT security is appalling
• Signals from the Crowd: Uncovering Social Relationships through Smartphone Probes
• Security after the death of trust
• Yahoo does bugbounty wrong, researcher reports serious vulnerability, gets $12.50 coupon for Yahoo store

The post ZFS Can Do that | TechSNAP 130 first appeared on Jupiter Broadcasting.

After returning from a successful EuroBSDCon in Malta, we\’re back to get you caught up on all the latest news! We\’ve got stories, interviews and a special treat for OpenBSD fans later in the show. All that and more on this week\’s BSD Now, the place to B.. SD.

Direct Download:

Video | HD Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | HD Vid Feed | HD Torrent Feed

– Show Notes: –

Headlines

FreeBSD 9.2 released

• FreeBSD 9.2-RELEASE is finally out
• Highlights include ZFS TRIM and LZ4 support, virtio drivers, dtrace and OpenSSH updates as well as lots of driver improvements
• Will be supported until 2014-09-30
• Get out there and freebsd-update or buildworld!

Four new NetBSD releases

• NetBSD 5.2 and 5.1 branches get security and bugfix updates
• The 6.1 and 6.0 branches were updated soon after, also with security updates and bug fixes
• Check the show notes for the full changelog

BIND being replaced by unbound in FreeBSD

• Most FreeBSD users are familiar with BIND from the security notifications
• It has has many vulnerabilities over the years, and we’ll finally be rid of it
• Being replaced with unbound and ldns, everyone rejoices
• As of September 24th, BIND is no longer built by default
• As of September 30th, BIND was completely removed
• Includes an easy to use script for local DNS
• OpenBSD also has unbound in base, but it\’s not built by default yet

DragonflyBSD future plans

• An announcement was posted that details some possible plans for Dragonfly
• dports (their version of FreeBSD ports) will be switching to GCC 4.7
• i915 support is probably going to be in version 3.6
• Work is being done on HAMMER 2, but it won\’t make it to 3.6
• 3.6 is also likely going to ditch pkgsrc as the default in favor of dports, due to a hugely positive reaction from the community

FreeBSD ports get Stack Protector support

• Some portsnap users noticed a massive sweep of every port being updated
• Shortly after, stack protector support was announced by Bryan Drewery
• Only works on i386 and AMD64 on FreeBSD 10 and AMD64 on 9
• Hopefully will become the default, but needs to go through some testing and exp-runs

EuroBSDCon 2013 wrap-up chat

• BSD Now is back from EuroBSDCon with lots of stories
• We picked up an OpenBSD 5.4 CD set at EuroBSDCon, before the official release
• We\’ll give a little showcase of what\’s inside, they put a lot of effort into it
• Comes with the OS, source code, stickers, music, cool other stuff
• Consider supporting the OpenBSD project

Interview

Kirk McKusick

Tutorial

Faster recompiles with ccache and RAM disks

• Rebuilding ports can be sped up with ccache
• RAM disk eliminates disk I/O bottlenecks
• poudriere uses both of these to speed up binary package builds

News Roundup

List of vBSDCon speakers posted

• Registration will be open until October 23rd
• Presentations covering FreeBSD, OpenBSD, FreeNAS and others

Xen PVHVM added to GENERIC

• It\’s now possible to run FreeBSD 10 under Xen with the GENERIC kernel
• freebsd-update will work now
• With FreeBSD 10 ALPHA 4 just being released, should be interesting
• We should call the new kernel \”XENERIC\”

Dragonfly AMD KMS port

• A Dragonfly user has started porting the new FreeBSD AMD KMS driver
• Still a work in progress, asking for help from the community

NetBSD gets an nVidia driver

• NetBSD gets a preliminary nVidia driver
• So far only supports the GeForce 2MX, so not a lot of use just yet
• No acceleration yet, but it\’s a start

FreeBSD cracks the top 10 on DistroWatch

• Over the last year FreeBSD has steadily moved up the rankings from #18 to #10
• Increasing from an average of 570 to 779 hits per day
• Surpassed CentOS, Puppy Linux and Slackware

Feedback/Questions

• Charlie writes in with a lot of questions: https://slexy.org/view/s21jRKf7lp
• Kjell-Aleksander writes in: https://slexy.org/view/s2M0OKmxMK
• Stefen writes in: https://slexy.org/view/s2YlVuhhUa
• Sichendra writes in: https://slexy.org/view/s2P7KtE5x2

• All the tutorials are posted in their entirety at bsdnow.tv
• Send questions, comments, show ideas/topics, etc to feedback@bsdnow.tv
• We don’t check YouTube comments, JB comments, Reddit, etc. If you want us to see it, send it via email (the preferred way) or Twitter (also acceptable)
• Watch live Wednesdays at 2:00PM Eastern (18:00 UTC)

The post Stacks of Cache | BSD Now 5 first appeared on Jupiter Broadcasting.