Pinned post
*
OpenBSD Now!

OpenBSD 8.0 released

Release notes: openbsd.org/80.html
Announce: marc.info/?l=openbsd-announce&

1+
Pinned post
OpenBSD Now!

Consider two OpenBSD PF configurations:

pf1.conf, where SSH blocked by default, but internal LAN traffic is allowed:

block in on em0 proto tcp to port 22
pass in quick on em0 proto tcp from 192.168.0.0/16 to any

and updated pf2.conf, where someone added quick to the blocking rule "for safety's sake":

block in quick on em0 proto tcp to port 22
pass in quick on em0 proto tcp from 192.168.0.0/16 to any

quick was added to a broad block rule, silently shadowing the subsequent quick pass rule. Both are quick rules, both are present, and the change consists of just one word. A reviewer might reason: "The pass rule still has quick, so LAN traffic should still go through." However, among quick rules, the "first-match-wins" principle applies, not "last-match-wins": the block in quick rule now matches LAN traffic before the quick pass rule and shadows it. "Last-match-wins" only applies to non-quick rules. Visually, nothing appears broken, yet the behavior has changed.

And proofwall detect this:

$ ./proofwall diff -n 2 pf1.conf pf2.conf
DIFFERENT: rulesets are NOT semantically equivalent. Regressions (2): pass in A, block in B:
- 192.168.0.0:0 -> 0.0.0.0:22 proto=tcp flags=0x00 iface="em0" dir=in
- 192.168.0.0:0 -> 0.0.0.0:22 proto=tcp flags=0xff iface="em0" dir=in

Rule issues (1):
[B] line 2: redundant rule (removing it changes nothing): pass in quick on em0 proto tcp from 192.168.0.0/16 to any

This is interpreted as follows: a regression specifically for 192.168.0.0/16 -> tcp/22 (traffic that previously passed is now blocked), while the pass ... quick rule in the second config has become redundant - its effect is completely overridden by an earlier block quick rule.

1
OpenBSD Now! boosted
Rafael Sadowski

If you're using 8.0 and have manually configured “ciphers” delete them. is now secure and PQC by default

0
OpenBSD Now! boosted
BSDTV

Next NYC*BUG: Nov 4th:
GEFS: Still Shredding the Files, Ori Bernstein
2026-11-04 @ 18:45 local (23:45 UTC) - Backroom of Brass Monkey 55 Little West 12th St
Remote participation: Plans are to stream via NYC*BUG website. Q&A will be via IRC on libera.chat channel - please preface your questions with '[Q]'.
This meeting will be a recap of EuroBSD, describing GEFS, the current state of it on OpenBSD, the work done since, and the pieces that are still missing. This talk will be environmentally friendly, with a high percentage of recycled content along with news on progress since EuroBSDcon 2026 talk.

For more information, please visit:
nycbug.org/

0
OpenBSD Now! boosted
Stefan Sperling

If you are using the bwfm(4) driver on , consider updating to -current soon, which just received some fixes for a crafted wifi frame injection issue where according the report "memcpy() then attempts to copy 0xfffffff0 bytes into a fresh mbuf cluster. [...] With datalen 0xfffffff0 and no received payload, the unpatched kernel [...] reset immediately to the boot loader".

Which sounds wild, but this reproducer injected fake ethernet frames into the driver via software hacks, and I don't have the patience to verify these claims with real hardware.

And of course, a PCI device has DMA access which means it can change kernel memory arbitrarily anyway unless the system has an iommu, which AFAIK OpenBSD does not use yet, at least not on amd64.

Not sure yet if there will be errata.

The Linux driver has some of the same bugs.

1+
OpenBSD Now! boosted
:rainbowCrow:

@cyberquixote @kajer TTL is a scam by big routing to sell more less-latency.

1+
*
OpenBSD Now!

OpenBSD 8.0 released

Release notes: openbsd.org/80.html
Announce: marc.info/?l=openbsd-announce&

1+
OpenBSD Now!

Game of Trees 0.130 released

  • default to using SHA256 object IDs in newly created repositories
  • add SHA256 repository support to gotd, gotsysd, and gotsys.conf
  • add an example for scheduled invocations of gotadmin cleanup to gotadmin(1)
  • clear any previously buffered data when receiving Git protocol packets
  • move buffers of size GOT_PKT_MAX off the stack to fix build on OpenBSD/alpha
  • use realpath(p, NULL) instead of realpath(p, buf) to avoid wrong buffer size
  • use PATH_MAX instead of _POSIX_PATH_MAX because the latter is too small

gameoftrees.org/releases/chang

0
OpenBSD Now! boosted
Bryan Steele :flan_beard:

Pigs really can fly, the moon is made of cheese and Wine now runs on ! :flan_cool:​

Largely made possible by the work of Andrii (NethIafin), fabien@, and thfr@, 64-bit Windows applications (yes, games) run on -current!

WIP ports@ patch here: marc.info/?l=openbsd-ports&m=1

🎮

1+
OpenBSD Now!

When I was young, one of my favorite games was Age of Empires, which was released for Windows. I haven't used Windows for a long time, but my love for the game has remained. There is a Linux port of the game called OpenAge. I began porting this game to OpenBSD in 2014; I finished the port last week, and all the patches for OpenBSD have been accepted upstream. Hooray!

I'll sent patches to ports@ soon.

github.com/ligurio/openbsd-wip

1+
OpenBSD Now! boosted
*
Bryan Steele :flan_beard:

Heads up, Theo de Raadt has committed some additional tightening of setuid/setgid programs in -current. :flan_hacker:​

deraadt@ modified src/lib/libc/dlfcn/init.c: libc initialization now aborts if a setuid/setgid program does not have the global variable _permit_setugid declaring that it is setuid/setgid.
The more important packages have been fixed, and the long tail will be fixed by people who encounter this problem.
ok sthen

deraadt@ modified src/lib/libc/dlfcn/init.c: For any binary linked against libc, compare the file setuid/setgid bits against the internal global variable _permit_setugid.
If either bit is set in the file mode, but the same bit is not set in the variable, generate a syslog message, output the same to stderr.
It looks like this: /usr/bin/x: not supposed to be setuid, aborting
[...]

More details were revealed in commits made last week laying the groundwork. :flan_thumbs:​

Create the weak global _permit_setugid which must match the setuid/setgid
mode of the executable file. This is documented in execve(2).

If the corresponding bits are not set right, it means this binary was not intended to be setuid/setgid. The file has become setuid/setgid accidentally, unintentionally, or due to attacker control, and libc will log the event and abort.
[...]
This change in bsd.prog.mk automatically (based upon BINMODE) creates an additional .c file with the correct variable definition to compile and link into the program, so that we don't need any additional changes in userland base.

More seatbelts! :flan_thumbs:​

1+
OpenBSD Now! boosted
Rafael Sadowski

The upcoming update to 6.12 will come with VA-API support enabled in QtMultimedia. QtMultimedia’s FFmpeg backend can now offload video decoding to the GPU via VA-API (Intel media driver / Mesa on AMD), so Qt and KDE apps on OpenBSD get hardware-accelerated playback for codecs like H.264, HEVC, VP9 and AV1 instead of decoding everything on the CPU.

1+
OpenBSD Now!

Happy Birthday, OpenBSD!

marc.info/?l=openbsd-misc&m=11

0
OpenBSD Now! boosted
Stefan Sperling

compatible version control system version 0.130 has been released.

This version adds server-side support for SHA256 repositories and defaults to SHA256 for newly created repositories.

We will be upgrading our @gothub hosting service to this version soon.

gameoftrees.org/releases/chang

0
OpenBSD Now! boosted
*
Bryan Steele :flan_beard:

I think it's about time for some :flan_hacker:​ :flan_cool:

Clang/LLVM 22 is now OpenBSD's base compiler on clang architectures, including updated libc++{,abi}, compiler-rt & libunwind support libraries.

bsd.network/@brynet/1166580624

OpenBSD/sparc64 switches to Clang by default! This was the last significant architecture to switch. This makes OpenBSD the only operating system to support sparc64 with a modern toolchain.

bsd.network/@brynet/1171301305

Since 7.9, Jonathan Gray (jsg@) has continued to update the drm graphics stack (inteldrm/radeondrm/amdgpu) bringing OpenBSD 8.0 to Linux 6.18.y/6.18.53, adding driver support for Intel Arc A-Series (DG2/Alchemist) cards.

Increased KVA (kernel virtual addresses) on amd64 (to 512G) now allows mapping more than 4G of VRAM (for example, GPU compute w/ Vulkan)

freshbsd.org/openbsd/src?q=drm

bsd.network/@brynet/1167944616

After a ton of work in Edmonton by Mike Larkin (mlarkin@) and Dave Voutila (dv@), OpenBSD vmm/vmd(8) now supports SMP guests up to 64 VCPUs per VM! :flan_cool:​ 🎉​

bsd.network/@brynet/1172950441

bsd.network/@brynet/1172997536

OpenBSD 8.0 adds qwz(4), new WiFi driver for Qualcomm WCN7850 "ath12k" devices.

bsd.network/@brynet/1165743693

A new driver, sambat(4), for monitoring battery status, cycle count/charge info on Samsung Galaxy Book4 Edge (Snapdragon arm64) machines.

bsd.network/@brynet/1166006745

Accelerated swap encryption on amd64 and arm64 by using AES CPU instructions.

bsd.network/@brynet/1170908422

OpenBSD/arm64 and OpenBSD/riscv64 boards can now heartbeat blinking LEDs to show system load averages.

:flan_hurrah:​ Das Blinkenlights!! :flan_hurrah:​

bsd.network/@brynet/1168794791

httpd(8) now supports many new features:

  • Setting custom HTTP response headers.
  • New blocking/filtering rules based on received HTTP headers (e.g: User-Agent: )

bsd.network/@brynet/1173716044

bsd.network/@brynet/1169791332

See also rsadowski@'s report: rsadowski.de/posts/2026/w2k26-

.. and finally, :flan_peek:​

I made my first commit to this release cycle!

bsd.network/@brynet/1170078335

And lots more to see in 8.0! :flan_thumbs:​:flan_hacker:​

EDIT: 8.0 is released! bsd.network/@brynet/1174706613

1+
OpenBSD Now!

Let's Encrypt, the nonprofit that provides free TLS certificates for millions of sites, has announced that it will be moving to certificates with 64-day lifetimes on February 10, 2027:

This means that any certificate we issue or renew on and after that date will have a 64 day validity period, and we expect the last 90-day certificate to expire on May 11, 2027. We will not revoke valid certificates as a part of this process.

letsencrypt.org/2026/10/07/64-

0
OpenBSD Now! boosted
The Real Grunfink
I've just published version 2.96 of #snac, the simple, minimalistic #ActivityPub instance server written in C. It includes the following changes:

Accounts can be marked as cool; anytime a cool account posts something, a notification will be sent.

Fixed an issue in Direct Messages sent from the people page; these posts didn't explicitly mention the recipient, and that confused some implementations.

Fixed crash when sending an empty EmojiReact.

HTTP requests can now be forced to use IPv6 by setting the force_ipv6_requests configuration directive to true in server.json.

Fixed a socket buffering issue under OpenIndiana (contributed by aleteoryx).

Mastodon API: Added missing requested_by field in the relationships entrypoint (contributed by Uilebheist), implemented the followers entrypoint (contributed by Uilebheist), use Mastodon's RFC3339 format for markers (contributed by nowster), fixed posts with muted words not being filtered out, fixed editing of media alt texts.

Tweaked HTML to avoid elinks complaining about a missing '#top' fragment.

Fixed a bug that made deleting the notification email address impossible.

RSS timelines are now cached because fuckers hammer for them continuously (probably AI crap bots).

Added information to README.md on how to build and install on Illumos / OpenIndiana Hipster 2026.04 (contributed by aleteoryx).

Updated Russian, Brazilian Portuguese and Czech translations (contributed by koru, daltux, pmjv).

https://comam.es/what-is-snac

If you find #snac useful, please consider buying grunfink a coffee or contributing via LiberaPay.

#snacAnnounces #FrugalFediverse

1+
OpenBSD Now!

Review first. Run second.

Ken Thompson, in his Turing Award lecture "Reflections on Trusting Trust," proved a chilling truth: "You can't trust code that you did not totally create yourself." Even a compiler can betray you.

Richard Stallman built an entire movement on this. Freedom 1: study the code, change it. Without that, you're not a user - you're a hostage.

Read the code. Or at least know who wrote it.

Agree?

1+
OpenBSD Now!

website with resources about troff, the text processor for typesetters

troff.org/

0
*
OpenBSD Now!

snac is a simple, minimalistic ActivityPub instance written in portable C (codeberg.org/grunfink/snac2).

I've created an OpenBSD port for it (www/snac) -
github.com/ligurio/openbsd-wip

// CC: @grunfink

1+
OpenBSD Now!

NixBSD is an attempt to make a reproducible and declarable BSD, based on NixOS. Although theoretically much of this work could be copied to build other BSDs, all work thus far has been focused on building a FreeBSD distribution.

github.com/nix-community/nixbs

0
*
OpenBSD Now!

OpenBSD Errata: October 7, 2026 (isakmpd xserver expat wsdisplay)

Errata patches for isakmpd, X11 server, libexpat and kernel wscons have been released for OpenBSD 7.8 and 7.9.

Binary updates for the amd64, arm64 and i386 platform are available via the syspatch utility. Source code patches can be found on the
respective errata page:

0
Show older

OpenBSD Now!'s choices:

asiabsdcon

5

openbsd

4

talks

2

openssh

1

playonbsd

1

callfortesting

1

WhyOpenBSD There is nothing here!

0

runbsd There is nothing here!

0
BSD Network

bsd.network is a *BSD-adjacent Mastodon Instance. We have a code of conduct.

Resources

Developers

What is Mastodon?

bsd.network

More…

v3.5.19+iceage · Privacy policy