Stefan Sperling @stsp@bsd.network
Posting mostly about tech stuff I'm working on but happy to read and chat about non-tech stuff too. I'm grateful to be learning so much about the world from all of you.
Tech stuff I'm working on currently includes OpenBSD, Apache Subversion, Software Heritage, Game of Trees, @gothub, and Dulwich.
Toots get auto-deleted after one month.
Joined Jul 2018
Pinned post
For my company I have put together #gameoftrees and #OpenBSD support packages which cover tasks I have been doing via ad-hoc consulting gigs for years now. And I asked some freelancing friends from the OpenBSD community to share the work with me.
We support deployments of OpenBSD in server and firewall roles via yearly fixed-price contracts. All base system components can be supported.
From our existing client base we know for a fact that there are small and mid-sized businesses out there who run OpenBSD and would benefit from working with us. We want to find more of them.
Pinned post
I will be hosting #OpenBSD and #PF firewall courses at @linuxhotel in the city of Essen, Germany.
OpenBSD: https://www.linuxhotel.de/course/openbsd-de
PF: https://www.linuxhotel.de/course/pf-de
Currently there are no dates set for either course, but it is possible to send Linuxhotel a proposal for the next date.
The target audience are system administrators who would like to learn about OpenBSD and PF in order to use them as part of their network security tool set.
(Do not be afraid to sign up if you do not understand German. While the courses are advertised in German, written course material will be in English and the presentation will be entirely in English if preferred by participants.)
@vanhoefm I am leaning towards only supporting the fixed variant of #WPA3 in #OpenBSD.
Hash-to-element has the advantage that ifconfig can compute the PT in userland, leaving the kernel to compute only the PWE during association.
Not supporting the workarounds for the broken version of WPA3 might help push people to updating (or replacing) their APs in case they are broken (or unfixable), at least in the OpenBSD user community. I don't think that would be a bad thing.
As far as I understand, hash-to-element can be added to older WPA3 devices with a software update. It doesn't require hardware modifications. Correct? If so, all vendors should be able to provide an update which adds support for hash-to-element.
Stefan Sperling
boosted
Backup all the things with #plakar and #OpenBSD !
https://x61.sh/log/2026/03/25032026151800-plakar.html
Stefan Sperling
boosted
New blog post, Open Source and AI: https://kusma.xyz/blog/2026/03/26/open-source-and-ai/ #openSource #AI
Stefan Sperling
boosted
I presented at the local planetary journal club this morning about the 3 articles I co-authored for The Conversation in the past weeks about the effects that one million satellites would have on the night sky, the atmosphere, and the orbital environment (spoiler alert: all very very bad)
And one on light pollution that I thought would get published today but might not be out until after the weekend.
Doing a small bit of work on #IPSec for a change.
nom nom nom 🍪
Stefan Sperling
boosted
Stefan Sperling
boosted
It has taken me a while to put into words why I dislike the use of AI in open source. I think I finally pin'd it down.
One of the best aspects of open source has always been sharing in the excitement around a project. An author spent time and energy to make this project that they were excited about, or solved a problem they had. You had the same problem or were inspired by their excitement and joined in on the fun.
Now people are shitting out entire code bases to do something and I just can't get excited about it. If you can't be ars'd to put in the effort, neither can I.
Then there are the other aspects: paying a company to be a Developer™, now there is an expectation of HyperProductivity®, environmental, ethical... the list goes on.
What happens to your codebase if you stop paying? Are you going to maintain the 200k lines it shat out in a week? Doubt it. Your skill set has been captured. Your project has been captured. Now you must pay to access it.
Fuck that.
Stefan Sperling
boosted
What's if you could ~$ git clone SWHID?
"You’d end up with git clone as a content-addressed fetch primitive rather than just a URL fetch, which is an interesting building block for reproducible builds and supply chain verification."
A nice write-up by @andrewnez on git remote helpers 👉 https://nesbitt.io/2026/03/18/git-remote-helpers.html
Stefan Sperling
boosted
Rooting OpenWRT from the parking lot: I discovered an XSS in the OpenWRT SSID scan page, that can be chained to remote root access 👾
Write-up and demo: https://mxsasha.eu/posts/openwrt-ssid-xss-to-root/
CVE-2026-32721, fixed in 24.10.6 / 25.12.1
Stefan Sperling
boosted
how to use civility to stop the borg
Finally found out why Tx was broken with iwx(4) on Intel AX211 BZ devices. Another one of those bugs which cannot be found without persistence and some amount of good luck.
open collective know-your-customer
Looks like the one year long process it took to get my company's external accountants to play along with setting up our own fiscal host for @gothub was very much worth it! Our initial plan was to be fiscally hosted by Open Collective Europe but OCE rejected our application as too commercial for reasons I could never figure out. They suggested we should try applying to the Open Source Collective instead. I am glad we never did!
Anyway, I hope this story will end with OC/OSC not using stricter identity checks than already performed by payment providers. Or at least hire a less dangerous partner company for identity checks. I doubt they can completely get around KYC rules in their jurisdiction. The worst outcome could be OC/OSC getting fined or shut down for non-compliance. They will likely have to pick some least bad option from some set of bad options to comply.
Huh, so my fennec fdroid had "remote improvements" enabled (settings - advanced - remote improvements). Since I have turned that off the main menu has finally stopped flipping between old and new style. It is just sticking to old style now.
Bit crazy that a feature which loads additional code over the network can be enabled in the fdroid version, isn't it?
Stefan Sperling
boosted
Stefan Sperling
boosted
Hab heute ein gehacktes GitRepo ein bisschen genauer angesehen. Es war das kubernetes-el Repo. Die Hack-Spuren sind mittlerweile weitgehend beseitigt, aber ich konnte sie mir zeitnah ansehen. Was passiert ist, ließ sich so für mich rekonstruieren:
- Angreifer forked das Repo
- Angreifer schickt einen Test-PR
- GitHub Worker läuft los, führt dabei aber malicious code durch den Worker aus
- Angreifer sieht, dass es geht und baut ein Script ein, dass einen GitHub Token an einen externen Webhook schickt und stellt damit erneut PR
- PR Check Worker läuft los, schickt den Token raus
- Angreifer nutzt den schreibberechtigten Token, um direkt von extern auf das Hauptrepo zuzugreifen
- Angreifer baut in das Paket ein "rm -rf" ein (ein Emacs Kubernetes Paket) und defaced das Repo; löscht letztlich alle Dateien im Repo bis auf ein Bild und einen Hack-Hinweis
Was hier zu sehen war: Der Angriff war letztlich einfach. Eine einfache Fehlkonfiguration - der GitHub Worker konnte Git Commits auf das eigene Repo durchfühfren und reagierte sehr gutgläubig auf PRs - hat gereicht, um theoretisch ein Tool mit Schadcode zu versehen, das viele Nutzende in Emacs haben. Das ist Supply Chain nicht nur auf großen Infrastrukturen, sondern direkt als Angriff auf einen Editor.
tl;dr: Pipeline und Worker Security ist ein Ding.
Stefan Sperling
boosted
Stefan Sperling
boosted
New on #blog: "Money isn’t going to solve the #burnout problem"
"""
The xz-utils backdoor situation brought the problem of FLOSS maintained burnout into the daylight. This in turn lead to numerous discussion on how to solve the problem, and the recurring theme was funding maintenance work.
While I’m definitely not opposed to giving people money for their FLOSS work, if you think that throwing some bucks will actually solve the problem, and especially if you think that you can just throw them once and then forget, I have bad news for you: it won’t. Surely, money is a big part of the problem, but it’s not the only reason people are getting burned out. It’s a systemic problem, and it’s in need of systemic solution, and that’s involves a lot of hard work to undo everything that’s happened in the last, say, 20 years.
But let’s start at the beginning and ask the important question: why do people make free software?
"""
https://blogs.gentoo.org/mgorny/2026/03/07/money-isnt-going-to-solve-the-burnout-problem/
Stefan Sperling
boosted
I moved all my repos to #GotHub:
And you can do the same! Go to https://gothub.org/ and check it out!
Maybe you are interesting on this one too:
Stefan Sperling
boosted
Hi all.
Just putting the feelers out as I'd love to know how many folks are using got on MacOs.
@teajaygrey does an amazing job every time I make a release of gameoftrees portable, but I could do with knowing how many of you are using it.
I made a change in the 0.123 release to fix socket handling for services such as gotwebd, which is good, but it's telling that it's taken this long, so I wonder how many users we have.
Let me know -- you can always email me at: thomas.adam22@gmail.com
Please boost this as much as possible, I'd appreciate it.
Posting mostly about tech stuff I'm working on but happy to read and chat about non-tech stuff too. I'm grateful to be learning so much about the world from all of you.
Tech stuff I'm working on currently includes OpenBSD, Apache Subversion, Software Heritage, Game of Trees, @gothub, and Dulwich.
Toots get auto-deleted after one month.
Joined Jul 2018
