OpenBSD Now! @openbsdnow@bsd.network
- https://twitter.com/openbsdnow
- Awesome OpenBSD
- https://github.com/ligurio/awesome-openbsd
Unofficial OpenBSD news, updates and thoughts. #OpenBSD #WhyOpenBSD #RunBSD #PlayOnBSD #CallForTesting #OpenSSH #EuroBSDCon #AsiaBSDCon #BSDCan #errata #release
Chief editor: @sergeyb
Joined Mar 2018
Pinned post
OpenBSD 8.0 released
Release notes: https://www.openbsd.org/80.html
Announce: https://marc.info/?l=openbsd-announce&m=179245843570316&w=2
Pinned post
Consider two OpenBSD PF configurations:
pf1.conf, where SSH blocked by default, but internal LAN traffic is allowed:
block in on em0 proto tcp to port 22
pass in quick on em0 proto tcp from 192.168.0.0/16 to any
and updated pf2.conf, where someone added quick to the blocking rule "for safety's sake":
block in quick on em0 proto tcp to port 22
pass in quick on em0 proto tcp from 192.168.0.0/16 to any
quick was added to a broad block rule, silently shadowing the subsequent quick pass rule. Both are quick rules, both are present, and the change consists of just one word. A reviewer might reason: "The pass rule still has quick, so LAN traffic should still go through." However, among quick rules, the "first-match-wins" principle applies, not "last-match-wins": the block in quick rule now matches LAN traffic before the quick pass rule and shadows it. "Last-match-wins" only applies to non-quick rules. Visually, nothing appears broken, yet the behavior has changed.
And proofwall detect this:
$ ./proofwall diff -n 2 pf1.conf pf2.conf
DIFFERENT: rulesets are NOT semantically equivalent. Regressions (2): pass in A, block in B:
- 192.168.0.0:0 -> 0.0.0.0:22 proto=tcp flags=0x00 iface="em0" dir=in
- 192.168.0.0:0 -> 0.0.0.0:22 proto=tcp flags=0xff iface="em0" dir=in
Rule issues (1):
[B] line 2: redundant rule (removing it changes nothing): pass in quick on em0 proto tcp from 192.168.0.0/16 to any
This is interpreted as follows: a regression specifically for 192.168.0.0/16 -> tcp/22 (traffic that previously passed is now blocked), while the pass ... quick rule in the second config has become redundant - its effect is completely overridden by an earlier block quick rule.
OpenBSD Now!
boosted
OpenBSD Now!
boosted
Ori Bernstein (ori@) has sent a follow-up mail about his experimental #GEFS port to #OpenBSD tech@, including a updated diff with newfs_gefs(8) utility, and more error handling. 
[...]
First off, thanks to Martijn, and everyone else who tried it out and sent patches.Everything is updated and rebased, and the diff has been regenerated with all of the lastest.
I've gone through a the error handling code. In theory the filesystem will handle errors mostly correctly. There are probably still places where theory diverges from reality. I've also forward ported most of the important bugfixes from 9front.
[..]
Some userspace tools have been done (you can now mkfs on openbsd!), but snapshot control hasn't.
OpenBSD Now!
boosted
I've just published version 2.97 of #snac, the simple, minimalistic #ActivityPub instance server written in C. It includes the following changes:
Quote-posting your own posts is now allowed (do it by adding
The Mastodon API can now be disabled by setting the
Fixed a crash in chunked transfer encoding code (special thanks to Sergey Bronnikov for bringing this to my attention).
Tweak to JSON loading code to circunvent
Mastodon API: Fixed error in voting code (contributed by uilebheist), more aggressive old data purging.
https://comam.es/what-is-snac
If you find #snac useful, please consider buying grunfink a coffee or contributing via LiberaPay.
#snacAnnounces #FrugalFediverse
Quote-posting your own posts is now allowed (do it by adding
RE: https://example.com/you/post-id in its own line in a post body).The Mastodon API can now be disabled by setting the
mastodon_api directive to false in server.json (no need to compile it out).Fixed a crash in chunked transfer encoding code (special thanks to Sergey Bronnikov for bringing this to my attention).
Tweak to JSON loading code to circunvent
fmemopen() issues on Illumos / OpenIndiana systems (contributed by aleteoryx).Mastodon API: Fixed error in voting code (contributed by uilebheist), more aggressive old data purging.
https://comam.es/what-is-snac
If you find #snac useful, please consider buying grunfink a coffee or contributing via LiberaPay.
#snacAnnounces #FrugalFediverse
OpenBSD Now!
boosted
You can now run the 64-bit Windows Steam client on #OpenBSD -current, a wine-steam downloader/launcher script has been provided as part of the new wine-extras port.
Be sure to read the pkg-readme. 
https://marc.info/?l=openbsd-ports-cvs&m=179319000560284&w=2
Series of Tubes is a free browser-based internet-building simulation game where you manage and grow a global telecommunications network.
OpenBSD Now!
boosted
To ease the transition for new users, #NetBSD -current now includes an alternative editor to vi(1) and xedit(1) in its base system, atto(1). https://man.netbsd.org/atto.1
It is a modeless screen-based editor similar to nano, pico, xedit, or emacs. It is only 48 kilobytes, making it suitable for inclusion in the rescue system.
(This is real, but I'm honestly missing an opportunity by not posting it on 1 April. Let the editor wars commence!)
OpenBSD Now!
boosted
I built a site that shows which known CVEs affect the FreeBSD Ports, and whether there is already a fix and a VuXML entry (the database behind pkg audit):
https://portstatus.bsdproject.de
Every hour it matches NVD and CNA data against the packages and VuXML, and shows whether a fix has reached the quarterly branch.
“Unaddressed” does not mean exploitable, just worth a second look.
Private project, not an official FreeBSD service.
Can you fit 500M of rules into a firewall?
OpenBSD Now!
boosted
If you're thinking about diving in, playing some games, @thfr shared some "Responsible OpenBSD Gaming Habits" over on the r/openbsd_gaming subredit. 
LibreSSL 4.4.0, 4.3.4, 4.2.3 released
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt
OpenBSD Now!
boosted
12 years on, #OpenBSD's port of #nginx still maintains its default chroot(2) patch.
https://raw.githubusercontent.com/rnagy/nginx_chroot_patch/master/nginx-1.30.0-chroot.patch
Reyk Floeter attemped to clean up nginx, wrote a large patch replacing all risky malloc calls w/ reallocarray(3), but upstream gave no indication they would accept, it was eventually discarded due to difficulty maintaining it.
https://www.openbsd.org/papers/httpd-asiabsdcon2015.pdf
After ~3 years in base, & the subsequent discovery of multiple "Heartbleed accelerating custom allocators", ngnix had outlived & outgrew its welcome.
OpenBSD Errata: October 23, 2026 (dbupdate)
Errata patches containing new dbupdate and updated cert.pem have been released for OpenBSD 7.9 and 8.0.
Binary updates for the amd64, arm64 and i386 platform are available via the syspatch utility. Source code patches can be found on the respective errata page:
OpenBSD Now!
boosted
@severin I've done an #OpenBSD port or retex 1.2.0 :
https://marc.info/?l=openbsd-ports&m=179261173699299&w=2
OpenBSD Now!
boosted
Upgrading from OpenBSD 7.9 to 8.0 is just too easy now. I miss having to print out the FAQ, grab the install ramdisks, merge /etc manually, and pray to the BSD gods for driver rain
OpenBSD Now!
boosted
NSD 4.15.4 is now available.
In addition to a number of bug fixes, this release of our authoritative DNS server adds UNECE and ISO RR types and a report-channel config option to return a Report-Channel EDNS option in responses.
Also, a catalog-group-pattern option to limit the patterns from which catalog consumer member zones may be configured by using the group property. Thanks to Qifan Zhang, Palo Alto Networks, for the suggestion.
OpenBSD Now!
boosted
🚨 Security update: Unbound 1.26.2 is now available.
This release consolidates security fixes for issues reported over a period of time. There are fixes for CVE-2026-35501, CVE-2026-50106, CVE-2026-96405, CVE-2026-97206 and CVE-2026-109125.
https://community.nlnetlabs.nl/t/unbound-1-26-2-released/3495
@grunfink I have an issue regarding snac2 that I would like to report, but not through a public channel. What is the best way to get in touch? I couldn't find your email.
OpenBSD Now!
boosted
- https://twitter.com/openbsdnow
- Awesome OpenBSD
- https://github.com/ligurio/awesome-openbsd
Unofficial OpenBSD news, updates and thoughts. #OpenBSD #WhyOpenBSD #RunBSD #PlayOnBSD #CallForTesting #OpenSSH #EuroBSDCon #AsiaBSDCon #BSDCan #errata #release
Chief editor: @sergeyb
Joined Mar 2018
OpenBSD Now!'s choices:
