BSD Cafe Billboard

Four hours ago: … critical services used by the human #FreeBSD community are either down, or so degraded they are mostly unusable, by AI scrapers. … Does anyone know which services are, or were, down? https://bsd.network/@dch/116816905361984918

(06/19) ⇒ MidnightBSD 4.0.6 RELEASE https://bsdsec.net/articles/midnightbsd-security-midnightbsd-4-0-6-release

This is my FreeBSD music collection. It consists of songs inspired by FreeBSD releases, experiments, and desktop and server experiences that have become part of everyday life. It was built using Suno AI and then tweaked and polished each one. https://interfacecraft.online/blog/2026/freebsd-music-collection/

Port knocking is mostly a bad idea. But people keep wanting to do it, for some false sense of security. If you don't consider it a security control but a way to keep garbage out of your logs, it might be valid. In my case I'm using an old USG Pro 4 running OpenBSD as my firewall and I'd prefer to avoid writing stuff to the logs, as I'd prefer the flash not to wear out sooner than needed, definitely not thanks to background radiation on the internet. https://dgl.cx/2026/06/ssh-port-knocking-with-openbsd

I'm revisiting amd64 assembly programming and came across this [1] great post on nasm programming on Linux. Sharing this in case anyone else is looking for information on the topic. [1] https://linuxvox.com/blog/basic-yet-thorough-assembly-tutorial-linux/

Sharing this [1] link as I dive into amd64 assembly programming on OpenBSD (it really came in handy!). This [2] Reddit thread also helped me understand the elf(5) requirements for programming assembly on OpenBSD. Happy hacking! [1] https://astharoshe.net/2020-06-28-Hello_assembler.html [2] https://www.reddit.com/r/openbsd/s/JN0hTLNKQF e: typo

https://freebsdfoundation.org/blog/freebsd-ai-assisted-vulnerability-discovery-project-launch/ … the key goal of reducing the number of exploitable vulnerabilities in the FreeBSD source code. The 6-month project is being funded by a grant from the Alpha Omega project. The funds will be used to engage FreeBSD Security Team members under fixed-term contracts to find and patch vulnerabilities. The Security Team’s access to publicly available AI models and tokens will be provided free of charge. AI will be used for vulnerability discovery and analysis only, all patches will be manually created. … In GitHub: all-projects/AI-assisted-vulnerability-discovery at main · FreeBSDFoundation/all-projects FreeBSD Receives Funding To Launch AI-Assisted Vulnerability Discovery - Phoronix discussion via https://fosstodon.org/@governa/116755744623083032 @governa@fosstodon.org FreeBSD AI-assisted Vulnerability Discovery Project launch | The FreeBSD Forums Cross-posted to r/freebsd in Reddit.

https://nextbsd.org/ https://www.reddit.com/r/BSD/comments/1u5qk0n/nextbsd_the_bsd_of_the_21st_century/ https://www.reddit.com/r/freebsd/comments/1u5qkds/nextbsd_the_bsd_of_the_21st_century/ … My main focus has been getting all the issues fixed with Gershwin Desktop so I can make an image include that + more kexts ASAP. Wifi kexts load but I need to port some 80211 stuff to integrate wifi into configd, etc. More to come. … … Mach IPC, launchd (replaces /sbin/init), configd/IPconfiguration (replaces netif), IOkit (replaces devmatch, devd). Resulting in automatic graphics detection, automatic networking with state change handling, service supervision, parallel startup to name a few things. I have other ideas beyond Darwin components like porting smb3 from illumos that I have been brewing about for a long time. New frameworks for jails, bhyve. The equivalent of dockerhub for jails. Management tools comparable to this https://www.hexbsd.org (an earlier creation of mine). A revived NAS appliance. A Gershwin on NextBSD image (desktop appliance). For people who are new to all of this: gershwin-desktop/gershwin-desktop: Desktop Environment based on GNUstep welcoming to switchers [image: 1781512879986-9febc628-3c7a-447a-844c-8ec2ef6f896e-image.jpeg]

https://thesiliconreview.com/2026/06/cybersecurity-incident-oracle-peoplesoft-shinyhunters-breach It's a sensationalist article, which is not a bad thing in this case. Less sensationally, but critical (9.8/10): Vulnerability in the PeopleSoft Enterprise PeopleTools... · CVE-2026-35273 · GitHub Advisory Database For the other three vulnerabilities, all moderate, that are mentioned in the article: Vulnerability in the PeopleSoft Enterprise PeopleTools... · CVE-2026-21934 · GitHub Advisory Database Vulnerability in the PeopleSoft Enterprise HCM Shared... · CVE-2026-22019 · GitHub Advisory Database Vulnerability in the PeopleSoft Enterprise FIN... · CVE-2026-34299 · GitHub Advisory Database This week's breach is all over the news, I first found it at https://mastodon.opencloud.lu/@BrideOfLinux/116737809000928257 from @BrideOfLinux@mastodon.opencloud.lu Before Oracle responded: Is this true? I have not seen a report yet who is affected. : r/oracle

The HUGEST, the MOST TREMENDOUS FreeBSD page-cache write primitive in the history of computing. Many people are saying it. Many. Believe me. https://bumsrake.de/ "Mouarffff"

⇒ OpenBSD under QEMU Architecture specific notes for OpenBSD guests under QEMU, with working command lines where installation succeeds and failure points where it does not. https://kirill.korins.ky/articles/openbsd-under-qemu/

(06/10) ⇒ A Final Return for OpenBSD Anti-Return-Oriented Programming Mitigations Return-Oriented Programming (ROP) continues to be a serious attack taking advantage of flaws in memory unsafe languages, particularly buffer overflows, to launch arbitrary code execution attacks by chaining together pieces of already existing code in loaded binaries and shared libraries, called gadgets. With the continued reliance on x86_64 CPUs in cloud and personal servers, mitigations that can meaningfully reduce the success of ROP attacks without significant overhead continue to be attractive. We propose the porting of one such software-based anti-ROP mitigation proposed by OpenBSD: compile-time instruction rewriting to avoid opportunities for ROP exploitation. We bring this mitigation, originally developed for the custom OpenBSD implementation of the LLVM compiler suite, to GCC by way of a standalone utility that sits in between the compiler and the assembler and rewrites potential gadget instructions before assembly into object code. Our utility provides a minimal reduction in gadgets with some penalties in binary sizes and performance impacts. We compare our GCC-ported standalone utility to the original OpenBSD LLVM mitigation and discovered that our standalone utility is weaker compared to the original LLVM-based mitigation. However, due to the overall weak reduction in gadgets for both the LLVM-based and GCC-based implementations, we conclude that seemingly obvious mitigations may prove to be anything but, and caution providing security improvements without significant testing and evaluation. https://www.researchgate.net/publication/405728967_A_Final_Return_for_OpenBSD_Anti-Return-Oriented_Programming_Mitigations ping: https://bsd.network/@bcallah/116725877009964245 It seems to be my 200th post here…

My posts: can not be edited under https://billboard.bsd.cafe/post/602 can be edited here, for example.

Since it is schedule for a June 16 release (more or less), I am going to wait till then to give it a whirl with my test NUC before going on to my Framework 13A. Omfreebdy looks like it will set up most of the stuff I wanted, so let's see what happens.

https://www.reddit.com/r/freebsd/comments/1ty5njr/pkgbase_major_upgrade_from_freebsd_144_to_151rc2/ This upgrade blended: part of the official announcement for 15.1-RC2 – altered for compatibility with the major upgrade part of Emrion's https://forums.freebsd.org/posts/762515 – adapted for my preferred shell, /bin/tcsh. … Packages for the third release candidate, RC3, were not available at the time.

⇒ (06/05) Aggressive caching for a Mastodon reverse proxy: what to cache, what to never cache, and why content negotiation will eventually betray you how to cache Mastodon with nginx on FreeBSD while handling content negotiation correctly, covering cache keys for HTML/ActivityPub/JSON variants, bypass rules for private traffic, and TTL strategies for assets, media, and dynamic pages. The guide includes production-tested configurations for thundering-herd protection, failover, and logging to verify cache behavior. https://it-notes.dragas.net/2026/06/05/aggressive_caching_for_a_mastodon_reverse_proxy/

⇒ (06/05) FreeBSD Jails The classic system administration changed a lot in a decade. Virtualization and container technology went through a remarkable improvement. (…) FreeBSD Jails don’t compete with containers. They don’t substitute virtual machines. Jails just fill a gap. https://tomsitcafe.com/2026/06/05/freebsd-jails/

https://www.blackduck.com/content/dam/black-duck/en-us/reports/rep-ossra.pdf The “Open Source Security and Risk Analysis” (OSSRA) report has been the industry’s definitive look at the state of open source code for a decade. Each year, we analyze anonymized findings from commercial codebases audited by the Black Duck Audit Services team, and this provides an unmatched, real-world view of how open source is used—and sometimes misused—across every major industry. This year’s findings document a pivotal moment: The explosion of AI-assisted development has fundamentally altered the risk landscape for software and the baseline for compliance with new regulatory initiatives such as the EU Cyber Resilience Act (CRA) and the Digital Operational Resilience Act (DORA). PDF, 44 pages. Context Open source organisations weigh in on age attestation Availability Noted in Reddit: … easily found with Google – without completing Black Duck's form, which requires a business email address: https://www.google.com/search?q="2026+Open+Source+Security+and+Risk+Analysis+Report"+PDF&udm=14 …

One thing about Tribblix on SPARC is that it tracks x86 pretty closely, but actual releases come at different times. What this means right now is that while Tribblix on x86 is effectively in freeze while I work through a bunch of breaking changes, many of those changes are now available on SPARC. While this may seem a bit odd, the reality is that not all the breaking changes apply to SPARC at all (I'm not planning to update perl or gcc there, even though I want to, because the updates won't even build properly), and even those that do are less appropriate (such as desktop updates like bumping the Xfce version). The one visible change that people might see is the python switch from 3.12 to 3.13.