Posts in category www.undeadly.org
doas environmental security
Ted Unangst (tedu@)
posted
to the tech@
mailing list regarding
recent changes to environment handling in
doas
(in -current):
[...]
After some reflection, I\'ve been convinced that it\'s unlikely everybody reads
the manuals, or that the manuals are even correct or complete. So the new doas
behavior moving forward is to reset most [...]
SSH gets protection against side chan...
Damien Miller (djm@) has just committed a new feature for SSH that should help protect against all the various memory side channel attacks that have surfaced recently.
Add protection for private keys at rest in RAM against speculation
and memory sidechannel attacks like Spectre, Meltdown, Rowhammer and
Rambleed. This change encrypts p [...]
ntpd auto time setting
Otto Moerbeek (otto@) has written
an update
on his recent ntpd(8) work to the tech@ mailinglist:
Hi,
I have been working on a nice feature that improves startup behaviour of
ntpd.
Summary: make sure you have at least one constraint source configured
and use no options. ntpd will set the clock if needed, even if you
machines h [...]
rpki-client(8) imported into the tree
Job Snijders (job@) has
imported
Kristaps Dzonsons\'
rpki-client
(discussed previously)
into the tree:
And here is the commit message:
Import Kristaps Dzonsons\' RPKI validator into the tree
rpki-client(1) is an implementation of the Resource Public Key
Infrastructure (RPKI), specified by RFC 6480. The client is responsible
f [...]
BSDCan 2019 videos available
Videos of presentations at
BSDCan 2019
are now (becoming) available from the
YouTube channel.
Links to the videos can now also be found in the usual place.
g2k19 Hackathon Report: Stefan Sperli...
Our next hackathon report comes from Stefan Sperling (stsp@):
My goal for g2k19 was to work on Tx aggregation support in the wifi stack.
But of course I didn\'t even get to start working on that before I was back home.
Read more…
acme-client(1) moves to Let’s E...
Florian Obser (florian@) has
committed
the changes required to move
acme-client(1)
in -current to the
RFC 8555
protocol used by the
Let\'s Encrypt v02 API:
CVSROOT: /cvs
Module name: src
Changes by: florian@cvs.openbsd.org 2019/06/07 02:07:52
Modified files:
usr.sbin/acme-client: acctproc.c acme-client.1 certproc.c
[...]
Recent Security Innovations
Introduction
There have been some recent security
innovations
previously unreported here:
New flag "MAP_CONCEAL" for mmap(2) allocations
No syscalls from pages where PROT_WRITE is still enabled
Read more…
Smartisan becomes Iridium Donor for 2...
Ken Westerback of The OpenBSD Foundation wrote in with some excellent news on the 2019 fundraising campaign:
The OpenBSD Foundation is excited to announce that it has received its
largest ever donation. Smartisan has topped
its own previous record donation with a 2019 donation of CDN$380,000.00.
This makes Smartisan the first Iridium [...]
g2k19 Hackathon Report: Andrew Fresh ...
Next up with a report from g2k19 is Andrew Hewus Fresh
(afresh1@):
This year I had been thinking of ideas for things to work on in the
weeks before the hackathon and the top thing on my list was to improve
portgen(1)
so that I could switch from tools I wrote to something
everyone was more likely to (Read more...)
g2k19 Hackathon Report: back to dee t...
Martin Pieuchot (mpi@) wrote in with a report from g2k19:
I was particularly excited to attend this year\'s general hackathon. I
arrived without expectation. My goal was to have a fresh look at the
kernel and discuss pending issues in a new way. Since I haven\'t really
hacked on OpenBSD during the last year, I wasn\'t sure what (Re [...]
Call for testing of ntpd(8) automatic...
Otto Moerbeek (otto@) has been working on improving the behaviour of ntpd(8) during system boot, especially for machines whose time is way off (e.g. for machines without a battery-backed clock (RTC)).
One recently committed improvement dealt with the problem of bad time in a DNSSEC environment, but Otto is working on more changes in this ( [...]
SNI support added to relayd(8) in -cu...
With this
commit,
Reyk Floeter (reyk@) completed the addition of
Server Name Indication (SNI)
to
relayd(8):
CVSROOT: /cvs
Module name: src
Changes by: reyk@cvs.openbsd.org 2019/05/31 09:25:57
Modified files:
usr.sbin/relayd: config.c parse.y relayd.c relayd.conf.5
relayd.h
Log message:
Add support for [...]
g2k19 hackathon report from Claudio J...
With the latest hackathon finished, the subsequent BSDCan completed and its attendees having returned home, Claudio Jeker (claudio@) writes in with the first report from g2k19:
Travelling to the hackathon was a bit of an adventure this year.
The software troubles with the 737 MAX caused frequent scheduling
changes. At Montreal airport [...]
OpenBSD 6.5 Released
2019-04-24, Calgary, Alberta, Canada and elsewhere: With a message sent to relevant mailing lists, Theo de Raadt (deraadt@) announced that the OpenBSD project\'s 46th release, OpenBSD 6.5 is now generally available from mirror sites all over the world.
Notable changes include but are not limited to:
On amd64 and i386 platforms, the defau [...]
docbook2mdoc-1.0.0 released
After doing active development on it for about a month,
i just released version 1.0.0 of the DocBook to mdoc converter,
docbook2mdoc(1).
The OpenBSD port was updated, too.
In a nutshell, docbook2mdoc was brought from experimental status
to an early release that can be considered mostly usable for
production, though no doubt there are s [...]
t2k19 Hackathon Report: On rsync, ssh...
The stream of t2k19 hackathon reports continues with this from Christian Weisgerber (naddy@):
Discounting an airport layover, this was my first trip to Asia.
I guess I picked the right spot. Seeing Taipei felt like stepping
into Ghost in
the Shell. Awesome. But this isn\'t the OpenBSD travel
blog…
Read more…
t2k19 Hackathon Report: unwinding in ...
Fresh from the recent t2k19 hackathon in Taipei, Florian Obser (florian@)
writes in with this report:
unwind(8) is weird. It is the first daemon I wrote without having a
constant use for most of its features. slowcgi(8), slaacd(8) and
rad(8) are different, I use them every day and I will notice when I
break stuff.
Read more&hell [...]
t2k19 Hackathon Report: Stefan Sperli...
A new hackathon report has arrived, this time from Stefan Sperling (stsp@), who writes:
This hackathon was an exceptional opportunity for several developers
involved in 802.11 wireless to meet face to face. I spent a lot of time
collaborating with Kevin Lo and Jonathan Matthew throughout the week.
Read more…
t2k19 Hackathon Report: Ken Westerbac...
Kenneth R Westerback (krw@) wrote in with a
report on his recent participation in
t2k19:
Rule 1 of Taipei travel -- nobody knows what an EasyCard is.
Read more…
