Coming up this time on the show, we'll be chatting with Antoine Jacoutot about how M:Tier uses BSD in their business. After that, we'll be discussing the different release models across the BSDs, and which style we like the most. As always, answers to your emails and all the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Optimizing TLS for high bandwidth applications
Netflix has released a report on some of their recent activities, pushing lots of traffic through TLS on FreeBSDTLS has traditionally had too much overhead for the levels of bandwidth they're using, so this pdf outlines some of their strategy in optimizing itThe sendfile() syscall (which nginx uses) isn't available when data is encrypted in userlandTo get around this, Netflix is proposing to add TLS support to the FreeBSD kernelHaving encrypted movie streams would be pretty neat***
Crypto in unexpected places
OpenBSD is somewhat known for its integrated cryptography, right down to strong randomness in every place you could imagine (process IDs, TCP initial sequence numbers, etc)One place you might not expect crypto to be used (or even needed) is in the "ping" utility, right? Well, think again David Gwynne recently committed a change that adds MAC to the ping timestamp payloadBy default, it'll be filled with a ChaCha stream instead of an unvarying payload, and David says "this lets us have some confidence that the timestamp hasn't been damaged or tampered with in transit"Not only is this a security feature, but it should also help detect dodgy or malfunctioning network equipment going forwardMaybe we can look forward to a cryptographically secure "echo" command next...***
Broadwell in DragonFly
The DragonFlyBSD guys have started a new page on their wiki to discuss Broadwell hardware and its current statusMatt Dillon, the project lead, recently bought some hardware with this chipset, and lays out what works and what doesn't workThe two main show-stoppers right now are the graphics and wireless, but they have someone who's already making progress with the GPU supportWireless support will likely have to wait until FreeBSD gets it, then they'll port it back overNone of the BSDs currently have full Broadwell support, so stay tuned for further updates***
DIY NAS software roundup
In this blog post, the author compares a few different software solutions for a network attached storage deviceHe puts FreeNAS, one of our favorites, up against a number of opponents - both BSD and Linux-basedNAS4Free gets an honorable mention as well, particularly for its lower hardware requirements and sleek interfaceIf you've been thinking about putting together a NAS, but aren't quite comfortable enough to set it up by yourself yet, this article should give you a good view of the current big namesSome competition is always good, gotta keep those guys on their toes***
Interview - Antoine Jacoutot -
[email protected] / @ajacoutot
OpenBSD at M:Tier, business adoption of BSD, various topics
News Roundup
OpenBSD on DigitalOcean
When DigitalOcean rolled out initial support for FreeBSD, it was a great step in the right direction - we hoped that all the other BSDs would soon followThis is not yet the case, but a blog article here has details on how you can install OpenBSD (and likely the others too) on your VPSUsing a -current snapshot and some swapfile trickery, it's possible to image an OpenBSD ramdisk installer onto an unmounted portion of the virtual diskAfter doing so, you just boot from their web UI-based console and can perform a standard installation You will have to pay special attention to some details of the disk layout, but this article takes you through the entire process step by step***
Initial ARM64 support lands in FreeBSD
The ARM64 architecture, sometimes called ARMv8 or AArch64, is a new generation of CPUs that will mostly be in embedded devicesFreeBSD has just gotten support for this platform in the -CURRENT branchPreviously, it was only the beginnings of the kernel and enough bits to boot in QEMU - now a full build is possibleWork should now start happening in the main source code tree, and hopefully they'll have full support in a branch soon***
Scripting with least privilege
A new scripting language with a focus on privilege separation and running with only what's absolutely needed has been popular in the headlines latelyShell scripts are used everywhere today: startup scripts, orchestration scripts for mass deployment, configuring and compiling software, etc.Shill aims to answer the questions "how do we limit the authority of scripts" and "how do we determine what authority is necessary" by including a declarative security policy that's checked and enforced by the language runtimeIf used on FreeBSD, Shill will use Capsicum for sandboxingYou can find some more of the technical information in their documentation pdf or watch their USENIX presentation videoHacker News also had some discussion on the topic***
OpenBSD first impressions
A brand new BSD user has started documenting his experience through a series of blog postsFormerly a Linux guy, he's tried out FreeBSD and OpenBSD so far, and is currently working on an OpenBSD desktopThe first post goes into why he chose BSD at all, why he's switching away from Linux, how the initial transition has been, what you'll need to relearn and what he's got planned going forwardHe's only been using OpenBSD for a few days as of the time this was written - we don't usually get to hear from people this early in on their BSD journey, so it offers a unique perspective***
PCBSD and 4K oh my!
Yesterday, Kris got ahold of some 4K monitor hardware to test PC-BSD outThe short of it - It works great!Minor tweaks being made to some of the PC-BSD defaults to better accommodate 4K out of boxThis particular model monitor ships with DisplayPort set to 1.1 mode only, switching it to 1.2 mode enables 60Hz properly***
Feedback/Questions
Darin writes inMitch writes in***
Discussion
Comparison of BSD release cycles
FreeBSD, OpenBSD, NetBSD and DragonFlyBSD***
View all episodes
