BSD Now

87: On the List


Listen Later

Coming up this time on the show, we'll be speaking with Christos Zoulas, a NetBSD security officer. He's got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We've also got answers to your emails and all this week's news, on BSD Now - the place to B.. SD.

This episode was brought to you by

Headlines
New PAE support in OpenBSD
  • OpenBSD has just added Physical Address Extention support to the i386 architecture, but it's probably not what you'd think of when you hear the term
  • In most operating systems, PAE's main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms - this version isn't for that
  • Instead, this change specifically allows the system to use the No-eXecute Bit of the processor for the userland, further hardening the in-place memory protections
  • Other operating systems enable the CPU feature without doing anything to the page table entries, so they do get the available memory expansion, but don't get the potential security benefit
  • As we discussed in a previous episode, the AMD64 platform already saw some major WX kernel and userland improvements - the i386 kernel reworking will begin shortly
  • Not all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of WX that was already there
  • The AMD64 improvements will be in 5.7, due out in just a couple days as of when we're recording this, but the i386 improvements will likely be in 5.8
  • ***
    Booting Windows in bhyve
    • Work on FreeBSD's bhyve continues, and a big addition is on the way
    • Thus far, bhyve has only been able to boot operating systems with a serial console - no VGA, no graphics, no Windows
    • This is finally changing, and a teasing screenshot of Windows Server was recently posted on Twitter
    • Graphics emulation is still in the works; this image was taken by booting headless and using RDP
    • A lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)
    • Not a lot of details on the matter currently, but we'll be sure to bring you more info as it comes out
    • Are you more interested in bhyve or Xen on FreeBSD? Email us your thoughts
    • ***
      MidnightBSD 0.6 released
      • MidnightBSD is a smaller project we've not covered a lot on the show before
      • It's an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-use
      • They also have their own, smaller version of FreeBSD ports, called "mports"
      • If you're already using it, this new version is mainly a security and bugfix release
      • It syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versions
      • You can check their site for more information about the project
      • We're trying to get the lead developer to come on for an interview, but haven't heard anything back yet
      • ***
        OpenBSD rewrites the file utility
        • We're all probably familiar with the traditional file command - it's been around since the 1970s
        • For anyone who doesn't know, it's used to determine what type of file something actually is
        • This tool doesn't see a lot of development these days, and it's had its share of security issues as well
        • Some of those security issues remain unfixed in various BSDs even today, despite being publicly known for a while
        • It's not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running it
        • When you think about it, file was technically designed to be used on untrusted files
        • OpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite - this time with modern coding practices and the usual OpenBSD scrutiny
        • This new version will, by default, run as an unprivileged user with no shell, and in a systrace sandbox, strictly limiting what system calls can be made
        • With these two things combined, it should drastically reduce the damage a malicious file could potentially do
        • Ian Darwin, the original author of the utility, saw the commit and replied, in what may be a moment in BSD history to remember
        • It'll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future - someone's already thrown together an unofficial portable version
        • Coincidentally, the lead developer and current maintainer of file just happens to be our guest today…
        • ***
          Interview - Christos Zoulas - [email protected]

          blacklistd and NetBSD advocacy

          News Roundup
          GSoC-accepted BSD projects
          • The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that list
          • FreeBSD's list includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. memory compression and deduplication
          • OpenBSD's list includes: asynchronous USB transfer submission from userland, ARM SD/MMC & controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it... porting HAMMER FS to OpenBSD
          • We'll be sure to keep you up to date on developments from both projects
          • Hopefully the other BSDs will make the cut too next year
          • ***
            FreeBSD on the Gumstix Duovero
            • If you're not familiar with the Gumstix Duovero, it's an dual core ARM-based computer-on-module
            • They actually look more like a stick of RAM than a mini-computer
            • This article shows you how to build a FreeBSD -CURRENT image to run on them, using crochet-freebsd
            • If anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us
            • ***
              EU study recommends OpenBSD
              • A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and tools
              • This is especially important, in all countries, after the mass surveillance documents came out
              • "[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts."
              • The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied on
              • Alongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: "Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways"
              • Reddit, Undeadly and Hacker News also had some discussion, particularly about corporations giving back to the BSDs that they make use of in their infrastructure - something we've discussed with Voxer and M:Tier before
              • ***
                FreeBSD workflow with Git
                • If you're interested in contributing to FreeBSD, but aren't a big fan of SVN, they have a Github mirror too
                • This mailing list post talks about interacting between the official source repository and the Git mirror
                • This makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved
                • ***
                  Feedback/Questions
                  • Sean writes in
                  • Bryan writes in
                  • Sean writes in
                  • Charles writes in
                  • ***
                    ...more
                    View all episodesView all episodes
                    Download on the App Store

                    BSD NowBy JT Pennington

                    • 4.9
                    • 4.9
                    • 4.9
                    • 4.9
                    • 4.9

                    4.9

                    89 ratings


                    More shows like BSD Now

                    View all
                    Security Now (Audio) by TWiT

                    Security Now (Audio)

                    1,971 Listeners

                    Software Engineering Radio - the podcast for professional software developers by se-radio@computer.org

                    Software Engineering Radio - the podcast for professional software developers

                    272 Listeners

                    The Changelog: Software Development, Open Source by Changelog Media

                    The Changelog: Software Development, Open Source

                    283 Listeners

                    LINUX Unplugged by Jupiter Broadcasting

                    LINUX Unplugged

                    265 Listeners

                    Python Bytes by Michael Kennedy and Brian Okken

                    Python Bytes

                    215 Listeners

                    Late Night Linux by The Late Night Linux Family

                    Late Night Linux

                    154 Listeners

                    Home Assistant Podcast by HK Media

                    Home Assistant Podcast

                    65 Listeners

                    CoRecursive: Coding Stories by Adam Gordon Bell - Software Developer

                    CoRecursive: Coding Stories

                    189 Listeners

                    Kubernetes Podcast from Google by Abdel Sghiouar, Kaslin Fields

                    Kubernetes Podcast from Google

                    181 Listeners

                    Late Night Linux Family All Episodes by The Late Night Linux Family

                    Late Night Linux Family All Episodes

                    44 Listeners

                    Linux Dev Time by The Late Night Linux Family

                    Linux Dev Time

                    21 Listeners

                    Self-Hosted by Jupiter Broadcasting

                    Self-Hosted

                    135 Listeners

                    2.5 Admins by The Late Night Linux Family

                    2.5 Admins

                    92 Listeners

                    Linux After Dark by The Late Night Linux Family

                    Linux After Dark

                    29 Listeners

                    Oxide and Friends by Oxide Computer Company

                    Oxide and Friends

                    47 Listeners