OpenBSD

Sometimes I like to think of OpenBSD development as a form of spiritual discipline. The project is a decades-long painstaking labor of love with hackers carefully rearranging source code by hand. In Dutch you'd call this monnikenwerk. So what better place could there be for a hackathon than an actual monastery?

Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).

The paper presents a longitudinal measurement study on the adoption of the pledge and unveil system calls in OpenBSD. These system calls are used to sandbox programs and libraries. Given a dataset covering 19 releases, many programs and libraries were modified to use the system calls already before their introductions in official releases

Both relayd(8) and httpd(8) now have the "secure" list of allowed crypto methods for HTTPS, which include TLSv1.3 and the TLSv1.2 AEAD cipher suites. The previous list was "HIGH:!aNULL" which contain non-perfect-forward-security methods and this change may cause old clients to not be able to connect.

True enlightment only comes from a truly free computing experience, probably! And while there is no nerd who lacks an opinion on Richard Stallman personally, likewise let none claim he does not practice what he preaches. Why, the very laptop in front of him was selected deliberately because it can operate with no binary blobs and no firmware you couldn't examine or replace with your own, and runs his choice of fully libre operating systems. The fact it has a Chinese MIPS64 derivative in it was undoubtedly just more compound on the heat spreader.

mpls_do_error copies (nstk+1) label-stack entries from a fixed 16-entry array when no BoS label is present, leaking 4 bytes of adjacent kernel stack memory in the ICMP/MPLS error response.

Port knocking is mostly a bad idea. But people keep wanting to do it, for some false sense of security. If you don't consider it a security control but a way to keep garbage out of your logs, it might be valid. In my case I'm using an old USG Pro 4 running OpenBSD as my firewall and I'd prefer to avoid writing stuff to the logs, as I'd prefer the flash not to wear out sooner than needed, definitely not thanks to background radiation on the internet.

In OpenBSD, the syslogd(8) system logger has already for a while now fork(2)ed the privileged from the non-privileged parts.

Architecture specific notes for OpenBSD guests under QEMU, with working command lines where installation succeeds and failure points where it does not.

UNIX was first created on Digital PDP-7 hardware, but as it grew and ran on more and more hardware platforms, some of them became quite iconic, and at least major milestones in UNIX evolution. If I were to name only three of them, I would name the PDP-11, hero of the 2BSD series, the VAX, supported from 3BSD onwards, and the hp300 (HP 9000/300 workstations), support for which was added in 4.3BSD-Reno. These machines are long gone (I wouldn't say ``dead'' as hobbyists are still keeping them alive, to this day, and I am myself still tinkering on VAX and hp300 systems on an irregular basis), but traces of their existence can still be found in BSD code today. Let me show you some hp300 leftovers

In this story, I would like to talk about something which has turned out to be both an asset and a curse.

Near the end of march 2002, Wim Vandeputte was contacted for a possible VAX hardware donation in Delft, in the Netherlands. The description of the hardware was a bit vague, it was supposed to be a VAXstation, in a large deskside cabinet. What's the relationship between a VAX and Firefox, you may already be wondering. Please bear with me, you will see in a few paragraphs.

Nostalgia for a more relaxed era of computing can drive one to resurrecting ancient protocols, breathing in solder fumes, and exploring old-new networking technologies on OpenBSD

Configurer les serveurs Vger et nginx, en tant que proxy, pour diffuser sur le protocol Gemini, de multiples noms de domaines

I know it isn't going to be comparable to Linux or anything like that yet, but does anyone here do any gaming at all on their openBSD setup?

Even things like emulators. I'm just curious as to what pitfalls you have experienced getting it to work and how well it works for you.

A quick interview with an OpenBSD community member: discussing the OS, the community's contributions to its development, and some future plans.

A new BSDCan video has been posted: Confidential Computing with OpenBSD -- The Next Step by Hans-Jörg Höxer

Confidential computing is a family of techniques to enhance security and confidentiality for data in use. One technical approach is strong isolation for virtual machines.

AMDs Secure Encrypted Virtualization (SEV) offers several feature sets for isolation of guest virtual machines from a non-trusted host hypervisor and operating system. These feature sets include memory encryption, encryption of guest state including CPU registers and an attestation framework.

With OpenBSD 7.6 released in October 2024 we are now able to use the memory encryption features of AMD SEV to run OpenBSD as both

    a confidential guest VM and     as a hypervisor providing a confidential execution environment.

Now, thanks to memory encryption the hypervisor is not able to peek into a guests memory and is not able to retrieve sensitive information. However, the state of the CPU registers used by the guest is still visible to the hypervisor.

Therefore, we implemented support of AMDs "Secure Encrypted Virtualization with State Encryption" (SEV-ES) for OpenBSD guests and hypervisor. With SEV-ES all CPU guest state is encrypted and hidden from the hypervisor.

In this talk we will explain the fundamentals of SEV and SEV-ES. Then we explore the challenges imposed by SEV-ES for both guest and hypervisor. Finally we will take a closer look into selected implementation details.

Hans-Jörg Höxer is employed at genua, a German firewall manufacturer, who is using OpenBSD as a secure and stable base for its products.

For more information, please visit:  https://www.bsdcan.org/2025/

• and - https://www.bsdcan.org/2025/timetable/timetable-Confidential-Computing-with.html

New BSDCan Video Posted:

The state of 3d-printing from OpenBSD by Andrew Hewus Fresh

It's possible to do some 3d printing related things on an OpenBSD machine, but there are a bunch of popular tools that aren't available in the ports tree. We will talk about some of the different classes of software and what things are popular and whether they are currently available on OpenBSD and what the blockers are from getting those into the ports tree.\

#3dprinting #openbsd #runbsd

This talk goes over the development of a distributed filesystem tailored for OpenBSD. While OpenBSD excels in many areas, its native filesystem support has room for improvement. This talk goes into using the Filesystem in Userspace (FUSE) on OpenBSD to provide for a distributed and highly available filesystem.

This talk also includes an introduction to the Raft Consensus Algorithm, which plays a critical role in ensuring data consistency and reliability across distributed systems. The Elixir programming language is used, providing the necessary foundation for the implementation of the distributed FUSE filesystem on OpenBSD.

Talk link

For more information, please visit: https://www.bsdcan.org/