alright I want to kick off a convo a while back which I never really finished, so jailing bhyve, within the handbook it is said to add security, but someone here at some point pointed out almost everything is inkernel, so jailing bhyve is nothing more than jailing the userspace utility and that bhyve being pwned would bypass the jail anyways (as its inkernel)

so question is, is jailing bhyve worth it?

I have both used it within a jail and outside of a jail, I find using a jail makes it easier though as I can inject the bhyve command into the startup of the jail, and then when the jail is stopped bhyve gracefully shutdowns

It would make sense if bhyve knows it's inside a jail and keeps to the constraints, but I really can't say about all the in-kernel stuff. It could even facilitate a jailbreak. Maybe ask on the mailinglists?

polarian: jailing bhyve limits some of the risk area to the jail rather than the raw host. the kernel parts of bhyve are setting managing the vmm, but there is also a lot of userspace code to handle vmexits

[tj]: interesting, so I am not doing it all for nothing then, I prefer using a jail anyways as it separates it from the host, just cleaner that way

and with zfs compression, its mostly cost free too

you would hope that most security mitigations are never actually exercised, like airbags

true

andrath: might be worth asking anyways for 1. mailing list history, and 2. would likely get a more indepth answer (as mailing lists are better for that shit, instead of small sync IRC communications)

is most recent iwlwifi ( that is in stable/15 branch ) works only in ac mode for Intel AX210 wireless? it seemed to me it had to be working in ax mode too

we don't have ax support

[tj]: ok, fair enough.

[tj]: too bad you cant just wrap LinuxKPI around that :p

the freebsd way of supporting lots of devices, wrap linuxKPI around Linux drivers and call it a day >:)

wasn't Adrian working on 802.11ax?

we need ieee80211 stack support for ax, we have some?

[tj]: idk for some reason I have some memory of Adrian working on ieee80211 support for ax, or maybe he spoke about the idea or something

idfk

I cant remember

personally I use 802.11n and I dont need anything more...

802.11ac is a nice to have but I dont find it helps me in any way

isn’t ’n’ the short distance one?

GoSox: depends, I actually use 802.11g a lot more (as its 5GHz which is less congested)

wait no 802.11n can do 5Ghz too iirc

sorry g is 2.4GHz

my favorite thing to do when a customer is complaining about constanatly shitty wifi, is to log in to their router and change the channels of their wifi to the middle numbers nobody uses. And like magic, their wifi goes from spotty and unreliable to rock solid

GoSox: you might be thinking of 802.11ac, which was only defined for 5GHz (and falls back to .11n for 2.4GHz)?

oh maybe i don’t know

but funny enough I am using 802.11g right now

because for some reason freebsd likes connecting with 802.11g, I have no fucking clue why

wifi all works so good these days, I don’t even pay attention to whats what

it does do 802.11n sometimes

anyway GoSox 5GHz is shorter distance, but in cities it will travel further due to less congestion, 2.4GHz has only a few non-overlapping bands and thus is heavily congested.

most people use the default channels, hardly anyone actually goes in to their router to change that

i’m sure people in a freebsd chat room do, but “normies” do not

GoSox: its usually not worth it

the point is that 5GHz is less congested because you can't see the other traffic at all (as least not as much), regardless of what channels you use

your AP will switch channels to the least congested (or should)

if you hard set it, if more APs pop up, you will be hard coded onto a congested band

when you’re in a multi-unit buildling or in a dense area where houses are very close together, it can be very worth it

s/band/channel/

GoSox: what you can do is narrow your channels that will help, but also affect performance (less bandwidth)

unfortunately most routers by default use the max channel width + max power... so its basically just a shouting match in the cities, who can have the biggest antenna :)

the benefit of 5GHz is it cant pass through thick walls, so for the most part your home is more shielded from it, downside is it struggles to cover a medium sized house, so you then need to mesh or run ethernet, meanwhile 2.4GHz can cover large spaces, but easily congested (2.4GHz better for countryside for example, or outdoor APPs)

s/APPs/APs/

also hi ivy IPv6 nexthop didn't work, turns out OpenBSD doesn't support it, thus it won't route OpenBSD side :(

the router gets the packet, doesn't know what the fuck to do with it, and drops it

polarian: i suggest writing a strongly worded letter

ivy: I just binat'd

pf ftw

its not worth any more months of my life

motivating myself to do something is hard enough, these setbacks just cause further issues

its being worked on, but its low priority

hopefully in a few releases (few years) it will be supported...

until then binat works fine (aka 1:1 NAT)

I wished I just binat'd in the first place, instead of fighting with IPv4-only on FreeBSD, and then IPv6 nexthop on OpenBSD *sigh*

i wonder if pf with route-to would work... although that's terrible and you should never use it

wifi is just poor

ISPs are always like “our router has the fastest wifi!” and I’m always like, who cares about wifi speed, if something is important it will be on ethernet

GoSox: not everyone can run Ethernet cables all over their house, and something may not be "important" but still benefit from increased download speeds

i bought a 1000’ spool of cat6 for my house and wired up everything :)

good for you, as i said, not everyone can do that

polarian: according to an OpenBSD user, IPv4 routes with IPv6 nexthops are supported since at least 7.8: x0r.be/@lw⊙bc/116317731957010927

ivy: I got told on the ML today its NOT supported

theres no way for route(8) to add a route for nexthop

hmm one says snapshot

one says 7.8

ML says none

fun!

ivy: unfortunately thats the only way to realistically have any reliable internet

I have knocked a few holes in walls (dont tell landlord) to run ethernet through

no mesh system, no enterprise wifi solution would work in a house with 20 APs surrounding i

it*

the house also has abnormally thick walls

it seems like that would depend on how large your house is

I would say its medium

in any case I just ran an external cable to my room, have a wifi AP there, and ethernet to my desk, and then I have a wifi AP along the trunk downstairs, and it gives me decent enough reliability, albeit not going to be the fastest

but if I need speed, I plug in, simples

in American-style/newbuilds wifi is better, but I am in a victorian home, and they are NOT designed for wifi xD

in any case I do want to move the fuck out anywqays :p

why does 'make CROSS_TOOLCHAIN=llvm19 WITHOUT_LLVM=yes buildworld' build libllvm? do i need another option to disable that?

ah, possibly WITHOUT_CROSS_COMPILER=yes

ivy: curious what you building llvm for

you into apple ecosystem stuff?

scottpedia: LLVM is shipped with FreeBSD, even time you build FreeBSD src, you build llvm

okay interesting

ivy: is it something depended by the freebsd in any way?

it's the C/C++ compiler, so yes

you can use an external toolchain, which means you use a compiler (llvm or gcc) which is not part of the system itself, e.g. from ports, but it seems like right now we still need to build some bits of llvm when doing that, perhaps for the ELF toolchain

ohh right freebsd doesn't use gcc/g++

i might actually switch to using gcc, since the gcc build often breaks and people don't notice or fix it

(on the downside, that means you have to fix the gcc build before getting around to the real work...)

isn't there a github integration that does gcc builds?

cyric: the Github pull request workflow runs a GCC build, if that's what you mean. but since it's always broken, no one cares if it fails

ivy: broken in what way? I thought the compiler are normally super reliable.

scottpedia: the compiler isn't broken, the build is broken, i.e. it doesn't build with gcc. this usually happens because gcc has some warning that llvm doesn't have, and we build most things with -Werror by default

sorry wdym the "build"? are you talking about the binary output?

scottpedia: the build of FreeBSD. building FreeBSD using GCC as the compiler.

okay so you mean you can't build freebsd with gcc?

can I say to "compile" freebsd with gcc? is there a difference when using either terms?

sorry i am not very familiar with the c/c++ ecosystem

ivy: #srcmgr's diverse enough that I think assigning to them for lack of better candidate is reasonable

i don't recall if they'd promised to re-route things that they can't do or not, but given current initiatives to try and fix stale review problems I'd imagine they will

I've got a newb question about using pf tables that source files and i'm not sure where to ask it :3?

then start with explaining what you want to do, then what you tried to do that and where you are stuck

it's more of how they work. I was just wondering if I need to reload pf when the files the tables point to are changed

yes

yes, you do, but there's a way to reload only tables with pfctl

(i can't remember what it is, though)

I'll read the manpage for that thank you :3

people can somebody give me recommendations regarding the best option between UnionFS, aufs and OverlayFS?

what are aufs and overlayfs?

rtprio: both are similar to unionfs with a copy-on-write feature

scottpedia: best option for what? what is the use case you are evaluating against?

voy4g3r2: i am planning on re-installing my OS with either one of these systems

filesystems*

i am looking for mainly the best compatibility

and reliability too, obviously

not familar with eithre of those in freebsd

also, zfs uses copy on write and that's what most folks use

yes. zfs seems to be the most professional choice

okay thx for the help rtprio

but seriously, do the latter two even work on freebsd? i've never heard of them; not in ports, not in /sbin so not sure you're going to swing an install with that

yeah i came to same conclusion as rtpio

scottpedia: my recommendation would be to minimize variables.. zfs exists and it is tested.. going outside of that would introduce risk which is fine.. but may not be fine when "something" goes boom

but you can't use unionfs or overlayfs as sole filesystem, they are for combining filesystems, so what is your use case here? (I assume that applies to aufs too, as you say that it is similar to unionfs)

scottpedia: have a look at the BUGS section in mount_unionfs man page

clearly states "IT DOESN'T WORK"

freebsd got pwned

fucks sake

they look like script kiddies too

the fact they put a Discord server there, they must not be any older than 18

is it known that the forums have been defaced?

what did freebsd do to get pwned

i couldnt find a proper communication channel to report it to, and the mailing list server seems to be taking a hit as well. it's super slow

as long as this is not a vuln in freebsd

and just a skill issue with sysadmins

I am happy

but if this is a potential RCE in the wild... I am fucking terrified

clusteradm is aware of the issue, the forum is not hosted on freebsd.org infrastructure

ivy: ahhhhh phew okay

can blame someone ele

else*

ivy is the mailing list also getting a hit or is it normally slow?

time to push freebsd foundation to run its own forums now!

Xinayder: mailing lists are always slow

Xinayder: hit by what?

i haven't noticed any issues with the lists today

it gives me a 503 backend error when I try to open the archives, plus it's taking so long to load here

Xinayder: slow meaning a few mins or a fe w hours

hmmm archives

slow meaning a few minutes

compared to about 20 minutes ago it's super slow

oh

502 to lists.freebsd.org

that is hosted by freebsd no?

might be down - just as a precaution

maybe.

what do some Turkish script kiddies want anyways

I hope. :)

well, the hackers mangaed to inject some code into xenforo, as it seems like every topic section in html is embedding the defacement web page, which is hosted on github

ah they are political

here I was shitting my pants thinking i ahd installed some malware by downloading sylve on my mini pc

right how are the pkg repos

this ^

I dont know what is hosted by who

and how its hosted

so whats the scope on this

from the sounds of it the forums are hosted separately

in which case everything else should be fine

well, that's creepy...

if this is creepy to you don't start thinking about what happens when somebody abuses their commit bit

well, of course

nah freebsd devs are nice

I only know one or two arseholes

they know who they are, they know full well how I feel about them :)

but is it even fully known what the scope of this is yet?

mewt: I dont think there is much to worry about

it seems like a bunch of political script kiddies

the limited info I can find on them is they hack people on political grounds

fair enough

We should be worried about what enabled this though

well I dont have a forums account so I couldn't give a toss

think of the poor LLM trainers

A part of the project's infrastructure has been breached and that is always serious

yeah idk, even if the impact is limited there, seems quite bad

to*

I wonder what the openbsd folks will think about it

they are probably munching on popcorn right now

Jokes aside, I just discovered it

I do wonder how it got pwned though

Likely a forum software vuln or something. Maybe social engineering.

I would prob go with social engineering

one of the admins prob got compromised

It's Kevin Mitnick

From the grave

Just one last hack

Crash Override

90% of the time it’s safe to blame php

Surely.

I remember way back there was a very easy way to gain admin access of a phpbb forum by changing a variable in a cookie

I don't remember what forum software they're using.

elarks: Sounds about right.

Forum software is pretty notorious for being vulnerable to injections and stuff. I wouldn't be surprised at all if was something simple.

I hope we get a nice postmortem

they use xenforo

There was a search string you could use on google to find forums with that specific version on phpbb

Xinayder: Ah. Thanks.

discourse gets regular security disclosures too iirc

so yeah

No recent CVEs from Xenforo. If it's a 0day, many others are interested about this

Quick look at exploit-db nothing stands out

Someone on the list just pointed out it’s only defaced is you have js enabled

baz: I disabled js

it still loads it

soooo

idk

It loads the defacement from github, but the loader JS is in forums.freebsd.org

hmmm

lts: the hackers look like script kiddies, like they could find a 0day and exploit it

I will be shocked if they did

True

I'm rather hoping it's that, perhaps via some automated fuzzing or (brr) AI

lol

AI couldn't pwn a fucking open system

in any case I am interested how in the infra is handled

It would be worse if the compromise happened due to bad processes

Anyone join that discord? I don’t have that cancer installed or have an account

I’m curious if they are relaying these chats over there

if xenforo is pwned, serves freebsd right for using proprietary shi

shit

My bet would be the attackers are sitting on this channel too

baz: I dont have Discord

hey ivy you around, I know you have Discord :)

lts: nah doubt it

script kiddies cant figure out how to use IRC

freebsd forums is back!!!!!!!

down for me, that's potentially good

I wonder if its managed hosting by xenforo themselves

ivy said its not on freebsd infra

so I wonder if xenforo themself got pwned, and or socially engineered

in which case, time to drop them like a hot potato!

nah, if it was xenforo then the damage would be far worse

> Forum upgrade in progress.

theres probably a library or js file that was updated that allowed an entry point or something like that

uh oh

seems like it looks like a 0day

looking at the IP addresses within the freebsd infra

it seems the forums isnt part of it

soooooooo

I am going to guess its hosted by xenforo directly or something

and its a them issue :p

maybe related to this: > In addition to the usual bug fixes, XenForo 2.3.10 includes a critical security fix involving a potential stored XSS vector in structured text mentions (mostly legacy profile post content). We'd like to extend thanks to metho for responsibly disclosing the issue.

I hope this wasn't a case of not installing security patches

tbh I just got started with freebsd today, at least it's not the 6th time they allow SSL certificates to expire like some certain arch-based distro

just to reiterate what i said above, the forum is not managed by the freebsd.org cluster admin team. (beyond i have no more information on it than anyone else here)

Xinayder: expired ssl certs is minor compared to being pwned

ivy: so its managed hosting by xenforo right?

thats what it looks like

i have no idea

Seems to live in some NetActuate datacenter

One would think they’ve got more important shit to do than admin a forum

lts: yeah I can whois an IP

but freebsd doesnt use netactuate

so thats how I figured out its not freebsd infra

so I can only assume its managed hosting...

ivy: how do you know about the freebsd cluster admin team? are you one of them?

i am not, but there was some internal communication about the issue

(which literally just said what i said above... i am sure there will be more information forthcoming later)

I would be very interested in learning more about freebsd infra

mk, thanks for the assurance

gotta bump into the right peopl eat a conf ig

it's actually managed by aliens, humans are not intelligent enough to comprehend the complexity of it

> XenForo Cloud systems are hardened against attack vectors to prevent data theft or leakage. Automated systems regularly snapshot and back up your data to off-site servers located in the EU for GDPR compliance purposes.

Would be funny if they got pwned now wouldnt it

on that note its nap time

You get naps!? Where do I get those!?

At $work we have dedicated nap rooms

lts: where do you work google?

or a sleep clinic?

I don't think Google employees get to sleep

At all

I sure know I don't get to sleep!

Must be nice.

since the forums are down, what is the correct way of changing freebsd to a rolling release, or the least, get the latest version of certain ports?

Xinayder, are you asking about the OS or the ports?

I suppose it's not a good idea to mix quarterly OS with latest ports?

for ports: a default installation tracks quarterly packages. you can change that to latest instead.

there is no such thing as a quarterly OS (unless I am missing something with regards to pkgbase in 15)

if I need/want something that is more recent than -RELEASE, I just go with stable. that however means that you're going to compile from source yourself on every update you want to make. I'd say that is the closest to "rolling release" you can get without actually running -CURRENT

-CURRENT is latest and -RELEASE is what?

assuming this is about ports, you shouldn't mix quarterly and latest packages. you can run quarterly and backport updates from main yourself, but that requires building your own ports and is a lot of work

Sounds like you'll just want to edit /etc/pkg/FreeBSD.conf and change quarterly to latest

that's the idea, yes, but should I change the freebsd-base repo to point to base_latest, or just keep the major release?

-CURRENT is the main branch, typically not what you want to use unless you're a developer

ivy, does pkgbase have a stable repo?

Xinayder: you probably want to touch only the FreeBSD-ports and -ports-kmods

Xinayder: FreeBSD-base is the OS itself, so unless you want to switch from (say) 14.4-RELEASE to 14-STABLE, you should *not* change that - that's completely unrelated to the version of ports you're using (latest/quarterly) - yes, it is a bit confusing that "latest" is used for both

jbo: yes, "base_latest" is stable

jbo: as opposed to say "base_release_0" which is X.0-RELEASE

I'm still scared of pkbase :p

"anything new is bad" - old man yelling at clouds

(except in 16, where base_latest is CURRENT, since there is no 16-STABLE yet, of course)

reasonable

ivy, lts: I see, thanks!

Xinayder: just to be clear (because this isn't always obvious to new users) - FreeBSD is split into two almost entirely unrelated parts, one is the base OS (usually called 'base' or 'src'), and the other is ports, which contains the majority of third-party software. if you aren't sure which is which, anything in /usr/local comes from ports, anything else comes from base

unlike most Linux distributions, you can use the same ports version on any supported freebsd release (13, 14, or 15)

hello

is there a way I can change the repo url from pkg.freebsd.org to use any of the ftp mirrors? or the ftp mirrors don't host binary packages?

Xinayder: you can put any URL you want, if you know a particular mirror you want to use. although i don't know if anyone has ever tested pkg with an FTP mirror...

i would probably prefer HTTP just because it's more widely tested

the format of the url string changes if you switch to plain https, no?

that is, mine is currently set to pkg+https://pkg.FreeBSD.org/${ABI}/latest

hmm, i was looking at mirrorservice.org for an example but it seems like they don't carry packages anymore, although i'm sure they used to... maybe something to do with the fastly transition

what happend to the forums ?

/join #bash

any updates on the hack/

baier: you should be able to space once then /join #bash

you on thelounge ?

I'm trying to install jellyfin with freebsd-ports set to latest, but the pkg cannot be found. it exists in freebsd-ports 15.0, though.

seems like it fails on extract or checksum, maybe the distfile got remade portsfallout.com/fallout?port=multimedia%2Fjellyfin%24

polarian: No updates that I've seen.

sad

Xinayder: I have (what appears to be) the latest Jellyfin amd64 package available if you want it.

Xinayder: Are you saying that "pkg install jellyfin" doesn't work with the package repo set to "latest" or are you actually trying to build from the port?

ek: the former

Gotcha'. Well, like I said, I can provide you the package I have if you want it (and trust it).

I won't be offended if not. Haha

it's fine, I can use the previous version from the quarterly release. it's not that outdated

I remember having issues with one of the previous versions. There was something broken withe generation of thumbnails or something? Had to replace some file to get it working.

Not sure what version that was fixed in.

ek, does hw acceleration work for you in jellyfin?

Xinayder: To be honest, I don't know. I have running in a jail on a NAS without a GPU. I've never tested HWA. But, I do like that I can tell it to use whatever number of threads I want for thumbnailing and trickplay generation.

forums are back up, yay

Xinayder: i do not think jellyfin in ports is GPU enabled.. it uses the ffmpeg package from ports and does not use an optimized version, available at jellyfin.org jellyfin.org/docs/general/post-inst…l/transcoding/hardware-acceleration

voy4g3r2, it worked after some setup. fwiw I'm running a jail under sylve, was a bit tricky to get it working. long story short, had to install drivers, mesa-gallium-va, on both host and jail

oh.. i have mine in a jail also, never got it to work.. but the amount of usage i get.. the cpu transcoding worked just fine.. plus my GPU is mainly for llama-cpp.. would you by chance have "notes"? it would be interesting

but hte whole getting a host GPU to work in a jail.. was always a epic fail for me

I used this sylve.io/guides/deployments/jellyfin-jail there's a section about adding the devfs rules for the jail

oh mucho gracias.. i may have to look at this in more details. thank you

the important thing to keep in mind is, after you change transcoding settings, restart your jellyfin through the web panel... I was stuck on this part for about 30 minutes because the ffmpeg call wouldnt initialize the device

but it still doesn't work properly, I just got a movie and tried playing it, transcoding started and it's being killed before finishing the job

i use base jails.. i would just reboot the jellyfin jail.. but good to know.. never heard of this sylve tool

Sylve is kinda cool. Been meaning to play with that and ClonOS when I get a chance.

i've had good results passing intel iGPU through to a an ubuntu bhyve vm

GPU acceleration works flawlessly out of the box

my freebsd machine is a mini pc, gmktec g10. has a Ryzen 5 3500U cpu with integrated radeon graphics

could work, you'll get a /dev/dri/renderD128 in linux

i personally got worried when llama-server is using it for vector models (not in a jail) then trying to share the card with a jail..

but this is good to see, that other people were more successful than me.. maybe worth another try

now if magically CUDA would work on freebsd.. it would make my life a lot easier.. vulkan works

mjp, it "works", I just need to find a way to tweak it. the transcode timer is killing the transcode job on jellyfin, dunno why

how did you confirm its using GPU and not CPU?

good question. I suppose /dev/dri/renderD128 refers to a GPU?

(you can configure which device to use)

on linux with intel gpu its very easy to confirm as there is a utility called intel_gpu_top which shows actual GPU usage