03:38:07 <rdr> I installed FreeBSD, I found the Free part, but where is the BSD?
04:13:13 <SponiX> rdr: I think the BSD is hidden in the kernel mainly, and the base userland. The Ports are a mixed bag
05:39:35 <LXGHTNXNG> xd
06:33:45 <o0x1eef> ant-x Create your own AI that consumes all official docs and man pages. Not that hard.
08:47:08 <Grell> Hello all
08:47:25 <Grell> how is everyone at 04:47:08 EST
09:41:49 <o0x1eef> ant-x I wrote this pasted on your comment, you could also add handbook search as well, and you'd have a pretty good FreeBSD knowledge source that's grounded in official docs https://0x1eef.github.io/posts/how-to-build-a-man-page-agent/
14:08:57 <polarian> I was looking at network filesystems and got a little despressed when I realised just how insecure it gets
14:09:22 <polarian> so NFSv4 is "secure" but is rarely used, NFSv3 being the main one in use, but most of the time its on local networks so its fine, ditto smb/cifs
14:09:43 <polarian> but recently a group of people I know have been having issues sharing files
14:09:59 <polarian> mainly recordings, and the best way to share them is to upload it to a single network share...
14:10:15 <polarian> but that opens a massive tin of worms
14:10:45 <polarian> NFS+wireguard, smb+wireguard, webdav (with it without wireguard, as it has tls encryption)
14:11:04 <polarian> sshfs also exists, but isn't fun to use if you aren't on Linux or BD
14:11:06 <polarian> BSD*
14:11:19 <polarian> NFS support for other OS I am not too sure about, but I know smb and webdav works natively on Windows/MacOS
14:12:09 <polarian> smb being the best supported, but security concerns, so wireguard is the only real choice here, and then webdav just works (same protocol used for nextcloud network shares for those who are unaware) but it requires importing a module into nginx, which gets annoying as its not always in the repos of many distros
14:12:21 <polarian> I dont know about freebsd support for any of this shit either...
14:12:38 <polarian> tl;dr, what do you folks use? If you had to network share over clearnet what would you do?
14:12:45 <polarian> (has to be normie friendly too)
14:19:03 <ivy> polarian: NFSv4 is no more secure than NFSv3, both support Kerberos.  in NFSv4 you get TLS as well, but that's still pretty uncommon
14:22:08 <ivy> also no one should be using NFSv3 anymore... the only common implementation i'm aware of that doesn't do NFSv4 is the Windows client, but there's a third-party client (ms-nfs) that does v4
14:28:36 <polarian> ivy: afaik NFSv3 does not have TLS, NFSv4 supporting TLS makes it somewhat viable to clearnet it
14:28:43 <polarian> the issue with NFSv4 is nobody fucking uses it
14:28:51 <polarian> NFSv3 "just works"
14:29:31 <polarian> ivy: Windows is one major reason for NFSv3's continued use, as you said, no native support, and the average company is hesistant to adopt something not natively supported
14:29:37 <ivy> i don't think that's accurate... based on questions i see on fs@, more people there are using NFSv4
14:29:48 <ivy> the Windows server does support v4, it's only the client that doesn't
14:29:50 <polarian> ivy: yes tech nerds who know a thing or two about security
14:30:09 <polarian> afaik the industry still uses NFSv3 because "it just works"
14:30:28 <polarian> also a lot of industry use of NFS is on local networks, not over WAN, thus the lack of encryption is less of an issue
14:30:45 <ivy> NFSv3 doesn't lack encryption...
14:30:48 <polarian> I thought it does?
14:31:06 <ivy> security with NFS is nearly always done with Kerberos - TLS is still not widely used, although i think adoption is increasing
14:31:39 <ivy> and NFSv3 works fine with Kerberos
14:31:40 <polarian> ivy: wasn't Kerberos support added in v4 though?
14:31:43 <polarian> hmmm
14:31:44 <ivy> no
14:31:45 <polarian> didn't know that
14:32:20 <ivy> you can also secure NFS with IPsec, but i've never seen anyone actually do that in practice (but i'm sure someone is)
14:32:43 <polarian> I did list above wireguard, which I would prefer over IPsec
14:32:50 <polarian> IPsec is just more complicated, thats all
14:34:00 <polarian> ivy: also isn't smb better supported than nfs on Windows/MacOS?
14:34:07 <polarian> I honestly haven't used NFS on a non-unix system
14:34:16 <ivy> Windows yes, Mac is terrible at both
14:34:22 <polarian> lol
14:34:29 <polarian> Apple explicitly states it supports smb though :p
14:35:16 <polarian> *sigh* whenever Apple enters into a conversation it is never for a good reason :(
14:35:20 <ivy> also, IPsec can be easier for a large number of systems because you can automatic key negotiation with IKE ... Wireguard doesn't really have a good equivalent to that
14:35:34 <polarian> sure, but small group of people
14:35:42 <polarian> wireguard much easier for that :)
14:36:57 <polarian> ivy: webdav just works though
14:36:59 <polarian> I know that
14:37:01 <polarian> but I really hate web
14:37:31 <polarian> I have seen webdav work on all 3 major os
14:38:06 <polarian> the annoying thing is you need an nginx module, and httpd (openbsd) doesn't support webdav, so you typically need to run two webservers on OpenBSD for it :/
14:38:14 <polarian> or use relayd
14:39:24 <polarian> and correct me if I am wrong but I dont see the nginx dav module within the port tree :/
14:39:39 <polarian> maybe its within the nginx port as an option
14:40:03 <polarian> ahhh it is, okay that makes it easier
14:40:27 <hodapp> yeah, I just feel like WebDAV is like that one friend where someone will go "I mean... I guess we could invite WebDAV..." and everyone kinda squirms and goes "yeah, I guess we could..." and tries to look for an excuse not to
14:40:54 <polarian> and HTTP_DAV is within the default options too, so this is actually piss easy to do on FreeBSD
14:41:11 <polarian> hodapp: but it just works :p
14:41:23 <ivy> how do you mount webdav?  fuse?
14:41:27 <polarian> yes
14:41:31 <polarian> theres a fuse module for it
14:41:36 <polarian> fusefs-webdavfs
14:41:51 <hodapp> polarian: yet SOMEHOW, no one ever wants to invite WebDAV
14:42:03 <polarian> yup its a "ugh" moment :p
14:42:34 <polarian> surprisingly a lot of people I have spoken about webdav with didnt realise you can use nginx to setup webdav, and you DONT need to use nextcloud
14:42:56 <polarian> and webdav is used a lot with nextcloud as nextcloud struggles to handle big files through its web UI
14:43:01 <polarian> so you inevitably mount it as a network share
14:43:06 <hodapp> I am glad to have just shitcanned NextCloud some months back
14:43:24 <polarian> but yeah network sharing seems like a hell of a tin of worms
14:43:27 <hodapp> it was full of things that just never ever quite worked right
14:43:48 <polarian> ivy's suggestion is what I essentially knew, overlay the protocol with encryption
14:43:53 <gbon121> there's also mod_dav in apache
14:43:55 <polarian> I was curious if anyone else had some fancy alternative
14:43:59 <polarian> gbon121: who uses apache anymore?
14:44:26 <hodapp> even little things like wanting to put it behind my reverse proxy with TLS, and most things handle this fine, and NextCloud just goes "NOW YOU JUST HOLD THE FUCK ON" and random things fail left and right
14:44:28 <ivy> i use apache everywhere, works fine, does everything
14:44:38 <polarian> ivy: seriously?
14:44:48 <polarian> I thought nginx killed apache
14:44:59 <polarian> I haven't seen someone use apache for years :p
14:45:10 <hodapp> so I switched to Immich for photo stuff, and Radicale for CalDAV/CardDAV
14:45:32 <hodapp> polarian: I thought caddy killed nginx
14:45:34 * hodapp hides
14:45:36 <polarian> oh there is one issue with nginx webdav though...
14:45:43 <polarian> hodapp: lol
14:45:53 <polarian> I dont see caddy much, I know it has a loyal userbase
14:46:19 <hodapp> I set it up internally and the built-in "automagically renews your goddamn certs" support is very very handy
14:46:21 <polarian> re: issue with nginx webdav, is basic auth
14:46:23 <polarian> ugh
14:46:28 <polarian> basic auth is a pain in the arse
14:46:42 <polarian> I use nginx webdav for a maven repository, as its more simple and lightweight than all the bloated solutions
14:46:59 <polarian> however the most annoying thing is hashing the user and password, and ensuring not to catch the whitespace in the string
14:47:23 <polarian> so many userspace commands will insert a \n and you dont want that hashed
14:47:46 <polarian> the number of times I have forgotten the \n and smashed my head on the desk not understanding why I am getting authentication errors :p
14:48:45 <polarian> sorry forgotten to remove the \n :p
14:49:21 <polarian> hodapp: I hate tls cert renewals, always breaks, and I get why people like caddy for that, but when you run email, and irc etc... you end up deploying a different solution anyways...
14:49:28 <polarian> caddy renewals are useful if you are only doing web
14:49:47 <polarian> acme.sh used to be good, but in the last 1-2 years its throws errors like crazy, and none of the dns api's I use work
14:50:14 <hodapp> polarian: it's been reliable for me, even for DNS-01 so I can have a wildcard cert for an internal-only subdomain I made
14:50:20 <polarian> certbot just works, but I dont like how it shits into /etc
14:50:46 <polarian> I am a fan of OpenBSD's acme-client
14:50:49 <polarian> sweet and simple
14:50:58 <hodapp> at one point I was doing an internal CA but was just so sick of Apple's dumb rules on custom CAs/certs
14:51:00 <polarian> but in all honesty I haven't found a good acme solution yet, I am on the verge of writing my own
14:51:06 <ivy> i wrote my own ACME client using uacme, using GSS-TSIG (Kerberos nsupdate) for dns-01
14:51:17 <ivy> works pretty well
14:53:41 <polarian> I use jails and vms a lot, and need to share certs between them, so I have been tempted for years to attempt my own basic acme client, which has a master (the host) and then can distribute certs to jails and vms with some sort of ACL to grant permission to each cert or something
14:53:53 <polarian> idk, it would make life so much easier, right now I have it scripted
14:53:59 <ivy> i use ACLs on the DNS server for that
14:54:08 <polarian> but this requires root to inject the cert into the filesystem of the jail
14:54:10 <polarian> and I dont like doing that
14:54:26 <polarian> and for VMs, it has to be done over sftp, and that means all vms MUST run ssh
14:54:29 <polarian> and thats just annoying
14:54:42 <polarian> ivy: wdym?
14:54:50 <polarian> like explain with more depth
14:54:56 <polarian> im interested
14:54:59 <ivy> polarian: dns-01 uses TXT records, so i use ACLs to control which hosts can create which txt records
14:55:11 <polarian> ah right
14:55:32 <polarian> ivy: your uacme is different than the public uacme?
14:55:34 <polarian> the well known one
14:55:38 <polarian> or is it that?
14:55:47 <ivy> e.g. update-policy { grant EXAMPLE.ORG. krb5-selfsub . TXT; }; means any host can create records for its own hostname
14:56:15 <ivy> polarian: it uses the normal uacme which is in ports
14:56:22 <polarian> ivy: oh wow, thats your project?
14:56:31 <ivy> no, i wrote my own client that *uses* uacme
14:56:35 <polarian> OHHHHHHHH
14:56:37 <ivy> mine is security/lfacme
14:56:38 <polarian> im stupid
14:56:41 <polarian> :p
14:56:50 <polarian> I notice sthen has contributed to uacme O.O