other than squid and ATS, are there any decent options for a basic non-caching forward http proxy? something lightweight/simple would be nice

I use tinyproxy

Privoxy?

Defenso-QTH: that looks good, thanks

relayd?

I have used tinyproxy for a personal proxy and that works well.

ivy: ssh and SOCKS

looks like i needlessly pestered dropbear dev with pure port issue

that's because since 2024.86, DROPBEAR_SHA1_HMAC DROPBEAR_RSA_SHA1 DROPBEAR_DH_GROUP14_SHA1, are all disabled

i mean after it

port options used to disable those, now it needs to enable them :p

Welp. I think I'm online from my own hosted soju bouncer.

vvelcome

LXGHTNXNG: Thanks! <great success meme>

good job!

that was... much easier than I expecte

expected *

Though I have to say, I'm a little disappointed that senpai/soju can't talk over unix sockets.

<rolls up sleeves> Time to submit patches.

totally random question here that feels obvious, but on the main freebsd site is there anywhere to see the current patchlevel of supported releases?

closest I can find is something like this, but there's no patch level (ie: 14.4-pX) associated with the errata and sec advisories.

spork_css, I think that is a good question. And one I haven't thought about. But you cited the errata. Look at the "Corrected:" header at the top. It lists the patch level in each errata.

and the tags on the git repo

That says what patch level each errata notice is corrected. But it does not say what the latest patch level for everything is.

I think Gedge's suggestion is best. Look at the git tags for the latest commit'd patch level.

Switching roles to web site maintainer (for other projects) it's okay to look at the cgit as a human browsing it. So that's one way to look. But it's not okay to hit it with a CI/CD frequent query. That I block (on other projects) and it looks like FreeBSD does too with the Anubis tool.

I appreciate the git suggestion, but I'm thinking more about normal users, not developers or people intimately familiar with the whole devel pipeline.

(I'm asking because someone asked me and it was really frustrating to explain to them)

This sounds like a job for a perl script and a webserver?

I did tell them to look at the errata/security advisories, but they also asked a good followup after looking at the advisories, and that is "what about kernel vs. userland patchlevel?".

And without some decent knowledge of how say, a security issue is fixed, that's not super obvious.

spork_css: FreeBSD userland and kernel are released together? Or do they mean third-party packages?

IIRC that's kind of the point of BSDs vs linux

If you run "freebsd-version -ku" you get an answer for each.

userland (IMO) != ports

I think of those as two distinctive things, at least as far as how freebsd-version reports things (referring to base, non-kernel as "userland").

I'm trying to advocate a bit these days and often get very lost myself with digging up stuff when people have questions.

So, `freebsd-version -k` spits out the same as `uname -r`; I have had *many* contentious discussions where people are asking for things that just don't... apply to bsds

A lot of confusion from the way some things are "official" like the main website, then you have things that are super helpful like freshports, but that's outside the project so...

example:

[spork@pnj ~]$ freebsd-version -ku

14.3-RELEASE-p5

14.3-RELEASE-p6

I know that's fine. A new user might wonder if they're running a vulnerable kernel tho.

I have a stupid queston: did you apply the p6 update and not reboot?

(well, not that fine, I'm terribly out of date)

I think it's known that both don't always increment, it's fine, but it also may confuse people.

But I have no easy way to back up that assertion other than "vibes". :)

Reason I'm asking is $JOB has people freaking out about patching linux kernels for copy.fail, and yet we have machines with (literally) 1537d uptime.

"Apply kernel, reboot. This is not hard."

It would be neat to have a page where you could see what differs between p5 and p6 and I suspect in this case it's that there's a userland fix in -p6 that does not require a kernel update.

FreshPorts is the bestest.

you're biased! :)

I just wish it was either in-house with the project or linked to or whatever.

The difference between p5 and p6 MAY be related to a fix in userland, which did not bump the kernel version. I'm not sure which vulns were fixed by p5/p6, I'm just giving an example

It took me forever to figure out why "pkg search" was omitting tor-browser, and I had to hit some other third party site to see this: portsfallout.com/fallout/1306465

spork_css: I know poudriere build logs and portscout both link to FreshPorts.

I'm just kind of running through things trying to use freebsd.org as sort of a canonical source for other docs, and... that just doesn't work.

spork_css: I don't believe there is going to be a comprehensive answer. The solution usually is "just upgrade" and I'm having a hard time figuring out why that migth be opposed.

spork_css: At freshports.org/www/tor-browser , click on the fallout icon, which does noet show well in dark mode.

That site desperately needs to be more friendly to noobs.

Yeah, I had no idea what the icon meant either or what a "port fallout" was. I don't imagine many people that don't maintain ports do either.

(that site being the main FreeBSD site, not yours)

:-/ I am all for making things more friendly, but, at some point blanket-advice needs to be honored?

spork_css: see freshports.org/faq.php#fallout

spork_css: If you want, get a list of icons on FreshPorts which need a better mouse-hover text. I know pkg-fallout does.

@wavefunction - I get it, but also I love to be able to get an answer, or come up with my own answer, and then be able to back it up with something, which also usually means learning something along the way and I don't know if a new user has any idea where to even look for something that's unofficially official.

dvl: this is all Omar's fault by the way

"why did installing this money manager app delete my tor browser"

and then I got curious

"where do I find which patch-level I should be on?"

and then I got curious again, lol.

Speaking of ports... I am hoping multitail eventually builds successfully. I keep hoping I will find time to look into the new undefined reference error but just haven't had the time.

spork_css: I don't know who Omar is.

you used to work for him!

OH, that Omar.

Like if I'm 5 years behind on what's going on in the world of FreeBSD, he's like 10 years behind.

So blind leading the blind.

In a few months he'll be asking me what etcupdate is. :)

I have a somewhat neurodivergent brain, and questions posed to me like "how do I find the current patchlevel?" get me going because:

a) it's a great question, and it indicates a desire to be up-to-date and safe

b) if that info is not readily available, it makes me wonder if there's some way to make that happen for the benefit of new users

Sadly it also gets me a bit concerned that maybe the project is running out of people to do things that help advocacy, and maybe a little too insular to the point where people running things may not be able to see the project with the view of an outsider.

current patchlevel? I look at the security announcements

I just perform a "env PAGER=cat freebsd-update fetch install" and then look to see if it upgraded or not. (The env is there in case the root shell is csh. The env makes it work for either.)

If something upgraded then I "shutdown -r now" to reboot. If "freebsd-version -kr" produces two different version strings then I reboot. Then "pkg upgrade -y" to finish things off rebooting again if I think it upgraded daemons.

dvl: I totally get it, but also I feel like it's not an awful idea to have the patchlevel right there on the front page next to the list of currently supported versions.

I would vote for the web site saying the current release patch level too. It would be more user friendly.

spork_css: That simple, yet frequently updated, change is a good thing for new-to-the-project people. It's very straight forward. I suggest putting in a PR, saying, I'd like to make this change, please show me how.

There might be a way to automate the update

I confess I never learned git, and I kind of hate it, but I suspect Gedge's idea to source it from there is the direction to go.

I don't want to create an additional problem but "git ls-remote git.freebsd.org/src.git | grep -F refs/tags/release/14.4" looks interesting.

hey folks, does someone run FreeBSD on a KVM virtualized ARM 64 host? Like Ampere Altara? because I have been experiencing random timing issues on one of them, I suspect that the problem will be the generic ARM event timer and the lack of some KVM timer like there are on X86_64 ones

kern.timecounter.hardware: kvmclock <= on X86_64

kern.timecounter.hardware: ARM MPCore Timecounter <= on ARM 64 (KVM virtualized)

not recently, at least

the kinds of issues I experience there is ping localhost is multiple miliseconds and very unstable and also when I do `service jail restart` the jails fail to restart, because vnet has not yet given up on interfaces etc. also when a socket is created like with python socket bind, and then restarted, it fails to bind again, it says that is already in use (but it can not be, since it's already restarted)

... well, in a few seconds then it works ... as if there was a timeout running

hmm, i suspect this may be a few different things

like, socket binding can be notoriously annoying if you don't use SO_REUSEADDR because of exactly that symptom

what I also notice, I have 2 virtual servers like that, and one is with 18 cores and one is with 6 cores. and the less cores one the less issues there are, so I suspect, the more cores (SHARED cores) there are, the bigger the desync among them

we've had a lot of issues with ucred lifetimes off-and-on in the last few years, what version of freebsd?

kevans_: wait - I am starting a python script that does socket bind ... then I am stopping it (no process, nothing) and then I am restarting it again ... and it fails to bind, exits, it takes around 20 seconds and then the script is able to bind again

as in, nothing at all connected to the bound socket in the process you just stopped?

kevans_: the version thing is also interesting, I was using 14 and there the issues were very prevalent, so I went to 15 and it got better, the ping localhost times were more stable, (not 30 ms but 10 ms) and so on

kevans_: well, when nothing bound, the issue does not happen, it goes like - I start it, I bind, then a client comes in, gets connection accepted, then I stop the script and when I want to restart (fast) then it fails to bind

gustik: yeah, this is a TIME_WAIT stall until you can re-bind

kevans_: of course, this is not a realistic scenario, just a testing one, in realistic scenario I would let the script continue running and having threads accept the connections but it is something that does not happen on my bare metal machine for example, also I am not sure if virtualized ones do this

but I will do more investigations

rwp: Nice one

kevans_: maybe - good point - I will investigate that

however, anyone seen long and unstable times on `ping localhost`?

spork_css / rwp I just tooted that git command. See if anyone takes it up.

PING(56=40+8+8 bytes) ::1 --> ::1

16 bytes from ::1, icmp_seq=0 hlim=64 time=6.816 ms

16 bytes from ::1, icmp_seq=1 hlim=64 time=3.936 ms

16 bytes from ::1, icmp_seq=2 hlim=64 time=5.378 ms

16 bytes from ::1, icmp_seq=3 hlim=64 time=3.901 ms

16 bytes from ::1, icmp_seq=4 hlim=64 time=2.716 ms

like this

and the interesting thing is, when I booted that virtual machine in single CPU mode, this issue does not happen, so it looks like that is a CPU core desync

and that got better with 14 -> 15 FreeBSD upgrade

kevans_: is it possible that I am experiencing the TIME_WAIT stall also on jails (restarting) when someone is connected to a service and then I am restarting, it keeps the VNET interface occupied and can not re-bind it to a new started jail, that may be the issue. no?

gustik: i'm not sure how this works on a per-connection basis offhand; if the pcb holds a reference to the ucred and the TIME_WAIT connection holds the pcb alive, it might be the same problem

kevans_: yes

I do think as well, because it is very strikingly similar issue

my drop in solution was to just not do service jail restart, but like service jail stop; sleep 20; service jail start

and/or creating a new epair to give the newly created jail to

yeah, it looks like that would be the case, but I also don't think TIME_WAIT should last quite that long

on PF firwall, the standard time for TIME_WAIT is 45 seconds

and I do see old connections in the table for approximately that long

in freebsd, msl is 30sec and TIME_WAIT is 2*msl

see

so anyway, the point is to be sure to not run into TIME_WAIT FIN_WAIT issues, one needs to give it around a minute

I found this about network socket locking

ah, we're probably an order of magnitude more complex than this these days

yes, looks to be old document

nowadays you have epochs and all kinds of crazy stuff to think about

however, since you seem to understand a lot of the inner workings, can you tell me if I am right in my assesment that the basic problem I am seeing also on the ping localhost times is that we have 1.) multiple CPUs where the stuff get context switched back and forth 2.) those CPU cores are virtualized, so get time shared by other customers (that cloud service) 3.) and since we have no KVM event timer, the

OS (FreeBSD guest) view of where the CPUs are in time is wrong, and thus it comes back at unexpected times?

i am not an expert on the freebsd internals but I don't really think it's possible, irrespective of OS, for the guest OS to have the "wrong view" of "where the cpus are in time"

I would suggest it's more likely you're just seeing abnormally high ping times and some jitter due to oversubscribed CPU

yes

I agree that the guest OS can not see much of the time passing, but maybe that is exactly the problem, my thinking was like this: 1.) I ping a packet to localhost 2.) who responds it? The same CPU or some other one (parallelization in kernel) 3.) even if it turns back right away ... well, on bare metal it would be 0ms, but since we are on a guest, the CPU may have gotten context switched to someone else,

and once the packet gets back the timecounter is bare metal, so it reports several miliseconds gone (maybe KVM clock would substract that time away and report correctly 0ms)

see => kern.timecounter.hardware: ARM MPCore Timecounter

however, thank you kevans_ for your insights because now I am calmed down, I was thinking at first I am experiencing a bug, but slowly I am starting to think that it's just virtualization side-effect

gustik: oh, sorry, one second- missed your message right after my last

and does anyone know if there are plans to implement KVM clock for ARM64 too? man.freebsd.org/cgi/man.cgi?query=k…tion=4&manpath=FreeBSD+16.0-CURRENT <= lol I just noticed that man.cgi has section written in german

yeah, the man.f.o author/maintainer is quite german, afaik (wolfram.schneider.org)

says "The host may be running another guest virtual machine, or a different process. Therefore, the precise timing typically required by interrupts may not always be possible. "

dvl - TY

gustik: my reading is that we'll always enqueue delivery of packets, so the answer of "which cpu does this go to" is dependant on $things and not necessarily the source cpu

always enqueue (in lo(4))

yes, so there is always some latency

so that basically matches my understanding

btw. I just am reading some RedHat documentation about the KVM and I noticed that even IBM Z system does not have a KVM clock, they say it's X86_64 specific

also this is interesting:

"When virtual time adjustment is enabled each time the VM transitions back to running state the VCPU’s virtual counter is updated to ensure stopped time is not counted. This avoids time jumps surprising guest OSes and applications, as long as they use the virtual counter for timekeeping. However it has the side effect of the virtual and physical counters diverging. All timekeeping based on the virtual

counter will appear to lag behind any timekeeping that does not subtract VM stopped time. The guest may resynchronize its virtual counter with other time sources as needed."

sounds familiar

Would FreeBSD be good as a desktop OS over something like linux?

Depends on your needs

I use it as a desktop

For an inexperienced user, I think, no. But for an experienced user, I think, Yes! I use it as my desktop. But I do not do on my desktop any of the things that it is not good at doing.

It's not a gaming system for example.

You can totally play nethack

and tetris

The best game on the system is the C compiler. Change my mind!

rwp, what would you say constitutes an experienced user? I've used diy linux distros like Arch and currently run Void, and I can navigate my way around a unix-like file system reasonably well by this point. Would that be enough or does it go deeper than that?

Also, if it isn't a gaming system why are bsd-games included hmm? Don't think rot13 is fun enough?

kiwikiwi, An experienced user already knows what works and what does not work. If they want to play Steam games on their desktop or not.

The inexperienced user installs onto their only working laptop without any swap and then asks, why can't I hibernate like I used to on my $PREV system?

They then say, I tried to install Steam and I can't get it to work. How does anyone do anything on this system?

I just bought this brand new NVIDIA gpu and I can't get the driver that I downloaded from NVIDIA to work.

rwp, thank you for the info, I think I have a better idea of what you mean now. But since you mentioned it, earlier my laptop died after I put it in hibernation but it didn't restore my PC state after I turned it back on later.

Isn't hibernation supposed to save the PC state even when power is lost? And I should definitely have enough swap space

For hibernation the memory is saved to swap and so one must have enough swap to hold the image. And I think, not sure now, it doesn't work with ephemeral encrypted swap, but not sure.

Suspend resume is often a problem. I have yet to get suspend resume to work on a Thinkpad T480 that I am using.

I've never had a problem with suspend restore, but for what its worth I'm using hybrid-sleep which does both hibernation and suspend. That might be causing some problems

It resumes, mostly, but I cannot get the display back afterward. It is stuck in the black display problem. I have to full reboot to get the display back.

Newcomers to FreeBSD will want to do what they have been doing, because what they have been doing is familiar. So... libvirt for VM management example. It works great on Devuan and other systems. But AFAIK it does not work on FreeBSD. But FreeBSD has podman. So no itch to make libvirt work. But immediately that's a new learning curve.

And now that I think about it I may have to pass on using the OS for desktop just because I'm trying to get into programming and I rely a lot on lazyvim (which I've hear has compatability issues)

i find it hard to believe that a vim-alike would not run on freebsd but I suppose it's possible

I don't have too many issues with learning curves in general, I like learning new things. The only time I've outright easily given up is when I was considering using a status bar reliant on CSS styling and Javascript configuration

or Java, I don't remember

opcode, it's not that it outright refuses to work, but it has specific plugins in the config that need workarounds to function on any of the BSDs

ah

well, I would suggest that tying yourself to a particular editor is a bad idea, but then again i use emacs, so...

kiwikiwi, Don't let me sell FreeBSD short though. I am slowly rolling all of my systems from linux to FreeBSD. FreeBSD is handling the hostile Internet network abuse much better for one. Upgrades are more robust. FreeBSD is just a superior server system.

opcode, I just like it because it retains the light load of stock NeoVim while having the functionality of a regular IDE thanks to plugins that do syntax highlighting and automatic syntax checks

Never tried emacs so I don't know if it has those features though

Emacs is simply the superior system. And it is a pretty good editor too.

i think syntax highlighting is table stakes for editors

for automatic syntax checks emacs uses language server protocol same as anything else these days

rwp, I was already considering it for server stuff in the future because of stuff like ZFS and jails among other things. I'd like to try it eventually but the only server in my house is my dad's old PC running an UNRAID media hub

I think people should never break their only working laptop system playing with a new operating system. They should learn new operating systems in a virtual machine running on their existing system. Then they should find an old castoff system and use it as a bare metal install. And then at some point they know what they need to know. At some point they will know they want to use it everywhere.

Yeah I tried NetBSD on a VM a few weeks ago since it seemed pretty easy to set up. Thought it was nice but package support was a little light for my liking

Otherwise my laptop is staying on Void (for the time being) and my main PC is staying Win10

>> ...and my main PC is staying Win10: So sad. So very sad.

So, like just now I upgraded my main desktop to 15.0R. I happen to have 4x displays on my desktop using the amdgpu driver. I upgraded. I forgot to disable loading the amdgpu driver until I can install the new one. Rebooted. And hung loading the old driver on the new kernel.

D'Oh! But Boot Environments to the rescue! I rebooted to the previous BE. I "bectl mount default /mnt" then "emacs /mnt/etc/rc.conf" commenting out the amdgpu driver. Rebooted. And I am moving forward along the upgrade path again. Just like that. A trivial fix to a simple mistake. Woot!

And then fully upgraded it is not happy. Crashes regarding the amdgpu module. So I booted back to the previous Boot Environment. I'll bectl destroy default to clear the failed attempt. Then will be create default again and it will all be as if I hadn't attempted it.

And can continue debugging and trying things later. It's a good desktop system for certain. But maybe a new user would not appreciate the nuances of it.

rmp, I think there's pros and cons of each of the big OS families. But I don't think the other two could ever make me completely abandon windows. Just about everything major is on there and requires minimal configuration most times, I just don't see myself using wine for everything that isn't native on the unix-likes, and I frankly just don't think the FOSS replacements for stuff like Office and

Photoshop are good enough for me to fully migrate to them.

I'm probably least likely to switch to Mac on a main machine if anything, though I do want a MacBook for my college stuff

Using MS-Windows is better than using Wine. Using a VM to host MS-Windows is better yet. Not using MS-Windows is the best answer! Honestly I only need to use MS for one particular thing and that's loading Jeppesen aviation database updates onto a custom Garmin flash card and that requires MS-Windows with no other option. That's the only thing I have used MS-Windows for in recent memory.

I keep it around because I use Office lots and sometime Photoshop CS6. Otherwise there are a whole lot of old games I play that can't be run without a billion windows-specific codec libraries and DirectX compatibility layers that have problems on wine.

And now you know why I specifically said it's not a gaming machine. Regardless of the peanut gallery all suggesting Adventure, Rogue, Nethack and others!