indeed

DNSSEC validation error on the de zone

knocked out a good part of the XMPP network lol

I was running Cavium/ThunderX (aarch64) on 13.5 and upgraded to 15.0, since 13.5 is out of support now. After booting 15.0 on these machines, they seem to not discover some PCIe devices anymore, e.g. and foremost the SOC NIC and a NIC in a PCIe slot (em/igb). So I basically have lost network connectivity and can access the boxes through serial.

Has anyone experienced similar behaviour on ThunderX?

polarian: that was incredible. just busting an entire root level domain in one fell swoop.

lol

In dmesg I see a lot of "pcib0: pci_host_generic_core_alloc_resource FAIL" messages, devices they have been discovered do not show up anymore

German efficiency eh?

This is aarch64 GENERIC

why take out one zone, when you can take out the entire de zone :p

I frankly don't know specifics of how DNSSEC works, just the difference is I don't maintain a root domain (or any domain beyond my personal one)

is fcgiwrap still the preferred way to convert a cgi executable to fastcgi? i only wonder because the source hasn't been updated for over 10 years... (i want to put a cgi script in a jail, and access it from the host via fcgi, without having to put an entire web server in the jail)

has the fastcgi protocol drastically changed in the last ten years?

if the code is complete and watertight (I do doubt it is watertight, though) there's no need to update it except for build system changes

LXGHTNXNG: no, but for example, is it not affected by HTTPoxy? does it just assume the web server will remove the header?

affected by which? i'm sorry

php is fastcgi

right click doesn't work on my desktop. i don't know if it's a software update or my hardware's on the fritz. i miss when software didn't get worse every update

spork_css, thank you for your assistance yesterday Defenso-QTH. My issue with pf when running VPN (openvpn) is not resolved. It was all due to ipv6 issues in routing when tun0 interface was up. My restrictive rules regarding DNS-leak made resolve go into loop/timeout. Simple solution, disable ipv6 on my system all together. Again thanks

that... sounds like killing a single cat with a nuclear bomb

linXea: when you vpn with ipv4 you nat

on ipv6 you dont need to nat

i found wireguard to be much easier to configure than openvpn, if you control the gateway

well, it created a resolve issue. I am no expert in VPN/networking. I would prefer wireguard, but my provider does not have that option available

created a resolve issue how? you were trying to contact the resolver over the VPN, and couldn't?

I got a 15s delay when browing, just like DNS seerver timed out, and tried next one

but only with some websites, not all

is your DNS server reachable over the VPN? is your browser set to use system DNS rather than DOH (many, many browsers now use DOH rather than /etc/resolv.conf)

according to $ dig cmd, everything looked in order, ping as well

however, disable ipv6, browsing is as fast as without VPN running.

note that the issue only occured when pf was running.

do you have IPv6 over the VPN? if not, and if you are preventing leaks, and if you have IPv6 addresses, you may be catching IPv6 addresses that, when the VPN is running, are spurious

on DNS lookups

also

is your web browser set up to use system DNS, or DNS over HTTP?

web browsers now quite commonly ship set to use DOH. This is a bane of users and admins alike.

running firefox, not really sure... I assumed it resolved to resolve.conf

firefox quite commonly uses DOH

check your settings, it's named some stupid misleading nonsense, let me check

I found it... Firefox decide what to use.,

turn that to always system DNS

then try browsing with your leak stopping techniques on and IPv6 not specifically disabled

according to standard protection. That would indeed explain the dubious behavior on only some sites

good catch.. I had no idea.. however that explain why my testing of current routing (netstat -r, dig etc.) did work

because your setup was correct, but your browser was working around it

if you are directing your DNS over the VPN make sure you are connecting to the VPN without needing a DNS name, in case you get disconnected and your leak stop techniques then stop you from making a DNS query

... it's always the simple thing... At least I got to enhance my pf.conf and clean it up

this isn't a simple thing. it's a violation of the principle of least surprise

programs are supposed to not override your DNS without a very good reason, or your say-so. browsers think they're better than you

now I got a much better understanding of the issue and can sole the issue the correct way. Disabling ipv6 is pretty much a dirty hack in my book, since a lot more services rely on ipv6

yep

nevertheless, great knowledge base in support-forums like this helps a lot.

maybe we need a better browser... gtk2 or gtk3 based, non-flatty UI like original firefox, built-in "noscript" capability, and easy default settings (NO strong-armibng to slurpy DNS servers)

shbrngdo: Servo?

I'd baseit on webkit, and allow you to pretend you're the latest chromium

'Sdeervo' - is that in ports?

'Servo' I mean

how about curl |less in a loop and parse html in your head?

I was thinking something more like the "minimalist browser" which you can implement using webkit and a 20 lkine python script, but with some really useful built-in features and an easy way to bypass the stupid compastibility "your browser is not supported" filters

except the outward appearane is old-school pre-chrome 3D sjeuomorphic

looks lije servo is not in an obvious place on freshports - I don't wanna create a ^&*( login

shbrngdo: sorry for the inconvenience. You can also search with a search engine: site:freshports.org lije

shbrngdo: But it's not there.

true but it looks like thats maybe blocked now, or are the major search engines being allowed to crawl it?

I really like qutebrowser

curl | less comes as close second

in theory with webkit it should be easy to bet basic functionality. The hard pat is the UI around it to do the cool stuff

yeah libcurl for sure if you do a webkit-based browser and want to filter things like 3rd party scripts and dumpable cookies

shbrngdo: Search engines are not blocked, just certain webpages if not logged in. mastodon.social/@FreshPorts has some posts about it. but feel free to ask.

oh ok - thanks for clarifying.

shbrngdo: I just did a test, and it found the port: site:freshports.org anvil -> freshports.org/sysutils/anvil

there are a lot of "penetrator" bots running inthe last couple of months, doing things like SYN floods on 443. Also recursive DNS queries [the (old?) default named config allowed them from outside; I had to explicitly disable them to avoid it as a DDoS vector]

oh ok - good - yeah finding something NOT there gave me ambiguous results

but there's a comment on freshports about bot activity explaining why you need a login now.

shbrngdo: Based on our discussion, I added another announcement line to the top of the website, suggesting: site:www.freshports.org

excellent!

This bot DDoS chaos scanning is getting WAY out of control.

I blocked (probably) sll of Brazil in my ipfw settings, and a number of IP ranges in Uraguay. The ISP complsint mails bounce. It goes on completely unchecked.

started using ipfw's "log" feasture, would log SYN flood attempts for 5 minutes, summarize list with grep + awk + sort and then add to 'list 1' in ipfw

Now I want to hug all the creatures from there who now maybe can't access services they need, talk to friends of theirs, due to ISP incompetence

set 'em up as /24's and there are probably a hundred entries in that list.

sorry, I'm a sentimental

I get it. nlocking legit traffic too. Most people can't do that. Maybe your friends can pressure government to END this?

This is gonna sound real dumb, but I'm-a ask it: if you have a full git-clone of the ports tree, do we have a nice perl/python/whatever script to generate the same data aswhat freshports shows for us?

wavefunction: There is the INDEX file, which can be fetched.

None of my friends have influence, and government at best does not understand the situation

(if they're anything like here in Canada)

wavefunction: I cannot recall where that comes from.

dvl: you mean make index ?

nimaje: Yes, and it can be fetched instead of create locally I think.

wavefunction: login-to-search is blocking you? Sorry.

wavefunction: In short, that won't give you what FreshPorts has, but it is a list of the ports.

dvl: No, I can still log in. I'm just wondering aloud if there are options to distribute / replicate / localize what is a central risk that every LLM and spammer wants

wavefunction: There is no list. The LLM's and spammers want literally *EVERYTHING*. They try to access stuff that doesn't even exist. Just a non-stop barrage of HTTP GET's. 100's of thousands (sometimes per minute).

ek: Right -- I've had to fight it myself, once bots figured out I had repo mirrors publicly available.

Yeah. That's a problem and it's sad.

I did incorporate go-anubis (dvl and I worked on it a bit together) and it has improved things quite a bit.

I also use blocklistd as well as fail2ban.

So this was more of a broad complaint than "oh god they're hitting <SITE>"

Not trying to minimize, just want to make sure I understand.

It's a very broad complaint. And, one that's more than warranted. It's a serious pain to deal with.

Layla walk time.

dvl: Have fun!

Hopefully, the weather there is better than it is here (although, we did need the moisture.)

ek: Yes, I meant that for the work channel ;)

Ah. Gotcha'!

hmm

been working on a terminal server

and I am really disappointed

it doesnt seem I can output the FDE prompt to the terminal server

this is loaded AFTER

plus this doesnt even work anyways

only getty works :/

this is unhelpful too

seems like this isnt possible :/

I guess pikvm is possible, but a lot of work, not as useful as being able to do it over serial