11:17:47 indeed 11:17:55 DNSSEC validation error on the de zone 11:18:13 knocked out a good part of the XMPP network lol 11:19:04 I was running Cavium/ThunderX (aarch64) on 13.5 and upgraded to 15.0, since 13.5 is out of support now. After booting 15.0 on these machines, they seem to not discover some PCIe devices anymore, e.g. and foremost the SOC NIC and a NIC in a PCIe slot (em/igb). So I basically have lost network connectivity and can access the boxes through serial. 11:19:25 Has anyone experienced similar behaviour on ThunderX? 11:20:37 polarian: that was incredible. just busting an entire root level domain in one fell swoop. 11:20:45 lol 11:20:51 In dmesg I see a lot of "pcib0: pci_host_generic_core_alloc_resource FAIL" messages, devices they have been discovered do not show up anymore 11:20:51 German efficiency eh? 11:21:07 This is aarch64 GENERIC 11:21:11 why take out one zone, when you can take out the entire de zone :p 11:22:13 I frankly don't know specifics of how DNSSEC works, just the difference is I don't maintain a root domain (or any domain beyond my personal one) 15:31:09 is fcgiwrap still the preferred way to convert a cgi executable to fastcgi? i only wonder because the source hasn't been updated for over 10 years... (i want to put a cgi script in a jail, and access it from the host via fcgi, without having to put an entire web server in the jail) 15:34:36 has the fastcgi protocol drastically changed in the last ten years? 15:35:05 if the code is complete and watertight (I do doubt it is watertight, though) there's no need to update it except for build system changes 15:35:51 LXGHTNXNG: no, but for example, is it not affected by HTTPoxy? does it just assume the web server will remove the header? 15:40:40 affected by which? i'm sorry 15:40:59 https://httpoxy.org/ 15:42:57 php is fastcgi 15:45:06 right click doesn't work on my desktop. i don't know if it's a software update or my hardware's on the fritz. i miss when software didn't get worse every update 15:46:12 spork_css, thank you for your assistance yesterday Defenso-QTH. My issue with pf when running VPN (openvpn) is not resolved. It was all due to ipv6 issues in routing when tun0 interface was up. My restrictive rules regarding DNS-leak made resolve go into loop/timeout. Simple solution, disable ipv6 on my system all together. Again thanks 15:46:45 that... sounds like killing a single cat with a nuclear bomb 15:47:18 linXea: when you vpn with ipv4 you nat 15:47:28 on ipv6 you dont need to nat 15:48:11 i found wireguard to be much easier to configure than openvpn, if you control the gateway 15:48:57 well, it created a resolve issue. I am no expert in VPN/networking. I would prefer wireguard, but my provider does not have that option available 15:49:17 created a resolve issue how? you were trying to contact the resolver over the VPN, and couldn't? 15:50:14 I got a 15s delay when browing, just like DNS seerver timed out, and tried next one 15:50:42 but only with some websites, not all 15:50:47 is your DNS server reachable over the VPN? is your browser set to use system DNS rather than DOH (many, many browsers now use DOH rather than /etc/resolv.conf) 15:51:22 according to $ dig cmd, everything looked in order, ping as well 15:51:46 however, disable ipv6, browsing is as fast as without VPN running. 15:52:18 note that the issue only occured when pf was running. 15:52:20 do you have IPv6 over the VPN? if not, and if you are preventing leaks, and if you have IPv6 addresses, you may be catching IPv6 addresses that, when the VPN is running, are spurious 15:52:33 on DNS lookups 15:52:35 also 15:52:49 is your web browser set up to use system DNS, or DNS over HTTP? 15:53:15 web browsers now quite commonly ship set to use DOH. This is a bane of users and admins alike. 15:53:50 running firefox, not really sure... I assumed it resolved to resolve.conf 15:53:58 firefox quite commonly uses DOH 15:54:08 check your settings, it's named some stupid misleading nonsense, let me check 15:55:05 I found it... Firefox decide what to use., 15:55:26 turn that to always system DNS 15:55:40 then try browsing with your leak stopping techniques on and IPv6 not specifically disabled 15:55:42 according to standard protection. That would indeed explain the dubious behavior on only some sites 15:57:00 good catch.. I had no idea.. however that explain why my testing of current routing (netstat -r, dig etc.) did work 15:57:15 because your setup was correct, but your browser was working around it 15:58:02 if you are directing your DNS over the VPN make sure you are connecting to the VPN without needing a DNS name, in case you get disconnected and your leak stop techniques then stop you from making a DNS query 15:58:24 ... it's always the simple thing... At least I got to enhance my pf.conf and clean it up 15:58:40 this isn't a simple thing. it's a violation of the principle of least surprise 15:59:37 programs are supposed to not override your DNS without a very good reason, or your say-so. browsers think they're better than you 16:01:38 now I got a much better understanding of the issue and can sole the issue the correct way. Disabling ipv6 is pretty much a dirty hack in my book, since a lot more services rely on ipv6 16:01:50 yep 16:04:08 nevertheless, great knowledge base in support-forums like this helps a lot. 17:34:49 maybe we need a better browser... gtk2 or gtk3 based, non-flatty UI like original firefox, built-in "noscript" capability, and easy default settings (NO strong-armibng to slurpy DNS servers) 17:35:11 shbrngdo: Servo? 17:35:34 I'd baseit on webkit, and allow you to pretend you're the latest chromium 17:36:12 'Sdeervo' - is that in ports? 17:36:32 'Servo' I mean 17:43:01 how about curl |less in a loop and parse html in your head? 17:50:15 I was thinking something more like the "minimalist browser" which you can implement using webkit and a 20 lkine python script, but with some really useful built-in features and an easy way to bypass the stupid compastibility "your browser is not supported" filters 17:50:46 except the outward appearane is old-school pre-chrome 3D sjeuomorphic 17:51:28 looks lije servo is not in an obvious place on freshports - I don't wanna create a ^&*( login 17:52:33 shbrngdo: sorry for the inconvenience. You can also search with a search engine: site:freshports.org lije 17:52:56 shbrngdo: But it's not there. 17:53:22 true but it looks like thats maybe blocked now, or are the major search engines being allowed to crawl it? 17:54:01 I really like qutebrowser 17:55:08 curl | less comes as close second 17:55:08 in theory with webkit it should be easy to bet basic functionality. The hard pat is the UI around it to do the cool stuff 17:56:14 yeah libcurl for sure if you do a webkit-based browser and want to filter things like 3rd party scripts and dumpable cookies 17:56:19 shbrngdo: Search engines are not blocked, just certain webpages if not logged in. https://mastodon.social/@FreshPorts has some posts about it. but feel free to ask. 17:56:43 oh ok - thanks for clarifying. 17:57:14 shbrngdo: I just did a test, and it found the port: site:freshports.org anvil -> https://www.freshports.org/sysutils/anvil 17:58:40 there are a lot of "penetrator" bots running inthe last couple of months, doing things like SYN floods on 443. Also recursive DNS queries [the (old?) default named config allowed them from outside; I had to explicitly disable them to avoid it as a DDoS vector] 17:59:45 oh ok - good - yeah finding something NOT there gave me ambiguous results 18:00:34 but there's a comment on freshports about bot activity explaining why you need a login now. 18:01:51 shbrngdo: Based on our discussion, I added another announcement line to the top of the website, suggesting: site:www.freshports.org 18:14:51 excellent! 18:18:32 This bot DDoS chaos scanning is getting WAY out of control. 18:38:40 I blocked (probably) sll of Brazil in my ipfw settings, and a number of IP ranges in Uraguay. The ISP complsint mails bounce. It goes on completely unchecked. 18:40:27 started using ipfw's "log" feasture, would log SYN flood attempts for 5 minutes, summarize list with grep + awk + sort and then add to 'list 1' in ipfw 18:40:56 Now I want to hug all the creatures from there who now maybe can't access services they need, talk to friends of theirs, due to ISP incompetence 18:40:58 set 'em up as /24's and there are probably a hundred entries in that list. 18:41:02 sorry, I'm a sentimental 18:41:55 I get it. nlocking legit traffic too. Most people can't do that. Maybe your friends can pressure government to END this? 18:45:27 This is gonna sound real dumb, but I'm-a ask it: if you have a full git-clone of the ports tree, do we have a nice perl/python/whatever script to generate the same data aswhat freshports shows for us? 18:46:16 wavefunction: There is the INDEX file, which can be fetched. 18:46:47 None of my friends have influence, and government at best does not understand the situation 18:47:01 (if they're anything like here in Canada) 18:47:41 wavefunction: I cannot recall where that comes from. 18:48:25 dvl: you mean make index ? 18:48:40 nimaje: Yes, and it can be fetched instead of create locally I think. 18:49:03 wavefunction: login-to-search is blocking you? Sorry. 18:54:47 wavefunction: In short, that won't give you what FreshPorts has, but it is a list of the ports. 19:02:43 dvl: No, I can still log in. I'm just wondering aloud if there are options to distribute / replicate / localize what is a central risk that every LLM and spammer wants 19:11:31 wavefunction: There is no list. The LLM's and spammers want literally *EVERYTHING*. They try to access stuff that doesn't even exist. Just a non-stop barrage of HTTP GET's. 100's of thousands (sometimes per minute). 19:12:30 ek: Right -- I've had to fight it myself, once bots figured out I had repo mirrors publicly available. 19:12:53 Yeah. That's a problem and it's sad. 19:13:56 I did incorporate go-anubis (dvl and I worked on it a bit together) and it has improved things quite a bit. 19:14:16 I also use blocklistd as well as fail2ban. 19:15:23 So this was more of a broad complaint than "oh god they're hitting " 19:15:47 Not trying to minimize, just want to make sure I understand. 19:15:59 It's a very broad complaint. And, one that's more than warranted. It's a serious pain to deal with. 19:40:27 Layla walk time. 20:09:48 dvl: Have fun! 20:10:10 Hopefully, the weather there is better than it is here (although, we did need the moisture.) 20:10:12 ek: Yes, I meant that for the work channel ;) 20:10:20 Ah. Gotcha'! 22:46:50 hmm 22:47:19 been working on a terminal server 22:47:23 and I am really disappointed 22:47:33 it doesnt seem I can output the FDE prompt to the terminal server 22:47:37 https://wiki.freebsd.org/SerialConsole 22:47:41 this is loaded AFTER 22:47:44 plus this doesnt even work anyways 22:47:47 only getty works :/ 22:56:03 https://www.reddit.com/r/OPNsenseFirewall/comments/136xm2e/enter_geli_password_through_serial_console_on_uefi/ 22:56:06 this is unhelpful too 22:59:47 https://lists.freebsd.org/archives/freebsd-hackers/2022-August/001420.html 22:59:50 seems like this isnt possible :/ 23:05:00 I guess pikvm is possible, but a lot of work, not as useful as being able to do it over serial