`at least my pkg got stuck in an infinite loop when doing 'pkg upgrade -f' after a major upgrade

That's not good. Was that on ports? Or the new pkgbase?

haven't switched to pkgbase yet. using 'pkg-static upgrade -f' fixed it, so I considered the problem a user error

Good that you were able to fix it. pkg-static is there for that reason.

Koston: iirc you're not supposted to do that

the wiki does sya

oh "When prompted to run pkg bootstrap -f: do not. "

when multiple sources give conflicting information, I trust the handbook first. but it is peculiar that a patch went into a REL that causes a central system tool to give false information

how do tell pkg-query to list only packages that have a category of lang ?

use %C

also at least zsh includes completion for pkg-query, just hit tab to get a full list of modifiers

.

just ran package updates. something that came through between may 1st and today has started to cause rendering issues with popups that have rounded corners (seen so far in firefox and pavucontrol) on amdgpu

anyone else seen this? I thought xf86-video-amdgpu was a likely culprit, but downgrading doesn't help

just doing some testing and it happens on modesetting DDX as well

there ends up being a black border around the popup, so the transparency isn't being rendered properly or something like that

running picom seemingly resolves the issue but I basically only ever use picom for the functionality that amdgpu's TearFree option provides, so I'd rather not run it if I can avoid it

might try mesa-devel instead of the increasingly outdated version of mesa that FreeBSD ships as the default

my graphics card doesn't even work unless i use the oldest available version of DRM, and that doesn't work on the fork that I prefer

for a while drm-510 was all that worked properly for me, then they decided to drop support for it. wary of having to rely on the oldest DRM since you aren't even guaranteed that it'll be supported for the lifecycle of the major release

currently testing out drm-612 even though it's not in the ports tree yet, which kinda surprises me since it's had a release tagged on git

I did roll back to confirm this issue with rounded corners is unrelated to 612 though

my recollection is that amdgpu out of 515 and 66 don't even load for me

now there is drm-latest-kmod (6.9) available in ports and then 6.12 can be built manually from the git repo

if you're on 5.10... how? are you still on FreeBSD 13?

I think I was on 14 and 15 before i switched back to linux in desperation on that computer

I realized that 5.10 could build on later 14.x by removing the version check in the makefile but it did not go well

ah

I don't remember exactly what issues it had but it was pretty busted

5.15 always caused kernel panics for me, 6.1 through 6.9 had issues with GPU hangs, but then even without a change to the kernel or drivers on my system, something changed in one of the packages that stopped triggering the hangs for me

hi. when a PR is in a state of New => Open, and it's fixed, and I can close the PR because it was created by me, should I close it?

f451: you may want to ask the committer if they plan to MFC it

it's not mfc-able

it was an issue with ntp and freebsd-update and it's fixed (dunno how)

by fixed i mean "the problem isn't happening now"

ivy: i'll err on the safe side ;)

Does anyone here have experience in using kTLS with nginx? I think I've got it working, but when I'm testing performance I am getting much worse results after enabling kTLS.

Enabling kTLS in the Nginx config that is.

what workload are you measuring?

I was using curl to download a 1G file from a webserver running in a VM on my local machine.

I would essentially just do that 5 times and use ministat to get stats for the differences

how long does a download take?

I don't have the exact data in front of me, but with kTLS it was around a second and without it was around 0.6 seconds

I last did benchmarking with ktls 5 years ago so sadly it is all quite fuzzy, but we could do 400gbit with a bit of tuning on our ampere machine

but that is exercising a very different test work load

Right. I also don't have a NIC that supports on NIC kTLS. I'm just using KVM for the VM software running the VM.

5 probably isn't enough runs to compare, you probably want a larger transfer a second is going to be a noisy duration. What is biting you is probably availability of offload for encrpytion being different between what user space nad the kernel can do in your vm

I'm wanting to write about it, but I'm not sure what I was doing wrong.

I don't have any suggestions for debugging this

Do you think that running on hardware would make a different?

maybe read that and see if john had suggestions for trouble shooting

yeah, I would expect bare metal to be different

Okay, I will try that. Thank you for the help and advice.

no problem I'm happy to help if you have more questions

I appreciate that. It's a cool technology I've heard a lot about and wanted to play with it more.

yeah it is pretty "high end" so you need a good set up to take advantage

Again, I was hoping to eventually write a bit about it on my blog as I haven't seen one uniform place to look for information on it.

Yeah, most workloads I think benefit more from QUIC than kTLS

At least that's the feeling I get

ktls is going to help with many bulk flows where context switches are a bottleneck

That makes sense, I wonder if I would see better numbers trying multiple client connections with bulk data rather than just the one connection repeating

I would use wrk and compare pulling large files with lots of connections

I'd play with this, but I just boxed up the t6 cards to send them to a new home

I think I did also try benchmarking with wrk and ran into similar issues. I'll try seeing if I can put it on my home server rather than a VM and see if it does any better. I don't have the machine in front of me at the moment unfortunately.

kTLS is supported out of the box on fbsd as long as the options are enabled correct? I think nginx also has support from the pkg as well, just have to enable the option.

yeah it should all be there and you can query counters somewhere to verify it is being used

Okay, I will look at it again tonight when I'm in front of the machine. I really appreciate the help; it's a cool technology that has a really interesting use-case.

The Netflix talks on how they use it in their caching servers is what made me really want to play with it, though I'm likely never going to need to send 100+ GB of encrypted traffic down a wire.

not with that attitude

Lol, that's fair enough.

just do a /dev/random-as-a-service, surely someone will then download a 100+ GB stream from you

xD

Heh, that would be a crazy SaaS idea. Entropy as a Service.

Only $10/user/mo

‰à‰

fac3: random.org

Amazing

I need to figure out how to sell anything like these guys

and of course I stole that idea: phoeagon.github.io/dev-random-as-a-service

Glorious.

I had only ever thought about selling email, selling entropy is much more profitable.

A resource that will run out when the universe dies

crafting a curl one-liner to generate random numbers

Right, then exposing an API for people to call those random numbers.

At a charge of course

you get the first 1000 random numbers free

fastcgi script to dd /dev/random

...

profit!

kinda annoyed I didnt think of that first

Here I thought I needed to learn more about technology to become more financially established. Turns out just selling snake oil does the trick

thats the startup incubator method

pitch to my rich parents and their friends my dumb idea, get some coders on fiverr to knock something together, sell it for $100m

The crazy part is the people that start those companies will open more companies when that one closes

yes

their skill is in relieving rich people of their money

Yeah, knowing people is supposedly the most important skill for career advancement

its why sales people are so annoying

first company I ever worked for was a venture capitalist funded startup by a dynamic duo who did it multiple times. always gunning for some "get rich quick" schemes and did a lot of dirty tricks to eg. lease hardware and never pay a dime for it

other of the two is currently suspected of various business related crimes

Feels grimey

Also doesn't feel sustainable

I used to do data collection/seizure for supreme court appointed liquidators

nothing about any of it was sustainable, no

fraud trials etc

its rampant

its not meant to be sustainable, its a race

get as much money moving around as quickly as possible

disappear with a cut before the music stops

hopefully you'll have flogged everything off to retirement funds/retail investors

Hope you aren't the one holding the bag?

yeah

Brutal

the ones that come undone are the ones who werent quick enough

but look at modern venture capital funding and all of tech is looking like that

"big" tech

i might just be old and jaded though

Unfortunately, and it seems like the products are starting to show their instability more and more these days

That's part of what makes self-hosting so interesting to me, at least then I have some control over the BS that I'm using.

Not very practical for everything though.

depends how stubborn you are

;)

To some degree. A lot more things are self-hostable than I thought. OAuth for example is something I wouldn't have thought could be somewhat easily done yourself.

Email is another classic one that is easier than people make it sound, but it's still a lot of work.

with some limitations I haven't figured out how to get around yet.

I used to host email for years before "the cloud"

My big issue with self-hosting email is MFA

problem became that office 365 etc $/mailbox was so low it wasnt worth us doing anymore

My company went from on-prem Exchange to O365. It was a lot less maintenance.

yeah I did heaps of those migrations

only thing I'd insist on is backing up the O365 mailboxes regularly

mailboxes are known to just disappear for a while

We do have backups for that.

sometimes they come back

sometimes they dont

and microsoft support is nonexistent

I've not dealt with them directly, but a former co-worker described it as, they'll never respond. One day the issue will be fixed and they will just close the ticket.

its why I dont do it any more. Having my income tied to something I have no control over gets a little old after a while

That's understandable

plus its intensely boring work lol

Also fair

it also depends on how far you're into your career to how much you can insulate yourself from it

i have that luxury now

I wouldn't consider myself terribly far in my career. I'm less than a decade in.

Nothing compared to people who have been working for 20+ years.

26 years and counting. and yeah, most of "big tech" is vaporware.

yeah I'm pushing 30

seen enough new hotness come and go

there are not all that many actual, real innovations made. PostgreSQL is still the big cheese in databases, for very much the same reason FreeBSD is on operating system side.

Yeah, but how many jobs use FreeBSD over Linux.

I know a couple of places that do, but I don't think they are terribly common.

Unfortunately.

it's not unfortunate

@fac3 are you in the US or Europe?

US

in Australia, use of BSDs is almost nonexistent

or very very niche

and i can remember when linux was the same

I could see that. A lot of the job postings for a "Unix Administrator" is almost entirely Linux

Occasionally solaris

so I find the linux groupthink nowadays pretty funny

from the same people who wouldve looked at you funny for not using microsoft stuff 20 years ago

I'm honestly just glad that the hordes of linux dimwits stay on their side of the fence and leave BSD alone

Indeed. I feel like a lot of the time it's glorified docker management.

ever tried reading the linux kernel mailing list?

I've read bits and pieces, but I'm not on it.

I worked on linux stuff for 20+ years and I never really interacted with "the community"

the BSDs are much friendlier in that regard

I've noticed that.

I've also noticed the BSD people tend to be more pragmatic and practical.

oxyhyxo: same. I read LKML for a very short while in my late teens and concluded it was far too juvenile and egocentric off-topic crap

linux has always had its dickhead contingent

not just dickhead either, but a whole lot of politically flavored sense of righteousness. which was always obvious since GNU was and is involved.

As an FSF member (and also FreeBSD user), I apologize for the false righteousness you've experienced.

the leftist linux folk used to diss BSD for welcoming contributions from big corporations. and now? BSD is 100% free of big corp influence, but linux.. hoo boy

I dont want to paint the entire linux community with that brush

that isnt fair

theres a lot of good people

true

but i've just observed that the BSD community seems a bit more civil and approachable generally

as someone whom is still a relatively newcomer to that community

There are good people that use Linux, and pedantic people that use the BSDs

I do generally like using BSDs for projects and hosting though. It's much more sane in a lot of ways

likewise

Docs are better too

what I'm talking about is how the projects are managed. if you have a good idea and present it properly (including submitting a PR with good quality code), you'll get a fair review and get good feedback

but in linux, you might get shot down for a whole number of reasons that have nothing at all to do with your idea or your code quality

Yeah, I've heard about those things happening on the LKML. I've not really tried to submit anything to FreeBSD other than ports though.

It does seem like fbsd is pretty opened to good ideas though. Especially if the person with the idea is submitting the work to do it and it doesn't break a bunch of stuff.

so much code and effort goes to waste with linux, because kernel development is basically a popularity contest decided via shouting match

Indeed.

anybody trying to get NGINX working with PQC key exchange?

I've not tried

What browsers support this? It browser support for it generally available?

It also looks like you have to have OpenSSL 3.2 or newer if you are using TLS 1.3

On the server that is

I realize it is rather a circular dependency and it doesn't matter which one but one side needs to go first.

i got chrome 'working', reporting it okay, but ssllabs.com keep complaining server doesnt support it

results heavily vary afaics, which is odd

its puzzling me

blog.nginx.org/blog/pqc-nginx I found this article on it. It doesn't mention FreeBSD though.

yes i have that in a tab open, also freebsdfoundation.org/our-work/jour…implementing-a-quantum-safe-website

which makes me think i set it up properly

also that my chrome on mac states the expected key exchange makes me think it 'works' but the ssllabs.com result says it doesnt, and a few curl attempts from various hosts also report not the expected key exchange value

Apparently my setup supports it, but I didn't do anything special for it.

ssllabs.com scan report its working nicely?

One of my certs is showing an A+ rating and that PQC Key exchange is supported. At least for that cert. I have another one I was going to check against too.

is that a letsencrypt one?

But is it all 100s?

It's let's encrypt cert running on a FreeBSD 15.0 host with nginx as the web server

nginx from ports or pkg?

Pkg

Also, don't know if it matters, I'm using the 6 day cert from Let's encrypt as well.

k, i got mine from ports because of modsecurity, but i can fiddle a bit on a another server with a pkg

Yeah, both of my certs support it.

fac3: i dont know of this setting/cert? how do you configure this?

the 6 day bit&

i dont expect it to change anything, should also work fine on self signed certs

but worth a try

You use the shortlived profile on the cert. checking the man page for certbot should show the flag, but I think it's --profile

If you already have a cert, then you may have to revoke and reissue though.

--preferred-profile shortlived

That's it

There is also a --required-profile

you may want to make that one shortlived as well.

If you are wanting the 6 day certs that is. Some people are hesitant on that idea.

Dang. One public server went from an A+ to A- :(

might as well burn it down :D

I think I get it back to A+ though.

But not all 100s.

Mine isn't all at 100s.

Shame!

Ikr, something to work towards

All 100s I think is more or less dropping support for supported yet old LTS distros.

likely yes

I don't have DNS CAA setup which I think is hurting my score

another nifty site checker is pagespeed.web.dev for performance testing

i use it, but for real performance i use just curl for timings, but the other recommendations are nice

Would dev tools give better insight on actual timings for specifics on the page.

in browser you mean?

Curl would work for static stuff, but I feel like for dynamics content it would struggle to give any real information.

Yes.

yes with dynamic content there is a fluctuating response, but within a certain margin imho (at least for what is acceptable performance)

shortlived doesnt make difference for ssllabs.com/PQC but i do see tis a better root cert

That's fair. I'm not a webdev so to some degree, I'm not really qualified.

switched to a pkg install now

scanning...

funny how 2 minutes then seem so long

Yeah, I felt like it took a while when I scanned.

but pkg version results the same for me

and like you im using 15.0

Interesting, I'm not sure what I would be doing differently. Are you declaring supported algos?

yes

Do you have HSTS?

Don't really think that would affect anything, but maybe?

any of those settings that you dont use?

fac3: yes i do use hsts

Looking at my nginx.conf, I'm actually the one not declaring the preferred ciphers.

but you do have tls 1.2 and 1.3 enabled?

Yes, along with QUIC

Not sure that makes a difference though.

at least i know that claude, nor amazon, nor openai support it in their bots :D

but even with ciphers commented.. it still get the 'does not support PQC key exchange'

okay got it working

and i get some weird deja vu :)

cant have different ssl settings per vhost

For what seems like ages ago, I asked here why console wasn't prompting for GELI on boot and someone indicated that was a limitation of the BIOS boot loader method I was using. After finally getting around to UEFI, I can confirm it works now. To whomever you are, thanks!

fac3: thanks for your time and brain power :)

and now i can also correct myself, that all those bots do support PQC :D

Conker: kevans helped you.

June of last year.

Aha, thank you kevans! and mason :)

I'm back, sorry had a meeting

iRobbery: Did you get it working?

fac3: yes yes, heritage configurations, had their own ssl settings, ciphers and what not. nginx doesnt like that, one setting to rule them all. Did the monk task of migration all those configs to include a single ssl-common

Ahh, well I'm glad you got it working.

Boosting security numbers is always fun

too :)

still have to do a bit of tinkering. Fixed a double / reapeating character output problem, as I guess the BMC is still capturing the console & serial when the boot menu pops up. But for some reason ipmi-console stops output right before login, and if you press a key it says "excess errors received" and closes the connection. Meanwhile ipmitool doesn't suffer from that, and shows the login after initing.

odd

Can anybody explain to me why everything including the base system being managed by pkg is a good thing ? (When does my choice to use freebsd-update stop ?)

I am not an advocate for pkgbase and so I can't. pkg works well for ports though. And I find pkg to be much faster than similar tools in either the Debian-family space or the Redhat-family space.