04:58:36 `at least my pkg got stuck in an infinite loop when doing 'pkg upgrade -f' after a major upgrade 05:02:09 That's not good. Was that on ports? Or the new pkgbase? 05:04:50 haven't switched to pkgbase yet. using 'pkg-static upgrade -f' fixed it, so I considered the problem a user error 05:06:02 Good that you were able to fix it. pkg-static is there for that reason. 05:08:34 Koston: iirc you're not supposted to do that 05:09:28 the wiki does sya 05:09:46 oh "When prompted to run pkg bootstrap -f: do not. " 06:16:29 when multiple sources give conflicting information, I trust the handbook first. but it is peculiar that a patch went into a REL that causes a central system tool to give false information 06:27:09 how do tell pkg-query to list only packages that have a category of lang ? 06:34:27 use %C 06:36:18 also at least zsh includes completion for pkg-query, just hit tab to get a full list of modifiers 09:58:52 . 10:11:14 just ran package updates. something that came through between may 1st and today has started to cause rendering issues with popups that have rounded corners (seen so far in firefox and pavucontrol) on amdgpu 10:11:49 anyone else seen this? I thought xf86-video-amdgpu was a likely culprit, but downgrading doesn't help 10:12:45 just doing some testing and it happens on modesetting DDX as well 10:13:53 there ends up being a black border around the popup, so the transparency isn't being rendered properly or something like that 10:15:48 running picom seemingly resolves the issue but I basically only ever use picom for the functionality that amdgpu's TearFree option provides, so I'd rather not run it if I can avoid it 10:19:25 might try mesa-devel instead of the increasingly outdated version of mesa that FreeBSD ships as the default 10:26:16 my graphics card doesn't even work unless i use the oldest available version of DRM, and that doesn't work on the fork that I prefer 10:35:31 for a while drm-510 was all that worked properly for me, then they decided to drop support for it. wary of having to rely on the oldest DRM since you aren't even guaranteed that it'll be supported for the lifecycle of the major release 10:41:41 currently testing out drm-612 even though it's not in the ports tree yet, which kinda surprises me since it's had a release tagged on git 10:42:12 I did roll back to confirm this issue with rounded corners is unrelated to 612 though 10:45:53 my recollection is that amdgpu out of 515 and 66 don't even load for me 10:50:16 now there is drm-latest-kmod (6.9) available in ports and then 6.12 can be built manually from the git repo 10:50:43 if you're on 5.10... how? are you still on FreeBSD 13? 10:52:13 I think I was on 14 and 15 before i switched back to linux in desperation on that computer 10:52:56 I realized that 5.10 could build on later 14.x by removing the version check in the makefile but it did not go well 10:53:12 ah 10:53:51 I don't remember exactly what issues it had but it was pretty busted 10:56:16 5.15 always caused kernel panics for me, 6.1 through 6.9 had issues with GPU hangs, but then even without a change to the kernel or drivers on my system, something changed in one of the packages that stopped triggering the hangs for me 12:40:48 hi. when a PR is in a state of New => Open, and it's fixed, and I can close the PR because it was created by me, should I close it? 12:42:07 f451: you may want to ask the committer if they plan to MFC it 12:42:22 it's not mfc-able 12:42:53 it was an issue with ntp and freebsd-update and it's fixed (dunno how) 12:44:10 by fixed i mean "the problem isn't happening now" 13:05:05 ivy: i'll err on the safe side ;) 13:26:44 Does anyone here have experience in using kTLS with nginx? I think I've got it working, but when I'm testing performance I am getting much worse results after enabling kTLS. 13:30:32 Enabling kTLS in the Nginx config that is. 13:31:07 <[tj]> what workload are you measuring? 13:31:31 I was using curl to download a 1G file from a webserver running in a VM on my local machine. 13:31:59 I would essentially just do that 5 times and use ministat to get stats for the differences 13:32:11 <[tj]> how long does a download take? 13:33:02 I don't have the exact data in front of me, but with kTLS it was around a second and without it was around 0.6 seconds 13:34:00 <[tj]> I last did benchmarking with ktls 5 years ago so sadly it is all quite fuzzy, but we could do 400gbit with a bit of tuning on our ampere machine 13:34:20 <[tj]> but that is exercising a very different test work load 13:35:19 Right. I also don't have a NIC that supports on NIC kTLS. I'm just using KVM for the VM software running the VM. 13:35:24 <[tj]> 5 probably isn't enough runs to compare, you probably want a larger transfer a second is going to be a noisy duration. What is biting you is probably availability of offload for encrpytion being different between what user space nad the kernel can do in your vm 13:35:31 I'm wanting to write about it, but I'm not sure what I was doing wrong. 13:35:39 <[tj]> I don't have any suggestions for debugging this 13:36:16 <[tj]> https://freebsdfoundation.org/wp-content/uploads/2020/07/TLS-Offload-in-the-Kernel.pdf 13:36:19 Do you think that running on hardware would make a different? 13:36:29 <[tj]> maybe read that and see if john had suggestions for trouble shooting 13:36:49 <[tj]> yeah, I would expect bare metal to be different 13:39:33 Okay, I will try that. Thank you for the help and advice. 13:40:10 <[tj]> no problem I'm happy to help if you have more questions 13:40:39 I appreciate that. It's a cool technology I've heard a lot about and wanted to play with it more. 13:41:11 <[tj]> yeah it is pretty "high end" so you need a good set up to take advantage 13:41:16 Again, I was hoping to eventually write a bit about it on my blog as I haven't seen one uniform place to look for information on it. 13:41:41 Yeah, most workloads I think benefit more from QUIC than kTLS 13:42:02 At least that's the feeling I get 13:58:11 <[tj]> ktls is going to help with many bulk flows where context switches are a bottleneck 14:00:35 That makes sense, I wonder if I would see better numbers trying multiple client connections with bulk data rather than just the one connection repeating 14:04:58 <[tj]> I would use wrk and compare pulling large files with lots of connections 14:05:31 <[tj]> I'd play with this, but I just boxed up the t6 cards to send them to a new home 14:07:13 I think I did also try benchmarking with wrk and ran into similar issues. I'll try seeing if I can put it on my home server rather than a VM and see if it does any better. I don't have the machine in front of me at the moment unfortunately. 14:08:10 kTLS is supported out of the box on fbsd as long as the options are enabled correct? I think nginx also has support from the pkg as well, just have to enable the option. 14:27:35 <[tj]> yeah it should all be there and you can query counters somewhere to verify it is being used 14:29:28 Okay, I will look at it again tonight when I'm in front of the machine. I really appreciate the help; it's a cool technology that has a really interesting use-case. 14:30:14 The Netflix talks on how they use it in their caching servers is what made me really want to play with it, though I'm likely never going to need to send 100+ GB of encrypted traffic down a wire. 14:39:53 not with that attitude 14:40:08 Lol, that's fair enough. 15:28:53 just do a /dev/random-as-a-service, surely someone will then download a 100+ GB stream from you 15:29:20 xD 15:29:26 Heh, that would be a crazy SaaS idea. Entropy as a Service. 15:29:40 Only $10/user/mo 15:32:02 ‰à‰ 15:35:19 fac3: https://www.random.org/ 15:35:47 Amazing 15:36:05 I need to figure out how to sell anything like these guys 15:36:30 and of course I stole that idea: http://phoeagon.github.io/dev-random-as-a-service/ 15:37:02 Glorious. 15:39:50 I had only ever thought about selling email, selling entropy is much more profitable. 15:40:11 A resource that will run out when the universe dies 15:41:39 crafting a curl one-liner to generate random numbers 15:42:10 Right, then exposing an API for people to call those random numbers. 15:42:18 At a charge of course 15:42:35 you get the first 1000 random numbers free 15:43:23 fastcgi script to dd /dev/random 15:43:28 ... 15:43:29 profit! 15:43:49 kinda annoyed I didnt think of that first 15:43:54 Here I thought I needed to learn more about technology to become more financially established. Turns out just selling snake oil does the trick 15:45:46 thats the startup incubator method 15:46:26 pitch to my rich parents and their friends my dumb idea, get some coders on fiverr to knock something together, sell it for $100m 15:47:07 The crazy part is the people that start those companies will open more companies when that one closes 15:47:36 yes 15:47:44 their skill is in relieving rich people of their money 15:48:17 Yeah, knowing people is supposedly the most important skill for career advancement 15:49:01 its why sales people are so annoying 15:49:01 first company I ever worked for was a venture capitalist funded startup by a dynamic duo who did it multiple times. always gunning for some "get rich quick" schemes and did a lot of dirty tricks to eg. lease hardware and never pay a dime for it 15:49:18 other of the two is currently suspected of various business related crimes 15:49:21 Feels grimey 15:49:37 Also doesn't feel sustainable 15:49:49 I used to do data collection/seizure for supreme court appointed liquidators 15:49:52 nothing about any of it was sustainable, no 15:49:53 fraud trials etc 15:50:00 its rampant 15:50:12 its not meant to be sustainable, its a race 15:50:33 get as much money moving around as quickly as possible 15:50:41 disappear with a cut before the music stops 15:51:07 hopefully you'll have flogged everything off to retirement funds/retail investors 15:51:12 Hope you aren't the one holding the bag? 15:51:17 yeah 15:51:24 Brutal 15:51:42 the ones that come undone are the ones who werent quick enough 15:52:16 but look at modern venture capital funding and all of tech is looking like that 15:52:21 "big" tech 15:53:15 i might just be old and jaded though 15:53:20 Unfortunately, and it seems like the products are starting to show their instability more and more these days 15:54:39 That's part of what makes self-hosting so interesting to me, at least then I have some control over the BS that I'm using. 15:54:48 Not very practical for everything though. 15:55:32 depends how stubborn you are 15:55:34 ;) 15:56:45 To some degree. A lot more things are self-hostable than I thought. OAuth for example is something I wouldn't have thought could be somewhat easily done yourself. 15:57:26 Email is another classic one that is easier than people make it sound, but it's still a lot of work. 15:57:39 with some limitations I haven't figured out how to get around yet. 15:57:59 I used to host email for years before "the cloud" 15:58:16 My big issue with self-hosting email is MFA 15:58:31 problem became that office 365 etc $/mailbox was so low it wasnt worth us doing anymore 15:59:06 My company went from on-prem Exchange to O365. It was a lot less maintenance. 15:59:17 yeah I did heaps of those migrations 16:00:17 only thing I'd insist on is backing up the O365 mailboxes regularly 16:00:28 mailboxes are known to just disappear for a while 16:00:30 We do have backups for that. 16:00:55 sometimes they come back 16:00:59 sometimes they dont 16:01:12 and microsoft support is nonexistent 16:02:02 I've not dealt with them directly, but a former co-worker described it as, they'll never respond. One day the issue will be fixed and they will just close the ticket. 16:03:15 its why I dont do it any more. Having my income tied to something I have no control over gets a little old after a while 16:03:36 That's understandable 16:04:18 plus its intensely boring work lol 16:04:40 Also fair 16:05:11 it also depends on how far you're into your career to how much you can insulate yourself from it 16:05:23 i have that luxury now 16:05:37 I wouldn't consider myself terribly far in my career. I'm less than a decade in. 16:05:49 Nothing compared to people who have been working for 20+ years. 16:06:43 26 years and counting. and yeah, most of "big tech" is vaporware. 16:06:56 yeah I'm pushing 30 16:07:17 seen enough new hotness come and go 16:07:45 there are not all that many actual, real innovations made. PostgreSQL is still the big cheese in databases, for very much the same reason FreeBSD is on operating system side. 16:08:13 Yeah, but how many jobs use FreeBSD over Linux. 16:08:25 I know a couple of places that do, but I don't think they are terribly common. 16:08:28 Unfortunately. 16:08:34 it's not unfortunate 16:08:44 @fac3 are you in the US or Europe? 16:08:49 US 16:09:07 in Australia, use of BSDs is almost nonexistent 16:09:10 or very very niche 16:09:26 and i can remember when linux was the same 16:09:41 I could see that. A lot of the job postings for a "Unix Administrator" is almost entirely Linux 16:09:51 Occasionally solaris 16:09:54 so I find the linux groupthink nowadays pretty funny 16:10:13 from the same people who wouldve looked at you funny for not using microsoft stuff 20 years ago 16:10:35 I'm honestly just glad that the hordes of linux dimwits stay on their side of the fence and leave BSD alone 16:10:46 Indeed. I feel like a lot of the time it's glorified docker management. 16:10:50 ever tried reading the linux kernel mailing list? 16:11:11 I've read bits and pieces, but I'm not on it. 16:11:29 I worked on linux stuff for 20+ years and I never really interacted with "the community" 16:11:41 the BSDs are much friendlier in that regard 16:12:02 I've noticed that. 16:12:44 I've also noticed the BSD people tend to be more pragmatic and practical. 16:12:45 oxyhyxo: same. I read LKML for a very short while in my late teens and concluded it was far too juvenile and egocentric off-topic crap 16:12:59 linux has always had its dickhead contingent 16:14:46 not just dickhead either, but a whole lot of politically flavored sense of righteousness. which was always obvious since GNU was and is involved. 16:15:39 As an FSF member (and also FreeBSD user), I apologize for the false righteousness you've experienced. 16:16:19 the leftist linux folk used to diss BSD for welcoming contributions from big corporations. and now? BSD is 100% free of big corp influence, but linux.. hoo boy 16:17:31 I dont want to paint the entire linux community with that brush 16:17:34 that isnt fair 16:17:40 theres a lot of good people 16:17:42 true 16:18:09 but i've just observed that the BSD community seems a bit more civil and approachable generally 16:18:40 as someone whom is still a relatively newcomer to that community 16:18:51 There are good people that use Linux, and pedantic people that use the BSDs 16:21:10 I do generally like using BSDs for projects and hosting though. It's much more sane in a lot of ways 16:21:29 likewise 16:21:32 Docs are better too 16:24:02 what I'm talking about is how the projects are managed. if you have a good idea and present it properly (including submitting a PR with good quality code), you'll get a fair review and get good feedback 16:24:20 but in linux, you might get shot down for a whole number of reasons that have nothing at all to do with your idea or your code quality 16:24:58 Yeah, I've heard about those things happening on the LKML. I've not really tried to submit anything to FreeBSD other than ports though. 16:25:48 It does seem like fbsd is pretty opened to good ideas though. Especially if the person with the idea is submitting the work to do it and it doesn't break a bunch of stuff. 16:26:11 so much code and effort goes to waste with linux, because kernel development is basically a popularity contest decided via shouting match 16:33:38 Indeed. 17:27:34 anybody trying to get NGINX working with PQC key exchange? 17:30:15 I've not tried 17:31:29 What browsers support this? It browser support for it generally available? 17:31:58 It also looks like you have to have OpenSSL 3.2 or newer if you are using TLS 1.3 17:32:02 On the server that is 17:32:06 I realize it is rather a circular dependency and it doesn't matter which one but one side needs to go first. 17:32:22 i got chrome 'working', reporting it okay, but ssllabs.com keep complaining server doesnt support it 17:32:48 results heavily vary afaics, which is odd 17:33:03 its puzzling me 17:33:05 https://blog.nginx.org/blog/pqc-nginx I found this article on it. It doesn't mention FreeBSD though. 17:33:30 yes i have that in a tab open, also https://freebsdfoundation.org/our-work/journal/browser-based-edition/embedded-2/implementing-a-quantum-safe-website/ 17:33:39 which makes me think i set it up properly 17:34:47 also that my chrome on mac states the expected key exchange makes me think it 'works' but the ssllabs.com result says it doesnt, and a few curl attempts from various hosts also report not the expected key exchange value 17:38:50 Apparently my setup supports it, but I didn't do anything special for it. 17:40:49 ssllabs.com scan report its working nicely? 17:41:39 One of my certs is showing an A+ rating and that PQC Key exchange is supported. At least for that cert. I have another one I was going to check against too. 17:41:52 is that a letsencrypt one? 17:41:57 But is it all 100s? 17:42:23 It's let's encrypt cert running on a FreeBSD 15.0 host with nginx as the web server 17:42:37 nginx from ports or pkg? 17:42:41 Pkg 17:43:07 Also, don't know if it matters, I'm using the 6 day cert from Let's encrypt as well. 17:43:16 k, i got mine from ports because of modsecurity, but i can fiddle a bit on a another server with a pkg 17:43:27 Yeah, both of my certs support it. 17:43:36 fac3: i dont know of this setting/cert? how do you configure this? 17:43:49 the 6 day bit& 17:44:36 i dont expect it to change anything, should also work fine on self signed certs 17:44:42 but worth a try 17:44:47 You use the shortlived profile on the cert. checking the man page for certbot should show the flag, but I think it's --profile 17:45:12 If you already have a cert, then you may have to revoke and reissue though. 17:45:23 --preferred-profile shortlived 17:45:29 That's it 17:45:36 There is also a --required-profile 17:45:43 you may want to make that one shortlived as well. 17:46:06 If you are wanting the 6 day certs that is. Some people are hesitant on that idea. 17:46:07 Dang. One public server went from an A+ to A- :( 17:46:27 * iRobbery hands skered a gas canister and a lighter 17:46:32 might as well burn it down :D 17:46:43 I think I get it back to A+ though. 17:46:47 But not all 100s. 17:47:00 Mine isn't all at 100s. 17:47:11 Shame! 17:47:21 Ikr, something to work towards 17:48:10 All 100s I think is more or less dropping support for supported yet old LTS distros. 17:48:25 likely yes 17:48:25 I don't have DNS CAA setup which I think is hurting my score 17:51:46 another nifty site checker is https://pagespeed.web.dev/ for performance testing 17:52:25 i use it, but for real performance i use just curl for timings, but the other recommendations are nice 17:53:00 Would dev tools give better insight on actual timings for specifics on the page. 17:53:20 in browser you mean? 17:53:21 Curl would work for static stuff, but I feel like for dynamics content it would struggle to give any real information. 17:53:25 Yes. 17:54:09 yes with dynamic content there is a fluctuating response, but within a certain margin imho (at least for what is acceptable performance) 17:55:22 shortlived doesnt make difference for ssllabs.com/PQC but i do see tis a better root cert 17:55:41 That's fair. I'm not a webdev so to some degree, I'm not really qualified. 17:56:37 switched to a pkg install now 17:56:41 scanning... 17:56:52 funny how 2 minutes then seem so long 17:57:11 Yeah, I felt like it took a while when I scanned. 17:58:02 but pkg version results the same for me 17:58:44 and like you im using 15.0 17:58:58 Interesting, I'm not sure what I would be doing differently. Are you declaring supported algos? 17:59:05 yes 17:59:47 Do you have HSTS? 18:00:02 Don't really think that would affect anything, but maybe? 18:00:23 https://pastebin.com/b1ugjZqu 18:00:49 any of those settings that you dont use? 18:05:08 fac3: yes i do use hsts 18:05:21 Looking at my nginx.conf, I'm actually the one not declaring the preferred ciphers. 18:05:56 but you do have tls 1.2 and 1.3 enabled? 18:06:34 Yes, along with QUIC 18:06:46 Not sure that makes a difference though. 18:06:54 * iRobbery clicks 'clear cache' and pokes nose 18:08:17 at least i know that claude, nor amazon, nor openai support it in their bots :D 18:08:57 but even with ciphers commented.. it still get the 'does not support PQC key exchange' 18:13:42 okay got it working 18:14:07 and i get some weird deja vu :) 18:14:36 cant have different ssl settings per vhost 18:20:24 * iRobbery undoing 30 testing settings builds :D 18:35:28 For what seems like ages ago, I asked here why console wasn't prompting for GELI on boot and someone indicated that was a limitation of the BIOS boot loader method I was using. After finally getting around to UEFI, I can confirm it works now. To whomever you are, thanks! 18:36:10 fac3: thanks for your time and brain power :) 18:36:26 and now i can also correct myself, that all those bots do support PQC :D 18:36:48 Conker: kevans helped you. 18:37:58 June of last year. 18:40:26 Aha, thank you kevans! and mason :) 19:09:47 I'm back, sorry had a meeting 19:10:21 iRobbery: Did you get it working? 19:12:29 fac3: yes yes, heritage configurations, had their own ssl settings, ciphers and what not. nginx doesnt like that, one setting to rule them all. Did the monk task of migration all those configs to include a single ssl-common 19:12:53 Ahh, well I'm glad you got it working. 19:13:16 Boosting security numbers is always fun 19:14:48 too :) 20:33:51 still have to do a bit of tinkering. Fixed a double / reapeating character output problem, as I guess the BMC is still capturing the console & serial when the boot menu pops up. But for some reason ipmi-console stops output right before login, and if you press a key it says "excess errors received" and closes the connection. Meanwhile ipmitool doesn't suffer from that, and shows the login after initing. 20:33:57 odd 23:07:24 Can anybody explain to me why everything including the base system being managed by pkg is a good thing ? (When does my choice to use freebsd-update stop ?) 23:37:04 I am not an advocate for pkgbase and so I can't. pkg works well for ports though. And I find pkg to be much faster than similar tools in either the Debian-family space or the Redhat-family space.