Just released a fix for #OpenSMTPD filter-spf on OpenBSD 7.9. Apparently pledge dns needs to be accompanied with rpath /etc/resolv.conf.

In case you like to do DNS lookups using #Go on #OpenBSD with pledge you have to set GODEBUG=netdns=cgo or compile using go build -tags netcgo ...

I.e. to make my honk resolve hostnames again without recompiling I have set the following:

$ cat /etc/login.conf.d/honk
honk:\
	:setenv=GODEBUG=netdns=cgo:\
	:tc=daemon:

Happy to see symon v2.91 is released and available in #openbsd current! 🎉

• modernized mbuf and smart probes
• new wg(4) probe
• new time probe to measure cpu usage of symon itself
• tight pledge and unveil for symux(8)
• unveil for symon(8)
• removed old 2001-2004 era ifdefs

mbuf:
- model after systat(1) mbufs
- add missing cluster mcl2k2
- big performance improvements
- stricter sysctl error handling
- remove ifdef KERN_MBSTAT (defined since OpenBSD 3.2)

smart:
- support running unpriviledged
- support disklabel UIDs using opendev(3)
- use xreallocarray instead of xrealloc
- stricter ioctl error check

pkg_add symon symux

Call for testing: OpenBSD vmm(4)/vmd(8) fd-ification #openbsd
https://undeadly.org/cgi?action=article;sid=20260804054218

A few people have asked me recently about how OpenSSH sshd implements privilege separation after the changes of the last couple of years, such as splitting sshd into multiple binaries.

I finally got around to writing it up - please take a look if you're curious.

https://github.com/openssh/openssh-portable/blob/master/README.privsep

@damienmiller is there a place I can read or watch about the rationale of openssh replacing sntrup761x25519-sha51 with mlkem768x25519-sha256 as the default kem?

update regarding my librewolf port for OpenBSD: it works perfectly. i screwed up the branding, so the menu icons (e.g. lxqt menu) say firefox. easy fix (just have to enable librewolf branding in the build process; accidentally removed it earlier)

https://codeberg.org/vimuser/librewolf-openbsd-port

will update for openbsd 7.9 soon (current package is 7.8) and then also for CURRENT. debating whether or not to maintain a temporary package repo, until openbsd merges it. i plan on sending to the openbsd ports team for review.

My greatest professional accomplishment of the year: I got my exec & manager teammates saying "point positive," a term from whitewater rafting and kayaking.

Meaning: when facing hazards, point people toward where to go/what to do, rather than drawing attention to everything to avoid.

2/ Zcash is here 😍

In Cake Wallet, Zcash is implemented the right way: shielded by default, with privacy built in, not optional. You get the best privacy that Zcash has to offer, with no extra hoops to jump through or manual steps to take. A modern, open-source experience, no waitlist required 😉

Where: #Berlin
When: March 19-23

Don't miss this great conference on the impact of #WikiLeaks organised by #DisruptionLab and #TatianaBazzichelli

https://www.disruptionlab.org/exposing-crimes-is-not-a-crime

#honkers ; does anybody know what happened to Ted?

Also does anybody have an up-to-date clone of honk? it appears the version i'm running is newer than the version i have the source for and the wayback machine doesn't have consistent snapshots of the source :<

@GrapheneOS any idea if a recent Pixel with your OS is vulnerable to any of the new airsnitch attacks?

We found that Wi-Fi client isolation can often be bypassed. This allows an attacker who can connect to a network, either as a malicious insider or by connecting to a co-located open network, to attack others.

NDSS'26 paper: https://www.ndss-symposium.org/wp-content/uploads/2026-f1282-paper.pdf
GitHub: https://github.com/vanhoefm/airsnitch

Excellent article on the work by Dan Goodin: https://arstechnica.com/security/2026/02/new-airsnitch-attack-breaks-wi-fi-encryption-in-homes-offices-and-enterprises/

I'd say we bypass Wi-Fi encryption, in the sense that we can bypass client isolation. We don't break Wi-Fi authentication or encryption. Crypto is often bypassed instead of broken. And we bypass it ;)

Anyone know where @tedu is? https://flak.tedunangst.com has been offline for a while...