honk https://honk.netsend.nl/ honk rss https://honk.netsend.nl/icon.png honk rss https://honk.netsend.nl/ kuijsten bonked https://mastodon.bsd.cafe/users/OpenBSDAms/statuses/117270148641135475 Ori Bernstein - GEFS: The File Shredder of the Future.

https://exquisite.tube/w/3QQimMdswWJxrsPaJtak2u

\o/

#EuroBSDCon #OpenBSD

]]> https://mastodon.bsd.cafe/@OpenBSDAms/117270148641135475 Mon, 14 Sep 2026 20:25:30 UTC https://mastodon.bsd.cafe/@OpenBSDAms/117270148641135475 kuijsten bonked https://bsd.network/users/lattera/statuses/117242864581524213 Reverse engineered #Stuxnet from 2010 samples released on GitHub: https://github.com/Sadpainy/Stuxnet

I have mirrored it on #Radicle : rad:z27MwjFvi6GvAPKX5tPeJPuvETYpR

#infosec #malware

]]> https://bsd.network/@lattera/117242864581524213 Thu, 10 Sep 2026 21:43:20 UTC https://bsd.network/@lattera/117242864581524213 kuijsten honked https://honk.netsend.nl/u/kuijsten/h/7Y1l96v7786rf4gZd7 Just released filter-dmarc v0.3.0. It now supports non-UTF-8 mail bodies and does stricter filter protocol parsing. If you are interested in #DMARC with #OpenSMTPD you should definitely give it a try.

https://netsend.nl/opensmtpd-filter-dmarc/

TODO:
Currently on OpenBSD "stdio rpath inet" is pledged and everything, that is DMARC, DKIM and SPF verification including DNS resolving, is done by Stalwart's mail-auth (written in Rust). I want to only pledge "stdio" to this huge amount of Rust code and do DNS resolving using OpenBSD native asr(3) in a separate process.

]]> https://honk.netsend.nl/u/kuijsten/h/7Y1l96v7786rf4gZd7 Thu, 10 Sep 2026 21:23:36 UTC https://honk.netsend.nl/u/kuijsten/h/7Y1l96v7786rf4gZd7 kuijsten honked https://honk.netsend.nl/u/kuijsten/h/24XmMDP1LtCdbPc36c I'm happy to share my #DMARC filter for #OpenSMTPD with a wider audience. I've been running it for several weeks myself and so far DMARC is being enforced successfully while no legitimate mail has been blocked. This is just a thin wrapper around @stalwartlabs's DMARC, DKIM and SPF implementations.

It supports an --spf-only-domains argument so that you can easily bypass DMARC for mailing lists like openbsd.org or lists.openwall.com.

See https://netsend.nl/opensmtpd-filter-dmarc/

]]> https://honk.netsend.nl/u/kuijsten/h/24XmMDP1LtCdbPc36c Tue, 01 Sep 2026 18:38:04 UTC https://honk.netsend.nl/u/kuijsten/h/24XmMDP1LtCdbPc36c kuijsten honked https://honk.netsend.nl/u/kuijsten/h/p6SYt8w2zR4pklS82Z Just released an update to my spf and spamtrap filters for #OpenSMTPD. If you are using them on a listener with auth enabled (i.e. listen on ... auth filter spf) you should update immediately because otherwise an attacker can bypass the filter.

Fixed in filter-spf v1.0.2 and filter-spamtrap v1.0.0, both released today.

]]> https://honk.netsend.nl/u/kuijsten/h/p6SYt8w2zR4pklS82Z Mon, 17 Aug 2026 18:49:25 UTC https://honk.netsend.nl/u/kuijsten/h/p6SYt8w2zR4pklS82Z kuijsten honked https://honk.netsend.nl/u/kuijsten/h/1j81F7jtPmlTqKCg4c Just released a fix for #OpenSMTPD filter-spf on OpenBSD 7.9. Apparently pledge dns needs to be accompanied with rpath /etc/resolv.conf.

]]> https://honk.netsend.nl/u/kuijsten/h/1j81F7jtPmlTqKCg4c Tue, 11 Aug 2026 18:53:42 UTC https://honk.netsend.nl/u/kuijsten/h/1j81F7jtPmlTqKCg4c kuijsten honked https://honk.netsend.nl/u/kuijsten/h/3wSz2x5G6MPmlpHjBS In case you like to do DNS lookups using #Go on #OpenBSD with pledge you have to set GODEBUG=netdns=cgo or compile using go build -tags netcgo ...

I.e. to make my honk resolve hostnames again without recompiling I have set the following:

$ cat /etc/login.conf.d/honk
honk:\
	:setenv=GODEBUG=netdns=cgo:\
	:tc=daemon:

]]> https://honk.netsend.nl/u/kuijsten/h/3wSz2x5G6MPmlpHjBS Sun, 09 Aug 2026 10:21:40 UTC https://honk.netsend.nl/u/kuijsten/h/3wSz2x5G6MPmlpHjBS kuijsten honked https://honk.netsend.nl/u/kuijsten/h/9j8nTBwdm58Q8FdsqW Happy to see symon v2.91 is released and available in #openbsd current! 🎉

  • modernized mbuf and smart probes
  • new wg(4) probe
  • new time probe to measure cpu usage of symon itself
  • tight pledge and unveil for symux(8)
  • unveil for symon(8)
  • removed old 2001-2004 era ifdefs

mbuf:
- model after systat(1) mbufs
- add missing cluster mcl2k2
- big performance improvements
- stricter sysctl error handling
- remove ifdef KERN_MBSTAT (defined since OpenBSD 3.2)

smart:
- support running unpriviledged
- support disklabel UIDs using opendev(3)
- use xreallocarray instead of xrealloc
- stricter ioctl error check

pkg_add symon symux

]]> https://honk.netsend.nl/u/kuijsten/h/9j8nTBwdm58Q8FdsqW Sun, 09 Aug 2026 10:49:29 UTC https://honk.netsend.nl/u/kuijsten/h/9j8nTBwdm58Q8FdsqW kuijsten bonked https://mastodon.social/users/openbsdjournal/statuses/117035709396389802 Call for testing: OpenBSD vmm(4)/vmd(8) fd-ification #openbsd
https://undeadly.org/cgi?action=article;sid=20260804054218

]]> https://mastodon.social/@openbsdjournal/117035709396389802 Tue, 04 Aug 2026 18:02:03 UTC https://mastodon.social/@openbsdjournal/117035709396389802 kuijsten bonked https://hachyderm.io/users/damienmiller/statuses/116853714071910955 A few people have asked me recently about how OpenSSH sshd implements privilege separation after the changes of the last couple of years, such as splitting sshd into multiple binaries.

I finally got around to writing it up - please take a look if you're curious.

https://github.com/openssh/openssh-portable/blob/master/README.privsep

]]> https://hachyderm.io/@damienmiller/116853714071910955 Fri, 03 Jul 2026 06:24:08 UTC https://hachyderm.io/@damienmiller/116853714071910955 kuijsten bonked https://mas.to/users/libreleah/statuses/116357307225534423 update regarding my librewolf port for OpenBSD: it works perfectly. i screwed up the branding, so the menu icons (e.g. lxqt menu) say firefox. easy fix (just have to enable librewolf branding in the build process; accidentally removed it earlier)

https://codeberg.org/vimuser/librewolf-openbsd-port

will update for openbsd 7.9 soon (current package is 7.8) and then also for CURRENT. debating whether or not to maintain a temporary package repo, until openbsd merges it. i plan on sending to the openbsd ports team for review.

Attachment: openbsd librewolf]]> https://mas.to/@libreleah/116357307225534423 Wed, 08 Apr 2026 20:27:10 UTC https://mas.to/@libreleah/116357307225534423 kuijsten bonked https://hachyderm.io/users/eanakashima/statuses/116336639789100929 My greatest professional accomplishment of the year: I got my exec & manager teammates saying "point positive," a term from whitewater rafting and kayaking.

Meaning: when facing hazards, point people toward where to go/what to do, rather than drawing attention to everything to avoid.

Attachment: A drawing showing a river rafter who has fallen out of a raft in rapids. The people still in the raft are pointing to a safe way to swim rather than at rocks to avoid. Caption: "Point positive: pointing the way to go, rather than at the problem." Drawing created by sketchplanations. ]]> https://hachyderm.io/@eanakashima/116336639789100929 Sun, 05 Apr 2026 09:29:37 UTC https://hachyderm.io/@eanakashima/116336639789100929 kuijsten bonked https://mstdn.plus/users/cakewallet/statuses/115899520248008233 2/ Zcash is here 😍

In Cake Wallet, Zcash is implemented the right way: shielded by default, with privacy built in, not optional. You get the best privacy that Zcash has to offer, with no extra hoops to jump through or manual steps to take. A modern, open-source experience, no waitlist required 😉

]]> https://mstdn.plus/@cakewallet/115899520248008233 Tue, 24 Mar 2026 15:32:21 UTC https://mstdn.plus/@cakewallet/115899520248008233 kuijsten bonked https://mastodon.social/users/smaurizi/statuses/116194779068278982 Where: #Berlin
When: March 19-23

Don't miss this great conference on the impact of #WikiLeaks organised by #DisruptionLab and #TatianaBazzichelli

https://www.disruptionlab.org/exposing-crimes-is-not-a-crime

Attachment: ]]> https://mastodon.social/@smaurizi/116194779068278982 Mon, 09 Mar 2026 14:36:38 UTC https://mastodon.social/@smaurizi/116194779068278982