Big fish. Small counter. Root shell.

We have to admit that even users of a well rounded operation system like OpenBSD sometimes encounter hardware that is not quite supported yet.

In their usual, unassuming fashion, the OpenSSH project have released a new version, release 10.6.

In a move that hints strongly that the new OpenBSD release is about to drop soon, the LibreSSL project have announced the new stable releases.

In Part 1 of this series, I laid out the foundational OpenBSD and Unbound architecture used to reclaim network sovereignty from an LG Smart TV. In Part 2, we saw how the OS holds the App Store hostage. In Part 3, I documented a stateful TCP kill switch that actively terminates Netflix streams if telemetry is blocked.

As I mentioned in my Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) post, development of relayd(8) and httpd(8) was revived.

I wanted to run Ubuntu 26.04 Server inside an OpenBSD vmm(4) guest. OpenBSD’s VM console is serial only, and the Ubuntu Server ISO does not boot correctly on a serial console out of the box. This post shows how to rebuild the Ubuntu ISO with the right kernel and GRUB options so it installs cleanly through vmctl console.

i don't really understand kernels. i heard the documentation on openBSD is great and i want to learn about kernels. will it teach me about kernels?

Filesystems on OpenBSD have come in two varieties, UFS1 or UFS2. Ori Bernstein has set out to possibly introduce a new option, the "Good Enough File System", which Ori describes as

Making your access logs cleaner by restricting who can connect to your VPS

In the late 1970s and the 1980s, the best choice for high-performance, high-capacity storage was so-called SMD disks.

It's a big day for routing security aficionados. The OpenBGPD project (a sub-project of the OpenBSD project) have announced version 9.9 of rpki-client(8), with various improvements, enhancements and fixes.

I start with apologies to williewillus, calvin, and reezer on Lobste.rs. Prior to July 9, I would have agreed with you all. But it appears I was wrong. There is no need to further engage; it is clear that critique-from-within is undesirable. Which is perfectly OK, because I stepped away from being on the inside. So let's just keep evaluating OpenBSD's mitigations and we'll continue to learn interesting things along the way.

Self-hosting your own services such as a blog, website, or email is a valuable skill. It gives you a better understanding in the technology and usually also fun to do. With privacy under pressure and Big Tech continuing to store our data, this might be a good time to host your own mail server.

Finding memory information and usage on OpenBSD requires a few commands and the right places to look. If you are used to Linux, then commands like free are no longer available. Let’s have a look at memory details on OpenBSD.

Returning readers of this site may have noticed that the pace of development in relayd(8) and httpd(8) has been picking up recently. Now Rafael Sadowski (rsadowski@) has a new blog post out titled Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) where he tells the story.

• https://rsadowski.de/posts/2026/dead-software-walking-relayd-and-httpd/

Thanks to the tireless work of among others Dave Voutila (dv@), development of the OpenBSD/amd64 virtualization system vmm(4)/vmd(8) continues to make progress. Now breaking changes, but with with potential benefits in both process isolation and compartmentalization of functionality, are on the way. It almost goes without saying that this code needs testing.

Sometimes I like to think of OpenBSD development as a form of spiritual discipline. The project is a decades-long painstaking labor of love with hackers carefully rearranging source code by hand. In Dutch you'd call this monnikenwerk. So what better place could there be for a hackathon than an actual monastery?

Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).

The paper presents a longitudinal measurement study on the adoption of the pledge and unveil system calls in OpenBSD. These system calls are used to sandbox programs and libraries. Given a dataset covering 19 releases, many programs and libraries were modified to use the system calls already before their introductions in official releases.

Both relayd(8) and httpd(8) now have the "secure" list of allowed crypto methods for HTTPS, which include TLSv1.3 and the TLSv1.2 AEAD cipher suites. The previous list was "HIGH:!aNULL" which contain non-perfect-forward-security methods and this change may cause old clients to not be able to connect.