Go, go, go ... again

Hi folks,

While leaf trees are falling, some other things are doing the same, sometimes in a slower pace :-)
For example the free doom3 client finally started to branch a new release after more than 2 years. At the time, it was very easy to port to OpenBSD but at least it is upstream directly. Also, golang's project has started to notify about release notes for the future 1.12 version, including my getrandom contribution. But the two releases per year really fits in here so major changes have time to go in ...

These days, I am doing a bit of DragonFlyBSD support here and there, radare previously, llvm a little, a mini patch for haproxy today ... and so on. I am not moving on from one OS to another :-) but just trying to do some "catching ups" so some oses are not (too) behind the others ... At the moment it is the 5.2.2 release while I write, and still amazed each time I dive into what so few contributors are able to accomplish, even though I might regret some lack features here and there (no sandboxing feature for example) ... overall, it still stands up well on its own.

LMMS for now will move forward its, already, 8th Release Candidate while I write (I discussed, with the lead developer, the 1.2.0 release back in early 2017). Hopefully this project will reach its final release in some weeks, while maybe accepting a certain "level of imperfection" (closed source and paying solutions were not perfect too when I used them) ... Audio softwares for advanced users or professionals are complex machinery with more possibility of subtle bugs and there is the 3rd party plugins support system which make the situation even more "weightened" ... so this puts things a bit in perspective. So all for the best :-) because I think this software deserves a good reputation.

Post (about) meetup

Hi folks,

Finally we made it happen and was the opportunity to get to know Tom Smyth, very well versed into network, ISP and also a big fan, in a personal and business level, of OpenBSD. I quickly saw him in EuroBSDCon but in the meetup I could witness his taste of convincing how OpenBSD can serve his security priorities, how well it is to fund worthy open source developers for the greater good and so on ... Was a great discussion to listen to. Of course seeing the other usual folks was great too ;-) which lead to think we should go on on "reviving" our group so we will see each other again in December (hopefully), the topics will be make public soon-ish but we will basically expand on topics we did not have time to reach.

Apart of this, my little redis changes had been merged, I may have further plans while also thinking of redis "mindset" i.e "not too much platform "boilerplate" please..." ; to summarise. radare2, again, merged some of my fixes and especially the DragonflyBSD build, thankfully despite being different than FreeBSD still have, to some extent, a similar-ish API.

At last php has moved towards the 7.3.0 release, at least the RC5 had been sorted out in due time so not so long after we should be "back in business" about taking care of new features for future versions. Definitely, the opcache.preload feature/directive will be one of the main point of attention (in my opinion). Finally, my merge request for openssl refactoring had been accepted.

2018 ... a new start

Hi folks, and Happy New Year !

Everyone already heard about Meltdown and Spectre, the most important is all open source oses are doing their best to provide mitigations while limiting the unavoidable performance hits ; the good side of it that led to some BSD projects to work together (like DragonflyBSD and OpenBSD people) in these problems, sharing concerns and solutions.

In the meantime, in a more personal level, I have been doing few professional contributions, like for Python (the uuid module build fix for *BSD) and possibly the libb2 dependency (improvement proposal). Last December, I got interested into fuzzing through American Flop Fuzz and LLVM lib fuzzer each one having its own interest, but was frustrated the latter did not have FreeBSD support. So I just provided a patchset in the fuzzer itself and the compiler frontends ... This will be available from clang 7.0 ...

Apart of this, as usual various small contributions to php, video games here and there or just simply helping out giving OpenBSD internal patchset upstream. Might be back writing a little bit for BSDMag as well. Otherwise, in a more or less near future, waiting for a special event but at this time very unsure it is going to happen but will keep you posted.

Kore again

Hi folks,

Following my previous post about testing Kore, I did some changes in the code to make it workable for NetBSD and DragonflyBSD and sent those changes to Joris Vink.
Those changes are merged now smoothly.

2014 retrospective

Hi folks,

Almost the end of 2014 ... When I recall what happens this year, I feel pretty good. Since I decided to contribute to Open Source projects, I put my small mark in operating systems used by many, increased my operating systems knowledge (obviously the BSD ones mainly, a bit Linux too), made valuable contacts like HardenedBSD guys (especially Shawn Webb and Oliver Pinter), some core FreeBSD committers like Baptiste Daroussin, some BSD Mag folks ... Wrote some articles for BSD Mag (since the last time I wrote another one which will be published in January).

To summarize :

- Kea project merged my PostgreSQL support + my fixes.
- Slighty later, DragonflyBSD merged upstream my spinlock patch.
- HardenedBSD folks decided to get me involved on their project.
- EuroBSD Con 2014, especially the Shawn Webb's conference. Although a bit disappointed that Vitosha room's videos are not available yet.
- Since then I ported some OpenBSD libc functions, updated arc4random (both kernel and userland ones). First work of Ptrace hardening support.
- Got interested on Stack Smashing Protection and studied BSD and Linux choices.
- I started to port LibreSSL (the real version, not the portable one ...), which led me to get interested in assembly (x86-64 mainly). That compiles already, still need refinement later.
- Some security fixes/patches for FreeBSD were merged upstream.
- One fix for OpenBSD is merged upstream.

Since then,  FreeBSD/HardenedBSD and OpenBSD are my main operating systems and now I know them much better, I had reconsidered a bit my opinion about the whole BSD thing.

1/ I consider OpenBSD better now, the whole source code has very good quality, clear, less "patchwork" than some other operating systems. Of course, the security focus attracts me pretty much. In base, I particularly like relayd and httpd (both from reyk@), it took me few hours to update the yacc parsing part (config) + the code update to make a custom version which use both Device Atlas API.

What blocks me to use OpenBSD more :
- Lack of real modern filesystem (like ZFS/Hammer 2).
- Cannot do serious virtualisation, nothing comparable to bhyve, no Virtualbox (I do not think it ll happen anytime soon) ; it is a feature I use very often (if not daily), uses lot of different operating systems more or less "exotic" ... cannot live without ...

The fact that OpenBSD is slower than FreeBSD does not bother me too much though.

2/ FreeBSD is still my preferred BSD among all (I run only HardenedBSD flavour now). I appreciate a lot ZFS, Dtrace, bhyve ... Even just the latter is amazing by itself ... The fact that clang is in base too (I hope OpenBSD will do the step one day) ... Not to mention the specific HardenedBSD features like ASLR, segvguard and so on ... Few things bother me a bit (like cddl code but it is understandable for realistic reasons ... I can imagine the big amount of work required to make a full BSD comparable version from scratch).

3/ DragonflyBSD ... I still like this one, regarding the (much) smaller community they represent, they make great work (great Haswell support for example).

4/ NetBSD, I have good respect for this project and runs it time in time in my VirtualBox. I do not dislike, it just does not fit totally my needs/expectations. Although I admire the fact that it can be ran as rump kernel ... Just awesome.

The fact that BSD provides both the kernel and the userland in a whole consistent part is what I like the most in a pure developer point of view. In the opposite, we have the Linux kernel then the whole "dispatched" GNU userland. Linux is not a bad operating system at all, just I like less the way it is.

So, for 2015, some new other things await me, hopefully. Great wishes to all.

HardenedBSD, SEGVGUARD and other friends

Hi folks,

Again about HardenedBSD, that starts small but smoothly, we got an article on Phoronix recently which is quite nice to be honest as this website is more for Linux topics. Also I got few but usually positive feedbacks when I talk about it ...

Also recently the SEGVGUARD branch was well updated (this feature is to avoid to get attacked via malicious segmentation faults usage).

In my part, after a long night to code MAC extended support for my PTRACE hardening branch (which allows to disable/enable hardening on a particular executable for example with the new ptracehdflags ...) + I applied also the DragonflyBSD's patch for taking care of SYSRET privilege escalation issue (Matt Dillon is really an hard worker ...), I am now responsible for the whole "ptrace" topic, I ll implement for next finer grained control over this.

All of these features provide this new sysctl tree :

security.pax.aslr.*
security.pax.segvguard.*
security.ptrace.hardening.*

But that a good chance it ll change soon in more consistent way ...

Small update :

Now the sysctl tree is under the root hardening oid just created by oliver :

hardening.pax.aslr.*
hardening.pax.segvguard.*
hardening.ptrace.*

Also just added some logging in case the ptrace call is not authorised.

Dragonfly BSD and spinlocks

Hi folks.

I made recently my first modest contribution to DragonflyBSD, it was about adding self description feature mostly to spinlocks. Was just accepted this morning after reviewing ! My small experience with OpenBSD led me to propose, as well, some overflow check fixes to some base utilities (some of those small issues still exist on FreeBSD, I made a small patch for it too) ... We will see if they ll accept as well ! But, whatever, this is a quite small community so it is already very good what they have done.

Besides, vacations are over for now, still things need to be started (like the article for my company...) !