This is a story I had been considering writing for a long time, as many wrong or stupid things have been said or written at the time it happened. Being on a quite sensitive subject, I have however opted to redact a few things, especially the identity of two OpenBSD developers, as well as some IP addresses and other minor details which could help identify them. They will be referred to as dev1 and dev2 in this story. It does not matter who they are, and they really are trustworthy.

Return-Oriented Programming (ROP) continues to be a serious attack taking advantage of flaws in memory unsafe languages, particularly buffer overflows, to launch arbitrary code execution attacks by chaining together pieces of already existing code in loaded binaries and shared libraries, called gadgets. With the continued reliance on x86_64 CPUs in cloud and personal servers, mitigations that can meaningfully reduce the success of ROP attacks without significant overhead continue to be attractive. We propose the porting of one such software-based anti-ROP mitigation proposed by OpenBSD: compile-time instruction rewriting to avoid opportunities for ROP exploitation. We bring this mitigation, originally developed for the custom OpenBSD implementation of the LLVM compiler suite, to GCC by way of a standalone utility that sits in between the compiler and the assembler and rewrites potential gadget instructions before assembly into object code. Our utility provides a minimal reduction in gadgets with some penalties in binary sizes and performance impacts. We compare our GCC-ported standalone utility to the original OpenBSD LLVM mitigation and discovered that our standalone utility is weaker compared to the original LLVM-based mitigation. However, due to the overall weak reduction in gadgets for both the LLVM-based and GCC-based implementations, we conclude that seemingly obvious mitigations may prove to be anything but, and caution providing security improvements without significant testing and evaluation

Architecture specific notes for OpenBSD guests under QEMU, with working command lines where installation succeeds and failure points where it does not.

Architecture specific notes for OpenBSD guests under QEMU, with working command lines where installation succeeds and failure points where it does not.

Trojaned OpenSSH (in 2002) https://lobste.rs/s/ti42hu #openbsd #security
http://miod.online.fr/software/openbsd/stories/trojan.html

• small screen, max 10 inch
• runs #OpenBSD or #NetBSD
• has a keyboard
• can connect to Internet
• it works
• price is reasonable

• MNT Reform Pocket (if I will be super rich one day, then I will take entire stock)
• HP Jornada (especially 720, but availability is not great)
• Zaurus machines (availability is almost zero and might not fill condition "it works")

Here is your last #OpenBSD story before the summer break: that one time OpenSSH was used in a supply-chain attack, before that expression was even coined.

http://miod.online.fr/software/openbsd/stories/trojan.html

#OpenBSD has a new browser in -current ports! ​

landry@ modified ports/www/librewolf/*: Import www/librewolf 151.0.3pl1, from MAINTAINER Leah Rowe

LibreWolf is a modified version of Mozilla Firefox focused on privacy, security, and software freedom. It enhances protections against tracking and fingerprinting, and applies additional hardening compared to standard Firefox.

ok caspar@

Thanks goes to @libreleah (maintainer) for sticking with it and getting the port into shape and ready for import! ​ ​

*** Repost on new instance ***

Hello Fediverse,

I'm happy to announce our very own Mastodon instance called "FediBlue", a new friendly place in the Fediverse for all people that are interested in free and open source software, especially Linux, BSD and illumos.

FediBlue is part of our ongoing effort to strengthen the FOSS community by publishing content about it and help projects gaining visibility in a time where many companies try to force their services on users, train AIs with people's data and collect as many data as they could.

Alongside the wonderful BSD Cafe community, where I'm also at, FediBlue should provide another very friendly and welcoming place in the Fediverse. In the next days, the Dark Blue Project presence will move completely to FediBlue.

https://mastodon.fediblue.de

#mastodon #opensource #freesoftware #linux #freebsd #openbsd #netbsd #illumos #darkblueproject #fediblue

🐡 I replaced Linux with OpenBSD - Here's What Happened // Zei

https://youtube.com/watch?v=FWqQgJMPK20

#openbsd #bsd #unix

#OpenBSD

Toying a bit more with my LXQt setup on OpenBSD 7.9 on "Tianve", my HP notebook.

Quite happy with the setup so far, chipped away some of the rough edges: Using now gtk2qt5, gtk2qt6 for qt theming with Qogir. Nicked the clipboard manager from xfce4, using xcalib for the color profile, set session XDG_RUNTIME to a user writable /var/user/$UID to make those apps happy reyling on it.

Desktop Wallpaper "Tanz der Farben" (Dance of the colours) by @orbite

#OpenBSD #Fishlinux #RunBSD #LXQt #Desktop #Screenshot

Alt...

Screenshot of OpenBSD running LXQT as Desktop environment Styling: Qogir-Berry gtk2/3/xfwm, QT theming via qt6gtk2/qt5gtk2 LXQT Panel: Graphite Icons: Qogir-Berry (colourized) Wallpaper: Tanz der Farben by @orbite There's a panel with some pinned icons floating on the left, a qterminal running a minimal neofetch with some system stats. At the bottom is a floating panel with two desktop switcher buttons. In the bottom right corner there's an OpenBSD Pufferfish icon (https://logodix.com/logos/1867876) labeled with LXQT Desktop and its logo. Above are two badges with slogans dealing with cancer.

Spent this evening puzzling about why my #OpenBSD virtual machine was only seeing 1 CPU. It was definitely due to me mucking up the OS configuration or somehow using the wrong kernel. Definitely. It certainly wasn't because #QEMU was only configured to give it one core. Oh no, absolutely not, I wouldn't be that stupid. Nope.

Do you want to come to Brussels, mingle with BSD people, perhaps do a talk, a tutorial or a BOF session?

The Call for papers https://2026.eurobsdcon.org/cfp/ is open until June 20th, for the conference in Brussels September 9-13, 2026.

We also offer pre-submission guidance/mentoring, see within.

Wonder what BSD and the conferences are about? See https://nxdomain.no/~peter/what_is_bsd_come_to_a_conference_to_find_out.html

@EuroBSDCon #freebsd #netbsd #openbsd #freesoftware #libresoftware #brussels #bruxelles

Latest 𝗩𝗮𝗹𝘂𝗮𝗯𝗹𝗲 𝗡𝗲𝘄𝘀 - 𝟮𝟬𝟮𝟲/𝟬𝟲/𝟬𝟴 (Valuable News - 2026/06/08) available.

https://vermaden.wordpress.com/2026/06/08/valuable-news-2026-06-08/

Past releases: https://vermaden.wordpress.com/news/

#verblog #vernews #news #bsd #freebsd #openbsd #netbsd #linux #unix #zfs #opnsense #ghostbsd #solaris #vermadenday

Latest 𝗩𝗮𝗹𝘂𝗮𝗯𝗹𝗲 𝗡𝗲𝘄𝘀 - 𝟮𝟬𝟮𝟲/𝟬𝟲/𝟬𝟴 (Valuable News - 2026/06/08) available.

https://vermaden.wordpress.com/2026/06/08/valuable-news-2026-06-08/

Past releases: https://vermaden.wordpress.com/news/

#verblog #vernews #news #bsd #freebsd #openbsd #netbsd #linux #unix #zfs #opnsense #ghostbsd #solaris #vermadenday

🚨 Hotel Discount Expires 🚨
The block booking for the hotel is expiring soon!

https://2026.eurobsdcon.org/accomodation.html

If you were planning to book your hotel early now is your chance!

https://www.warwickhotels.com/hotel-barsey-by-warwick/book/dates-of-stay?domain=2026.eurobsdcon.org&groupID=4846572

Hotel Barsey by Warwick
Louizalaan 381-383, 1050 Brussel

Located near the Flagey area, know for its restaurants and bars.

#RUNBSD #FreeBSD #NetBSD #OpenBSD #EuroBSDCon #EuroBSDCon2026 #BSD

Alt...

Cutout of the EuroBSDCon 2026 banner. Comic like drawing. First panel has a butler serving a nice Belgium beer. There are two speech bubbles. 1. ...we find this? 2. Etterbeek, Sir. The second panel has Manneken Pis doing his thing.

After thorough testing, we are in the process of upgrading our mailservers (plural) to the latest OpenBSD 7.9 snapshots.

This helps us to keep our clients safer. OpenSMTPD was already way ahead when it comes to exploit mitigations - especially on OpenBSD. The developers have taken it even further with splitting the daemon into six parts which all are now randomly relinked on reboot.

If that is too technical, the short version is: the mailboxes of our clients are now even better protected against baddies :)

#OpenSMTPD #OpenBSD #Mail #Security

Alt...

OpenSMTPD banner featuring a friendly Pufferfish (the OpenBSD mascot) dressed up as a mail delivery person, delivering letters to other fish

Just got my first daily mail from `security(8)`. If I'd known about that, I might have waited a day after my initial install to start doing personalization/tinkering, to see a less noisy diff! But it's quite cool that this is just another thing set up out of the box.

My impression of #OpenBSD is continuing to clarify as this OS that expects you to be very professional, very responsible for what goes on on your system, but gives you all the tools you need (including ones you never thought of) so that the responsibility is practical and comfortable at human operator scale. Or in a different phrasing: OpenBSD is for grownups, in the same way that Linux is for startups.

@dfloyd888

Au contraire, mon frère!

#FreeBSD has a handbook that covers almost every basic config situation you'd face.
#OpenBSD has man pages covering nearly everything
I haven't gotten very deep into #NetBSD, but I'm sure its documentation is on point.
#9front has... 9front has... 9front has some very nice people on fedi who will tell you turn back now while there's still time 😂

The documentation experience on Linux is various forum posts telling you to try various things, none of which work, and maybe some obtuse documentation text file on kernel.org. Egad.

Back on my bullshit with OpenBSD, after a Buckminster Fuller-esque nap. I'll probably need to figure out how to SSH into this QEMU VM, because for whatever reason, the framebuffer is hurting my eyes. Maybe I'm getting old! Using my own terminal would be greatly preferred.

But I'm already in love with the mail system in a way I've never felt before. On Linux, email always felt arcane, opaque, and to be avoided - I hosted my own a long time ago in the Roaming Initiative days, and hated it badly. And of course, we've all seen `sudo` threaten "I'm emailing the administrator about this!" with no clue where THAT email went to.

On OpenBSD, mail is one of the first things used to introduce the system, and it's simple and clean and straightforward, and it's treated as "just a basic thing all users deserve to have working out of the box."

#openbsd79 #openbsd

Yoooo, it's actually that easy? This is the shortest HTTP server config I've ever had to type, unless you count `python3 -m http.server` or something. That's insane.

#openbsd

Alt...

VM session on the left, OpenBSD handbook page about httpd on the right. In the terminal, you can see the leftovers of the `top` command I used to confirm that httpd was running as user `www` (I may have got a little spooked during `rcctl get httpd` and seeing user `root` earlier). Then I install curl, which downloaded and installed instantly. Finally, `curl localhost` produces my simple little `index.html`.

Oh, my microphone does not work anymore with any browser on #OpenBSD
(it works with Audacity if I set AUDIORECDEVICE) 😬

@stefano @outofcreativity

Nice! We have played a (minor) part into getting it ready for #OpenBSD, by giving the devs access to some compute - which resulted in a commit spree that I hadn't seen before.

They are incredibly kind, humble and knowledgeable.

Figured out how to get ISC DHCPd and #PowerDNS to do dynamic DNS on #OpenBSD

```
subnet 192.0.2.0 netmask 255.255.255.0 {
/* usual declarations here */
set ClientHost = pick-first-value(
host-decl-name,
option fqdn.hostname,
option host-name,
"no-hostname");
set ClientIP = binary-to-ascii(10, 8, ".", leased-address);
set ClientFQDN = concat(ClientHost, ".", "dhcp.example.com");

on commit {
log(concat("Commit: IP: ", ClientIP, "FQDN: ", ClientFQDN));
execute("/usr/local/bin/pdnsutil", "rrset", "add",
"dhcp.example.com", ClientFQDN, "A", "300", ClientIP);
}
on release {
log(concat("Release: IP: ", ClientIP, "FQDN: ", ClientFQDN));
execute("/usr/local/bin/pdnsutil", "rrset", "delete",
"dhcp.example.com", ClientFQDN, "A");
}
on expiry {
log(concat("Expire: IP: ", ClientIP, "FQDN: ", ClientFQDN));
execute("/usr/local/bin/pdnsutil", "rrset", "delete",
"dhcp.example.com", ClientFQDN, "A");
}
}
```