I have kept my SSH and signing keys on hardware for years. The private key lives on an OpenPGP card or a Nitrokey, it never touches the disk, and a stolen laptop is a stolen laptop rather than a stolen identity. What changed over the last year is the software I use to talk to those cards. For SSH authentication and Git signing I no longer go through GnuPG at all. I use three small Rust programs from the OpenPGP Card project instead.

When a database running on ZFS slows down, buying more hardware isn't always the answer. The bottleneck could be storage, RAM, or CPU, and each has its own signal: latency histograms for storage, ARC demand hit ratio for RAM, worker-thread CPU time for CPU. Learn how to diagnose the real cause before spending money on hardware.

Every FreeBSD package was compiled in a fresh jail whose network was cut once the sources had been fetched and checked, and every night the system compares what it has installed with the project's list of known flaws. Nobody had to switch either of those on. On Linux each distribution decides for itself how strictly its packages are built, and the administrator who builds a package of their own decides again. Lean Software.

RealNAS is a FreeBSD package set that adds NAS management to a stock system. It installs a middleware daemon, an Angular WebUI, and a small HTTPS reverse proxy for ZFS pools, datasets, snapshots, SMB and NFS shares, local users, alerts, reporting, updates, and boot environments.

Two network ports bundled with LACP and a VLAN on top, kept across reboots. On Ubuntu the file on disk is YAML and the prompt speaks another vocabulary, with a generator translating between them. On FreeBSD it is four lines in rc.conf and two commands that use the same words. Like for Like.

Not specifically for FreeBSD, but as I tend to use a lot of refurbished equipment this device has been great. No financial incentive either, just a family of products that has helped with administration, particularly using securelevel.

I am also running FreeBSD on an ovh dedicated server. Their SYS Eco servers are fairly priced and include KVM access.

I am also running FreeBSD on an ovh dedicated server. Their SYS Eco servers are fairly priced and include KVM access.

It's a bit oversimplified, but I found it to be a fair assessment and good for a quick explanation if you're ever asked, 'Why FreeBSD?'

FreeBSD rotates its logs with a program written in 1987 that reads one line per file, renames, sends a signal, waits ten seconds and compresses. On Debian the same job for nginx takes eighteen lines and a shell. Technical Beauty Scope.

On 2026-10-21 the PHP project released fixes for two critical vulnerabilities nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2). Every PHP version since PHP 5 is affected. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

AI-generated ZFS commands can look correct and still put your data, performance, and recovery options at risk. See how three seemingly reasonable choices for ashift, synchronous writes, and pool upgrades can lead to poor performance, lost database transactions, and recovery issues. Learn what to check before you trust AI-generated settings

A bit of a surprise, really, Wine is making its way to OpenBSD. An experimental port has been submitted, and early testing shows it can already run dozens of 64-bit Windows apps (including quite a few games).

The announcement comes from OpenBSD developer Thomas Frohwein, who made the proposed port public on the OpenBSD mailing list and describes it as possibly the most surprising port proposal of the year.

As Frohwein makes clear, getting Wine to work on OpenBSD has been a team effort with the bulk of the work being done by Andrii and Fabien. The biggest hurdle has been the %gs segment register. Wine needs this, but OpenBSD doesn’t allow applications to set GSBASE directly.

The breakthrough was a software workaround which uses the %gs prefix to generate the instructions, circumventing a major compatibility issue which had previously made getting Wine onto the OS so difficult.

The results are already very impressive. The dev team has successfully tested a good number of 64-bit Windows apps, and most run quite nicely. Even more surprisingly, a recent remaster of The Witcher 3 appears to run quite well (though again you do need to install vkd3d-proton to get the D3D12 via Vulkan to work).

Frohwein also posted links to screenshots and gameplay recordings to show off the progress. He pointed out that the gameplay in the recordings may look a bit less smooth than it actually is, as they were recorded directly from the system using FFmpeg.

Of course, there are still limitations. The biggest one is that WoW64 (Wine’s compatibility layer for running 32-bit Windows apps in a 64-bit environment) doesn’t currently work. The OpenBSD port is therefore limited to 64-bit Windows software.

The built-in Wine test suite is also disabled for now. Some of the tests need access to the X server, and some just hang (though the developers have not seen this in their own real-world testing with a large number of games).

For anyone wanting to play around with the port, Frohwein recommends starting with the 64-bit version of Notepad++ (a fairly light Windows app). He also suggests running Wine under a separate unprivileged user account until additional security restrictions can be implemented.

Importantly, Wine has not yet been officially accepted into the OpenBSD ports collection. The current submission is a work in progress which is being proposed for testing, feedback and review by the OpenBSD developers.

Still, given OpenBSD’s very strict security model and the technical difficulties of the task, getting Wine to run modern Windows apps and indeed some of the more demanding games is a significant accomplishment. If it does eventually make it into the official collection, it would go some way toward extending the range of software available to OpenBSD users.

For more details, see Frohwein’s announcement.

A Debian cloud image is 322 packages, drawn from 216 source packages and 94 upstream projects and carried by 129 maintainers, assembled by a distribution. FreeBSD's base system comes from one tree and one team, with nine elected people at the top and one security officer for every supported release, and the difference shows up where bugs live: at the seams. Lean Software.

Two FreeBSD machines can share one IP address with two lines of configuration and no process to keep alive, because the heartbeat runs in the kernel, and the same interface speaks VRRPv3 whenever the other side of the switch expects it. Technical Beauty Scope.

There is a special kind of embarrassment in being the person who explains Ansible to other people during the week and then spends Sunday evening typing freebsd-update fetch install into a dozen SSH sessions.

Ask a FreeBSD kernel what one of its settings does and it answers in a sentence. It does so for 15,065 of its 15,416 settings, because since 1995 the explanation has been written into the same line of source as the setting itself. Technical Beauty Scope.

The machine that serves this blog keeps five ways back from its last upgrade, and four of them were laid without anybody asking. A Debian server, after the same morning, would keep two kernels. Lean Software.

In January 2019 a Linux kernel developer told a ZFS user, on the kernel's own mailing list, to switch to FreeBSD. He meant it as a dismissal. This piece takes it as advice and checks whether it holds. Like for Like.

J’ai décidé de plus laisser mon serveur web directement ouvert sur internet et de tout faire passer via un reverse proxy nginx (qui était déjà mon serveur web). Tant qu’à faire, comme le serveur ne servira qu’à cela, j’en ai profité pour partir sur un freebsd 15 pour ne plus tout avoir sous Debian.

The standard asks ls for 26 switches. This machine gives it 44, and the GNU tree gives it 60. Every single one of them had a reason. Lean Software.

A system call on this machine costs fifty-two nanoseconds. The same call in a Linux guest on the very same processor costs eight hundred and sixteen. Neither number is about the kernel type, and that is the finding. The Bench Marker.

At the end of last year I wrote about jailexec, my Ansible connection plugin that manages FreeBSD jails by SSHing to the jail host and running everything through jexec. That article has a section called Security Design. It proudly explains the two-stage file transfer: upload to a temporary location on the host, then move it into the jail with privilege escalation.