New on the blog: ArtCraft is rebuilding Photoshop, Lightroom, Premiere, Word, Excel and more in Rust, with AI coding agents.
I tried it. PhotoCraft actually handled my video thumbnails, apps start in 1-2 seconds, and there are native #FreeBSD builds.
The more interesting part: GUI, CLI and agents drive the same engine. And when code gets cheap, verification becomes the bottleneck.
Articles on my blog that were written with AI assistance now include a disclosure below the references section, with a link to my AI policy.
The ideas, technical content, and drafts are mine. AI helps me polish the English, and I review every edit.
I write Ansible for a living. Until recently I still patched most of my own servers by hand, one SSH session at a time.
Now: freebsd-update and pkgbase, thin Bastille jails, thick jails via jailexec, a Proxmox cluster, RHEL. Dry runs first, explicit reboot policies, and an honest list of what still isn't covered.
Plus the reboot I should have seen coming.
FINALLY!!!
After #BMV rejected the German fascist party AfD, #Tesla stepped in and proudly delivered the new East German #cybertruck! What a beauty she is … 🤪🇩🇪🖕🏾
The Ansible guy finally uses Ansible on his own infra 🙈
Today FreeBSD routers, Bastille jail hosts, the mail server and the Proxmox cluster + PBS moved to AAP: git inventory, defensive patch playbooks, and a curated Private Automation Hub as the only collection source.
Jails are patched via my jailexec connection plugin, now also a collection. Already on GitHub, Codeberg & PyPI - Ansible Galaxy release coming soon!
New post: Claude Code on a FreeBSD 15.1 Plasma desktop, running as a Linux binary through the Linuxulator. In a Proxmox VM, over xrdp.
Four detours, four wrong labels. Xorg found no screens. VirtIO-GPU gave me a framebuffer, not acceleration. And a "version regression" was really two Claude installs fighting over my PATH.
Then the agent firewalled its own host with pf and a dead-man's switch. It also misread a config file about root.
> Mom, can we have AWS S3 bucket?
> No, we already have AWS S3 bucket at home.
Good grief. There may actually be an outbreak of pneumonic plague in Russia.
I just went outside to check whether the DeLorean accidentally dropped me off in the wrong century.
Apparently it’s time to dig out the beaked plague-doctor masks, stuff them with herbs, and start protecting ourselves from the miasma again.
Absolutely normal events for 2026.
#PneumonicPlague #Russia #WrongCentury #DeLorean #PlagueDoctor #Miasma #TimelineError
New in FreeBSD Foundationals, part 4: rc.d, the service framework that fits in your head.
How /etc/rc orders your services, why rc.conf is just shell, what rc.subr gives you for free, and the daemon(8) pidfile trap that makes "service stop" quietly restart your process.
Then I audited my own production rc.d scripts. One of them reports "not running" while serving live Mastodon traffic.
https://blog.hofstede.it/freebsd-foundationals-rcd-the-service-framework-that-fits-in-your-head/
The zsdt(1) especially with -19 level is VERY efficient.
From 13 MB to 114 KB.
Greatest thing about ZSTD?
Decompression speed is similar no matter which level You used to compress.
New on the blog: Self-Hosted AI.
Qwen 3.8 27B on a rented RTX PRO 6000 Blackwell, one shell command, ~150 tokens per second. For most of my everyday coding, it is simply good enough now.
Also: what "self-hosted" really means on someone else's GPU. You swap trust in an AI vendor for trust in an infrastructure provider. Not zero trust, but a question I already know how to answer.
https://blog.hofstede.it/self-hosted-ai-qwen-38-on-a-rented-blackwell-at-150-tokens-per-second/
ansible-jailexec 2.0.3 is out: a security release for the Ansible connection plugin that runs tasks inside FreeBSD jails via jexec.
Files pushed into a jail were staged in /tmp on the jail host with the source file's mode (often 0644), so other local users on the host could read them during the transfer. Staging now uses a private 0700 directory.
Thanks to GitHub: manus-pi for the report!
Advisory: https://github.com/chofstede/ansible_jailexec/security/advisories/GHSA-cfm5-946c-m3qx
Your playbook failed. Management wants a root cause. You have 30 seconds.
Introducing larvitz.bofh, an Ansible collection that returns Bastard Operator From Hell excuses:
"Root cause: The mainframe tripped over an unhandled SIGSEGV in the automated espresso machine."
Seedable, so each host keeps its story straight. Bonus category: Deutsche Bahn.
„Wie alt ist eigentlich die Jugendorganisation eurer Partei?“
Union: „Unser JU-Chef ist 34. Jung, dynamisch und bei den Erwachsenen darf er schon fast ohne Sitzkissen mit am Tisch sitzen.“
Wenn 34 bei euch noch als Nachwuchs gilt, versteht man zumindest plötzlich sehr viel.
For almost a year, my Ansible connection plugin for FreeBSD jails had a jail escape.
A symlink inside a jail, a root-owned mv on the host, and every file transfer could land wherever the jail wanted. Rejecting ".." didn't help at all.
Now it's CVE-2026-55074. Here's the bug, the fix, and what disclosing it looks like when the project has one maintainer.
https://blog.hofstede.it/my-ansible-plugin-had-a-jail-escape-cve-2026-55074/
#FreeBSD #Ansible #InfoSec #CVE #Jails #OpenSource #Security #SysAdmin
Got the 2026H2 Anti-Virus Update successfully installed 💉 (C19, Influenza and FSME)
Falls jemand mit der DKV Krankenversicherung telefonieren muss, und der "AI Telefon Bot" zu nervig ist:
"HALLLOOOOO?"
"Ist da der Hansi?"
"Also die Susanne war am Sonntag...
JETZT UNTERBRICH MICH DOCH NICHT DAUERND!"
[piiep] Sie werden zu einem Sachbearbeiter verbunden...
Man muss einfach nur genug Zeug labern, was denen ihr Computer nicht versteht, dann scheint der Failsafe zu greifen 😅
Ich hoffe wirklich, das wird bei den im CRM nirgends transkribiert und abgespeichert!!
Meine lieblings Jahreszeit? Ende Merz!
$ ping -Q 0xDB -c 3 bahn.de
PING bahn.de: 56 data bytes
Request timeout: ICMP entfällt heute ersatzlos
64 bytes: icmp_seq=2 time=48h (Umgekehrte Wagenreihung: Payload vor IP-Header eingetroffen)
Request timeout: Außerplanmäßiger Halt in Fulda (USB-Stick-Kurier sucht Bordbistro)
--- bahn.de ping statistics ---
3 transmitted, 1 received, +1 out of order, 66% loss
Wir bitten um Ihr Verständnis. Senk ju vor träweling.
Techniker ist informiert, Anschluss-Ping in Hannover wird leider nicht erreicht. 🚄💨
#DeutscheBahn #BahnChaos #SysAdminHumor #Linux #DevOps #Fail