My ThinkPad T480 now boots with the FreeBSD orb instead of the Lenovo logo :freebsd:

No Windows needed, all done from FreeBSD 15.1:
- extract Lenovo's bootable BIOS ISO with geteltorito (it's in ports!)
- mdconfig + mount_msdosfs, drop a LOGO.JPG (≤60 KB, ≤768×432) into FLASH/
- dd to a USB stick, F12, "Update system program", answer Y to the logo prompt

Bonus: BIOS 1.53 -> 1.56 along the way.

Inspired by https://justine.smithies.me.uk/updating-the-bios-and-boot-logo-on-a-thinkpad-p14s-running-freebsd.html from @justine

#FreeBSD #ThinkPad #RunBSD

I've packaged the OpenPGP card Rust tools by @hko and @wiktor as #FreeBSD ports

oct: manage your OpenPGP card
oct-git: sign Git commits with your card
openpgp-card-ssh-agent: SSH agent, keys stay on the card

Until they land in the ports tree, grab them here:
https://codeberg.org/Larvitz/freebsd-openpgp-card-ports

The new-port PRs need a committer, so testing and reviews are welcome:
https://bugs.freebsd.org/293960
https://bugs.freebsd.org/293961
https://bugs.freebsd.org/293962

#OpenPGP #Rust #YubiKey #Nitrokey

@tux @Mathias @AlienJay

https://www.heise.de/hintergrund/Altersverifikation-im-Fediverse-Wie-der-KIDS-Act-Mastodon-herausfordert-11474098.html

3/3 One thing you might have noticed: between Oct 22 and today, burningboard.net could not send any e-mail. After a package cleanup, the mail configuration pointed to a CA certificate file that no longer existed. It's fixed now.

If you were waiting for a confirmation or password reset mail, please just request it again. Sorry about that!

Tonight we're repacking the database (pg_repack) to get rid of bloat. You shouldn't notice anything.

Thanks for your patience, and enjoy your weekend! 💚

#MastoAdmin #FreeBSD

2/3 Also done today:

Checked the Node.js October security release (Brotli CVE-2026-111497). Our streaming server never decompresses untrusted Brotli data, so the risk is low. We'll update as soon as the FreeBSD package is out.

The streaming server now properly verifies the database's TLS certificate.

Rewrote our rc.d scripts the way rc.subr intends: supervisor pidfile, automatic restart after a crash, and "service restart" works on the first try. Background: https://blog.hofstede.it/freebsd-foundationals-rcd-the-service-framework-that-fits-in-your-head/

Package updates on the host and in all jails

nginx: separate cache directories, a nearby DNS resolver (thousands of DNS errors gone) and a catch-all for unknown hostnames

We retired our Tor onion service

Lots of small cleanups after a deep health check

Maintenance report for burningboard.net 🛠️ 🧵 1/3

Highlight of the day: all internal traffic now runs over #IPv6 only! 🎉

Our instance runs on #FreeBSD in separate jails: nginx, Puma/streaming, Sidekiq and the database. Every jail has had IPv6 from day one, but some of the services still talked to each other over private IPv4.

Not anymore:

• nginx -> Puma & streaming
• Rails, Sidekiq & streaming -> PostgreSQL & Valkey
• Prometheus exporters, Loki, OpenSearch
• DNS resolvers

Internal connections now use hostnames from one shared hosts file that only contains IPv6 addresses, so a name automatically means IPv6. PostgreSQL and Valkey no longer listen on IPv4 at all, and the internal IPv4 (pf) firewall rules are gone.

IPv4 is only left where the Internet still needs it: incoming to nginx, and outgoing to servers without IPv6.

📸 sockstat and pg_stat_activity: not a single IPv4 address left inside.

#MastoAdmin #Mastodon #Bastille #FreeBSD #Unix #IPv6

A lot of the AI criticism on here resonates with me. Nobody really knows what these models were trained on or how they were aligned. The IP questions are unresolved, artists are getting hurt, and people ship output they never validated: technical debt on steroids. All legitimate, and I’m critical of AI on a political level, too.

But accepting reality isn’t the same as endorsing it. AI won’t disappear because I look away, and refusing it entirely mostly puts me at a disadvantage. Closing your eyes in a lion’s cage has never been a great strategy.

So I use it deliberately, as an editor and amplifier rather than an author, and I validate what it gives me.

Where do you draw the line?

#AI #LLM #SoftwareEngineering #AIEthics

Strafanzeige gegen Unbekannt wegen Sachbeschmutzung und unerlaubter Entsorgung biologischer Abfälle. 🕊️🚨

Die Ermittlungen gestalten sich schwierig:
Täterbeschreibung: Graues Federkleid, zwei Beine, auffällig nervöse Kopfbewegungen.

Tatzeit: Zwischen 11:50 und 12:00 Uhr.

Tatort: Aluminium-Fensterbank eines IT-Arbeitsplatzes.

Spurenlage: DNA-Material am Tatort sichergestellt. Täter flüchtig, vermutlich auf dem Luftweg.

Zeugen: Der Geschädigte befand sich in einer Videokonferenz und konnte die Tat aus dem Augenwinkel sehen.

Heads up for fellow Linux admins: CVE-2026-99999 (dubbed "PwnEscape") is out, and it is a nasty one (CVSS 9.3).

Despite being called a KVM escape, the actual bug lives in the host IPv4 networking stack. Untrusted CHECKSUM_PARTIAL offload metadata from a guest can overwrite already-validated packet headers during ip_do_fragment(), leaking host memory or allowing a guest-to-host escape.

Mainline patches landed Oct 14, and stable backports are out. Check your hypervisors and reboot!

https://pwn.ai/blog/pwnescape

#Linux #Kernel #SysAdmin #InfoSec #KVM #ITSEC #CVE

Happy 30th Birthday, @kde! 🎂🎉

Three decades of free software, community power, and relentless innovation. Celebrating the milestone today by running KDE Plasma 6.8.0 on Fedora 44 - smooth, gorgeous, and rock-solid on Wayland.

Here’s to another 30 years of building one of the best computing experiences on the planet. Huge thanks to everyone who codes, designs, translates, and supports KDE! 💙

#KDE30 #KDE #KDEPlasma #Plasma6 #Linux #Fedora #OpenSource #FLOSS #Wayland #ThinkPad

New on the blog: ArtCraft is rebuilding Photoshop, Lightroom, Premiere, Word, Excel and more in Rust, with AI coding agents.

I tried it. PhotoCraft actually handled my video thumbnails, apps start in 1-2 seconds, and there are native #FreeBSD builds.

The more interesting part: GUI, CLI and agents drive the same engine. And when code gets cheap, verification becomes the bottleneck.

https://blog.hofstede.it/artcraft-rust-agent-desktop-apps/

#RustLang #OpenSource #AI #AIAgents #Linux #FOSS

Good grief. There may actually be an outbreak of pneumonic plague in Russia.

I just went outside to check whether the DeLorean accidentally dropped me off in the wrong century.

Apparently it’s time to dig out the beaked plague-doctor masks, stuff them with herbs, and start protecting ourselves from the miasma again.

Absolutely normal events for 2026.

#PneumonicPlague #Russia #WrongCentury #DeLorean #PlagueDoctor #Miasma #TimelineError

New on the blog: Self-Hosted AI.

Qwen 3.8 27B on a rented RTX PRO 6000 Blackwell, one shell command, ~150 tokens per second. For most of my everyday coding, it is simply good enough now.

Also: what "self-hosted" really means on someone else's GPU. You swap trust in an AI vendor for trust in an infrastructure provider. Not zero trust, but a question I already know how to answer.

https://blog.hofstede.it/self-hosted-ai-qwen-38-on-a-rented-blackwell-at-150-tokens-per-second/

#SelfHosting #LLM #Qwen #OpenWeights #DataSovereignty

„Wie alt ist eigentlich die Jugendorganisation eurer Partei?“

Union: „Unser JU-Chef ist 34. Jung, dynamisch und bei den Erwachsenen darf er schon fast ohne Sitzkissen mit am Tisch sitzen.“

Wenn 34 bei euch noch als Nachwuchs gilt, versteht man zumindest plötzlich sehr viel.

#JU #CDUCSU #Nachwuchs #NieWiederCDU

For almost a year, my Ansible connection plugin for FreeBSD jails had a jail escape.

A symlink inside a jail, a root-owned mv on the host, and every file transfer could land wherever the jail wanted. Rejecting ".." didn't help at all.

Now it's CVE-2026-55074. Here's the bug, the fix, and what disclosing it looks like when the project has one maintainer.

https://blog.hofstede.it/my-ansible-plugin-had-a-jail-escape-cve-2026-55074/

#FreeBSD #Ansible #InfoSec #CVE #Jails #OpenSource #Security #SysAdmin

Falls jemand mit der DKV Krankenversicherung telefonieren muss, und der "AI Telefon Bot" zu nervig ist:

"HALLLOOOOO?"
"Ist da der Hansi?"
"Also die Susanne war am Sonntag...
JETZT UNTERBRICH MICH DOCH NICHT DAUERND!"

[piiep] Sie werden zu einem Sachbearbeiter verbunden...

Man muss einfach nur genug Zeug labern, was denen ihr Computer nicht versteht, dann scheint der Failsafe zu greifen 😅

Ich hoffe wirklich, das wird bei den im CRM nirgends transkribiert und abgespeichert!!

#ki #hotline #failsafe #krankenkasse

Meine lieblings Jahreszeit? Ende Merz!

$ ping -Q 0xDB -c 3 bahn.de
PING bahn.de: 56 data bytes

Request timeout: ICMP entfällt heute ersatzlos
64 bytes: icmp_seq=2 time=48h (Umgekehrte Wagenreihung: Payload vor IP-Header eingetroffen)
Request timeout: Außerplanmäßiger Halt in Fulda (USB-Stick-Kurier sucht Bordbistro)

--- bahn.de ping statistics ---
3 transmitted, 1 received, +1 out of order, 66% loss
Wir bitten um Ihr Verständnis. Senk ju vor träweling.

Techniker ist informiert, Anschluss-Ping in Hannover wird leider nicht erreicht. 🚄💨

#DeutscheBahn #BahnChaos #SysAdminHumor #Linux #DevOps #Fail

We had a big wave of automated Mastodon signups with very predictable usernames.

I first tried the sledgehammer approach and blocked known VPN ranges at the firewall.

It (partially) worked.

It also blocked legitimate ProtonVPN users. 😬

So I replaced that with a tiny custom Mastodon validator that rejects the actual abusive username pattern instead.

Much cleaner: block the abuse, not the transport.

How-to + code:
https://gist.github.com/chofstede/a422427570004719196cde948521dd04

#Mastodon #Mastoadmin #Fediverse #SysAdmin #Ruby #Rails #Security @tux @AlienJay @aping

Entire house felt like it moved. Small earthquake in southwest Germany 😳

#germany #earthquake