Would an uncooked steak that has spent time in the literal vacuum of space (for at least five minutes) be edible?

This is why yesterday I separated out the radicle-node instance from the radicle-httpd instance.

The radicle-node instance is the #HardenedBSD primary seed node. That node also performs our every-six-hour autosync with #FreeBSD.

The Radicle httpd (radicle-httpd) provides a web-accessible read-only view of our various projects. The httpd will create as many new threads as requests that come in. It has no upper bounds.

This means that I need to place those bounds via other means, like applying resource constraints to the jail.

If both the node and the httpd are running in the same jail, a threat actor could just spawn a bunch of long-running web requests, which would prevent our autosync from succeeding.

So, now that the node and the httpd are separate, we can still have a reliable autosync while having a less-reliable read-only httpd.

#Radicle #infosec

These last couple of weeks have taught me A LOT about #FreeBSD jails. I've learned how to apply resource controls, like maximum number of processes and threads.

I've also learned what happens when those resource constraints are hit: debugging things from within the jail is prohibitively difficult on a sufficiently chatty system (chatty in the way of resource constraint usage).

For example, if the maximum number of threads for the entire jail is 100, and your multi-threaded daemon is receiving more than 100 HTTP requests per minute, it's going to have a hard time.

You can't login to the jail. You can't even destroy the jail (jail -r). You must first remove all resource constraints for the jail, then proceed to either destroy it or login.

Freelance software engineers: what sites do you use to find gigs? With my wife effectively out-of-work, I need to pick up some extra work myself. Hoping to pick up around 10 hours per week of extra work.

#programming

So, I think I might make this more formal via email and announcement, but this has been taking up a large chunk of mental space. I desperately need help in developing HardenedBSD. While I'm so grateful for the many kind and encouraging words, there's still so many hours in a day.

I'm also very grateful we have one person who recently has stepped up, helping move the Pledge port ahead (and closer to full API compat.)

Please consider this post as unofficial. This is just "my thoughts as I've experienced them the past few days." If something comes from publicly posting my thoughts, all the better.

I'm wondering if anyone knows any folks interested in the kinds things we do at HardenedBSD. specifically looking for folks to mentor to do either osdev on hbsd itself, or in developing the censorship- and surveillance-resistent mesh network proof-of-concept.

i could budget a small amount for acquiring HaLow mesh gear. i don't have the budget for a laptop or other equipment. the only requirement is that all this R&D work be done on HardenedBSD.

When it comes to hardware acquisition, it's hard to know who to trust. I would like to make sure donated funds used properly and don't want to be scammed.

On the osdev side, I would like an implementation of random fd assignment. open(2) and friends usually just use the first available number, increasing until maxfd limit is hit.

i would like to change it to be less predictable, to a random search mode rather than incremental search.

This would help mitigate file descriptor reuse bugs.

Of course, we would collaborate via #Radicle for any development work.

One last thing: I should be explicit in that all this is unpaid volunteer work. I have never received payment for my work and don't intend to.

I understand that a large portion of volunteer work fizzles out or doesn't work out. That's fine. I would just expect return to the HardenedBSD Foundation of any procured hardware.

#HardenedBSD #infosec #osdev

Note to conference organizers: please do not wait until the last second to send out presentation acceptance/rejection letters. Some people require multiple month heads up (like me).

I HOPE (ha!) that they can be better organized next year. Otherwise, I don't think I'll ever submit to HOPE again.

#infosec #FreeBSD #HOPEConference #libhijack

I've got things working! I now suspect the problem was my Framework16 laptop, not the server.

Directing #Radicle to point to my other laptop for the initial seed fetch for both src and ports resulted in success!

So we are officially on to the next step of the process: Integrate Radicle support into the #HardenedBSD ports tree.

Now, time for sleep.

I'm 100% out of ideas. Our servers cannot handle the load the AI/LLM web scraping bots place on #GitLab. #Radicle is turning out to still not be ready for prime-time. I refuse to use #GitHub beyond being a read-only mirror.

Self-hosting our code repos is an absolute requirement in order to provide higher levels of OPSEC than what third-party hosted services can provide.

So, at the hands of our oligarchic overlords, is this the death of HardenedBSD?

Someone please provide me ideas. I have no idea what to try next and I'm desperate.

RIP my SSD

#Radicle is working fine for #HardenedBSD src and ports between two laptops on the same physical network.

But, it's not working in the slightest on the HardenedBSD infrastructure. I cannot get the seed node fully fetching the repos. Radicle just times out.

The biggest issue is that it will try to restart the fetch from the very beginning upon failure.

So we're transmitting the same exact data many, many, many, many, many, many times only to end up failing again.

Radicle should probably archive the data at the point of failure, then when restarting the fetch, it can start from where it left off.

Otherwise, we're experiencing first-hand the populist definition of insanity: doing the same thing over and over and over again but expecting different results.

If we lived in a certain geographic region within the US at the time, my wife would have been counted among the dead: https://www.hrw.org/news/2026/03/06/us-abortion-restrictions-causing-preventable-deaths

She has had at least eight confirmed miscarriages, but more likely somewhere around 12-14.

In one of those cases, she was around 14-18 weeks pregnant (we weren't sure the exact time.) Her hormones had done the usual: going the opposite direction, creating a hostile environment for the fetus.

Not all of the fetus aborted itself naturally. She needed a procedure to remove the rest of the dead tissue.

That procedure she had is medically coded an abortive procedure and would have triggered the anti-abortion laws, even though the pregnancy had ended itself "naturally".

If we lived in one of those geographic regions (Idaho, Utah, a large number of Southern US states), her OB/GYN would have prohibited the procedure since all abortive procedures are banned--regardless of actual circumstances.

The Comet Pro KVM we ordered came in. It's working just fine and dandy with our #HardenedBSD storage server.

I'm thinking that if I combine this with obs-studio, I can get a recording of the faulty boot issue.

But if anyone knows anyone at GL.inet that can get us a donation, that would be cool.

Gonna carve off a few hundred bucks to get three GL.inet Comet Pro KVMs for the #HardenedBSD development infrastructure. The iDRAC in these servers is ancient, don't even support TLSv1.2. So having a more modern option will help, especially after the boot loop issue this morning during a failed upgrade.

Your periodic reminder that university access was free in the 60's/70's in the US in certain regions.

Now we won't even have CPB.

RIP CPB: https://www.usatoday.com/story/news/nation/2026/01/05/corporation-public-broadcasting-dissolved/88036028007/

I really wish Electron wasn't a thing. Second time attempting to build it on a particular system. The build timed out after 72 hours.

Like, what are we doing when a stupid web framework takes so many resources to just compile?

For reference, I can build HardenedBSD's userland and kernel in less than two hours on the same system.

An entire OS builds faster by several multitudes than this stupid web framework bullcrap.

I haven't been paying too close attention, but has there been any progress on #GrapheneOS support for the Pixel 10 line?

how many hummingbirds are in this bottle, do you think?

Buttoning a shirt:

I have published a new build of #hbsdfw (a #HardenedBSD 14-STABLE fork of #OPNsense): https://hardenedbsd.org/~shawn//hbsdfw/hbsdfw_installer_vga_14.2-20241231-212608.iso.xz

This build has been lightly tested. Further testing would be appreciated. I plan to deploy this version on my perimeter firewall on 05 Jan 2025.

This build also integrates the -fzero-call-used-regs=used feature that recently landed in HardenedBSD 15-CURRENT across the entirety of base userland and packages.

Default username: root
Default password: hbsdfw