[{"categories":null,"contents":"We want our blog to provide much value to our readers. With our origins in open source, we share almost everything that we know. At the same time we want it to be a good experience, so easy to read, quick to load, and not invading any privacy. For that reasons, we made some extreme decisions a while back. No tracking and no cookies are just a few examples. With a changing climate we want to go a few steps further. So while overhauling this blog in 2024, we also focused on being more sustainable and applying eco-friendly measures wherever we can.\nFocus on reducing CPU cycles Every action costs an amount of energy, from development up to you as reader looking at this page. Let\u0026rsquo;s have a look at some of the following measures that we implemented:\nStatic website generator Reduce number of systems Static generator This website uses Hugo , a static website generator, to create and publish the website.\nDevelopment systems Our development systems are also optimized to limit their CPU usage, including running tasks on low-energy devices. Where possible we consolidated systems, unless this was in conflict with security principles that we apply. Some higher risk environments will be separated, but otherwise consolidation is one of the ongoing objectives.\nReducing bandwidth System fonts Compressing assets Increase caching Rate-limit bots Block outdated or misbehaving systems WebP images Using default system fonts This blog now uses system fonts only. By using a so-called font stack that only contains fonts that are commonly available, readers will get typically a font that is optimized for reading text. The additional benefit is speed, as no external font has to be downloaded and processed.\nCompressing assets Most file formats can be compressed. The result is much smaller data transfers, at the cost of some CPU cycles to compress and decompress. In the past we let our web server compress almost all files (except images) using Gzip compression. That means that the web server was doing this so called \u0026lsquo;on-the-fly\u0026rsquo; compression all day. Even for files that were requested thousands of times a day. Nowadays we pre-compress all files and then offer it when a client supports it. For maximum coverage we now support both Brotli and Gzip. This one-time compress action will be done using the best possible compression options, to save bandwidth as much as possible.\nIncrease caching possibilities In the past we had somewhat limited possibilities when it came to caching. So with the 2024 overhaul, we simplified the configuration of our web server yet enhanced caching settings. Based on the content type (MIME types), we provided a hint to clients how long they should cache resources. This way less requests have to be made over the long term.\nRate-limits With the overhaul we implemented more strict rules when it comes to our bandwidth. Our traffic pool is big, but that doesn\u0026rsquo;t mean we can be more progressive in reducing it further. Clients (including bots) that misbehave, get rate-limited. The response returned is HTTP 429 with a message indicating that rate-limiting was applied. When the client does not resolve their issue, we go a step further and block it. We already saw a lot of tools waste a lot of resources, including bandwidth, CPU cycles, and energy.\nBlocking outdated clients This website was made with the \u0026ldquo;open\u0026rdquo; mindset of the web. Almost any client should be able to connect, as long as it is fairly modern. For that reason, we don\u0026rsquo;t use the most strict protocol set. This way somewhat older systems can still connect. At the same time, clients that are outdated or simply don\u0026rsquo;t support basic protocols or technologies, will be blocked. For example, this website will only allow HTTPS connections. Older TLS versions are disabled, as well as older ciphers. Does your client not support at least HTTP 1.1 and content encoding, chances are big that it won\u0026rsquo;t be allowed. These older clients should be updated, so they support the modern web. The benefit is also that less data is required to retrieve content.\nWebP and SVG for images Before we used mostly files in JPEG or PNG format. With WebP being introduced in 2010 and available for some time now, most modern browsers support it. Screenshots and other images were converted to WebP and are the preferred resource. Only if the browser does not support it yet, we provide a fallback to PNG or JPEG. Icons and our logo are now Scalable Vector Graphics (SVG), which provides a much sharper result and a reduced file size.\nMore green energy in the mix With the development of the blog, we also looked at how we can increase the amount of green energy. This is energy from renewable sources, including our own solar panels. That is also why we moved some tasks to during the afternoon, when the most solar energy is available, such as some backup tasks.\nReducing data storage Every website will quickly grow when it comes to storage on the disk or in a database. Although we no longer use a database engine, the storage is still a thing. For that reason, we simplified our backup strategy, including the usage of snapshots. Now we can go back longer in time, while reducing the overall storage needs. Also, the backup structure has been simplified, as everything is now in one directory together. With WordPress this was a combination including the WordPress software, plugins, templates, images on the disk, and the database export. With a much simpler disk structure, it is easier to replicate data or make a standalone copy. For example, for disaster recovery we still want to have multiple types of backups and in different locations.\nDuplicate data reduction The backups above are the only exception now when it comes to duplicate data. While building up our internal website structure, we removed as much as possible to limit data duplicates. So we don\u0026rsquo;t have a development, test, and production environment for the website. One system does the development and testing, the output (generated by Hugo) is then synced to production system. Obviously with an optimized method to reduce time, bandwidth, and CPU cycles.\nUser Experience Design (UX) We want the best possible experience when browsing our website, so we applied multiple measures to improve the blog and its interface.\nUser interface Focus on performance Reduce errors in HTML and CSS Limit JavaScript usage Error handling User interface When redesigning the blog, we applied the Mobile First approach. Articles should be readable (and fast) on a mobile phone, so all clutter was removed. A simple header, content area, and footer is what remains. On larger screens, the content area will be capped to ensure that the article is still easy to read.\nHTML and CSS Using HyperText Markup Language (HTML) and Cascading Style Sheets (CSS) most of the pages are formatted and styled. This blog uses HTML5 and we tried to minimize errors in the syntax. This way it should show correctly on as many devices as possible.\nLimited use of JavaScript JavaScript allows developers to use powerful events within a website. Our focus is on getting articles clearly on your screen without JavaScript when possible. The only exception is our search engine, that runs on the client system itself. It requires some logic processing that by default HTML does not support. For that single page we tried to find a small library that allows you to search in all articles, without any overhead on our systems.\nPerformance of the pages Using the proper HTML and CSS syntax is a good start, but not enough. Keeping it as small as possible decreases the overhead on the client. After all, there is less to process, resulting in pages that load and show quicker. So where we can, we stripped out useless HTML tags and don\u0026rsquo;t use a CSS framework. Instead, we only add CSS when needed for proper display. When adding new pieces, we look directly on how to consolidate and decrease overhead. In this case there is additional value in it, as all CSS is available in a \u0026lt;style\u0026gt; tag. The browser does not have to do an extra HTTP request, but can directly start processing the page. This helps with speeding up the page rendering. For those readers active in web design, magic words like Above the Fold, First Paint, First Contentful Paint (FCP), and Largest Contentful Paint (LCP). In simplified terms that would mean that the shorter the time it takes to achieve these, the quicker a website loads and shows on your screen.\nError handling If a page does not exist (404), we point you to the search engine on the website and a link to main page. This way you can easily navigate to a point that works and might help to find you the information that you were looking for.\nFor search engines we started to respond to outdated pages or assets with HTTP 410 (Gone). This way we want to signal them that they should not retry, and instead focus on pages that do exist.\nQuestions or suggestions? Do you have any feedback for our initiative to make this blog more eco-friendly? Let us know!\n","permalink":"https://bsd-audit.com/sustainable-web-design/","tags":["website"],"title":"Sustainable web design"},{"categories":null,"contents":"Finding memory information and usage on OpenBSD requires a few commands and the right places to look. If you are used to Linux, then commands like free are no longer available. Let\u0026rsquo;s have a look at memory details on OpenBSD.\nMemory capacity One of the easiest methods to find the memory sizes is by using the output of dmesg, which will include hardware information. Filter out the lines that are related to memory and the total and available amount of memory will be displayed.\n# dmesg | grep -i mem real mem = 1056952320 (1007MB) avail mem = 998526976 (952MB) Another option is using sysctl and retrieve the key hw.physmem to find the\n# sysctl hw.physmem hw.physmem=1056952320 Memory usage # top -d 1 load averages: 0.11, 0.09, 0.08 mail.example.org 14:09:32 58 processes: 1 running, 56 idle, 1 on processor up 11 days 02:14:21 CPU states: 0.0% user, 0.0% nice, 0.1% sys, 0.0% spin, 0.9% intr, 99.0% idle Memory: Real: 286M/623M act/tot Free: 338M Cache: 192M Swap: 9296K/1264M PID USERNAME PRI NICE SIZE RES STATE WAIT TIME CPU COMMAND 56989 _rspamd 2 0 114M 93M sleep kqread 11:27 0.00% rspamd 91511 _redis 2 0 18M 4588K sleep kqread 7:34 0.00% redis-server 1803 _rspamd 2 0 98M 79M sleep kqread 6:58 0.00% rspamd 33019 _unwind 2 0 16M 21M sleep kqread 2:48 0.00% unwind 51184 _rspamd 2 0 62M 29M sleep kqread 2:06 0.00% rspamd 70802 www 2 0 2488K 5536K idle kqread 0:56 0.00% httpd 83309 www 2 0 2508K 5520K idle kqread 0:55 0.00% httpd 29351 www 2 0 2504K 5532K idle kqread 0:54 0.00% httpd 94015 root 2 0 48M 5560K sleep kqread 0:29 0.00% rspamd 19307 _ntp 2 -20 1172K 1248K sleep kqread 0:12 0.00% ntpd 81934 james 28 0 1888K 3252K run - 0:09 0.00% sshd-session 31135 _pflogd 4 0 1016K 928K sleep bpf 0:07 0.00% pflogd 25823 _unbound 2 0 13M 13M idle kqread 0:07 0.00% unbound 73436 _unwind 2 0 2492K 3484K idle kqread 0:06 0.00% unwind 18631 root 2 0 1140K 1124K idle kqread 0:04 0.00% cron 3003 _syslogd 2 0 1492K 1460K sleep kqread 0:03 0.00% syslogd 76375 _smtpd 10 0 46M 4740K sleep thrslee 0:03 0.00% filter-senderscore 28284 _smtpd 2 0 5120K 7896K idle kqread 0:01 0.00% smtpd ","permalink":"https://bsd-audit.com/openbsd/memory-information-on-openbsd/","tags":["hardware","memory"],"title":"Show memory information on OpenBSD"},{"categories":null,"contents":"If you are interested in BSD, this is the place for you. It\u0026rsquo;s a sister blog of Linux Audit :-)\nGoals Our goal is to write high-quality content and make it freely available. This way you can use it to secure your systems. Missing a particular subject on the blog or found something that is relevant? Let us know!\nWho is writing? Many of the articles are written by security specialist Michael Boelen . Michael is a security developer and founder of CISOfy. He covers topics within Linux security, from system hardening to compliance and regulations.\nAbout CISOfy This blog is sponsored by CISOfy . Resources are invested into this blog to make BSD and Linux security accessible to a wider audience, from system administrators to auditors and developers.\nFeedback Your comments, ideas, and feedback are welcome! If there is a particular subject you want to see covered in an article, then contact us. Please send us an email at blog @ cisofy.com.\nAbout CISOfy Lynis Screenshot of a Unix security audit performed with Lynis.\nLynis is a battle-tested technical security audit tool . It is open source , freely available, and used by system administrators all over the world. Other users include IT auditors, security professionals like pentesters. Lynis can also be used as a client component in the Lynis Enterprise solution.\nLynis Enterprise Suite For those who maintain more than 10 systems, there is the Lynis Enterprise Suite. It is much more than just Lynis. It includes a central management interface, additional plugins for Lynis, reporting capabilities, a custom implementation guide and more helpful information. For example, it contains extended information regarding each security control. Besides that, it will show you how to solve a finding, manually or with ready-to-use hardening snippets.\n","permalink":"https://bsd-audit.com/about/","tags":null,"title":"About"},{"categories":null,"contents":"Want to share feedback or just want to know more about a particular article or topic? There are a few ways to get in contact.\nMastodon: mboelen E-mail: blog@cisofy.com Guest bloggers In all the years, no single proposal was received with the intention to create a dedicated article without any commercial incentive. For that reason, guest blog posts are closed till further notice.\n","permalink":"https://bsd-audit.com/contact/","tags":["website"],"title":"Contact details"},{"categories":null,"contents":"Privacy is important, so this website limits the amount of information collected.\nThis websites uses:\nLog files to store and process requests, including IP addresses (e.g. abuse of our resources) Webmaster tools such as that of Google and Bing to monitor the health of the website, but no tools like Google analytics. Got any questions regarding privacy? Feel free to ask via the contact page.\n","permalink":"https://bsd-audit.com/privacy-policy/","tags":null,"title":"Privacy Policy"},{"categories":null,"contents":"","permalink":"https://bsd-audit.com/website/sitemap/","tags":["website"],"title":"Sitemap"},{"categories":null,"contents":"This page contains the most recent changes to the blog.\n","permalink":"https://bsd-audit.com/website/latest-changes/","tags":["website"],"title":"Latest changes"}]