2/3 Also done today:
Checked the Node.js October security release (Brotli CVE-2026-111497). Our streaming server never decompresses untrusted Brotli data, so the risk is low. We'll update as soon as the FreeBSD package is out.
The streaming server now properly verifies the database's TLS certificate.
Rewrote our rc.d scripts the way rc.subr intends: supervisor pidfile, automatic restart after a crash, and "service restart" works on the first try. Background: https://blog.hofstede.it/freebsd-foundationals-rcd-the-service-framework-that-fits-in-your-head/
Package updates on the host and in all jails
nginx: separate cache directories, a nearby DNS resolver (thousands of DNS errors gone) and a catch-all for unknown hostnames
We retired our Tor onion service
Lots of small cleanups after a deep health check
Larvitz :fedora:
npub1fj…jaq90
2026-10-24 09:59:49 UTC
in reply to nevent1q…n377
Author Public Key
npub1fj6u59lnses9xu6xa6ewugrfg2e639lg32r24383525xq3deyuaspjaq90Published at
2026-10-24 09:59:49 UTCEvent JSON
{
"id": "d8fc6467bf3bfa781ad89effcf154e3c4822e047325ff265fe9f05f10681dd60",
"pubkey": "4cb5ca17f38660537346eeb2ee206942b3a897e88a86aac4f1a2a86045b9273b",
"created_at": 1792835989,
"kind": 1,
"tags": [
[
"p",
"4cb5ca17f38660537346eeb2ee206942b3a897e88a86aac4f1a2a86045b9273b"
],
[
"e",
"e8f39a5553b4edddfea054dbe9d2ebf9792033b8d76b7a2597eac8c7c081b0bf",
"",
"root",
"4cb5ca17f38660537346eeb2ee206942b3a897e88a86aac4f1a2a86045b9273b"
],
[
"proxy",
"https://burningboard.net/@Larvitz/117495299409105354",
"web"
],
[
"proxy",
"https://burningboard.net/users/Larvitz/statuses/117495299409105354",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://burningboard.net/users/Larvitz/statuses/117495299409105354",
"pink.momostr"
],
[
"-"
]
],
"content": "2/3 Also done today:\n\nChecked the Node.js October security release (Brotli CVE-2026-111497). Our streaming server never decompresses untrusted Brotli data, so the risk is low. We'll update as soon as the FreeBSD package is out.\n\nThe streaming server now properly verifies the database's TLS certificate.\n\nRewrote our rc.d scripts the way rc.subr intends: supervisor pidfile, automatic restart after a crash, and \"service restart\" works on the first try. Background: https://blog.hofstede.it/freebsd-foundationals-rcd-the-service-framework-that-fits-in-your-head/\n\nPackage updates on the host and in all jails\n\nnginx: separate cache directories, a nearby DNS resolver (thousands of DNS errors gone) and a catch-all for unknown hostnames\n\nWe retired our Tor onion service\n\nLots of small cleanups after a deep health check",
"sig": "b84bbe7d60a780ae3d48ece2c4e4f7c688c15640bc4019e807a83f5d54acf5c4de7e648eb89dc490a1799a47a6d3b382fd568d631bcd3ae96155bc1ae7c5b6b1"
}