From george at ceetonetechnology.com  Wed Aug  5 17:06:28 2026
From: george at ceetonetechnology.com (George Rosamond)
Date: Wed, 5 Aug 2026 17:06:28 -0400
Subject: Tonight NYC*BUG: jpb on VIDAR
Message-ID: <e10ad528-e598-400e-a8f5-58759ee980d7@ceetonetechnology.com>

Note jpb will be remote, but there will be people watching at the Brass
Monkey

**

 VIDAR - Server Protection for Internet facing FreeBSD Servers, Jim Brown
2026-08-05 @ 18:45 local (22:45 UTC) - Backroom of Brass Monkey 55
Little West 12th St

Vidar is a combination of programs, a PostgreSQL database, and the SEC
correlator engine that reads logfiles from authentication, email
(postfix), and web server (nginx), (and potentially any other logs) and
takes action based on SEC rules to add e ntries to an IPFW firewall. In
concept it is similar to fail2ban and has some features in common with
blocklistd.

SEC reads the logs in real time and based on its rules and correlations,
outputs metadata that is piped to a process that inserts the events into
a PostgreSQL database and further pipes the offending IP address to a
script that updates a table named ?BAD? in IPFW. This table is read by
IPFW rules to block offending external systems from wreaking havoc on a
FreeBSD host.

A corresponding table named GOOD contains whitelisted IP addresses so
you don?t accidentally lock yourself out.

<RANT>

Are you sick and tired of seeing:

2a03:b0c0:3:d0::402:d001 - - [31/Jan/2026:17:37:17 -0500]
\x16\x03\x01\x05\xDE\x01 ...

in your nginx logs and sick of seeing:

Feb 20 16:36:03 jimby dovecot[59472]: imap-login: Disconnected:
Connection closed (no auth attempts in 5 secs): user=<>,
rip=206.168.34.125, lip=174.136.97.66, TLS: Connection closed, ...

in your mail logs and sick of seeing:

Feb 20 12:47:58 jimby sshd-session[47730]: Invalid user zzzz from
2607:f170:44:12::5d0 port 520

in your authentication logs?

With Vidar, you get to put the hammer down:

?If you abuse my system, I will shut you out. Permanently.?

</RANT>

Vidar has additional tricks - a way to dump the IPFW BAD table and a way
to import it later - you can keep this database of shame up to date on
all those miscreants and keep them away. You can even import the BAD
table on another FreeBSD system running IPFW. Also, there?s a handy
audit script that lets you compare the entries in the database with what
is actually in the IPFW BAD table. Also, Vidar keeps the evidence of the
event in question that resulted in blocked access. Finally, using SEC
rules, you can make the block last for an hour (for a misconfigured
remote system) or a day (for a script kiddie), or permanently (for a
determined hacker), or any length of time you choose.

There is also a feature to check live processes and alert if, for
example, the vi editor is running at 2:00am in the morning.

Jim Brown is a long time BSD aficionado who currently lives in Durham, NC.

Nearest NYC Subway is the 14th Street/Eighth Avenue station L, A, C, E.

To get to the backroom, you must enter the front door, follow the long
bar on your left, and walk all the way to the back. At the rear of the
BrassMonkey, you will see an alcove for the 3 bathrooms our room is off
to your right.

From jamex1642 at gmail.com  Fri Aug  7 23:55:27 2026
From: jamex1642 at gmail.com (Jamex1642 Jamex1642)
Date: Sat, 8 Aug 2026 00:55:27 -0300
Subject: Tonight NYC*BUG: jpb on VIDAR
In-Reply-To: <e10ad528-e598-400e-a8f5-58759ee980d7@ceetonetechnology.com>
References: <e10ad528-e598-400e-a8f5-58759ee980d7@ceetonetechnology.com>
Message-ID: <544F7B89-DA16-4664-85C2-C7D9B99CCF97@gmail.com>

On Aug 5, 2026, at 6:07?PM, George Rosamond <george at ceetonetechnology.com> wrote:
> 
> ?Note jpb will be remote, but there will be people watching at the Brass
> Monkey
> 
> **
> 
> VIDAR - Server Protection for Internet facing FreeBSD Servers, Jim Brown
> 2026-08-05 @ 18:45 local (22:45 UTC) - Backroom of Brass Monkey 55
> Little West 12th St
> 
> Vidar is a combination of programs, a PostgreSQL database, and the SEC
> correlator engine that reads logfiles from authentication, email
> (postfix), and web server (nginx), (and potentially any other logs) and
> takes action based on SEC rules to add e ntries to an IPFW firewall. In
> concept it is similar to fail2ban and has some features in common with
> blocklistd.
> 

Hey this sounds great. 
I like the idea of simplicity in that it sec that fits it all together generally . Correlations  in time is mechanism for the start of the most  transaction. Just kidding around but what about a grey listed database in the spirit of spamd such that certain ips are considered tainted and grey listed among the good guys , then you could bump the interval the badder the offender ? more spurious hits across more sites .. higher correlations ~ then the snowball might melt .. of course you might have some problems with malicious use of that feature !!! Haha  .. the future is time .. miss the nycbug studs,

Cheers James 

Ps Running /usr/games/factor $( date +%s ) on OpenBSD is fun .. remove the new line and the let the stuff scroll .. zoom it out by decreasing yo font size .. over rover . 


> SEC reads the logs in real time and based on its rules and correlations,
> outputs metadata that is piped to a process that inserts the events into
> a PostgreSQL database and further pipes the offending IP address to a
> script that updates a table named ?BAD? in IPFW. This table is read by
> IPFW rules to block offending external systems from wreaking havoc on a
> FreeBSD host.
> 
> A corresponding table named GOOD contains whitelisted IP addresses so
> you don?t accidentally lock yourself out.
> 
> <RANT>
> 
> Are you sick and tired of seeing:
> 
> 2a03:b0c0:3:d0::402:d001 - - [31/Jan/2026:17:37:17 -0500]
> \x16\x03\x01\x05\xDE\x01 ...
> 
> in your nginx logs and sick of seeing:
> 
> Feb 20 16:36:03 jimby dovecot[59472]: imap-login: Disconnected:
> Connection closed (no auth attempts in 5 secs): user=<>,
> rip=206.168.34.125, lip=174.136.97.66, TLS: Connection closed, ...
> 
> in your mail logs and sick of seeing:
> 
> Feb 20 12:47:58 jimby sshd-session[47730]: Invalid user zzzz from
> 2607:f170:44:12::5d0 port 520
> 
> in your authentication logs?
> 
> With Vidar, you get to put the hammer down:
> 
> ?If you abuse my system, I will shut you out. Permanently.?
> 
> </RANT>
> 
> Vidar has additional tricks - a way to dump the IPFW BAD table and a way
> to import it later - you can keep this database of shame up to date on
> all those miscreants and keep them away. You can even import the BAD
> table on another FreeBSD system running IPFW. Also, there?s a handy
> audit script that lets you compare the entries in the database with what
> is actually in the IPFW BAD table. Also, Vidar keeps the evidence of the
> event in question that resulted in blocked access. Finally, using SEC
> rules, you can make the block last for an hour (for a misconfigured
> remote system) or a day (for a script kiddie), or permanently (for a
> determined hacker), or any length of time you choose.
> 
> There is also a feature to check live processes and alert if, for
> example, the vi editor is running at 2:00am in the morning.
> 
> Jim Brown is a long time BSD aficionado who currently lives in Durham, NC.
> 
> Nearest NYC Subway is the 14th Street/Eighth Avenue station L, A, C, E.
> 
> To get to the backroom, you must enter the front door, follow the long
> bar on your left, and walk all the way to the back. At the rear of the
> BrassMonkey, you will see an alcove for the 3 bathrooms our room is off
> to your right.

From mcevoy.pat at gmail.com  Sat Aug  8 07:46:03 2026
From: mcevoy.pat at gmail.com (Pat McEvoy)
Date: Sat, 8 Aug 2026 07:46:03 -0400
Subject: NYC*BUG September 2nd  talk or social?
Message-ID: <8479458E-BBD0-4E0D-AA00-F953E09F21BC@gmail.com>

Does anyone have a talk they would like to give for our September 2nd meeting?
If we don't have a talk, then we will have a social. 

From mcevoy.pat at gmail.com  Sun Aug  9 13:45:52 2026
From: mcevoy.pat at gmail.com (Pat McEvoy)
Date: Sun, 9 Aug 2026 13:45:52 -0400
Subject: NYC*BUG September 2nd  talk or social?
In-Reply-To: <8479458E-BBD0-4E0D-AA00-F953E09F21BC@gmail.com>
References: <8479458E-BBD0-4E0D-AA00-F953E09F21BC@gmail.com>
Message-ID: <973A74CC-91B7-48FC-B154-D465C7DEC9AE@gmail.com>

Hey Folks 
Unless someone else has a better topic, I propose using the Sept 2nd NYC*BUG meeting to test a EuroBSDCon streaming/IRC bot /   Peertube / discord  system I want to have worked out for the conference. Feel free to bring you discord / IRC clients and we will kick it around and find the sharp edges at the meeting instead of during the conference. This would help our remote community interact with and enjoy conference content in as smooth a fashion as possible. So more testing and walking through how the community plans to integrate this disparate systems into a functioning conference communication system. 
Thoughts?

Patrick McEvoy


> On Aug 8, 2026, at 07:46, Pat McEvoy <mcevoy.pat at gmail.com> wrote:
> 
> ?Does anyone have a talk they would like to give for our September 2nd meeting?
> If we don't have a talk, then we will have a social.

From jpb at jimby.name  Sun Aug  9 20:00:19 2026
From: jpb at jimby.name (jpb)
Date: Sun, 9 Aug 2026 20:00:19 -0400
Subject: NYC*BUG September 2nd  talk or social?
In-Reply-To: <973A74CC-91B7-48FC-B154-D465C7DEC9AE@gmail.com>
References: <8479458E-BBD0-4E0D-AA00-F953E09F21BC@gmail.com>
 <973A74CC-91B7-48FC-B154-D465C7DEC9AE@gmail.com>
Message-ID: <20260809200019.1c284bdc@jimby.name>


Great idea Pat.  Happy to help test.

Jim B.


On Sun, 9 Aug 2026 13:45:52 -0400
Pat McEvoy <mcevoy.pat at gmail.com> wrote:

> Hey Folks 
> Unless someone else has a better topic, I propose using the Sept 2nd
> NYC*BUG meeting to test a EuroBSDCon streaming/IRC bot /   Peertube /
> discord  system I want to have worked out for the conference. Feel
> free to bring you discord / IRC clients and we will kick it around
> and find the sharp edges at the meeting instead of during the
> conference. This would help our remote community interact with and
> enjoy conference content in as smooth a fashion as possible. So more
> testing and walking through how the community plans to integrate this
> disparate systems into a functioning conference communication system.
> Thoughts?
> 
> Patrick McEvoy
> 
> 
> > On Aug 8, 2026, at 07:46, Pat McEvoy <mcevoy.pat at gmail.com> wrote:
> > 
> > ?Does anyone have a talk they would like to give for our September
> > 2nd meeting? If we don't have a talk, then we will have a social.  


From jpb at jimby.name  Sun Aug  9 20:46:13 2026
From: jpb at jimby.name (jpb)
Date: Sun, 9 Aug 2026 20:46:13 -0400
Subject: Test - please ignore
Message-ID: <20260809204613.5d4e97fe@jimby.name>


Testing a change to my dkim milter.  Now using relaxed/relaxed
canonicalization instead of simple/simple.

Hoping to not have OpenDMARC complain anymore... :-)

Anyway - sorry for the noise,
Jim B.

From pete at nomadlogic.org  Mon Aug 10 14:30:34 2026
From: pete at nomadlogic.org (Pete Wright)
Date: Mon, 10 Aug 2026 11:30:34 -0700
Subject: NYC*BUG September 2nd talk or social?
In-Reply-To: <973A74CC-91B7-48FC-B154-D465C7DEC9AE@gmail.com>
References: <8479458E-BBD0-4E0D-AA00-F953E09F21BC@gmail.com>
 <973A74CC-91B7-48FC-B154-D465C7DEC9AE@gmail.com>
Message-ID: <38d760d6-b5a4-4eae-8293-6a4de280c9b0@nomadlogic.org>



On 8/9/26 10:45, Pat McEvoy wrote:
> Hey Folks
> Unless someone else has a better topic, I propose using the Sept 2nd NYC*BUG meeting to test a EuroBSDCon streaming/IRC bot /   Peertube / discord  system I want to have worked out for the conference. Feel free to bring you discord / IRC clients and we will kick it around and find the sharp edges at the meeting instead of during the conference. This would help our remote community interact with and enjoy conference content in as smooth a fashion as possible. So more testing and walking through how the community plans to integrate this disparate systems into a functioning conference communication system.
> Thoughts?
> 
i'd be happy to help remotely from california - sounds like a great idea :)

-pete

-- 
Pete Wright
pete at nomadlogic.org


From edlinuxguru at gmail.com  Mon Aug 10 22:34:45 2026
From: edlinuxguru at gmail.com (Edward Capriolo)
Date: Mon, 10 Aug 2026 22:34:45 -0400
Subject: another AI question
In-Reply-To: <adZ_XRHb5X3uhWNv@cons.org>
References: <3153f3cb-b40e-4d6a-b34d-5ea273a10f7f@ceetonetechnology.com>
 <E8937AC4-736E-416E-A1A2-9FDA67F2CC42@longcount.org>
 <adV8HUzUbfLBoQqD@cons.org> <adZ_XRHb5X3uhWNv@cons.org>
Message-ID: <CAENxBwwZkYne-Nfnit+FeTzjv-TQ8VQXezbE+nhy5igg6J8UCg@mail.gmail.com>

On Wed, Apr 8, 2026 at 12:17?PM Martin Cracauer <cracauer at cons.org> wrote:

> Martin Cracauer wrote on Tue, Apr 07, 2026 at 05:50:21PM -0400:
> > The situation with LLMs on FreeBSD is not totally catastrophic.
> >
> > The NVidia drivers are currently broken on my 5090, so I cannot
> > compare Vulkan/FreeBSD to Linux/Cuda.
>
> Made them work, you need loader.conf
> hw.nvidia.registry.EnableGpuFirmware=17
>
> Performance on bartowski/Qwen_Qwen3.5-27B-GGUF:Q6_K_L in llama.cpp is:
> - FreeBSD Vulkan 49 tokens/second
> - Linux CUDA 56 tokens/second
>
> Will get Linux/Vulkan numbers when I have a chance.
>
> But this is encouraging.  Windows was also 10% slower than Linux.
>
> Martin
>
> > But they work on my 2080ti with Vulkan and run both ollama and
> > llama.cpp, accelerated.
> >
> > On my laptop with "AMD Ryzen 7 PRO 4750U with Radeon Graphics" also
> > runs Vulkan and accelerates ollama (although only by a factor of 3
> > compared to CPU).  This combo does not run llama.cpp
> >
> > Now that NVidia drivers are running on at least one of my cards I'll
> > give it another go to run CUDA through Linuxulator.
>
> That go failed.  No CUDA on Linuxulator still.
>
> Martin
> --
> %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
> Martin Cracauer <cracauer at cons.org>   http://www.cons.org/cracauer/


A while back I did mention I wanted to do a port but it slipped my mind.
Here you go: https://github.com/freebsd/freebsd-ports/pull/579

To get a taste for it:
${LOCALBASE}/bin/curl -fsS --no-buffer -H 'Content-Type: application/json' \
-d '{"model":"Qwen3-0.6B-JQ4","stream":true,"max_tokens":384,"chat_template_kwargs":{"enable_thinking":false},"messages":[{"role":"user","content":"Deliverance
is an AI Inference engine that runs on Java and can leverage native code
for optimizations. Tell me why FreeBSD is a great operating system to run
Deliverance."}]}' \
FreeBSD is a great operating system to run Deliverance, a powerful AI
inference engine, for several reasons:\n\n1. **Open-Source and
Community-Driven**: \n FreeBSD is an open-source operating system, which
means it's free for all users. This is a significant advantage for
developers who want to run Deliverance without additional licensing costs.
The community is active and supportive, which means there's a strong
support system for developers and users alike.\n\n2. **High Performance and
Scalability**: \n FreeBSD is known for high performance and scalability.
This makes it ideal for running large-scale AI inference systems like
Deliverance, which can handle high computational demands. The operating
system is optimized for speed and efficiency, which is crucial for
real-time applications.\n\n3. **Cross-Platform Compatibility**: \n FreeBSD
is a Unix-like operating system, which means it works well on a wide range
of hardware, including desktops, servers, and embedded systems. This makes
it a great choice for developers who want to run Deliverance on various
platforms.\n\n4. **Customization and Flexibility**: \n FreeBSD is highly
customizable, allowing users to tailor the system to their specific needs.
This flexibility is important for developers who want to build their own AI
inference engines or integrate Deliverance with existing systems.\n\n5.
**Security and Reliability**: \n FreeBSD is known for strong security
features, which is essential for an AI inference engine that may be used in
production environments. The operating system is secure and reliable,
ensuring that Deliverance can be deployed safely and efficiently.\n\nIn
summary, FreeBSD is a great choice for delivering AI inference engines like
Deliverance due to its open-source nature, high performance, cross-platform
compatibility, and strong security features.

The way this is built I spend the majority of my time playing with small
models. The output above is from the QWEN 3 0.6B. I think you get about 100
tokens per second (with that model and moderate hardware like a 16GB mac).
I run 4B quantized on the same gear. On some modest servers with ~32 RAM i
run mixtral (quantized) as it is mixture of experts each token is only
using an "experts" worth of the weights.

Java 25 has support for panama which is SIMD, yet portable. Interestingly
that allows you to mix-and-match and even run an ARM based SIMD pipeline on
an X86. You wouldn't want to do that but it is nice for testing. There are
two levels to the native library support. The first is SIMD not in Panama
but hand rolled c-code.For some sets of operations the memory bandwidth on
CPU is the biggest factory and the native will not yield huge benefits over
Panama, in other cases it does.

The second level of native is GPU. This is using web GPU/dawn. This hasn't
been a huge focus but some parts of the decode pipeline use the GPU. With
dawn you dont need say 4 GB of cuda libs then 4 more GB blast libs, somehow
a 9MB library lets you build shaders.

The way the project is structured it is #writeonceinferenceanyware the port
uses pure Panama, and you can build the other stuff if you are feeling up
to the task. You can have fun reading all of
https://www.reddit.com/r/freebsd/comments/11nqzo0/nvidia_gpu_on_freebsd/

So that is the hook, give the port a try. The longest part is probably
downloading the model.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.nycbug.org:8443/pipermail/talk/attachments/20260810/661f5baf/attachment-0001.htm>