Posts

• 2026-06-28 · FreeBSD 15.1

  You've Heard of kqueue. Here's Why It's Actually Different (One Interface for Everything)

  Sockets, timers, signals, file changes, process exit: on Linux those are five separate mechanisms. On FreeBSD they're one interface. kqueue isn't just an epoll competitor, it's a unification, and that's the part people miss.

• 2026-06-26 · FreeBSD 15.1

  Every FreeBSD Base Tool Already Speaks JSON (libxo)

  Pipe ls straight into jq on a stock FreeBSD box, with no install. Around a hundred base tools emit JSON, XML, or HTML from the same code path that prints their text. Structured output as a property of the system, not a per-tool afterthought.

• 2026-06-24 · FreeBSD 15.1

  There's a Typed Serialization Library in the Base System, and It Passes File Descriptors (libnv)

  nvlist is a typed, nested, dependency-free serialization primitive in the FreeBSD base system (libnv) that can move open file descriptors between processes. That last property makes it quietly perfect for handing secrets around.

• 2026-06-22 · FreeBSD 15.1

  The Process-as-a-File-Descriptor Idea Finally Got Its Missing Piece

  Process descriptors have been in FreeBSD base since 9.0, but until 15.1 you couldn't reap exit status by descriptor. pdwait closes the loop.

• 2026-06-18 · FreeBSD 15.1

  Your bhyve Command Line Is a Config File in Disguise (bhyve -k)

  bhyve takes a config file (a hierarchical tree of dotted keys with variable expansion) instead of a wall of -s slot flags. And it'll translate your existing command line into that config for you. All in base, no vm-bhyve required.

• 2026-06-16 · FreeBSD 15.1

  FreeBSD's Base System Ships a Test Framework, and It's the Same One the OS Tests Itself With (ATF + Kyua)

  /usr/tests exists on a stock install. The OS ships its own regression suite, run by a framework that's also in base, and nothing stops you pointing it at your own code. C tests, shell tests, isolation, cleanup, reporting, no packages.

• 2026-06-14 · FreeBSD 15.1

  Five Things You're Reimplementing That libc Already Ships

  A bias-free random number, a bitset, a one-call file hash, the program's own name, and human-readable byte sizes. Each is a small thing C programmers rewrite constantly, and each is already in the FreeBSD base system.

• 2026-06-12 · FreeBSD 15.1

  The HTTP Client pkg Uses Is in Base, and You Can Call It in Three Lines (libfetch)

  Fetching a URL from C usually means taking a dependency on libcurl. FreeBSD ships libfetch in base: HTTP, HTTPS, FTP, and file URLs behind one small, regular API that returns a plain FILE *. It's what pkg itself downloads with.

• 2026-06-10 · FreeBSD 15.1

  You Keep Writing readdir Loops. The Tools You Use Don't (fts)

  Walking a directory tree correctly means handling symlink loops, unreadable subdirs, deep nesting, and pre- vs post-order traversal. rm, cp, chmod, ls, and du don't hand-roll that with readdir. They use fts, which is in base and handles the hard parts for you.

• 2026-06-08 · FreeBSD 15.1

  Capsicum: Take Away a Process's Ambient Authority, Then Hand Back Exactly What It Needs

  Most sandboxes filter syscalls: a blocklist you have to get exhaustively right. Capsicum inverts it. cap_enter() drops a process into a world with no ambient authority at all, where the only things it can touch are the descriptors it already holds. This is the capability model, in base, and it's the design the libnv, process-descriptor, and kqueue pieces have all been pointing at.

• 2026-06-06 · FreeBSD 15.1

  Jails Are a Programmable Primitive, Not Just a Sysadmin Tool (libjail, and Lua in Base)

  Everyone knows jail(8) the command. Fewer know jails are a kernel primitive with a C library your application can drive directly, and that FreeBSD's base Lua interpreter ships jail bindings. You can create and manage isolated environments from inside your program, no shelling out.

• 2026-06-04 · FreeBSD 15.1

  Four Footguns the Base System Already Defused

  A temp file without the race, a string copy without the overflow, a password read without the echo leak, and a way to ask 'am I running with privileges someone might be exploiting?' Each replaces a standard-library call that has a subtle security bug, and each is in base.

• 2026-05-29 · FreeBSD 15.1

  Root Isn't a Monolith: How FreeBSD Split Superuser Into ~200 Named Privileges (priv)

  The reason a jail's root can bind low ports but not reboot the host isn't a special case. FreeBSD long ago broke 'uid 0 can do anything' into a couple hundred specific, named privilege checks. That decomposition is why partial root exists at all, and it's a quietly radical piece of the security architecture.