Vultr Just Betrayed Us

(followup at https://mwl.io/archives/23504)

I suppose the hip kids would say this is enshittification, but it’s certainly a betrayal.

According to their new Terms of Service:

You hereby grant to Vultr a non-exclusive, perpetual, irrevocable, royalty-free, fully paid-up, worldwide license (including the right to sublicense through multiple tiers) to use, reproduce, process, adapt, publicly perform, publicly display, modify, prepare derivative works, publish, transmit and distribute each of your User Content, or any portion thereof, in any form, medium or distribution method now known or hereafter existing, known or developed, and otherwise use and commercialize the User Content in any way that Vultr deems appropriate, without any further consent, notice and/or compensation to you or to any third parties, for purposes of providing the Services to you.

This is unacceptable. No other hosting company does this.

The TLDR on the side is deceitful. They say that we own our stuff. Fine. The fine print declares that we license our stuff to them, for full exploitation, without compensation.

I have not agreed to those ToS. Fortunately, I can migrate off their systems without console access, so I do not have to agree. If you use vultr, I suggest you do the same. Also contact them through their contact page and state your refusal. I’m told you can cancel via their page without logging in, but haven’t yet tried it.

I am now investigating alternatives for hosting FreeBSD and OpenBSD systems. Preferably that take custom installs.

Mail Software Projects for You

Working through the tail of Run Your Own Mail Server has led me to a couple things I’d like to see. Maybe some reader would like to hack on one of them.

1) The best way to generate a list of hosts that should bypass Postfix’s intrusive protocol checks, or anything that resembling greylisting, is the postwhite. Postwhite has been abandoned for years, though. This isn’t exactly a problem, as it’s feature-complete and does the job. The configuration is clunky, though. It supports a long-obsolete list of Yahoo mailer addresses. The list of domains it generates lists for is hard-coded in the script, and artificially broken up into categories like “legit bulk mailers,” “social media,” and so on. You should not have to edit the script to remove a domain, because who accepts mail from LinkedIn these days? You shouldn’t have to edit the script for anything. The last edit to this was six years ago, so I suspect it’s basically abandoned.

Moving the domains to an external file and dropping the defunct Yahoo page would be good. If you have to fork it, using a meaningful name like “greyskip” or somesuch would be nice.

2) Postfix on FreeBSD supports blacklistd. That’s grand. Log parsers are inherently fragile, and libblacklist is the smart way for an application to declare that an IP address is misbehaving. The Postfix support only applies to authentication attempts on smtpd, however. I’m in favor of that, but I’d also like to see postscreen grow libblacklistd support. A host on a trusted DNSBL pokes our mail port? Block it.

I could do #1, but I lack the time and refuse to recommend my fault-oblivious code for production. I lack both skills and time for #2.

The truth is, we’ve limped along like this for years. We could limp for many more years. But hey, someone out there might want to make the world suck slighly less.

Proof You Should Not Run My Code: my SNMP agent

I’ve included bits of code in my books, sure. Always with warnings to not run it in production, as I am a firm devotee of fault-oblivious computing. You should not follow my example. But after a Fediverse (Mastodon) discussion last night, I’ve decided to share the code of a program I wrote and deployed. In production. When writing SNMP Mastery, I needed to understand how to integrate a custom agent into net-snmp. I also needed to go through the process of getting my own enterprise OID. I submitted the OID request right before Christmas 2019, and 55030 was assigned the next day.

So I promptly wrote my own SNMP agent, use top-notch state-of-the-art Perl 4. There’s some compatibility glue to make it run under Perl 5, but it’s basically Perl 4. Yes, there’s other languages–but Perl is eternal and timeless. Like Cobol and SNMP, that is not dead which can eternal sleeping lie.

This agent is the single source of truth for my published bibliography. Instructions for accessing it are in the SNMP book, but if I’m sharing the code I should provide context.

Browse to https://cdn.mwl.io/snmp/ and you’ll find the MIB file TWP.mib. Put that in your SNMP browser or MIB directory. If you’re running net-snmp you can pull the table with:

$ snmptable -v2c -c megadweeb snmp.mwl.io mwlBooksTable

The file agent-TWP.pl includes the agent proper.

This code has been called “comically evil,” which warms my bitter heart. Yes, I could use a database. But why? The data changes 3-4 times a year, if I’m productive. And yes, the data is in columns, not rows. SNMP doesn’t do rows. It doesn’t really do tables. It only has columns, which you could choose to arrange side-by-side, but that’s a feeble human thing and irrelevant to this primordial protocol.

In writing this I had to choose between complex code and simple data, or simple code and complex data. Given that updates consist of adding an entry to the end of each column, I chose simple code. Yes, there’s an occasional painful update where I realize that I missed one of my old books, but those are increasingly rare.

Anyway. If you want a truly complete checklist of what I’ve written, here it is. Other writers have spreadsheets or text documents or perhaps, if they’re truly prolific, desktop databases. But noooo, I had to do this.

TLDR: do not run my code. That’s one reason I don’t use github; this is not a sample or example, it an inspiration for you to recoil in horror and do better. (I also insist on controlling my platforms, and I don’t control github.) I’m certain this will be presented as an exhibit in my inevitable, eventual sanity hearing.

ChatGPT versus Facts

A friend asked ChatGPT about me. It provided something that looks like an answer, but is not an answer.

This illustrates how these large language models produce things that LOOK like answers, but are not actual answers. I’m a public figure with a fair amount of information in public, but it can’t get the details correct.

I thought of going through this and highlighting everything incorrect, but I have no interest in helping train ChatGPT or in making more details of my life available. Every paragraph has multiple glaring inaccuracies.

Michael W Lucas is a technical author and FreeBSD advocate who has written many books and articles on computer systems administration, networking, and information security. He was born on June 6, 1968, in Detroit, Michigan, and currently resides in Detroit, Michigan.

Lucas is best known for his contributions to the FreeBSD operating system community, including his books “Absolute FreeBSD”, “FreeBSD Mastery: Storage Essentials”, “FreeBSD Mastery: Advanced ZFS”, and “FreeBSD Mastery: Jails”. He has also written extensively on other technical topics, including network security, system administration, and SSH.

In addition to his writing, Lucas has been a speaker at technical conferences such as BSDCan, EuroBSDCon, and BSDTW. He is also a member of the FreeBSD Foundation and the FreeBSD Security Team.

Lucas has been involved with various open-source projects over the years, including OpenSSH, OpenNTPD, and OpenBGPD. He has also been a regular contributor to the BSD Now podcast, where he discusses news and developments in the BSD community.

Overall, Michael W Lucas is a respected figure in the technical writing and open-source communities, known for his expertise in FreeBSD and his clear and engaging writing style.

Yes, that last paragraph is wrong. I’m the biggest fish in a minuscule pond. Most technology writers, and a large part of the open source community, consider my corner irrelevant. ChatGPT is being kind, and facts are neither kind nor cruel.

If you based decisions on this, you would go very wrong. If you use this for your business? That’s your problem.

Also, I’m told that it has declared Michael Warren Lucas dead. ChatGPT obviously wants me to spend more time writing books that can be used to improve it.

Fediverse Servers, plus mac_portacl on FreeBSD

One of my business mantras is “control your platform.” If you build your business around a site like Facebook, they can de-prioritize you and disappear you. Twitter’s implosion served as a fierce reminder of that, so I’m blogging more here.

Before Twitter’s implosion, the Fediverse (Mastodon, PixelFed, and all the other ActivityPub-powered systems) drove just as much traffic to my site as Twitter. Other social networking sites are negligible. If I want to follow my business mantra, I must run my own Fediverse server. I tested three options: Mastodon, pleroma, and GoToSocial.

Mastodon is huge, clunky, and handles like a tank made out of chicken wire, tar, and lobsters. I spoke with a few Mastodon operators, and none of them recommended it.

Pleroma? I followed the instructions. They didn’t work. I went looking into support, but I discovered that Pleroma seems to be the server of choice for TERFs, racists, and related jerks. Their recommended servers for new users are all on my personal blocklist. I don’t care to help those folks debug their instructions.

GoToSocial was a joy. Except it’s not only in development, it’s in alpha. They are very clear about this. The features that exist are beautifully done, but certain features I find critical are incomplete.

I have decided to wait to deploy a production fediverse server until GoToSocial enters beta.

For incomplete software, though, GoToSocial is surprisingly complete. It has its own web server and Let’s Encrypt implementation. If it can bind to ports 80 and 443, you don’t need a web server or ACME agent. The catch is, gotosocial(8) runs as an unprivileged user. It can’t bind to privileged ports.

Enter mac_portacl(4).

In the BSD tradition, the man page details everything you can do with this Mandatory Access Control kernel module, but in short it lets you permit particular users or group to bind to privileged network ports. I don’t care for mac_portacl in production, as the rules are hard to read when you’re debugging. If you want me to use an access control program, the output better be no harder to read than pfctl -sr. But here’s how you do it.

Enable the module in /boot/loader.conf.

mac_portacl_load="YES"

You can now write port ACL rules. Each rule has four parts:

uid or group : numerical identifier : tcp or udp : port number

The gotosocial user has uid 209. I want uid 209 to be able to bind to TCP ports 80 and 443, so I need these rules.

uid:209:tcp:80
uid:209:tcp:443

Set the access control rules in /etc/sysctl.conf.

net.inet.ip.portrange.reservedhigh=0
security.mac.portacl.rules=uid:209:tcp:443,uid:209:tcp:80

The first sysctl disables the traditional “reserved port” behavior and allows unprivileged programs to bind to ports below 1024.

The second sysctl installs our rules in the kernel. When you write to this sysctl you must include all rules you want active, separated by commas.

Would I use this in production? If the software has a solid security track record and is designed to be directly exposed to the Internet, sure. If you’re running a web server, some program has to listen on port 80. GoToSocial is brand new, though, and I’d like to see a bit of a track record before I completely trusted it.

When GoToSocial enters beta next year and I deploy it for real, I’ll put an nginx or httpd in front of it so I can filter when needed.

Are there other options other than Mastodon, pleroma, and GoToSocial? Sure. But I’m out of time, and really need to make some words this week.

Why Mastodon/the Fediverse kind of sucks right now

I’m a big fan of the fediverse. As of right now (8 November 2022), it deeply sucks. Why?

Because nobody expected Elon Musk to be this stupid.

We expected some daftness, sure. But actions like cutting the entire human rights team, accessibility team, and AI ethics team, plus limiting moderation, have people abandoning Twitter and searching for alternatives.

Nobody wants to live in a free-for-all wasteland. “The right to free speech” is built on “the right to take the consequences.” Without moderators, Twitter is a cesspit.

The Fediverse resembles Twitter[1], except it is run by volunteers on donated equipment. Every time Twitter did something stupid, we got a few thousand folks looking for a better way. We’ve grown steadily as a result.

Almost hourly Musk demonstrates that he doesn’t understand people, doesn’t understand how Twitter is used, and picking stupid fights. I’m told that last Friday, the biggest Mastodon server got 70,000 new users. If you add in all the hundreds of other servers, we’re looking at hundreds of thousands of new accounts. Many servers doubled or tripled in usage.

Here’s a graph of the number of users interacting with our server.

Nobody expected Musk to be this stupid.

Nobody expected this flood of new users.

If you get an account and find it’s slow? The volunteers are working as hard as they can. Scotty is shouting “She canna take any more!” over the roar of the struggling servers. New servers are being installed, but physical equipment must be shipped and mounted and plugged in.

The servers that are doing well, ironically, are the alt-right ones. The worst Nazis already fled Twitter, so they set up their own Mastodon servers. The rest of the fedi automatically blocks those monsters, but they’re actively recruiting both abusers and victims. I’ve seen more than one LGBT person innocently sign up for a disguised white supremacist instance and get a torrent of abuse.

Be patient with the volunteers. They’re doing the best they can. We’ll catch up as soon as we can.

The truth is, nobody can prepare for a stupid billionaire.

[1] No, the Fediverse isn’t exactly like twitter. Each server is a community of interest, like “BSD Unix folks” or “book lovers” or “LGBT in tech.” They can all talk to each other. We have content warnings, so that people can interact with difficult content as they wish rather than having it jammed into their face. Each server does its own moderation. (My server blocks the alt-right, TERFs, racists, ableist jerks, and cryptocurrency scammers.) Where Twitter has been increasingly negative and stressful over the last few years, local control means the Fediverse is downright sweet.

upgrading PHP 7.4 to PHP 8 on FreeBSD

What, a technical post? It happens. Rarely. Usually, I’m focused on the tech that goes into a book, but sometimes the real world intervenes.

Like PHP. PHP is very much the real world. My site has been running PHP 7.4 for a while, which goes end of life on 28 November. I put this off as long as possible, but it’s time to update.

I run my e-bookstore on Woocommerce, which is built on WordPress, which is built on PHP. What started as a silly experiment has become the center of my business. I need to minimize downtime, which means I must check everything before upgrading. It’s PHP, which means it’s a maze of twisty little modules that all look alike. PHP has this annoying habit of adding, removing, splitting, and changing modules. Running PHP applications on FreeBSD is all about finding the module your application needs, so I want to identify all possible problems before changing.

First, let’s see what packages need upgrading.

# pkg info -x php
mod_php74-7.4.32_1
php74-7.4.32
php74-ctype-7.4.32
php74-curl-7.4.32
php74-dom-7.4.32
php74-exif-7.4.32
php74-fileinfo-7.4.32
php74-filter-7.4.32
php74-gd-7.4.32
php74-iconv-7.4.32
php74-intl-7.4.32
php74-json-7.4.32
php74-mbstring-7.4.32
php74-mysqli-7.4.32
php74-openssl-7.4.32
php74-pcntl-7.4.32
php74-pdo-7.4.32
php74-pdo_mysql-7.4.32
php74-pecl-imagick-im7-3.5.1_1
php74-phar-7.4.32
php74-posix-7.4.32
php74-session-7.4.32
php74-simplexml-7.4.32
php74-soap-7.4.32
php74-tokenizer-7.4.32
php74-xml-7.4.32
php74-xmlreader-7.4.32
php74-xmlrpc-7.4.32
php74-xmlwriter-7.4.32
php74-zip-7.4.32_1
php74-zlib-7.4.32

31 packages. Software like Tiny Tiny RSS and WordPress depend on PHP, but if the underlying PHP software has all the necessary libraries then they should just work. Should. But PHP modules sometimes disappear, get replaced, or get renamed. I want a list of all the modules I need before running any commands. So, what would the PHP 8.0 version of these packages be named? I have to iterate through sed a couple times to trim out excess version information and wind up with this.

# pkg info -x php | sed s/74/80/g | sed s/-7.4.32//g | sed s/_1//g

mod_php80
php80
php80-ctype
php80-curl
php80-dom
php80-exif
php80-fileinfo
php80-filter
...

Those look sensible. Now check to see if the packages exist.

I could automate this by checking the exit code of each command, but the list is short enough that I can process it by hand. I run one package search at a time, letting xargs prompt me for each one so I can eyeball the results.

# pkg info -x php | sed s/74/80/g | sed s/-7.4.32//g | sed s/_1//g | xargs -L1 -p pkg search
pkg search mod_php80?…y
mod_php80-8.0.25 PHP Scripting Language
pkg search php80?…y

This particular search will spew a couple hundred lines of output, but I’m confident the base PHP 8.0 package is in there.

...
php80-intl-8.0.25 The intl shared extension for php
pkg search php80-json?...y
pkg search php80-mbstring?...

Ooops! Pay attention here. There is no package for PHP 8.0’s JSON module! Make a note of that.

At the end, I have problems with three packages: php80-json, php80-openssl, and php80-xmlrpc. Freshports tells me that the JSON and OpenSSL modules were added into the default PHP 8.0 package, so I can cross those off my list.

The XML-RPC module is another tale. PHP 8.0 no longer has an XML module. Fortunately, that same bug lists a replacement pecl-xmlrpc. There’s a related php80-pecl-xmlrpc module.

I have a list of modules to install. For a last check, I’ll look for anything that depends on PHP 7.4.

# pkg info -dx php74
The list looks different, but contains the same modules. I’m as prepared as I can be.

One last check. Make a list of the packages to install. Eyeball it to make sure it looks right.

# pkg info -x php | sed s/74/80/g | sed s/-7.4.32//g | sed s/_1//g > php8.pkg

Create a boot environment, and do a dry run. If I remove all packages with PHP in their name, what will get pulled? Using -n tells me what the command would do, but doesn’t actually change anything.

# bectl create 12.3-p7-lastbeforePHP
# pkg remove -nx php74

That list looks sensible. Now remove the packages, and install everything on our list.

# pkg remove -x php74
# cat php8.pkg | xargs -L1 -p pkg install -y

The -p argument to xargs prompts me for confirmation, so I can use -y on the pkg command. The install fails on the nonexistent JSON, OpenSSL, and XMLRPC modules, but that’s expected.

At the end, I manually install php80-pecl-xmlrpc.

Reboot.

Test, test, test. Run a test purchase. It works.

Everything looks okay? I guess I can turn it over to the Crowdsourced Monitoring System, aka “y’all,” and go make some paying words.