XMPP Service Operators - 2026-05-23

httpd + relayd openbsd gets you more or less everything you need. But it's not as comfortable as nginx

relayd handles things like redirecting http to https and reverse proxying

> it seems they reported it and nginx either will shortly or has patched it but I haven't seen anything concrete yet :( moparisthebest, no patch from nginx 3 days later ↺

27 days left on the disclosure period before the POC is published

I assume it will be until next weekend until all major distros have updated their repos, I assume the patch will be available on Sunday

tom, thats because nginx does a lot more than just a webserver these days, this is why OpenBSD dropped it from base and wrote httpd and relayd. As jaj, explained, they both do different things, you can run relayd for proxying and redirects without needing to run a full blown http server, allowing you to strip down the attack surface massively. Note: OpenBSD httpd is portable and available on Linux-based platforms

it is considerably slower though, as with all OpenBSD software, security comes before performance

~OpenBSD by default disables SMT~

icebound.dev, "OpenBSD httpd is portable and available on Linux-based platforms" do you have a source for that? I tried to find it just now and all I can find is a fork on github which hasn't been updated in 6 years.

> icebound.dev, "OpenBSD httpd is portable and available on Linux-based platforms" do you have a source for that? I tried to find it just now and all I can find is a fork on github which hasn't been updated in 6 years. Oh maybe they abandoned it ↺

nevermind ignore me, I think it was abandoned

sad, I had my hopes up for a second there :)

sorry :/

https://downloadable.pain.agency/file_share/019e5619-54ca-7845-88fc-d04033243bce/caddy%20my%20beloved.gif

lol, wait until there is an RCE in caddy :p

s/is/is discovered

jonas’: you can run it in an openbsd VM 😜

^^^

it will also piss off mopar if you did, so win win!

> lol, wait until there is an RCE in caddy :p i mean caddy is in go which is supposedly memory safe by way of garbage collector, so any rce would have to be some really bad logic flaw. worst im anticipating realistically happening is a dos (go makes most memory errors a "safe panic") which i can live with ↺

might should take this to xmpp:operators-offtopic@group.pain.agency?join