Summary
Recent discussions highlight significant developments in cybersecurity and system administration, particularly regarding long-term support (LTS) in FreeBSD and the implications of recent cyberattacks on country code top-level domains (ccTLDs).
The conversation begins with an analysis of FreeBSD's LTS release cycles, reflecting on lessons learned from Linux's experiences. The hosts note that while vendors like Red Hat and Ubuntu have extended their LTS support, the upstream kernel has reduced its support duration due to volunteer limitations. This disparity raises questions about how LTS can better serve users rather than just vendors.
Attention then shifts to Google's response to recent hijacks of ccTLDs, specifically .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). The attackers compromised these domains, allowing them to issue unauthorized HTTPS certificates. Google emphasizes the importance of monitoring certificate transparency logs and suggests that domain owners implement Certificate Authority Authorization (CAA) records to prevent unauthorized certificate issuance. The discussion underscores the need for proactive measures to secure domain ownership and prevent similar attacks in the future.
Further topics include upcoming changes in SSL certificate lifetimes and Ubuntu's decision to limit supported file systems for secure boot configurations, aiming to reduce vulnerabilities in the bootloader. The episode also addresses a troubling bug in Intel's Connectivity Performance Suite that disrupts IPv6 functionality, illustrating the ongoing challenges in network management and the importance of rigorous testing in software updates. Overall, the discussions reflect a commitment to enhancing security practices and adapting to the evolving landscape of technology.
Show Notes
Why you should be watching for SSL certificates that you didn’t issue, Let’s Encrypt is shortening the length of certs to 64 days, Ubuntu tightens up GRUB with secure boot, an Intel driver bug breaks IPv6 for major services, and running websites from a home Internet connection.
Plugs
Support us on patreon and get an ad-free RSS feed with some early episodes
FreeBSD Release Cycles and Enterprise Requirements: Why LTS Matters
News/discussion
Chrome’s Response to Recent ccTLD Registry Hijacks
64-Day Certificate Lifetimes Coming Feb 2027 – Let’s Encrypt
Ubuntu 26.10 drops Btrfs, XFS & ZFS /boot with Secure Boot
A preinstalled Intel driver is silently breaking IPv6, OneNote and Microsoft 365
See our contact page for ways to get in touch.
More from 2.5 Admins
Supermarkets found out why their fridges shouldn’t be on the Internet and Samsung smart fridges broke after a firmware update, why we don’t recommend MoCA, some tips for running ethernet cables in your house, and why it’s fine to use a short TTL with your domains.
Why batteries in homes could benefit everyone involved, why we didn’t bring up wake-on-LAN when someone asked about keeping a NAS powered on as little as possible, building a router vs buying one, and ways to manage ssh connections.
Google offers a few pennies to web publishers to make up for stealing their content and not sending them any traffic, the tech we’d try to use after the apocalypse, why Jim doesn’t virtualise his clients’ desktops, and setting up Volume Shadow Copy so your users can restore their own files.
The challenges of funding open source software projects, how Netflix uses FreeBSD in a positive way, why you shouldn’t try to complicate your monitoring, and running servers in a small residence.
Microsoft really wants you to update your Exchange server, our thoughts on immutable distros, more on Jim’s approach to internet access for his kids, restricting access to servers on a corporate network, and cloning and backing up operating systems with ZFS.