{"title":"The Code Wanderer","subtitle":"Wandering through OpenBSD, privacy, security, programming, and data science. Powered by open source.","link":[{"@attributes":{"rel":"self","type":"application\/atom+xml","href":"https:\/\/hervyqa.srht.site\/atom.xml"}},{"@attributes":{"rel":"alternate","type":"text\/html","href":"https:\/\/hervyqa.srht.site"}}],"generator":"Zola","updated":"2026-07-30T00:00:00+00:00","id":"https:\/\/hervyqa.srht.site\/atom.xml","entry":[{"title":"Switching to OpenBSD as the Primary Operating System","published":"2026-07-29T00:00:00+00:00","updated":"2026-07-30T00:00:00+00:00","author":{"name":"\n hervyqa\n "},"link":{"@attributes":{"rel":"alternate","type":"text\/html","href":"https:\/\/hervyqa.srht.site\/blog\/switch-from-linux-based-to-openbsd\/"}},"id":"https:\/\/hervyqa.srht.site\/blog\/switch-from-linux-based-to-openbsd\/","content":"

Complete operating system#<\/span><\/a>\n<\/h2>\n

This is a solid reason why I left linux-based systems. \n\nOpenBSD<\/a> is an operating system which includes kernel, userland,\ndocumentation, init, utilities, configuration tools, display servers,\naudio support, and core components developed by OpenBSD teams. \n\nLinux<\/a> is different, linux just a kernel, a piece software\nmanages hardware, memories, processes, and system calls. Linux does not\nprovide the userland tools, libraries, shells, or utilities necessary\nto make a computer usable for everyday tasks, wether for server, desktop\nor workstation. Linux is not complete operating system without GNU\nutilities, init system, display managers and others. That is why Linux\nkernel cannot stand alone without userland software.<\/p>\n

OpenBSD functions as a singular, cohesive operating system project.\nThe Linux kernel on the other hand is merely a component, it is not\nan operating system in itself. What we commonly refer to as \u201cLinux\u201d\nare actually distributions like Debian, Arch, or Fedora, which take\nthe Linux kernel and bundle it with their own specific choices and\nconfiguration.<\/p>\n

Secure by default#<\/span><\/a>\n<\/h2>\n

OpenBSD carries minimal services by default, only the essential services\nare enabled. Other services, such as telnet and FTP, are disabled by\ndefault to significantly reduce the attack surface. OpenBSD has only two\nremote access points by default installation, which sets it distinctly\napart from Linux-based operating systems. When comparing CVE databases,\nOpenBSD has approximately \n\n200<\/a> known\nCVEs, whereas Linux has \n\n20.000<\/a> CVEs.\nThis disparity highlights the extensive security vulnerabilities within\nthe Linux kernel.<\/p>\n

The OpenBSD source code has undergone rigorous auditing by developers.\nAll base components have been strictly audited manually, including\nthe kernel, libc, init, and utilities. Furthermore, all source code is\naccessible via \n\nAnonCVS<\/a> or \n\nCVSWeb<\/a>.<\/p>\n

OpenBSD also serves as the upstream origin for several widely\nused pieces of software, such as OpenSSH, OpenBGPF, PF, OpenSMTPd,\nLibreSSL, iked, mandoc, and numerous others (Hansteen, Peter<\/a>)<\/span>. Moreover, OpenBSD boasts many other \n\nInnovations<\/a> available on its official website.<\/p>\n

UNIX philosophy#<\/span><\/a>\n<\/h2>\n

The OpenBSD community adheres strongly to core UNIX principles.\nParticularly code correctness<\/strong> which is minimizing unnecessary\ncode is paramount as it directly mitigates vulnerabilities. OpenBSD\u2019s\ncodebase is characterized by minimalism and simplicity, making it\nexceptionally easy to audit and maintain. Furthermore, the design\nphilosophy emphasizes that each program should do one thing well. This\ncontrasts sharply with many Linux-based systems, where the system,\ninit process handles numerous tasks, leading to complexity that is much\nharder to audit and prone to excessive, unnecessary features.<\/p>\n

OpenBSD\u2019s commitment to hardware is also tight, focusing only on\nhardware with full compatibility. As a result, every hardware component\nbenefits from high quality and thorough documentation. This approach\nprioritizes strong, secure code correctness over sheer feature quantity.\nConsequently, some modern hardware, like Wi-Fi cards, OpenBSD may\ncurrently not support.<\/p>\n

The documentation#<\/span><\/a>\n<\/h2>\n

Every program on OpenBSD comes with excellent documentation. Users\ncan search and read the \n\nManual<\/a> page easily. Probably\nno operating system documentation in the world are better or more\ncomprehensive than OpenBSD\u2019s. Every binary, library, driver, or\nscript delivered in the base system includes its own manpage<\/code> (Baumann, Florian<\/a>)<\/span>. For example, you can consult\nthe manuals for commands like \n\nmount(8)<\/a>, \n\nrcctl(8)<\/a>, and \n\nsysupgrade(8)<\/a>. The documentation is complete,\naccurate, and consistent. Even every new OpenBSD releases, the\ndocumentation and changelogs are excellent.<\/p>\n

As an OpenBSD user, you must be comfortable using \n\nman(1)<\/a>\nand \n\nhelp(1)<\/a> commands to grasp system functionality. Reading\nman pages is superior to browsing external resources.<\/p>\n

man man<\/span><\/span>\nman rcctl<\/span><\/span>\nman afterboot<\/span><\/span>\nman sysupgrade<\/span><\/span><\/code><\/pre>\n
Man pages are categorized into several types:<\/p>\n
    \n
  1. General commands (tools and utilities).<\/li>\n
  2. System calls and error numbers.<\/li>\n
  3. Library functions.<\/li>\n
  4. Programmer\u2019s reference guide.<\/li>\n
  5. Device drivers.<\/li>\n
  6. File formats.<\/li>\n
  7. Games.<\/li>\n
  8. Miscellaneous information.<\/li>\n
  9. System maintenance and operation commands.<\/li>\n
  10. Kernel internals.<\/li>\n<\/ol>\n
    OpenBSD also features comprehensive \n\nFAQ<\/a> pages\nthat provide technical explanations like covering hardware support,\ninstallation, verification, partitioning, disk encryption, package\nmanagement, networking, multimedia, virtualization, and deep-dive\ntutorials to help users understand any complex topic.<\/p>\n
    The installer experience#<\/span><\/a>\n<\/h2>\n
    The initial installation is straightforward. It uses a text-based\ninterface, which might confuse users accustomed to a GUI, but is\neasy to understand, covering only basic questions. The installer\nsupports \n\nautoinstall(8)<\/a>, to upgrade to a release version\nuse \n\nsysupgrade(8)<\/a>. Linux users, users should note that\nsome initial configurations differ slightly. The default OpenBSD\nfilesystem is FFS2<\/code>, and the disk scheme similar to \/dev\/sdXN<\/code>\n(e.g., \/dev\/sd01<\/code>). However, OpenBSD surprisingly creates an automatic\npartition alongside \n\nfdisk(8)<\/a> to manage all partitions.<\/p>\n
    The installer defaults to encrypting the disk using \n\nsoftraid(4)<\/a> and \n\nbioctl(8)<\/a>. Unlocking requires\na passphrase. For Linux-based distributions, this full-disk encryption\nfeature is not enabled by default.<\/p>\n
    The installer does not ship with non-free firmware, especially for Wi-Fi\ncards (Stru\u015b, Marcin<\/a>)<\/span>. However, after the first\nreboot, the system automatically executes \n\nfw_update(8)<\/a> to\ndownload and install the required non-free firmware for all detected\ndevices. For new users, I highly recommend reading the useful manuals \n\nafterboot(8)<\/a> after installation.<\/p>\n
    Simple init system#<\/span><\/a>\n<\/h2>\n
    OpenBSD uses \n\nrc(8)<\/a> (init daemon) and \n\nrcctl(8)<\/a> for control services. This init system is simple, script-driven, and\nminimal in functionality. There is no bloat, every service is managed\nby a traditional shell script stored in \/etc\/rc.d\/*<\/code> and run by rc<\/code>\ninit. Using this init improves trust and security by reducing the attack\nsurface.<\/p>\n
    OpenBSD\u2019s init follows KISS (Keep It Simple Stupid) principles. There\nare no complex daemons, no hidden background processes, no device\nmanagers, no login managers, no network managers, no binary output. The\nsystem is running as it should.<\/p>\n
    This init has high auditability because each service is a transparent\nshell script, making it easier to audit for security. This approach is\nimportant for the OpenBSD project.<\/p>\n
    Clear license#<\/span><\/a>\n<\/h2>\n
    Sometimes people ask or complain that OpenBSD does not support specific\nsoftware or hardware. The issue is that not every software license\nallows for free redistribution or recompilation from source. OpenBSD\nonly accepts the ISC or Berkeley style license for software, the GPL\nis not acceptable. This is not a drawback to supporting all software\nor hardware, but rather a consequence and a choice<\/strong>. It is amusing\nif people accuse OpenBSD of not supporting a particular software and\nconsider it a drawback without knowing the actual license terms. OpenBSD\nfreely allows redistribution of both binary and source code, and remains\nusable by anyone for any purpose.<\/p>\n
    Basically, OpenBSD carries free drivers and firmware on the system base.\nAfter installation, it automatically executes \n\nfw_update(8)<\/a>,\nwhich downloads and installs non-free firmware, including vmm-firmware<\/code>\nfor virtualization.<\/p>\n
    Conclusion#<\/span><\/a>\n<\/h2>\n
    There are several benefits to using OpenBSD as a daily driver. Users\ncan learn about the UNIX style as a platform. It has tidy and complete\ndocumentation \n\nman(1)<\/a> and \n\nhelp(1)<\/a> (pages for\neach kernel, library, script, daemon, utility, and single binary).\nCoding style is with \n\nstyle(9)<\/a>, allowing users to write\nmodular code and easily to read. Scripting uses \n\nksh(1)<\/a>\nas a default shell. Bugs are mitigated with \n\npledge(2)<\/a>, \n\nunveil(2)<\/a>, KARL (Kernel Address Randomized Link), W^X memory\nprotections, and other \n\nSecurity<\/a> features. Firewall\nrules are set with \n\npf(4)<\/a>. Server setups such as web, mail,\nDNS, WireGuard, virtualization, and others.<\/p>\n
    Users adopt a security-first mindset from the beginning, do one thing\nand do it well. OpenBSD has a permissive license, allowing every user\nto freely to modify, redistribute, and learn from the code without\nrestriction from complex GPL.<\/p>\n
    Furthermore, users acquire deeper technical knowledge and cultivate\na security-conscious, responsible mindset. An assets highly valued in\noperating-system development and cyber security practice.<\/p>\n"},{"title":"How I Wrote an Article with Markdown and Zola","published":"2026-07-22T00:00:00+00:00","updated":"2026-07-25T00:00:00+00:00","author":{"name":"\n            hervyqa\n          "},"link":{"@attributes":{"rel":"alternate","type":"text\/html","href":"https:\/\/hervyqa.srht.site\/blog\/how-i-wrote-an-article\/"}},"id":"https:\/\/hervyqa.srht.site\/blog\/how-i-wrote-an-article\/","content":"
    Actually my initial idea is to create a guide to explain how to write\narticles on Markdown. But, let me explain alongside a more specific\nstatic site generator with custom shortcodes. I used \n\nZola<\/a> a static site generator (Prouillet, Vincent<\/a>)<\/span> to\nproduce website, previously my website was built with a different static\nweb generator. This seems difficult to optimize. At other times I will\nexplain why I migrate in-deep.<\/p>\n
    Markdown is everywhere, also plays a critical role in the world of\nopen source software and web development (Watkins, Don<\/a>)<\/span>. The documentation I read is always written in\nMarkdown.<\/p>\n
    Document settings#<\/span><\/a>\n<\/h2>\n
    There are several settings before writing an article. Create a user\nprofile, manage the zola config, create a post directory and front\nmatter.<\/p>\n
    User profile#<\/span><\/a>\n<\/h3>\n
    Before I write an article, I have to create a user file in the data\ndirectory. The user retrieves the data from the toml<\/code> file. For\nexample, my current user identifier is hervyqa<\/code>. I made hervyqa.toml<\/code>\nand saved to data\/authors\/hervyqa.toml<\/code>. Users can use any user\nidentification they want.<\/p>\n
    For instance, hervyqa.toml<\/code> is my user data:<\/p>\n
    1<\/span>name<\/span> =<\/span> "<\/span>Hervy Qurrotul<\/span>"<\/span><\/span>\n2<\/span>email<\/span> =<\/span> "<\/span>hervyqa@disroot.org<\/span>"<\/span><\/span>\n3<\/span>sourcehut<\/span> =<\/span> "<\/span>hervyqa<\/span>"<\/span><\/span>\n4<\/span>codeberg<\/span> =<\/span> "<\/span>hervyqa<\/span>"<\/span><\/span>\n5<\/span>mastodon<\/span> =<\/span> "<\/span>datasci.social\/@hervyqa<\/span>"<\/span><\/span><\/code><\/pre>
    Zola configuration#<\/span><\/a>\n<\/h3>\n
    Zola configuration is available in zola.toml<\/code> or config.toml<\/code> file.\nBelow is \n\nTermivy<\/a> theme configuration. I enable the table\nof content (toc), license, citation, bibtex, attribution, and additional\nnotes.<\/p>\n
     1<\/span>[<\/span>extra<\/span>.<\/span>toc<\/span>]<\/span><\/span>\n 2<\/span>enable<\/span> =<\/span> true<\/span><\/span>\n 3<\/span><\/span>\n 4<\/span>[<\/span>extra<\/span>.<\/span>content<\/span>]<\/span><\/span>\n 5<\/span>license<\/span> =<\/span> true<\/span><\/span>\n 6<\/span>license_type<\/span> =<\/span> "<\/span>cc-by<\/span>"<\/span><\/span>\n 7<\/span>citation<\/span> =<\/span> true<\/span><\/span>\n 8<\/span>citation_bibtex<\/span> =<\/span> true<\/span><\/span>\n 9<\/span>citation_attribution<\/span> =<\/span> true<\/span><\/span>\n10<\/span>note<\/span> =<\/span> true<\/span><\/span><\/code><\/pre>
    New post#<\/span><\/a>\n<\/h3>\n
    After that, create a new directory as a blog title, and files as content\nof the blog. For instance, the structure as below:<\/p>\n