This year, I had the great opportunity to participate in the Google Summer of Code for the FreeBSD Project. After my proposal for “Live-patching for the FreeBSD kernel” was accepted, I worked for three months to make the first revision of the subsystem and associated tooling. My mentors, Bojan Novkovic and Mateusz Piotrowski, recommended that I attend the EuroBSDCon and invited me to the Devsummit, where I could expose my work to other developers and gather feedback to improve it. 

I decided to follow their suggestion and, being still a student, asked the Foundation for a travel grant, which they kindly accepted. This year, the event lasted five days (from September 9th to 13th), with the first two days dedicated to the FreeBSD Devsummit, one day for tutorials, and then the conference proper. The chosen location was in the VUB campus, in the lovely city of Brussels, which I had visited just once before. Travel was fairly straightforward to and from the Brussels Airport in Zaventem, and I found lodging just 2km away from the site. 

I had confirmed my talk allocation with Benedict Reuschling, the organizer of the Devsummit. Surprisingly, I was given the very first talk, at 10:30 of the first day. This ended up being a blessing in disguise, as I was able to easily break the ice. After a few stressful minutes, I proceeded to continue my talk without problems. Thankfully everyone was nice and provided useful feedback and questions to reflect upon. After my slot was over, I continued to listen to other talks of the day. I had many opportunities to meet and talk with many other attendees: Robert Clausecker, Olivier Certner, Aymeric Wibo, Kyle Evans, Mark Johnston, Kristien Nielsen, Christos Longros, Charlie Li, just to name a few. Overall, my work for live-patching was received quite well, which was very encouraging to see. 

The following day, I continued to attend talks. I particularly liked the one about scheduler improvements from olce@. I talked quite a bit with fellow young attendees, George (Polarian) and Goran. I was also quite happy to see a few other Italians at the conference, such as Vanja Cvelbar, Toni Tiveron and Stefano Marinelli. I had a good talk with Eirik Overby, who brought a few vintage

computers to the event, including a 486. I was eventually invited to dinner with him and some of his colleagues from Entersekt. 

On the third day, I attended a few talks of the EuroBhyveCon in the morning. Then, in the afternoon I followed the Ports Any% Speedrun tutorial by Mateusz. The day was wrapped up with a wonderful dinner at a local restaurant arranged by Aymeric for me and other young attendees. There, I had the pleasure to also dine with Kirk McKusik and Eric Allman. 

Saturday was the first day of the conference proper. I followed the following talks that day: 

– The night 142 of my servers went up in the clouds. Physically. By Stefano Marinelli 

– Run Time Reoptimization for Modern Heterogenous Systems by gnn@ – BSD as a Foundational Platform for Nationwide Semiconductor Education in Japan by Hiroki Sato 

– Base system packages in Production: A Practical Overview by Lukas Engelhardt 

That evening the social event was held in the Africa Museum just outside of the city. We were taken to the location by a wonderful vintage tram. I really enjoyed the food, company and location of the event. 

Sunday was the last day of the event, and it was quite busy. Pontus Stenetorp made a small raffle in the morning, and I ended up winning a nRF52 development kit. The sessions I attended that day were: 

– Hotplugging adventures in the bhyve hypervisor by Bojan 

– Bringing memory safety to BSD with CHERI by Brook Davis – ELKE – Encrypted & Lovely Kage Environment, using FreeBSD by Vinícius – Keeping up with language-based packaging systems in Ports (especially Python) by Charlie Li 

I also participated in the final session that wrapped up the conference, which included the traditional auction of things people lost. 

Thanks again to the FreeBSD Foundation for sponsoring my attendance to my first BSD conference. 

The post EuroBSDCon Trip Report – Federico Angelilli first appeared on FreeBSD Foundation.

This summer, I started an internship with FreeBSD Taiwan, and my mentor, Li-wen Hsu, recommended that I attend EuroBSDCon. He said it is a good chance to make connections and get familiar with the community, as I had also started my master’s degree in the Netherlands. Through the generous support of travel grants provided by the FreeBSD Foundation, I was able to attend the conference. 

I also viewed EuroBSDCon as an opportunity to explore where I could contribute to the FreeBSD Project, as I was still trying to find an intersection between my own interests and the needs of the community. Due to scheduling conflicts, I was only able to attend the main conference over the weekend. Nevertheless, I aimed to learn from the technical talks, to better understand the FreeBSD community, and to explore possible directions for future contributions. 

Throughout the talks over two days, I found three talks that especially stood out to me and gave me new ways of thinking about problems that I had previously considered from a much narrower perspective: 

• The Realities of Enterprise FreeBSD1 by Allan Jude 

I was curious about what makes FreeBSD unique, especially in real-world situations. This talk partly answered that question, and also brought me a perspective I had never considered. Unlike individual users, in an enterprise environment, unvalidated updates can introduce risks. So updates have to go through validation, testing, and deployment processes, while security vulnerabilities may require rapid patching, and the product lifecycle may outlast the OS support lifecycle. I found this perspective inspiring and relevant to me as an Embedded Systems student, because long-lived embedded products face exactly this kind of lifecycle problem. 

• Run Time Reoptimization for Modern Heterogenous Systems2 by George Neville-Neil 

Before attending the talk, I knew that I had not studied optimization in much depth. This talk delivered the idea in a fresh way and motivated me to learn more about the area. George presented an approach to dynamic and adaptive optimization at runtime. Instead of relying only on optimization decisions made before execution, the system monitors actual hardware behavior through performance counters and uses that feedback to re-optimize selected functions while the program is running. I found this particularly interesting because I had never thought deeply about the motivations and limitations behind different optimization 

1 https://events.eurobsdcon.org/2026/talk/HRXAHF/

2 https://events.eurobsdcon.org/2026/talk/CPAE7W/ 

techniques. This talk made me realize that optimization is an area I have not explored deeply enough and may be worth studying further. 

• Unix Manpages, Then and Now3 by Kristaps Dzonsons 

I had generally treated man pages as a natural part of Unix, so it had never occurred to me to think of them as a documentation interface with their own design assumptions and limitations. This talk covered some of the history of man pages, but also limitations of the format and interface, such as limited language support, the difficulty of writing good man pages, poor fit for tools like curl or C++, etc. This was particularly relevant to me because I am also planning to contribute documentation to the FreeBSD Handbook. 

Following my mentor Li-Wen’s advice, I also tried to make connections and get familiar with the community. It didn’t go very well at first. I found it difficult to start conversations. Either  I didn’t know what to say, or I couldn’t find the opportunity to talk to speakers I wanted to talk to. During the conversation with my mentor, I learned that one speaker, Zhen-Rong Wu4, had studied at the same university where I completed my bachelor’s degree. After his talk on Sunday, I had the chance to introduce myself and talk with him, and we continued our conversation during lunch break. I learned a little about his experience and how he first became involved in FreeBSD-related work. Later that day, I also had the opportunity to have dinner with Li-Wen, Zhen-Rong, and several other FreeBSD community members and conference attendees at a small local restaurant in Brussels. We talked about the cultures of different countries, which made me appreciate how international and welcoming the community is. 

Over the two days, I was really impressed by how approachable the people in the community can be. Many of the attendees were experienced engineers and researchers, yet the atmosphere remained relaxed and friendly, with speakers joking on stage. At the same time,  the technical discussions were serious, and the Q&A sessions often included detailed and challenging questions. One question in particular left a strong impression on me. After Zhen-Rong’s talk, someone asked how the community could help the project. That moment made me feel that the community was not only interested in hearing about new work, but was also actively thinking about how to participate and help move projects forward. 

The conference gave me several directions to follow after returning home. In my conversation with Zhen-Rong, formal verification came up as one possible area. He advised me to look into FreeBSD-related formal verification work and ask my mentor about possible projects. He also invited me to contact him if I decide to pursue work in that direction. Another outcome came from George Neville-Neil’s talk. Since I did not manage to speak with him during the conference, I emailed him afterward. He kindly replied and introduced me to Ed Maste, and I am currently following up on that connection. Although I am still exploring 

3 https://events.eurobsdcon.org/2026/talk/MDEE9H/

4 https://events.eurobsdcon.org/2026/talk/HSMCFS/ 

where I can best contribute, I now have a much clearer set of technical interests and several concrete people and directions to follow up with. 

I had two very fruitful days in Brussels. Having only recently moved to the Netherlands and started my master’s degree, I was still finding my rhythm. And these two intensive days gave me a clearer sense of where I could go next, both in learning and in contributing to FreeBSD. 

I had also attended AsiaBSDCon earlier this year, but I attended largely because it was nearby and because one of my professors encouraged students to participate. By the time of EuroBSDCon, I had become more motivated to contribute to the FreeBSD Project. Thanks again to the FreeBSD Foundation for sponsoring my travel expenses to EuroBSDCon 2026.

The post EuroBSDCon 2026 Trip Report – Yan-Cheng Chen first appeared on FreeBSD Foundation.

Please note that the information provided in this document is for informational purposes only and does not constitute legal advice.

Earlier this year, the Foundation launched its Cyber Resilience Act (CRA) Readiness project. The launch blog post outlines the reasons for the project and what it seeks to achieve. 

A lot of progress has been made in the project since February which we would like to share with you. First, a reminder that the project is being documented on a GitHub repository, with monthly updates and meeting notes available for you to read. 

What is the CRA? – A quick refresher

Note: this is a very brief overview. There is a lot of detail in the regulation which is not given here.

• The EU Cyber Resilience Act is a new EU regulation. 
• It affects anyone selling Products with Digital Elements (PDEs) in the EU. 
• It mandates that PDEs are managed through a secure software lifecycle and that actively exploited vulnerabilities must be reported to the European authorities.
• Its goal is to improve the security of software (and hardware with software installed) for users residing within the EU, whether individuals or organizations. 
• The regulation is enforced through various mechanisms, including non-compliance fines for manufacturers of up to €15M or 2.5% of global revenue. 
• The regulation is already in place, with a phased rollout. Manufacturers are already obliged to report actively exploited vulnerabilities within 24h of discovery, and after Dec 11, 2027 all PDEs on the market must meet “Secure by Design” obligations and have an CE mark affixed.

How does the CRA affect FreeBSD? 

FreeBSD vendors serving the EU market have a responsibility to ensure that the implementation of FreeBSD they include in their products meets the CRA’s requirements for “Secure by Design” and “Secure by Default”. They are also responsible for reporting any actively exploited vulnerabilities in their entire codebase which naturally includes FreeBSD code.

The FreeBSD Project itself, along with its contributors, is not directly regulated by the CRA but may expect to see a change in focus for manufacturers who are seeking to meet their CRA obligations. There is a little over a year remaining for manufacturers to get their SBOMs in order, and make any other changes needed so that their PDEs have a secure software lifecycle. Their reporting obligations are already in force, so a critical incident (with the chance of large fines) could occur at any time. 

As the upstream project, FreeBSD may start to experience some behavioral changes in downstream manufacturers, for example:

• Pressure to engage with manufacturers who are up against tight vulnerability report and remediation deadlines, or who are looking for patches in a hurry.
• Manufacturers looking for information on FreeBSD secure development practices, or who are looking for a FreeBSD SBOM.
• Manufacturers looking for ways to reduce risk in FreeBSD or its dependencies or who are looking for alternatives to FreeBSD.
• Manufacturers coming with questions about how FreeBSD works or is developed, or who want changes to how FreeBSD works or is developed.

What is the Foundation’s role in this?

The FreeBSD Foundation exists to support the FreeBSD Project. Its longstanding and extensive role in supporting the Project means it is classified as an “open source software steward” under the CRA. There are a few lightweight obligations under the CRA for stewards, but there are no fines. Where stewards are involved in development work or managing infrastructure, they have some reporting responsibilities but these do not come into force until Dec 11, 2027. They are also required to provide a cybersecurity policy to Market Surveillance Authorities (MSAs) on demand. 

Getting ready to meet these responsibilities has been part of the Foundation’s Cyber Resilience Act (CRA) Readiness project, but the project has been scoped to go much further and ensure that the FreeBSD Project and its community are ready to support and engage with manufacturers as they seek to meet their CRA obligations.

Project progress to date

Reminder: the project is being documented on a GitHub repository, with monthly updates and meeting notes available for you to read. 

Foundation readiness

Manufacturer outreach program

The Foundation has been contacting manufacturers to understand what they are doing to prepare for the CRA and to seek their support for FreeBSD. The engagement levels have been mixed, with European vendors being most advanced in their understanding and interest.

Steward obligations

The Foundation has created its Cybersecurity Policy, an internal document that captures existing relationships and processes in the FreeBSD Project and can be provided to the MSA as neededWe have also created an internal live cybersecurity incident protocol for Foundation staff to follow in case of an incident which needs to be reported under the CRA.

The Foundation has been preparing to use the European Union Agency for Cybersecurity (ENISA) reporting platform. This is the platform that manufacturers are already using to report actively exploited vulnerabilities, and it will be opened up to stewards on Dec 11, 2027.

Open Source solidarity

We have been engaging with the Eclipse Foundation’s Open Regulatory Compliance (ORC) working group to keep up with the latest news from the European Commission (EC), share perspectives, and support other projects.

FreeBSD Project readiness

Security Team Resilience

The Foundation has invested in increasing the resilience, capacity, and CRA expertise of the Security Team by sponsoring Pierre Pronchery to join as a new member. His dual role on the team and as a Security Engineer for the Foundation has been pivotal in facilitating the flow of information in both directions. He is currently working on a CRA live incident information pack for the Security Team to reference in case of a live incident.

Core Team engagement

The Foundation has been keeping the new Core Team (which was formed in June) up to date with the work in flight, and sharing CRA information so that the Core Team can begin to include CRA considerations in their work.

SBOM tooling for FreeBSD

A large part of the readiness project has been dedicated to developing the tooling for creating an SBOM at build time for FreeBSD. SBOMs (Software Bills of Materials) are required by manufacturers under the CRA and form the backbone of license compliance and vulnerability management. This has proven to be a complex and challenging project which has many unknown unknowns. The progress has not been linear but the solution is becoming very robust and comprehensive, and will prove to be an excellent asset to FreeBSD over the coming years. Work is ongoing and will be available in FreeBSD 16, and also in point releases of FreeBSD 14 and 15 when ready.

FreeBSD community readiness

Information sharing

The Foundation has been working hard to understand the CRA and share FreeBSD-specific information about it. Key outputs include:

• Project launch blog post
• Project GitHub repo
• Monthly updates
• Monthly meeting notes
• Guide to CRA for FreeBSD Business Users 
• Guide to CRA for FreeBSD Community Members 
• Reference page for manufacturers who want to work with FreeBSD to meet their CRA obligations  including providing a dedicated Foundation CRA email address for inquiries (cra@freebsdfoundation.org)
• SBOM article in the FreeBSD Journal
• Running a CRA/SBOM tutorial at EuroBSDcon
• Project update at FreeBSD DevSummit

Legislative engagement

We have been sharing known open consultations on legislation with the community via mailing lists, and on a GitHub reference page. We have had some really supportive community members who have collaborated on providing feedback to the EC on their draft public guidance.

What’s next and how can you help?

The Foundation’s project has achieved the majority of its immediate goals, but the CRA is here to stay and FreeBSD will feel its influence over the coming months and years. The Foundation remains committed to supporting FreeBSD through this phase of its development.

Our main focus going forward will be to work with the Core Team, Security Team, and manufacturers to make improvements to FreeBSD’s security posture that will in turn make CRA compliance easier. Keep an eye on the monthly updates to track progress.

The number one thing you can do to help is to learn about the CRA – so thank you for reading this post. If you have any questions feel free to ask, by emailing cra@freebsdfoundation.org. Your questions help us to improve our work.

If you are a manufacturer affected by the CRA, we would love to hear from you and understand how you are preparing and what you need from FreeBSD. Where concrete changes are needed, we would be happy to coordinate a joint effort supported by like-minded manufacturers.

Donations in support of the CRA readiness work are always appreciated and will help us to continue supporting this important work

The post October 2026 Update: Getting Ready for the EU Cyber Resilience Act first appeared on FreeBSD Foundation.

For Nimish Jain, working on FreeBSD this summer meant getting an up-close look at something he had long been curious about: how large, complex pieces of software work together.

The post Learning at Scale: FreeBSD Foundation Intern Nimish Jain on Exploring the FreeBSD Codebase first appeared on FreeBSD Foundation.

For University of Waterloo student Sourojeet Adhikari, an early interest in understanding how computers work eventually grew into a summer spent helping bring AMD’s ROCm GPU computing platform to FreeBSD.

The post FreeBSD Foundation Intern Sourojeet Adhikari on Bringing ROCm to FreeBSD first appeared on FreeBSD Foundation.

When Jim Huang Chen began his internship with the FreeBSD Foundation, he was only finishing his first year as a Software Engineering student at the University of Waterloo. A few months later, he had spent the summer working inside the FreeBSD codebase, contributing to Raspberry Pi support, learning from longtime developers, and gaining a much deeper understanding of how an operating system works.

For Jim, that process of learning became one of the most valuable parts of the experience.

The post FreeBSD Foundation Intern Jim Huang Chen on Raspberry Pi Support and Open Source first appeared on FreeBSD Foundation.

We have a couple of updates to share about the FreeBSD Journal.

The post An Update on the FreeBSD Journal: New Editor, New Format first appeared on FreeBSD Foundation.

This year, I had the great privilege of receiving the FreeBSD Foundation travel grant to attend BSDCan.

The conference informally kicked off with the traditional gathering at the Father & Sons bar near the 90U residence on Tuesday. The first day of the FreeBSD developer summit opened with Nicholas Carlini’s talk about LLM-driven security analysis in the FreeBSD kernel, setting the tone for the remainder of the first devsummit day. Alpha-Omega’s Michael Winser continued this discussion from an open-source maintainer’s perspective, outlining strategies for dealing with the torrential influx of LLM-reported vulnerabilities. After a brief lunch break, the summit continued with Vince Milum’s presentation about building a Raspberry Pi-based GPS NTP server appliance using FreeBSD. The overview of his journey in applying FreeBSD to such an unorthodox use case was interesting and highlighted a few rough edges when using FreeBSD in embedded computing.

The summit continued with the Foundation’s yearly overview and an update from the srcmgr team, after which I spent some time catching up with a few colleagues in the hallways. The first day was capped off by a pizza dinner at the 90U lounge.

The second day of the devsummit began with an overview of the current state of the FreeBSD project’s infrastructure and the ongoing efforts to expand its use of cloud resources. After two “Have/Need/Want” planning sessions, I attended Olivier Certner’s talk about his ongoing work in the scheduler.
The devsummit concluded with a round of shorter talks about planned work in the network stack, extended kernel errors, and virtual memory improvements from Netflix. The day concluded with a hacking session at the 90U lounge that lasted well into the night.

The first day of the conference began with Sean Howard’s talk about accessibility tooling that allowed them to use OpenBSD while recovering from eye surgery. Next up was Martin Vahlensieck’s talk about his new tool for creating temporary VMs on FreeBSD. After a short lunch break, I attended Henning Brauer’s talk about OpenNTPD and its now 20+ years of history. Following a short break in the quiet room, I attended Colin Percival’s talk about the turbulent FreeBSD 15.0 release process. The day once again concluded in the hacker lounge, where I also spent some time talking to Mark Johnston and John Baldwin about our ongoing srcmgr activities.

The final day of the conference began with Allan Jude’s talk about the recently introduced ZFS AnyRAID feature. Next up was Olivier Certner’s talk about the ongoing work to support hibernation on FreeBSD.
The talk explored the implementation details in a lot of depth, and I was particularly astonished by the amount of groundwork needed to add proper hibernate support in the kernel. After lunch, I attended John Baldwin’s talk on thread-local storage. Another one of John’s fantastic ELF-related talks, it went into the gory details, behind TLS support in various parts of FreeBSD.

The penultimate talk of the day was another by Martin Vahlensieck, this time dealing with a deep dive into a seemingly trivial operation – writing to /dev/null. The talk was put together exceptionally well and did a great job of presenting complicated operating system concepts to a varied audience of users and developers. The last talk of the day was Jaeyoon Choi’s talk about adding Universal Flash Storage support to FreeBSD, after which we slowly started heading to the closing reception.

Attending this year’s BSDCan provided me with plenty of new project ideas for the near future and reinvigorated my drive to contribute to the project.
Once again, thank you to the FreeBSD Foundation for sponsoring my attendance this year.

The post BSDCan 2026 Travel Report – Novković first appeared on FreeBSD Foundation.

The June 2026 FreeBSD DevSummit & BSDCan was again successfully recorded and streamed through longtime streaming sponsor ScaleEngine. The requested DevSummit 2 question microphone system kept our running around to a minimum and fit the two rows of DMS1160. We got to see CheriBSD hardware again, in fact, Brooks Davis presented from a CheriBSD box. This year, the DevSummit focused more on AI integration than in previous years. Community member Warner Losh, in particular, gave an interesting talk about how he has used AI to help resolve an issue he was facing. I will refer you to the video posted to the FreeBSD YouTube channel for more details.

Community members Michael Williams and AV Lead Andrew Fengler lent us the mixing boards, which gave us the control we needed, so speakers, both low and enthusiastic, were heard clearly. This year’s hardware collection included community-donated hardware and personal hardware lent for the event. BSDCan fundraiser-in-chief Michael Dexter brought everything from home that the TSA would let him, and my bags were so full, I didn’t have room for my customary roll(s) of gaffer tape.

BSDCan has been successfully building attendee numbers year over year, with just shy of 170 for 2026. My fondest memory of the conference as part of the very hard working organization committee, was seeing Henning pull our shawarma vendor aside to deliver effusive praise for what many agreed was a fantastic lunch on Saturday.

Other highlights:
– additional sleep support for the Framework laptop (Thank you, Devon!)
– one of the smoothest AV team activations I have ever seen at a conference.
– improved social media tie-in via both IRC and Discord
(Many thanks to Charlie Li, Setesh, & and a team of Discord volunteers)
– Nearly $2,000 raised for local charities.

Now, if you will excuse me, I have 4 days of videos to edit and post to the web.
Be well,
Patrick McEvoy bsdtv / bsdcan 2026 con chair

The post BSDCan 2026 Travel Report – Patrick McEvoy first appeared on FreeBSD Foundation.

I’m really grateful to the FreeBSD Foundation for sponsoring my trip to BSDCan 2026 in Ottawa. The conference ran for four days — two days of DevSummit, then two days of the main conference, with many interesting talks throughout. For me, it’s mainly a chance to talk with developers I don’t otherwise get to reach in day-to-day work. This was my third time attending, and I was happy to be back again. 

This year’s DevSummit felt a little different from previous years. A number of sessions touched on how AI is influencing project maintainability. Some of that influence is positive — vulnerability research came up as one example — but it’s also adding real burden on the reviewer side. Hearing different opinions from different people gave me a much broader view of the issue than I had going in. 

This was also my first DevSummit as a src committer, so on day two, I got to take part in “Have Need Want” — the usual BSDCan session for this — and present my own work for review along with my plans for the next release. That covered updates to our USB stack, LLVM, CPU power throttling, and bhyve. I also got some feedback privately afterward, which drew a bit of welcome attention from other developers. 

On the first day of the main conference, the talk I found most interesting was “Heterogeneous Scheduling on FreeBSD” by Minsoo Choo. It wasn’t really about the scheduler itself, but it got into something just as important: how heterogeneous core information should feed into the scheduler, and where and how that should happen.  It reminded me that my CPU throttling work needs the same kind of information.  Right now, the idea is to raise performance parameters as fast as possible under load, and back off while idle to save power. On a non-heterogeneous system, that only means tracking idle time. But on a heterogeneous system, cores differ in performance, which changes how we translate an abstract performance instruction into something a given core can act on — and that in turn affects how the cpufreq interface makes its decisions. I was glad to hear that there are already interfaces that provide heterogeneous-core hints for throttling, and I’m hoping to fold that into my future work. 

On day two, I went to “Return of the Segment: Thread Local Storage” by jhb@. Since I also work on LLVM ELF internals, it was great to finally get a clear picture of how Thread Local Storage actually works under our libc++ ABI. jhb@ walked through it well — starting from thread-local errno and building up to a compiler-guided ELF TLS design. Afterward, we talked about whether we should move errno over to compiler-based TLS. 

All in all, it was a great trip, with many good conversations with other developers.  Thanks again to the Foundation for making it possible for me to be there. 

Respectfully, 

ShengYi Hung

The post BSDCan 2026 Trip Report – ShengYi Hung first appeared on FreeBSD Foundation.