4 ms·
The Book of PF, 4th edition
- dhruv3006 9mo agoLot of admiration for no starch - your books are great !
- globular-toast 9mo agoI wish I had more of them. I maintain a modest library made out of real paper and I'm so glad No Starch still has good quality paper and excellent binding. I have a few of the more recent print on demand O'Reilly books but they feel more like cheap print outs I could have done myself. Unfortunately they are just so expensive so I do have to be very selective.
- xqb64 9mo agoYeah. My favorite are books that guide you through implementing complex systems projects from scratch, like Nora Sandler's "Writing a C compiler", or Sy Brand's "Building a Debugger". I wish they produced A LOT more of them.
- iberator 9mo agoThose are some new and very very shallow books. There better one's from 90" and 80".
- eager_learner 9mo agocare to name a few such good oldies?
- HackerThemAll 9mo agohttps://www.amazon.com/Compiler-Construction-Monographs-Computer-Science/dp/1461297311 https://www.amazon.com/Compiler-Construction-Monographs-Comp... This one is my favorite.
- cultofmetatron 9mo agomuch like swimming, it helps to start in the shallow end before you tread into deeper waters.
- xqb64 9mo agoThe central point behind this type of books isn't so much to build an enterprise-grade production-ready thing, but rather to bridge the delta between zero and having a working thing of sufficiently large complexity, which inevitably exists for someone who had never been there before. Having that in mind, I think these books are very valuable.
- pss314 9mo agoPer Dr. Marshall Kirk McKusick (as announced in one of the recent BSD conferences), No Starch Press will be publishing the third edition of the Design and Implementation of the FreeBSD Operating System book sometime later this year.
- assimpleaspossi 9mo agoI was just wondering about this the other day. I own both previous versions.
- user3939382 9mo agoChapter 1, config files don’t go in /etc. Well they do, but also /var. And also here and also there. It’s like linux you get a free treasure hunt built in when you need to update something. Some services get local_ attached even though all the services are local. Somehow NetBSD is able to avoid all of this. But do you want working drivers or not? End of chapter 1. Actually FreeBSD is great and for a modern OS better than linux in all ways but ecosystem and even there it’s fine. But also the design while it makes sense in some way kind of sucks, it’s messy.
- goku12 9mo agoI buy ebooks straight from publishers like Nostarch and Leanpub. (In fact, I have an older edition of this book). There are a few books that are sold directly by the authors too. All of them DRM-free. I actively avoid publishers and sellers who don't respect me as a consumer/reader. People need to start demanding better deals, or else we'll end up with monopolies that won't think twice about deleting books in your custody that you purchased from them.
- notamario 9mo agoYarr, that do be a problem matie. In all seriousness, how has DRM not yet been recognized as the failure it is?
- xqb64 9mo agoGot any notable suggestions from Leanpub?
- ansonhoyt 9mo agoJeff Geerling's classic, "Ansible for DevOps", since naturally you'll be configuring PF on lots of servers. [1] https://leanpub.com/ansible-for-devops https://leanpub.com/ansible-for-devops
- goku12 8mo agoThe Kubernetes Book, by Nigel Poulton. A very detailed and well explained book that is updated every year and you get them all for a one-time purchase. Build Your Own Lisp, by Daniel Holden. This is an often cited classic with a lot of precious concepts explained in detail. It can be read for free online. But this is an opportunity to reward them for it. (Yes, I do own a purchased copy). Ansible for DevOps by Jeff Geerling. Already mentioned by the sibling commenter. There a lot more on my wishlist. All of them are competitively priced at 10 to 15$ each.
- clickety_clack 9mo agoNo starch are the best! I’ve learned so much from them.
- gspr 9mo agoI'd love something similarly scoped centered around nftables. Does anyone have a suggestion? I see No Starch has a Linux Firewall book, but it's from 2008 and is thus iptables-based.
- skywal_l 9mo agoPF = Packet Filter
- promiseofbeans 9mo agoWas thinking I had missed an entire edition of Pathfinder for a moment upon reading the title
- replooda 9mo agoYour comment made me one day younger.
- INTPenis 9mo agoIt's a great book, I used to have some edition of it and it helped me a lot professionally with setting up firewalls, load balancing, traffic shaping and more. I also had a book on Designing FreeBSD rootkits that was very educational. Unfortunately I've given away all my books for more minimalistic living where I am instead dependent on digital information. Not sure how to feel about it.
- antics9 9mo agoThere are e-readers and DRM-free electronic libraries.
- accrual 9mo agoI almost did the same and still think about doing it! I also have an older edition of this book somewhere in a small stack of OpenBSD books I purchased when I was first learning the system. These days I never reference them. But they do make for a neat OpenBSD area on my bookshelf.
- INTPenis 9mo agoI started listening to audiobooks a few years ago, even re-listened to a lot of classics I read, but in audio format. And at some point when I was ready to move to a new apartment I realized my bookshelves were just a burden. They were never used, and only gathered dust. So I donated all my books. I'm not saying I've learned everything, but I am senior now so all those old computer books are just collecting dust. Combined with the fact that I use search engines for everything I need to know. I realize that if the internet goes out, I'm fucked, but I don't care.
- iyn 9mo agoWhat's everyone's experience with modern PF in production? Also, not to start a holy war, but what people think about modern PF vs nftables? I've only ever used nftables (and only in fairly simple scenarios) but I've always been curious about the PF side of the world.
- mono442 9mo agoIt's slower than nftables.
- touisteur 9mo agoNot to ask anyone for free work but any write-up on this, I'd love to read.
- flipped 9mo agohttps://toni.cunyat.net/2019/11/nftables-vs-pf-ipv4-filtering-tests-as_24.html https://toni.cunyat.net/2019/11/nftables-vs-pf-ipv4-filterin.... According to this article, it depends on usecase.
- deleted 9mo ago[deleted]
- accrual 9mo agoI manage a pf.conf with about 400 rules across a dozen VLANs, I find it intuitive and even enjoyable to work on. It feels kinda like editing source code - there are some host, network, and port declarations at the top, a section for NAT and egress, then a section for each VLAN that contains the pass in/pass out rules. I tail the pflog0 interface in a tmux session so I can keep an eye on pass/block, and also keep a handy function in my .profile to make it easy to edit the ruleset and reload: function pfedit { vi /etc/pf.conf && \ pfctl -f /etc/pf.conf && \ { c=`pfctl -s rules | wc -l | tr -d ' '`; printf 'loaded %s rules\n' "$c"; } } This opens the file for editing, reloads the ruleset (which also validates it), then returns the rule count if successful.
- 9mo ago
- MarginalGainz 9mo agoFor me, the decisive factor is readability as a safety mmechanism. When you are debugging a network outage at 3 AM, PF's syntax (pass in on $ext_if...) reads almost like English sentences. nftables is technically powerful and faster than legacy iptables, but the cognitive load required to parse a complex ruleset is still higher than PF. In an operational context, clarity prevents outages. That alone makes PF the superior choice for edge firewalls where human auditability is critical.
- sipelaut 9mo ago[flagged]
- sunshine-o 9mo agoBy the way, I see the book covers FreeBSD 14 but in FreeBSD 15 (released in December) PF got a big update [0]. - [0] https://www.netgate.com/blog/updates-to-the-pf-packet-filter-in-freebsd-and-pfsense-software https://www.netgate.com/blog/updates-to-the-pf-packet-filter...