Sixteen months had passed since Hurricane Harvey tore through the Texas coast in August 2017, killing more than 80 people and flattening entire neighborhoods. And when Texas lawmakers gathered in Austin for their biennial session, the scale of the storm’s destruction was hard to ignore.

Legislators responded by greenlighting a yearslong statewide initiative to evaluate flood risks and improve preparedness for increasingly frequent and deadly storms. “If we get our planning right on the front end and prevent more damage on the front end, then we have less on the back end,” Charles Perry, a Republican senator from Lubbock who chairs a committee overseeing environmental issues, said at the time.

In the years that followed, hundreds of local officials and volunteers canvassed communities across Texas, mapping out vulnerabilities. The result of their work came in 2024 with the release of Texas’ first-ever state flood plan.

Their findings identified nearly $55 billion in proposed projects and outlined 15 key recommendations, including nine suggestions for legislation. Several were aimed at aiding rural communities like Kerr County, where flash flooding over the Fourth of July weekend killed more than 100 people. Three are still missing.

But this year, lawmakers largely ignored those recommendations.

Special dispensation for getting "yearslong" right per AP Style. So many fucking hyphens show up in purportedly professional outlets.

• The episode begins where “Hegemony” ended, with Captain Pike [Anson Mount] in a state of shock as the Gorn starships attack the USS Enterprise.

• Number One [Rebecca Romijn] suggests jamming the Gorn communications so they can’t co-ordinate attacks, similar to how in the Kelvin universe, the the crew aboard the USS Franklin was able to override the drone swarm’s signal in “Star Trek Beyond”. Presumably due to budgetary constraints, Uhura uses a Beastie Boys soundalike as opposed to actually broadcasting “Sabotage” this time.

• It was established that the Gorn use light for ship to ship messaging in “Memento Mori”

• Spock [Ethan Peck] suggests tagging the Gorn destroyer with an element called wolkite that will allow it to be tracked through subspace. In “Star Trek: The Undiscovered Country” Spock put a viridium patch on Kirk’s uniform so that he and Doctor McCoy could be tracked after being taken prisoner by the Klingons. And, in “Star Trek Beyond” Spock suggests a necklace he gave Uhura could be used to locate her thanks to its unique radiation, though he claims he did not originally intend to gift his girlfriend a tracking device.

• Season three opening credits changes:

• There is a slightly different angle on the close up of the bussard collector

• At approximately 42 seconds in, the season two opening featured a port side profile the saucer bathed in an orange light, whereas the season three iteration shows the ship traveling through a green gas cloud

• At approximately 51 seconds, the season two opening showed a close-up of the secondary hull as the sEnterprise travelled away from a glowing orb at about a ¾ angle, and in season three, we have a low angle on the starboard side of the secondary hull which pulls out to reveal the ship traveling away from a fiery burst

• Season two’s opening showed the Enterprise traveling through the atmosphere of a planet with what appears to be extremely large plant stalks at 55 seconds, and season three’s intro does the same, but this time it appears to be at night, whereas season two’s was in the morning

• About 67 seconds into the season two opening, the Enterprise is flying towards a tower in a planetary atmosphere, and in season three, we see it traveling through planetary ring with a Klingon D7 battlecruiser in the foreground

• At 70 seconds in, on the season two opening, the Enterprise is flying through the planetary ring, but there’s no Klingon ship and the asteroids are on fire, and in the season three sequence, the Enterprise is flying towards the aforementioned tower, but the landscape is snow and ice, as opposed to clouds or mist

• Approximately 72 seconds in, and the Enterprise is flying through an asteroid field in the season two opening, and in season three it’s is flying in orbit of a tiny green planet

• Season two’s opening has the same tiny green planet sequence at approximately 75 seconds, and season three’s intro features a shuttlecraft leaving the shuttlebay before the Enterprise warps away

• At 77 seconds, in season two, the Enterprise is flying above some glowing green volcanoes or craters, and in season three we see one of Starbase One’s biome pods with some mountains surrounded by water, with the shot eventually zooming out to show more of the starbase and the attending fleet; In addition to Enterprise and other Constitution-class, or Sombra-class starships, spaceframes featured include:

• What appears to be design inspired by the NX-01

• A freighter with a number of cargo pods

• A starship with underslung nacelles and a dorsal mission pod

• Approximaety 80 seconds in to season two’s opening, we see a Starbase One biome pod with a snowcapped mountain

• When the Enterprise drops out of warp into the fleet, we see the USS Pablo Picasso, which is the same spaceframe as the USS Kelcie Mae from “Under the Cloak of War”.

• There appears to be Nimitz-class starships with new, cylindrical nacelles, as part of the fleet.

• In Pike’s ready room we see a close up of the star map, featuring part of the Gorn Hegemony’s claimed territory, and just outside that territory is the Cestus system; a colony on Cestus III being attacked by the Gorn in “Arena” was that episode’s inciting incident; the Gorn captain claimed that the Federation colony were invaders into their space.

• Pelia [Carol Kane] and Scotty [Martin Quinn] attempt to integrate the device he created to hide his shuttle from the Gorn, as mentioned in “Hegemony”, into the Enterprise systems.

• Martin Quinn has been added to the cast as one of the stars of the show.

• La’an has flashbacks to her time as prey on a Gorn breeding world as an adolescent, which we learned about in the series premiere, “Strange New Worlds”.

• George Samuel Kirk [Dan Jeannotte] speculates that the digestive chamber that he and the rest of the away team were placed in breaks down living bodies to create fuel for the Gorn destroyer, which would indicate that a bunch of rendered humanoids can somehow power an absolutely massive ship capable of warp, and with seemingly impenetrable shields. Guess the Federation should feel silly for relying on matter/anti-matter reactions.

• Doctor M’Benga [Babs Olusanmokun posits that the digestive chamber might simply be making food for the Gorn. What both he and Sam fail to realize is that the Gorn are using the biomass to create a giant, Kaiju sized Gorn that they’ll need to assemble a team to go on a suicide mission to defeat, but if they’ve got enough Paragon or Renegade points they’ll be able to complete the mission without losing anyone.

• Chapel [Jess Bush] and Spock speculate they could use a Number One’s genetically modified Illyrian DNA to fortify Captain Batel’s [Melanie Scrofano] human system to give her a chance of surviving the Gorn parasites hatching. We learned that Number One is Illyrian and her genetic modification is able to prevent all sorts of problems, up to and including a warp core overload, in “Ghosts of Illyria”.

• The screen in Pike’s ready room shows a map of the Finibus system, the Galdonterre system, and the Kessik system.

• Enterprise visited Finibus III in “Memento Mori” and found that the colony there had been attacked by Gorn.

• The Albino hid on Galdonterre III and escaped before Kor, Koloth, and Kang could locate him, as per “Blood Oath”

• We learned in “Prophecy” that B’Elanna Torres was born on Kessik IV.

• ”Uhura and I have been pouring over all available data on the Gorn.” When Kirk asked Spock about information regarding intelligent life in the region of space near Cestus III, Spock replied, ”Nothing specific, Captain. Unscientific rumours only. More like space legends.”

• Number One tells Pike that Gorn sightings correlate to coronal mass ejections, something Sam speculated in “Hegemony”.

• Chapel and Spock wear red biohazard suits, seemingly inspired by the ones worn by the away team that visited the Psi 2000 Federation outpost in “The Naked Time”

• ”If this goes sideways, it’s Valeo Beta all over again.” The *Enterprise was dispatched to Valeo Beta V in “All Those Who Wander” and found Gorn.

• ”Enterprise, against an entire armada? We wouldn’t stand a chance.” Enterprise and the USS Discovery held off an armada of automated Section 31 starships, including Enterprise covering Discovery’s escape through a time portal, in “Such Sweet Sorrow, Part 2”.

• La’an’s brother, Manu, was previously mentioned in “Memento Mori” and “All Those Who Wander”.

• This is the first instance of Gorn text being seen on screen. The TNG comic, “The Gorn Crisis” also featured a Gorn alphabet, but it was not the same symbols as shown here.

• Enterprise was able to beam out ”several hundred” surviving Parnassus colonists from the Gorn destroyer in a matter of less than a minute, through critical levels of radiation, and their own shields. In “Crisis Point”, Rutherford exclaimed, “It’s a movie. You can beam whatever you want. You can do all sorts of beaming stuff in a movie.”* No, wait, that doesn’t actually apply here.

• ”I can’t help wondering if we didn’t create a problem for someone else to solve later.” “Arena” takes place about seven years after this episode, and by that point the Federation will have apparently have forgotten all knowledge of the Gorn.

• ”I’m Erica Ortegas. I fly the ship,” Ortegas’ [Melissa Nevia] catchphrase originated in “Among the Lotus Eaters”.

• Pike begins to pray after saying his father won. We learned in “New Eden” that his father taught comparative religion.

• Batel objects to Number One’s genetically modified Illyrian DNA being used in her treatment. Batel was responsible for persecuting the case against Number One for lying on her Starfleet application.

WordPress is one of the most widely used platforms for publishing content online. It’s often criticized as an insecure platform, but in reality WordPress itself is secure – it’s the many plugins, unmaintained or poorly developed, that generate significant vulnerabilities.

Many people host WordPress on Linux, often using Docker. While this is a valid approach, there are excellent alternatives – sometimes even better ones – for getting your WordPress site online in a secure, reliable, and updatable manner. The goal is to make the web a safer place and avoid the computing monoculture that increasingly pushes toward uniformity of solutions and setups – an attitude that I believe is harmful even when the solutions are open source.

For this type of setup, therefore, I’ll describe how to accomplish everything using FreeBSD. The jail separation, performance, and ZFS versatility – all reasons that support this choice. This guide will serve as a foundation – everything will work at the end, but it won’t cover all possible combinations or configurations.

We’ll be using BastilleBSD, which supports both ZFS and UFS. While FreeBSD’s base system has everything needed to create and run jails, BastilleBSD is incredibly useful for managing them. Since it’s written in shell script and has no database dependencies, management and backups are straightforward. Furthermore, moving jails becomes extremely simple – either by using the bastille command directly or by copying the files (or datasets, if you’re using ZFS).

BastilleBSD also supports templates, but for this tutorial, we’ll perform the operations manually to understand each step.

First, install Bastille:
pkg install bastille
Next, run the setup process:
bastille setup
Now, bootstrap the desired FreeBSD release:
bastille bootstrap 14.3-RELEASE update
With that, BastilleBSD is ready to go.

Creating the Jails

Now, let’s create the jail that will contain Apache, PHP, and WordPress:
bastille create apache 14.3-RELEASE 10.0.0.254 bastille0
Note: This command will only create and assign an IPv4 loopback address. For IPv6, the simplest solution is to assign an address for the jail directly to the host’s interface. To do this, note an available IPv6 address and assign it to the jail. For example, if the host’s network interface is vtnet0:
bastille edit apache
Add the following lines to the configuration file:
ip6 = new;ip6.addr = "vtnet0|2001:0DB8:1::443/64";
Restart the jail:
bastille restart apache
Next, let’s ensure that connections to the host’s ports 80 and 443 are redirected to the apache jail:
bastille rdr apache tcp 80 80bastille rdr apache tcp 443 443
Now, if using ZFS, let’s create a dedicated dataset for WordPress and mount it in the jail. The reason is simple: decoupling the Apache jail from the WordPress directory will allow for updates, rollbacks, etc. of the Apache jail without touching the WordPress files. I assure you that, in the long run, this approach will save many headaches.
zfs create zroot/wordpressbastille mount apache /zroot/wordpress/ /usr/local/www/wordpress nullfs rw 0 0
Now, let’s create the jail that will contain MariaDB:
bastille create mariadb 14.3-RELEASE 10.0.0.253 bastille0

Configuring the MariaDB Jail

Access the MariaDB jail’s console:
bastille console mariadb
Once inside, install the MariaDB server:
pkg install mariadb118-server
Enable and start the mysql-server service:
service mysql-server enableservice mysql-server start
Now, access the MySQL command line to set up the WordPress database:
mysql
Execute the following SQL commands (you should use more secure user, password, etc.):
CREATE USER wp@10.0.0.254 IDENTIFIED BY 'password';CREATE DATABASE wordpress;GRANT ALL PRIVILEGES ON wordpress.* TO wp@10.0.0.254;FLUSH PRIVILEGES;
Exit the MariaDB jail console to return to the host.

Configuring the Apache & PHP Jail

Now, let’s configure the apache jail. First, access its console:
bastille console apache
Inside the jail, install PHP and all the necessary extensions. We won’t install WordPress from the FreeBSD package – while it’s updated and maintained, I prefer to manage dependencies manually. It will be easier to manage updates in the long term, such as changing PHP versions, etc. At the time of writing this article, for example, the WordPress package depends on PHP 8.3 while I prefer to use 8.4.
pkg install php84 php84-bcmath php84-bz2 php84-calendar php84-ctype php84-curl php84-dom php84-exif php84-fileinfo php84-filter php84-ftp php84-gd php84-gettext php84-iconv php84-intl php84-mbstring php84-mysqli php84-opcache php84-pcntl php84-pdo php84-pdo_mysql php84-pecl-imagick php84-phar php84-posix php84-readline php84-session php84-shmop php84-simplexml php84-soap php84-sockets php84-sodium php84-tokenizer php84-xml php84-xmlreader php84-xmlwriter php84-xsl php84-zip php84-zlib
Next, install Apache:
pkg install apache24
Modify /usr/local/etc/apache24/httpd.conf to enable the required modules. Uncomment or add the following lines:
LoadModule mpm_event_module libexec/apache24/mod_mpm_event.so#LoadModule mpm_prefork_module libexec/apache24/mod_mpm_prefork.so#LoadModule mpm_worker_module libexec/apache24/mod_mpm_worker.so...LoadModule proxy_module libexec/apache24/mod_proxy.so...LoadModule proxy_fcgi_module libexec/apache24/mod_proxy_fcgi.so...LoadModule ssl_module libexec/apache24/mod_ssl.so...LoadModule rewrite_module libexec/apache24/mod_rewrite.so
Enable and start the Apache service:
service apache24 enableservice apache24 start
To optimize performance, enable PHP-FPM to listen on a socket. Modify the /usr/local/etc/php-fpm.d/www.conf file.

Comment out this line:
;listen = 127.0.0.1:9000
And add these lines:
listen = /tmp/php-fpm.socklisten.owner = wwwlisten.group = www
Now, we need to configure Apache to use PHP-FPM correctly. Create the file /usr/local/etc/apache24/Includes/php-fpm.conf and add the following:
<FilesMatch \.php$> SetHandler proxy:unix:/tmp/php-fpm.sock</FilesMatch>
Restart Apache for the changes to take effect:
service apache24 graceful
It’s good practice to copy the production PHP template to the final, modifiable php.ini file, which can be customized with the required options and limits:
cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini
Make any desired changes now (or later), then enable and start PHP-FPM:
service php_fpm enableservice php_fpm start

Installing WordPress

Navigate to the web server’s root directory:
cd /usr/local/www
Download and extract the latest version of WordPress:
fetch wordpress.org/latest.zipunzip latest.zip
Set the correct permissions:
chown -R www:www wordpress/
Now, create an Apache virtual host configuration file at /usr/local/etc/apache24/Includes/wordpress.conf – be sure to modify the “example.com” with your own real domain name:
<VirtualHost *:80> ServerAdmin webmaster@example.com ServerName example.com ServerAlias www.example.com DocumentRoot /usr/local/www/wordpress <Directory /usr/local/www/wordpress> DirectoryIndex index.php index.html index.htm Options FollowSymLinks MultiViews AllowOverride All Require all granted </Directory> ErrorLog "/var/log/httpd-example.com-error.log" CustomLog "/var/log/httpd-example.com-access.log" combined</VirtualHost>
Finally, restart Apache one more time:
service apache24 graceful
The server will now respond on port 80 with the specified hostname, but this is absolutely not optimal or recommended. It’s therefore appropriate to generate a certificate to enable HTTPS.

For a simple solution, I recommend installing certbot with the Apache plugin to manage everything through Apache:
pkg install py311-certbot py311-certbot-apache
In order to automatically renew the certificates, add this line to /etc/periodic.conf:
weekly_certbot_enable="YES"
And, once installed, generate the certificate:
certbot --apache -d example.com -d www.example.com
You can now proceed to connect to the specified URL and begin with the WordPress guided installation, remembering the authentication and database details (the host, in this example, is 10.0.0.253 – not localhost, since we installed it in a dedicated jail).

Congratulations, your site is installed and operational. Ready to receive content for publishing. It’s exposed on IPv4 and IPv6, with HTTPS (and automatic certificate renewal, managed directly by FreeBSD) and separated from the database.

Generally, I prefer to add an additional jail with a reverse proxy. This way it will be possible to install different software in different jails, ensuring that the reverse proxy “routes” requests correctly. I’ll explain this procedure in a future article.

While this is my inaugural FreeBSD post for the BSD Cafe Journal, I’ve actually written extensively on the topic for my own blog, it-notes.dragas.net

Stefano Marinelli

2025-07-14 14:10:00

It’s Not WordPress. It’s the Plugins.

One of the reasons I’m always so happy to attend conferences and technical events (the real ones – not the flashy, sponsor-driven ones designed just to sell products or services) is because I get to meet amazing people and always come away having learned something new.

I’ve been using WordPress since 2006 and have been managing hundreds of installations from a sysadmin perspective. Over time, I’ve noticed a clear pattern: most hacks and compromises happen through plugins or outdated installations. And often, these installations (and plugins) become outdated because they’ve been patched together so messily that updating them becomes nearly impossible – especially when the PHP version changes.

In March 2025, I attended a fantastic conference: OSDay 2025. I gave a talk on why I believe it makes perfect sense to consider the BSDs in 2025, but many of the other talks were truly eye-opening.

To mark the launch of the BSD Cafe Journal, I’d like to share the link to a particularly interesting talk by Maciek Palmowski: “How we closed almost 1k plugins in a month — the biggest WordPress bug bounty hunt.”

What struck me right away was how much his analysis of WordPress security aligned with what I’ve seen over the years: WordPress, out of the box, is reasonably secure. It’s the plugins – often old, unmaintained, or poorly written – that make it vulnerable.

I highly recommend watching his talk. It’s definitely worth your time.

youtube.com/watch?v=Y3HsjvRAof…

OSDay 2025 - Why Choose to Use the BSDs in 2025

The slides, the notes, and the text behind my presentation at OSDay 2025 in Florence, Italy - 'Why Choose to Use the BSDs in 2025.

^{Stefano Marinelli (IT Notes)}