DATABASES Signal 135
Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8)
↗
If you operate OpenBSD-based infrastructure using relayd or httpd, these daemons are no longer effectively unmaintained — active commits are landing again. The security improvements (stricter TLS defaults, duplicate header rejection, parser differential fixes) and crash-fixing race condition patches directly affect production reliability for reverse-proxy and load-balancing workloads.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The original author Reyk Floeter retired from OpenBSD, leaving relayd and httpd without engaged maintainers until rsadowski and kirill@ resumed work.
Security changes include switching the default TLS cipher set to "secure", adding ECDSA support, rejecting duplicate Content-Length headers, and rejecting obs-fold headers per RFC 9112 5.2.
A reload race condition that caused relayd crashes has been fixed, alongside multiple memory leaks and missing NULL/bounds checks.
THE CLUSTER