bsdnexus.com

What is BSDnexus?

BSDnexus is a personal BSD and systems-programming blog. Its content is written from the perspective of someone working close to the operating system: C functions, manual pages, and the small implementation details that are easy to overlook when you only use high-level tools.

The page evidence shows that mix clearly. One post recounts writing a custom version of the C library function strdup() after an IRC conversation, using malloc(), strlen() and memcpy() rather than a loop. Another set of headings covers key-pair generation, listing and viewing keys in a keyring, public versus private keys, and encrypting files. So the site sits at the intersection of low-level C programming and practical BSD/Unix tooling.

A reader who would get the most from it is someone comfortable with command-line systems, C, and security basics, and who prefers short, experience-driven notes over formal tutorials. It is not a general news site, a vendor documentation portal, or a beginner's introduction to BSD.

As a next step, pick the topic that matches your current task. If you are working with encryption keys, start with the key-pair and keyring posts; if you are studying C, read the strdup() implementation and compare it with your libc's version, noting the edge cases the short example does not handle.

How do I generate a key pair on BSDnexus?

BSDnexus covers key-pair generation as a command-line exercise, not a one-click button. The page's own section headings — "GENERATE KEY PAIR," "LISTING / VIEWING KEYS IN KEYRING," "PUBLIC KEYS," "PRIVATE KEYS," and "ENCRYPTING FILES" — suggest a walkthrough built on a standard OpenPGP/GnuPG-style toolchain, where you create a key, inspect it in your keyring, then use it to encrypt files.

What each stage is for

A concrete reader scenario

Say you want to email a colleague a sensitive file. You generate your own pair first, so you have a keyring to work from. You then obtain the colleague's public key and encrypt the file to it, so only their private key can open it. Your own private key stays put — it is the part you never send.

The practical decision point is passphrase and storage: a private key protected by a strong passphrase but backed up somewhere safe is more useful than one you cannot recover after a disk failure.

Next step

Open BSDnexus and start at the "GENERATE KEY PAIR" section, then work downward through the list in order — generating, listing, and only then encrypting. If you want the underlying tool's own reference alongside it, GnuPG documents the same workflow in more depth.

How do I list and view keys in my keyring on BSDnexus?

BSDnexus covers GPG key management in its "LISTING / VIEWING KEYS IN KEYRING" section, which is the part of the site that answers your question. The site splits its key material into two groups: public keys and private keys.

To list and view keys in your keyring, the standard GPG approach works like this:

• List public keys only: gpg --list-keys shows the public keys in your keyring.
• List private keys only: gpg --list-secret-keys shows the private keys you hold.
• Show key fingerprints: add --fingerprint to either command, e.g. gpg --list-keys --fingerprint, so you can verify a key before trusting it.
• View full key details: gpg --list-packets <file> inspects the packets inside an exported key file when you need to see its structure.

A practical next step: run gpg --list-keys --fingerprint first, note the fingerprint of the key you care about, then use that fingerprint (not the short key ID) whenever you encrypt, sign or share the key. Short IDs can collide, so fingerprints are the safer identifier.

The two-list split matters depending on your role: if you are just encrypting a file for someone, you only need their public key in your keyring; if you are decrypting or signing, you need your own private key available. Use --list-keys to check what you can encrypt to and --list-secret-keys to confirm what you can decrypt or sign with.

What is the difference between public and private keys on BSDnexus?

BSDnexus presents public and private keys as two halves of one key pair used for encryption. The public key is the part you share; the private key is the part you keep to yourself.

The core difference

• Public key: Meant to be distributed or listed openly. Someone can use it to encrypt a file intended for you.
• Private key: Meant to stay on your machine. It is the key that lets you decrypt what was encrypted with the matching public key.

How BSDnexus organizes them

The page groups its material into sections that mirror this split: generating a key pair, listing or viewing keys in a keyring, public keys, private keys, and encrypting files. That structure suggests a practical workflow rather than a theoretical discussion: create the pair, inspect which keys are available, share the public half, protect the private half, then encrypt with the public key.

A concrete example

Suppose a colleague wants to send you a sensitive file. They encrypt it with your public key. You receive the encrypted file and use your private key to decrypt it. If you lose the private key, the file is effectively locked away. If someone else obtains your private key, they can read anything encrypted to you.

Practical decision criteria

• Share the public key as widely as needed for others to encrypt to you.
• Keep the private key offline or protected with a passphrase where possible.
• Treat the keyring as the place where both halves live until you export or back them up.
• If you only need to verify a signature or encrypt, you can work with public keys alone; decryption requires the private key.

As a next step, generate a test key pair and try encrypting a small file with the public key, then decrypting it with the private key. That exercise makes the division of labor between the two keys obvious.

How do I encrypt files using BSDnexus?

BSDnexus is not an encryption tool; it is a personal technical blog. The page you're asking about is a post that walks through GnuPG-style key operations—generating a key pair, listing and viewing keys in a keyring, distinguishing public from private keys, and encrypting files. So the honest answer is: you don't "encrypt files using BSDnexus." You read BSDnexus to learn the commands, then run them with an encryption program on your own machine.

What the page actually covers

The headings on BSDnexus map to a standard public-key workflow:

• Generate key pair — create a public key you share and a private key you keep.
• Listing / viewing keys in keyring — inspect what keys exist locally.
• Public keys — the part others use to encrypt to you or verify your signatures.
• Private keys — the part that decrypts and signs; never share it.
• Encrypting files — the actual operation, done with the recipient's public key.

A concrete reader scenario

Suppose you want to email a sensitive document to a colleague. You'd generate your own key pair, have your colleague do the same, exchange public keys, then encrypt the file to their public key so only their private key can open it. BSDnexus's post is the walkthrough for those steps; your local GnuPG installation is the tool that performs them.

Where to go for the actual software

If you need authoritative command references rather than a blog narrative, the official sources are:

• GnuPG — the manual and documentation for the gpg command.
• OpenBSD — if you're on OpenBSD, its FAQ covers signify and related tooling.

Decision criterion

Use BSDnexus when you want a short, example-driven explanation of the key concepts and a working command sequence to adapt. Use the official project documentation when you need current flags, version-specific behavior, or security guidance—blogs age, and cryptographic tooling changes.

How can I write my own strdup function in C like the example on BSDnexus?

Write a small helper that allocates memory for a copy of a string, copies the characters into it, and returns the new pointer. The BSDnexus post describes exactly this exercise: after checking the strdup() man page, the author considered a for loop, was pointed toward memcpy(), and produced a short implementation using malloc, strlen and memcpy.

A faithful version of that approach looks like this:

#include <stdlib.h>
#include <string.h>

char *mystrdup(const char *string)
{
    char *p;

    if ((p = malloc(strlen(string) + 1)) == NULL)
        return NULL;

    return memcpy(p, string, strlen(string) + 1);
}

The concept is straightforward, but there are two details worth fixing before you rely on it.

The off-by-one and the missing terminator. The version quoted on BSDnexus allocates strlen(string) bytes and copies strlen(string) bytes. That leaves no room for the null terminator, so the result is not a valid C string and any later printf, strcmp or strlen on it reads past the allocation. Allocate strlen(string) + 1 and copy that many bytes, as above. Copying the terminator is also why memcpy with + 1 works without a separate assignment.

NULL input. The standard strdup does not accept a null pointer; passing one is undefined behaviour. If your code might receive NULL, decide explicitly whether to return NULL or to treat it as an error, rather than letting strlen crash.

A practical reader scenario

Suppose you are writing a small configuration parser that reads a token from a buffer, then stores it in a struct that outlives the buffer. You cannot just keep a pointer into the buffer, so you duplicate the token:

config->name = mystrdup(token);
if (config->name == NULL) {
    /* handle allocation failure */
}

Later, every one of those duplicated strings needs a matching free(). That ownership rule is the real cost of strdup-style helpers, and it is the main reason some codebases avoid them in favour of fixed buffers or a dedicated arena.

When to write your own

If you are targeting strict C rather than POSIX, note that strdup is not part of the ISO C standard library, which is another legitimate reason to keep a private helper. The name mystrdup or similar avoids clashing with a library version.

As a next step, add the + 1 fix, then write a short test that duplicates an empty string and a longer string, and run it under a memory checker such as Valgrind. An empty string is the case that catches the missing terminator immediately. If you want to read the original discussion and the surrounding C notes, see BSDnexus.