FreeBSD – a lesson in poor defaults
&gt; I think swap should <i>always</i> be encrypted. FreeBSD developers disagree. It&#x27;s surprising just how much private data in memory gets written to disk. Someone I know has run hexdump on his swap partition and found PGP private keys in plain view. Your SSH key might be password-protected on disk, but it could end up in swap sooner or later... with no password needed.<p>GnuPG and a few other security-conscious programs try to avoid this by using mlock() [1]. Unfortunately, by default the ZFS ARC can grow beyond the limit for wired pages, which will make those mlock() calls start failing once the system has been up long enough [2].<p>[1] <a href="http:&#x2F;&#x2F;pubs.opengroup.org&#x2F;onlinepubs&#x2F;7908799&#x2F;xsh&#x2F;mlock.html" rel="nofollow">http:&#x2F;&#x2F;pubs.opengroup.org&#x2F;onlinepubs&#x2F;7908799&#x2F;xsh&#x2F;mlock.html</a><p>[2] <a href="https:&#x2F;&#x2F;ximalas.info&#x2F;2012&#x2F;04&#x2F;10&#x2F;not-enough-room-for-wired-pages&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ximalas.info&#x2F;2012&#x2F;04&#x2F;10&#x2F;not-enough-room-for-wired-pa...</a>