FreeBSD – a lesson in poor defaults
> I think swap should <i>always</i> be encrypted. FreeBSD developers disagree. It's surprising just how much private data in memory gets written to disk. Someone I know has run hexdump on his swap partition and found PGP private keys in plain view. Your SSH key might be password-protected on disk, but it could end up in swap sooner or later... with no password needed.<p>GnuPG and a few other security-conscious programs try to avoid this by using mlock() [1]. Unfortunately, by default the ZFS ARC can grow beyond the limit for wired pages, which will make those mlock() calls start failing once the system has been up long enough [2].<p>[1] <a href="http://pubs.opengroup.org/onlinepubs/7908799/xsh/mlock.html" rel="nofollow">http://pubs.opengroup.org/onlinepubs/7908799/xsh/mlock.html</a><p>[2] <a href="https://ximalas.info/2012/04/10/not-enough-room-for-wired-pages/" rel="nofollow">https://ximalas.info/2012/04/10/not-enough-room-for-wired-pa...</a>