FreeBSD – a lesson in poor defaults
> I think swap should always be encrypted. FreeBSD developers disagree. It's surprising just how much private data in memory gets written to disk. Someone I know has run hexdump on his swap partition and found PGP private keys in plain view. Your SSH key might be password-protected on disk, but it could end up in swap sooner or later... with no password needed.GnuPG and a few other security-conscious programs try to avoid this by using mlock() [1]. Unfortunately, by default the ZFS ARC can grow beyond the limit for wired pages, which will make those mlock() calls start failing once the system has been up long enough [2].[1] http://pubs.opengroup.org/onlinepubs/7908799/xsh/mlock.html[2] https://ximalas.info/2012/04/10/not-enough-room-for-wired-pa...