Let me say it up front: managing a firewall of any decent complexityis hard. Sooner or later you start losing track of rules and what'sactually going on, writing half-redundant rules, and so on; inshort, your firewall ruleset descends into sysadmin superstition .I've recently realized that part of why this happens is that there arethree views of your firewall's behavior that you need, and you can't getall of them just from reading your firewall rules; at most

Just like users have folklore , system administrationdoes too. Our sort of superstition is a bit different, though ( well , usually ):it is the kind of thing where you say 'I don't know why that's there,but let's not remove it just in case'. When our system environmentsreach a certain level of fragile complexity and westart losing track of the fine details, of course our informed actionsstart descending into rote procedures.

(This really accelerates when new people come

I wrote before about how updating RPMs wouldoccasionally leave .rpmnew files behind that were, in fact,identical to the normal version of the file. I believe that I nowunderstand what causes this and what's going on: I think it's anothermanifestation of the RPM multi-architecture file ownership problem .

The .rpmnew files are created when you update a package where you'vechanged one of its configuration files from the default version andthe package also includes a new version of the configuration file.