I spent today reading up on Sunscreen, the Solaris 9 bundled IPfiltering system. It's been interesting, partly because Sunscreen'sbuilt around a different packet matching model than I'm used to, anduses a great deal of different terminology (for example, what I thinkof as 'transparent bridging' is called 'stealth mode').

Sunscreen doesn't actually match packets as such. Instead you define'services', for which you specify some combination of destinationand/or source ports

A recent commentator on HowNotToDoDNSI has prompted me to write aboutthe hell that glue records could be in in the Internet's old days. Toreally cover the horror, I'll start with the ordinary glue recordhorror.

Glue records are additional A records that get returned by higherlevel nameservers when people ask for NS records to avoid recursionproblems that would otherwise ensue when, eg, foo.com has www.foo.com as its nameserver. This can be exploited to optimize DNSlookups a bit, as

Is concurrency hard? You can certainly find people arguing both sidesof the issue if you look hard enough (mostly for rather than against).But I think the question may be blurring two things together that areworthwhile to separate: 'concurrency is difficult to learn andunderstand', and 'concurrency is tricky to implement correctly'.

For example, in his reaction to Joel Spolsky's Java Schools article ,Tim Bray gives a little taxonomy of difficulty:

My experience differs from Joel's in another respect: