In a comment on my entry about common multi-factor authenticationmethods , Ben Hutchings said (in part):

I tend to think push-based approval is the least secure of thethree. I've read several incident reports where the attacker got auser's password and then repeatedly tried to log in, spamming themwith approval requests until they gave in and tapped Approve.

I've read similar reports (perhaps the same reports), so I believethat this MFA push notification fatigue is real,

Suppose, not hypothetically, that you use NMH as your mail client and that you wouldlike to cc: yourself on all of the mail you send; this is what Ido. It's relatively easy to set this up for the NMH comp command,which creates new messages. There are a number of approaches andit's easy to understand all except the most complex ones, and sinceyou have to create the complex ones yourself, presumably anyone whocan set it up knows what they're doing

A very common and popular feature of IMAP based mail readers (IMAP clients) is that when you send email, theywill also send the email to one of your IMAP folders, often called'Sent'. On the one hand this is a good idea and many people counton it to keep a record of all of their outgoing email, but on theother hand it can give rise to mysterious issues, for at least twobroad reasons.

The first reason is that what IMAP clients aren't actually '

In a comment on my entry on splitting our local DNS resolversapart to serve different audiences , DavidMagda asked if using per-IP ratelimiting wasa potential solution. My feeling is that it would be difficult forus to do this today with any confidence, and it's not clear to methat reasonable per-IP ratelimits would stop all the problems.

We use Unbound asour DNS resolver, partly because that's what OpenBSD seems to likefor this (our local DNS resolvers are OpenBSD machines).

Probably like many people, we have some machines that are set upas local DNS resolvers. Originally we had one set for everyone,both our own servers and other people's machines on our internalnetworks , but after some recentissues we want to make DNS resolution on our own critical serversmore reliable and are doing that partly by having a dedicatedprivate DNS resolver for our servers .Right now all of our servers do DNS in the old fashioned way, witha nsswitch.conf that tells them to use DNS

We operate a collection of ourown servers, and also a bunch of internal networks for otherpeople's machines . As part of this we operateour own DNS infrastructure, including local DNS recursive resolvers(which are necessary to handle things like our split horizon DNSsetup ). Historically we have used one set oflocal DNS resolvers to handle everything; both DNS lookups from ourown servers and DNS lookups from other people's internal machinesgo to the same DNS resolvers. After all, why not? It'

Under ertain circumstances , Linux will triggerthe Out-Of-Memory Killer and kill some process. For some time, therehave been two general ways for this to happen, either a global OOMkill because the kernel thinks it's totally out of memory, or aper- cgroup based OOM killwhere a cgroup has a memory limit .These days the latter is quite easy to set up through systemdmemory limits, especially user memory limits .

The kernel exposes a vmstat statistic for total OOM kills from allcauses

Unbound is a commonresolving DNS server; we use it ourselves on our local recursiveDNS resolvers. For a long time, Unbound has had the ability to setratelimits, as covered in the unbound.conf manualpage. These ratelimits have historically been a little complicatedto understand ( for example ), and thesituation is still not completely clear in the current (September2023) documentation.

Unbound can have both a global ratelimit, set with ' ratelimit ',and one or more different rate limits for

It's a tradition with me that sooner or later, I hit a GNU Emacsfunction that doesn't work the way I want it to and has no applicablecustomization options. My traditional brute force approach to dealingwith these functions has been to redefine them; I'd copy their codeto my .emacs or some personal .el file, modify or replace it totaste, and then insure that my definition got used instead of thestandard one. If what I really cared about was a keybinding,