The evaporation of lots of .ga domains
Over on the Fediverse, I talked about something that might notbe widely known :
Today I found my (first) .ga site with useful information thatdisappeared in the recent great .ga purge,
(from 2019 and so not necessarily right for current Go, but it givesme/you some general ideas). (I believe this is by @joakimkennedy who may either have re-homedit elsewhere or not done so because these articles are now obsolete
Where your program's configuration files ('dotfiles') should go today
Over on the Fediverse, Ben Zanin had a question :
Is there a general consensus about the preference order of dotfiles andconfig directories?
Let's say we have a tool that reads an optional config file &populates/uses a small state file.
1. There is the traditional ~/.example/ dir that would contain `config` and `db`
2. There is the XDG ~/.config/example/config and ~/.local/example/db
3. There is the truly
The Certificate Authority's view of Certificate Transparency and CT Logs
TLS Certificate Transparency is a system where browser vendors require Certificate Authoritiesto publish information about all of their TLS certificates incryptographically validated logs, which are generally run by thirdparties (see also Wikipedia ). I'vewritten before about the TLS client's view of this and how it relates to potentiallyuntrustworthy CT log operators, but I haven't written about theCertificate Authority's view of things. The CA's view is alsorelatively similar to the view a TLS server has.
The normal behavior
There are two levels of isolation when building Linux packages
Today I once again had to rebuild an Ubuntu package from source,and once again it didn't go well . This gives me agood opening to talk about the two sorts of build isolation youwant when building or re-building packages for your Linux distribution.
The first sort of isolation is isolation of the binary build areafrom the package source area , whichthe Debian package format doesn't have; the lack of this isolationcan easily cause explosions .Without this isolation, repeatedly building the package is dangerous
The potential risks of using (Open)ZFS On Linux with at least NFS
I've written in the past about how we've had problems with Maildirformat mail storage and howmaking /var/mail local to our IMAP server was a significant improvement . A common element to both ofthese issues that our NFS fileservers use (Open)ZFS On Linux . Over time, I've come to feel that thisrepresents a potential risk factor for our environment.
Now, on the one hand we might have seen these issues with NFSregardless of the underlying filesystem on the fileservers, even
A potential issue with outstanding query limits in your DNS resolver
A while back we had a little incident where our internal forwardingDNS resolvers stopped resolving internal names . This startedhappening very shortly after the university's general Internetconnectivity was interrupted, and while I believe we're not entirelysure about the root cause, we have a theory that feels plausible.That theory is limits in outstanding queries and generally ratelimits in the DNS resolver that our internal forwarding DNS serverswere running.
It's routine for a lot of systems inside our network to be lookingup external DNS
(Apparent) Certificate Authorities aren't always actual CAs
The CA news of the time interval is, to quote Matt Holt ( also ):
Well, I inadvertently discovered a zero-day RCE in acme.sh and got aChinese CA to shut down overnight:
The CA in question was called 'HiCA', and even if you keep goodtrack of the (many) TLS Certificate Authorities that your browseror operating system trusts, you may be scratching your head inpuzzlement because you've never heard of it before. That's
Let's Encrypt (really ACME) has a decent reason for (still) using CSRs
As I found out a while back (in this entry ), the ACME protocol that Let's Encrypt invented and usedsubmits its actual requests for TLS certificatesas Certificate Signing Requests (CSRs) , despiteCSRs being famously complicated things that are theoretically fullof information that Let's Encrypt and ACME don't care about. Thestory I heard was that this was initially done because Let's Encryptworried that the Certificate Authority Baseline Requirements might require CSRsto properly issue a TLS certificate, but recently Matthew McPherrin
A retrospective on my thesis about language niches, fifteen years later
Back in 2007, I wrote A thesis about language niches ,in which I thought there were three such niches and they wereprobably all occupied, with low odds of any of the current occupantsbeing displaced. The three niches I saw then were 'low level' (Cand C++), 'loose control' (Java and C#), and 'loose control withdynamic typing' (Python, Ruby, etc). I was recently thinking abouthow my thesis has played out
I should read the Vim help more often
A while back I wrote about handling numbers in Vim when they havea dash in front of them , and in a comment,Seth pointed me to a special option in visual mode ,'g Ctrl-A', which will increment a column of numbers the way Iwanted here. Since this is visual mode, I can select the numberswithout the leading dashes.
One of the morals I drew from this is that when I'm trying to dosomething in Vim, I should read the help (more
Menu