A while back I had a hot take on the Fediverse :

Another day, another 'producing HTML with stringtemplates/interpolation is wrong' article. People have been writingthese articles for a decade or more and people doing web developmenthave kept voting with their feet, which is why we have stringtemplates everywhere. At this point, maybe people should considerwriting about why things have worked out this way.

(I don't think it's going to change, either. No one has structuredHTML creation

In my views on protocols and encryption ,I called SMTP and IMAP 'stream based protocols' without reallyexplaining what I meant and why this mattered (and why NFS v3 isn'treally one, even though it's also transported over TCP). Whilewriting a comment on that entry I came to a realization about thisin the context of encryption. The short version is that streambased protocols have context , or equivalently that a specificconnection for such a protocol has state, state that's not

In the context of encryption for NFS , agood question was raised in the comments for this entry :

This makes me wonder, what is it about file-access protocols that theyfundamentally "have to" go through a VPN or be tunneled through SSH,in your opinion, instead of using protocol-integrated security likeeverything else can? (This is in context of workstation-to-server, notserver-to-server.)

That is, why we use SSH-over-Internet instead of Telnet

A comment on my entry on NFS with Kerberos versus normal NFS mentioned that one advantage of NFS withKerberos is that it can encrypt all of the NFS traffic between yourservers (whether they be NFS clients or NFS servers). My view isthat there are better ways to achieve this in today's world, onesthat I trust more for this purpose.

The first option is to use IPsec for at least the NFS traffic between NFS servers and NFS clients.IPsec has the advantage that IPsec security policies will generally

One of the big divisions between NFS v3 and NFS v4is that NFS v4 is normally used with Kerberos. In normal configurations,this means that Kerberos is used to authenticate user requests; aNFS v4 client that claims to be making a NFS request on behalf ofa given user must prove this by presenting an appropriate Kerberosticket. This is different from NFS v3, where normally NFS clientsare trusted by the NFS server to identify which UID the client ismaking the NFS request on behalf of

I recently read Daniel Lemire's The absurd cost of finalizers inGo ( via ),which reports on a remarkably high cost of using a finalizer toinsure that C memory is freed. Lemire's numbers aren't atypical;in my own testing in a different environment I found a rough factorof ten difference between directly calling C malloc() and free() and using a finalizer to call free() .

The first reason for this increased overhead in Lemire's test caseis perhaps somewhat surprising

Here's something that hadn't struck me until I looked it up forthis entry: Apache 2.4 is now morethan ten years old. The first 2.4 release was made in early 2012( per Wikipedia ),and despite being that old, 2.4 remains the current version of theApache web server (with 2.4.57 released in early April of this year,2023). There is a '2.5' in development

Recently I read KDE Plasma is NOT a Desktop Environment ( via ),which maintains that it's more like an environment constructionkit, out of which one could build multiple environments. I havesome reactions to this, and also I have some opinions on what adesktop environment even is on a modern Linux system (opinionswhich may count as a bit heretical).

The classical Unix vision of a desktop environment is that it's basically a window managerand a suite of graphical applications built around a common look

For reasons beyond the scope of this entry, we didn't collect anymetrics from our Ubuntu 18.04 ZFS fileservers ( trying to do so early on ledto kernel panics ). When weupgraded all of them to Ubuntu 22.04, we changed this, puttingvarious host agents on them and collecting a horde of metrics thatgo into our Prometheus metrics system ,some of which automatically appear on our dashboards. One of theresults of this is that we've started noticing things