When I started to write yesterday's entry on how OpenSSH certificatesaren't X.509 certificates , I initiallytitled it as being about 'SSH certificates'. This wouldn't beunusual; Matthew Garrett's article We need better support for SSHhost certificates alsouses 'SSH' here. I changed my entry's title out of a sense ofpickyness, because although OpenSSH is the dominant SSH implementation,it's not the only one. Or maybe it is, depending on

The ZFS ARC is ZFS's version of a disk cache. Further general information onit can be found in two highly recommended sources, Brendan Gregg's2012 Activity of the ZFS ARC and Allan Jude 's FOSDEM 2019 ELI5:ZFS Caching ( also , via ). ZFSexposes a lot of information about the state of the ARC throughkstats, but there isn't much documentation about what a lot of themmean. Today we're going to talk about some

Recently I wrote about learning about the extra hazards of mutualTLS in web server programs , where theextra hazard is that your Apache or other web server program mustnow parse TLS X.509 certificates andunderstand ASN.1 encoding and so on, which is a lot of code thatit probably doesn't currently run. When writing that entry, itoccurred to me to wonder if (Open)SSH had the same problem, sinceOpenSSH supports user authentication through signed certificates(instead of personal keypairs)

Over on the Fediverse, I shared a phish-related discovery :

Today's discovery: people hosting phish landing forms in IPFS andusing Cloudflare's IPFS gateway to do the work of web access tothem. Nicely played. Everyone is going to point fingers at everyoneelse.

(As usual the email has a different URL, with a 'this is our securedocument link' that takes you to the IPFS hosted form.)

Let's be a little bit more specific, because it's a

A while back I wrote about silencing KDE application notificationsounds under fvwm , where the solution was toopen up the desktop settings or volume control application of yourchoice and turn off the volume of what is variously called 'NotificationSounds' or 'System Sounds'. Initially I did this through KDE andthought it was a KDE-specific setting, but as pointed out to me incomments, this is actually a global (to the system) sound streamfor system sounds and events. This is an extremely blunt hammer

Recently I wrote about how Go 1.21 will have a static toolchainon Linux , where the ' go ' program willbe statically linked so you can freely copy even a locally builtversion from Linux distribution to Linux distribution. If you'rean innocent person, like I was before I started my journal , you might thinkthat achieving this yourself in Go 1.20 and earlier isn't hard. Infact, it turns out that I failed, although my failure was disguisedby the situation

In Linux (and other operating systems), NSS (Name Service Switch) is a mechanismthat lets the system implement name resolution for various sortsof name lookups through a system of dynamically loaded sharedobjects, configured through /etc/nsswitch.conf . Alsoin Linux, in theory, you can statically link programs through the'-static' argument to various programs like GCC and the Go toolchain . Statically linking programexecutables because this can avoid situations where you can't runan executable on an older Linux version

We have various host-related alerts in our Prometheus and Alertmangersetup . Some of those are about thingson the host not being right (full disks, for example, or networkinterfaces not being at the right speed ), but some of them are alertsthat fire if the host is down; for example there's alerts on pingfailures, SSH connection failures, and the Prometheus host agent not responding.Unsurprisingly, we reboot our machines every so often and we don'tlike to get spammed with spurious

A while back, I lamented on the Fediverse :

Current status: yak shaving a Go 1.17 built on Ubuntu 20.04 so I canbuild Go 1.20 on 20.04 so I can build a binary with Go 1.20 that willrun on 20.04 for reasons.

The easy way to solve this problem would have been to downloadan official binary release tarball , becausethese are built so that they'll run on pretty much any