I mentioned before that I've been switching some libvirt-basedvirtual machines to UEFI . I've recentlyhad to do some more things there, which has led me to discoverwhat's important about the XML parts of your libvirt machinedefinitions for this. Or at least, what's important if you usevirt-manager to change things.

(There's a long story that boils down to libvirt external snapshotsnot playing well with virtual CD-ROMs, BIOS PXE booting beingannoying, and

I recently read Geoff Huston's Revocation of X.509 certificates ,which in part talks about OCSP 'sfailure. One of the pragmatic reasons for OCSP being dead is that Chrome dropped support for it morethan a decade ago. Specifically, Chrome's replacement for certificaterevocation was for Chrome to have an internal set of revokedcertificates .Recently, Firefox has adopted a similar approach (with a differenttechnical implementation).

One of my views of this is that it shows browsers recognizing andaccepting that

I recently wrote about all of the various steps of a UEFI networkinstall , where you have a wholecollection of DHCP, GRUB fetching things via TFTP and HTTP, and soon, all to boot into your Ubuntu server install ISO image. Specifically,all of the GRUB stuff and much of the complicated DHCP stuff is there because we haveto load the installer's kernel and initial ramdisk. Our primaryusage for UEFI network installs is to reinstall physical serversthat are now in inconvenient locations, so eventually it occurred

I recently mentioned that we'dbuilt a backup MX server due to concernsprompted by a scheduled power outage .In a comment on that entry, Greg A. Woods said something that I broadlyagree with:

I think backup MX hosts are, generally speaking, a bad idea in moderntimes (even going back a couple of decades).

[...]

The added maintenance overhead and headache of keeping a full-timebackup MX host running and reliably forwarding ALL email it collects,and reliably rejecting all

There are at least three ways that x86 machines can try to bootfrom the network; BIOS PXE boot, UEFI PXE boot, and UEFI HTTPboot . All of them start by the machineasking a DHCP server for what it should boot, and all of them requiredifferent answers from the DHCP server. If you want to support morethan one network booting option, your DHCP server needs to give eachsort of client the right answer for it, which generally means you haveto tell the DHCP server how

Suppose, not hypothetically, that you have a locally customizedUbuntu server install ISO image ( and have for a while ), and you also now have a number of UEFIbased machines that it would be convenient to (re)install over thenetwork without having to visit them in person (and they don't haveIPMIs/BMCs that support virtual media). It turns out that you cantake an Ubuntu ISO and install from it over the network, but howthe various steps and stages connect together isn'

If you need to (re)install a large collection of servers or serversin inconvenient locations for physical access, booting them fromthe network in order to install them is something that you mightbe quite interested in. In the pre-UEFI PC 'BIOS' era of MBR booting,this was often called PXE booting , butUEFI changes things around.

UEFI firmware typically has builtin support for networking, which is to say that there are UEFIprotocols (function calls) for doing common things with the network (

We have an extended power outage coming up, one that's long enoughthat I think we want a backup MX that can stay up during it . I've been building out astand-alone duplicate of our current inbound mail gateway, and todayI added a lower priority DNS MX record that points to it. Whathappened next is predictable :

This is my absolutely not surprised face that mere moments after Iadd a secondary MX to one of our zones, various IPs show up to pokeits SMTP port

One of the slow moving pieces of TLS news isthat Google is effectively requiring everyone to stop issuing TLScertificates that can officially be used for "Client Authentication" (although the actual wording mayhave walked this back a bit ).Certificate Authorities can create new roots that can be used toissue TLS certificates that are officially usable for clientauthentication, but Let's Encrypt isn't currently planning to dothis .This was announced last year and then slowed down a bit this year,but it's still