In a comment on a recent entry , Verisimilitude noticed a feature that I quietly addedto here not too long ago:

I've noticed the Add Comment button is now conditionally excluded;that's a neat trick.

I've long had precautions against comment spam and they've mostly worked. But not entirely, and so there havealways been some network areas that I disallowed comments from evenif they didn't run into those precautions. And if a (bad) networkarea was a sufficiently high

Every so often I create some sort of little language, of lesser orgreater power, and when I do I have some heresies (like usingrecursive descent parsing ). One of those heresiesis that I usually leave out real operator precedence, other thansupport for '(' and ')'.

Operator precedence is nice and there are all sorts of cool algorithmsfor implementing it without tearing your hair out. But it's mostlynice for arithmetic expressions (or if you have a lot of operators),

For reasons outside of the scope of this entry, we have an increasing number ofservers in an inconvenient location ( I called it 'offsite' but that's notquite accurate). Since these servers run Ubuntu LTS, they're goingto need to be reinstalled with new versions every so often, startingthis summer (as 26.04 comes out), and we really don't want to dothat in person, so we've been thinking about our options.

The best option

One of things that has happened over the past N years, for somevalue of N, is that a lot of universities have outsourced theiremail to one of the big providers of this (Microsoft and Google arethe two most common). Email is far from the only thing thatuniversities have outsourced; for example, most universities don'trun their entire authentication stack, because push based MFA istypically only available through vendors .People online regularly decry this outsourcing, especially foremail, and say that universities should

Over on the Fediverse I indulged in some snark :

Network inventory hot and grumpy take: Yep, it's not great thatsysadmins and network people don't necessarily have a hardware andnetwork inventory, unlike modern software development where famouslyeveryone knows exactly what their entire dependency tree is and whyit's there and has full trust in it staying that way.

(That is sarcasm.)

Let's get this out of the way right at the start: inventories arehard . I don't just

On the Fediverse, I had a learning experience :

Another what the heck moment in Fedora 43. In Gnome-terminal (only,not xterm), hitting 'Delete' in vim insert mode no longer deletescharacters to the left of the cursor, only characters to theright. Delete is generating ^? in both gnome-terminal and xterm, andDelete works to delete characters in vim in g-t on the ':' commandprompt.

Whatever vim / gnome-terminal combined stupidity this is,

One of the things that Apache and other web servers have been ableto do for a long time is to compress responses when the requestingagent indicates that it supports this. Accepting compressed responsesis so common that not doing so is potentially an bad sign , although a distressing number ofsyndication feed fetchers don't request (or accept) compressedresponses. Apache is sophisticated enough that it can compressoutput on the fly and do it for unpredictable sources of dynamiccontent, such as CGIs and Django web applications (and requests

Over on the Fediverse, I said :

I feel I've now written enough Linux nftables configurations that I'vecome to like it. It's a more pf-like experience than iptables, that'sfor sure (and that's a good thing when you're writing a coherentruleset instead of manipulating things on the fly).

I've had to write a few static IP filtering rulesets recently (onUbuntu), and in each case I immediately reached for nftables andenjoyed the

Nftables is the currentgeneration Linux firewall rule system, supplanting iptables (whichsupplanted ipchains). As covered in the nft manual page , nftableshas the concept of 'symbolic variables' . SinceI'm used to BSD PF, I will crudely describe these as a combinationof some parts of pf tables and PF macros. I personally feel that the nft manual page doesn'tdo a good job of documenting what's possible in these, so here aresome notes.

The simple case is simple values: