In some circles, it's popular to denigrate file extensions as aWindows-ism that's only necessary because of (historical) limitationsof that platform. However, we have a fair amount of evidence thatpeople like file extensions even on platforms where they aren'tnecessary, and adopt them by choice in various circumstances evenwithout technical need.

The obvious primary source for this evidence is people's habits onUnix. Unix doesn't need file extensions and they're by no meansuniversally used

I recently read Shrikant Sharat Kandula's Shell Script Best Practices ( via ). One of thesuggested best practices is:

3. Use the .sh (or .bash ) extension for your file. It may befancy to not have an extension for your script, but unless yourcase explicitly depends on it, you’re probably just trying to doclever stuff. Clever stuff are hard to understand.

I have the opposite view. Unless you have a strong reason, youshould avoid putting an extension like

Over on Twitter and the Fediverse I saidsomething:

A quiz: you've a normal, ordinary person and you've received an emailwith a PDF invoice attached (so it says). You click on the invoice inyour mail program and it shows you this. What are you seeing and howalarmed should you be?

The spoiler is that this is the 'HTML attachment presented as aPDF attachment' phish that Italked about yesterday. This isn't a real PDF that's been encrypted

I don't get much spam email in general and I get even less that hasmalware payloads, so in one sense it's always interesting when onemakes it through our various anti-spam measures and I get to actuallylook at a sample for myself. Today I received what looked like amalware attack using a PDF:

Subject: [...] has sent you a document(s)

[...]
File Name: Invoice-38937.pdf
File Size:

I recently read Taras Glek's Curious Case of Maintaining SufficientFree Space with ZFS ,where Glek noticed that ZFS wasn't immediately updating its spaceaccounting information when things were deleted. This isn't necessarilysurprising and I'm not sure it's unique to ZFS. In practice, I believethat many filesystems don't actually perform all steps of deleting afile at once (as we see it from the outside).

There are two conjoined problems for filesystems when deletingthings. First, in

I've known about DNS Certification Authorization (CAA) records for a while, but I've generally considered them mostly an interestingcuriosity instead of something that people should generally careabout. If you knew that you only got TLS certificates from Let'sEncrypt (for example), you could set a CAA record on your domainto this and get what I thought of as 'a bit of extra security'. Butyesterday, when writing about how Certificate Transparency isabout improving the TLS ecology , I had

In Emily M. Stark's Certificate Transparency is really not areplacement for key pinning ,one thing that Stark notes is that Certificate Transparency doesn't really have strongsecurity properties. You can say some fuzzy things about securityproperties that CT perhaps offers (although they get fuzzier whenyou look at the details ), but there'svery few concrete security claims you can make (or that people tryto make, for example in RFC 9162 ). Having been thinkingabout this for a while

Suppose, not entirely hypothetically ,that you have a Prometheus metric that has been slowly driftingupward for some time. You would like to find out the last time thatit has been below some value. In an ideal world this would be asimple Prometheus operation, because the raw data is there in theTSDB. In this actual world, Prometheus makes it hard to work withwhen metrics actually happened . However,you can do it in a relatively straightforward way because of somethingI had forgotten until I started to write

Writing and maintaining a modern browser is probably one of themost challenging programming projects you could ask for; it hasto deal with inherently hard problems and a large scale.

A modern browser is a relatively or very concurrent and veryasynchronous (with all sorts of unpredictable network and inputevents happening all over the place), and is expected to be a highlyresponsive system. It faces a hostile environment at multiple levels;not only are attackers trying to exploit it, but various websitesthemselves may be uncooperative and resource-