DMARC DNS record inheritance and DMARC alignment requirements

To simplify, DMARC is based on the domainin the 'From:' header, and what policy (if any) that domain specifies.As I've written about (and rediscovered) more than once ( here and here ), DMARC will look up the DNS record for theDMARC policy in exactly one of two places, either in the exact From:domain or on the organization's top level domain. In other words,if a message has a From: of 'someone@breaking.news


One problem with (Python) docstrings is that they're local

When I wrote about documenting my Django forms ,I said that I knew I didn't want to put my documentation in docstrings,because I'd written some in the past and then not read it this timearound. One of the reasons for that is that Python docstrings haveto be attached to functions, or more generally, Python docstringshave to be scattered through your code. The corollary to this isthat to find relevant docstrings you have to read through your codeand then remember which bits of it are


Wayland has good reasons to put the window manager in the display server

I recently ran across Isaac Freund's Separating the WaylandCompositor and Window Manager ( via ), whichis excellent news as far as I'm concerned. But in passing, it says:

Traditionally, Wayland compositors have taken on the role of thewindow manager as well, but this is not in fact a necessary step tosolve the architectural problems with X11. Although, I do not knowfor sure why the original Wayland authors chose to combine the windowmanager and Wayland compositor, I assume it was


Cleaning old GPG RPM keys that your Fedora install is keeping around

Approximately all RPM packages are signed by GPG keys (or maybethey're supposed to be called PGP keys), which your system storesin the RPM database as pseudo-packages (because why not). If yourFedora install has been around long enough, as mine have, you willhave accumulated a drift of old keys and sometimes you either wantto clean them up or something unfortunate will happen to one ofthose keys (I'll get to one case for it).

One basic command to see


Making empirical decisions about web access (here in 2026)

Recently, Denis Warburton wrote in a comment on my entry on howHTTP results today depend on what HTTP User-Agent you use :

Making decisions based on user-provided information is unwise in2026. The originating ip address is the only source of "truth" ...and even then, that information needs to be further examined beforediscerning whether or not it is a valid piece of communication.

It's absolutely true that everything except the source IP addressis under the control of an attacker


I think dependency cooldowns would be a good idea for Go

Via Filippo Valsorda , I recentlyheard about a proposal to add dependency cooldowns to Go . The general idea of dependency cooldowns is to make it so that people don't immediately update to new versionsof dependencies; instead, you wait some amount of time for peopleto inspect the new version and so on (either through automatedtooling or manual work). Since one of Go's famous features is'minimum version selection', you might think that a cooldown wouldbe unnecessary, since people have to manually update


On today's web, HTTP results depend on the HTTP User-Agent you use

Back in the old days, search engines mostly crawled your sites withtheir regular, clearly identifying HTTP User-Agent headers, butonce in a while they would switch up to fetching with a browser'sUser-Agent. What they were trying to detect was if you served oneset of content to "Googlebot" but another set of content to "Firefox",and if you did they tended to penalize you; you were supposed toserve the same content to both, not SEO-bait to Googlebot and


You (I) should document the forms of your Django web application

We have a long-standing Djangoweb application to handle (Unix) accountrequests. Since these are requests, there is some state involved,so for a long time a request could be pending, approved, or rejected,with the extra complexity that an approved request might be incompleteand waiting on the person to pick their login. Recently I addedbeing able to put a request into a new state, 'held', in order todeal with some local complexities where we might have a requestthat we didn


UEFI-only booting with GRUB has gone okay on our (Ubuntu 24.04) servers

We've been operating Ubuntu servers for a long time and for mostof that time we've booted them through traditional MBR BIOS boots.Initially it was entirely through MBR and then later it was stillmostly through MBR (somewhat depending on who installed a particularserver; my co-workers are more tolerant of UEFI than I am). Butwhen we built the 24.04 version of our customized install media,my co-worker wound up making it UEFI only, and so for the past


The story of one of my worst programming failures

Somewhat recently, GeePaw Hill shared the story of what he calledhis most humiliating experience as a skilled and successful computerprogrammer .It's an excellent, entertaining story with a lesson for all of us,so I urge you to read it. Today I'm going to tell the story of oneof my great failures, where I may have quietly killed part of aprofessor's research project by developing on a too-small machine.

Once upon a time, back when I was an (advanced)