One of the things periodically heard about large, fundamental opensource projects is a wish that they would slow down, stop changingthings all the time, and work on stability (both low level withbugs and higher level with fixing rough edges and polishing things).However, I've come around to a cynical view that this may not bepossible, partly sparked by the various discussions around opensource maintenance in the wake of the recent log4j issue . Instead, I have a thesis:large open source

Very recently, in the course of a conversation on Twitter that moreor less about our internal network access authentication needs , it struck me that sometimesthat part of the purpose of a security system is to make it so that anactual attack is required to get past the security, instead of justan accident. I am considering attack in a broad sense, in the sensethat someone who wants to sidestep your security needs to actively dosomething unusual.

There are two useful things that come from this simple dividing line.

Over in the lobste.rs reactions to my entry on how running your own email service is an artisanalchoice , a number of people havebeen surprised that webmail is an important issue in this. To behonest, I'm surprised myself. We operate a pretty basic off the shelf webmail service, and entirelyagainst my expectations it's enduringly popular with our users.

Our webmail's popularity is both in how often it's used and howmany different people have used it. It's regularly

For reasons beyond the scope of this entry , for thepast couple of years I've been running a large commercial anti-spamsystem (and its malware recognition) side by side with what we couldput together with ClamAV and some low-costcommercial ClamAV signature sources. More or less from the beginning it's been clear to me that our commercialsystem was recognizing malware that ClamAV was not. Some of this was new things that we could add to our manual recognition and rejection , but at this point

Over on Twitter, I said something that's been on my mind for awhile , andis a bitter thing for me to accept:

Gloomy sysadmin take: it's no longer possible for ordinaryorganizations to operate a quality email infrastructurethemselves. You can run a little artisanal one and feel happy aboutit, but it will not at all measure up to the quality of systems run byeg Google and Microsoft.

This is not directly about the big providers making it harder andharder to send them email,

I've decided that going forward I pretty much want to manage anythird party Python programs I install, like the Python LSP server and pxpx , through pipx (as an extension of managing them in virtual environments ). I've also experimented with installing PyPymyself . One of the advantages of using my ownPyPy on our Ubuntu servers isthat our Ubuntu servers run various versions of Ubuntu LTS, and soI would normally run into the pip Python version issue if I relied on the system Python. All of

We have a few pervasive internalnetworks ; they're open for use by anyone inthe department and are present more or less everywhere through thedepartmental space and sometimes beyond (for our wireless network).For reasons beyond the scope of this entry, we need to associateevery device on these networks that we allow to talk to the worldwith someone who's taken responsibility for its presence. As acorollary of this, we need to block access off the network to devicesthat we don't have a

Today I tweeted :

The Linux ss command is one of those things that I should learn oneof these days but I keep just using lsof unless lsof is going to bereally inconvenient (or slow).

In the way of these things, this prompted me to go poke at ss again. It turnsout that something important has happened in the world of ss since I last looked at it in late 2018 , namely ss 's very useful filtering language is now actually documentedin its manual page .

I have a Fedora virtual machine image that I use to try out Fedoraupgrades before I have to do them on my real system. Because it wascreated a long time ago, it had only a 20 GB disk. For a long timethis was okay, but when I went to upgrade it from Fedora 34 toFedora 35, the upgrade failed with an out of space error. Obviouslythe time had come to enlarge the disk and grow everything.

Growing the disk image depends on your virtualization system