I mentioned in a recent entry that myoffice workstation had started producing alarmingkernel messages about non-maskable interrupts (NMIs) happening foran unknown reason:

Uhhuh. NMI received for unknown reason 31 on CPU 10.Do you have a strange power saving mode enabled?Dazed and confused, but trying to continue

I've now been able to identify what triggers these NMI messages.On my office machine they can reliably be produced by running the Cloudflare eBPF Prometheus exporter with the ipcstat example exporter, which uses

I was recently reading Scott Helme's The Complexities of ChainBuilding and CA Infrastructure (it's part of a series from last year on the impending doom ofexpiring root CAs ,which was linked to by Helme's Let's Encrypt Root Expiration -Post-Mortem ).In it Helme mentioned something that previously hadn't consciously struckme about the modern Certificate Transparency environment. I'll just quoteHelme here:

Who are the biggest CAs out there?

A few years ago that was probably a

Famously, modern Unixes by limit the (default) size of the mainprocess stack and the size of thread stacks; they pick differentlimits, which causes issues because C has no way of dealing withthis . Today, for reasons beyondthe scope of this entry, I became curious if V7 had any stack sizelimit and if it didn't, when such a limit appeared.

The short answer about V7 is that V7 had no stack size limit. Thecombination of your stack and your program

Today, my office workstation logged a kernel message(well, a set of them) that I've seen versions of before, and perhaps youhave too:

Uhhuh. NMI received for unknown reason 31 on CPU 13.Do you have a strange power saving mode enabled?Dazed and confused, but trying to continue

While I (still) don't know what caused this and what to do about it(other than reboot the machine in the hopes that it stops happening),this time I

We have a sensitive host that absolutely has to be protected withmulti-factor authentication. When we first set it up in late 2016,the second factor we chose was touch-required SSH keys held onYubikeys . Recently, we have been switchingthis host over to the university 's institutional multi-factor authentication . The university's MFAuses Duo, so our sensitive host is set up to use Duo's PAM module .

(Integrating Duo with OpenSSH led me to explode what combinations of

We've recently deployed multi-factor authentication for SSH accessto some especially sensitive machines, which has caused me to becomemuch more familiar with how OpenSSH's sshd and MFA interact witheach other and the limits on that. Unfortunately these limits meanthat some combinations of authentication methods are not reallyavailable (or not available at all). For example, in many situationsyou can't require people to use their Unix password and then eithera public key or MFA authentication.

The simple way to describe the

Recently I wrote about how I should use virtual environments forthird party programs , and said that I wouldlikely wind up trying pipx . Today,I ran ' pip3 list --user --outdated ', stared at the output of thatand ' pip3 list --user ', and decided that my situation in my ~/.local had reached enough critical mass that I was willing toburn it down and start over from scratch. So here are some earlynotes on pipx , after experimenting with

I somewhat recently read j. b. crawford's host firewalls , which as I readit puts forward a core thesis:

The great thing about a host firewall, the thing that really makes ita powerful tool that can do things that your Third-Generation SmartFirewall in the network rack can't, is something of a secret weapon: ahost firewall can make decisions based on not just the packet but theprocess that sent or will receive it .

In the old days, this was to spot and

Three things are definitely true on modern Linux and modern Linuxdesktops. Pretty much everyone is using NetworkManager, NetworkManagerincludes GUI frontends, and desktops have GUI interfaces forcontrolling your active networks and configuring them. In a niceregular universe, the desktop's GUI frontends would be using theNetworkManager GUI frontends like nm-applet and nm-connection-editor ,and would thus usually automatically support everything thatNetworkManager itself supports (since the NetworkManager developerstend to update their GUI frontends when they add features likesupport for WireGuard or