The balance of power between distributions and software authors

In a comment on my entry on how modern software controls dependenciesbecause it helps software authors , PeterDonis raised a good and interesting point:

I understand the issue you are describing for software authors, but asa software user , if bundling static dependencies instead of usingshared libraries means security vulnerabilities in software I'm usingtake longer to get fixed, then I'll just have to stop using thatsoftware altogether. And for the vast majority of software I use, Idon't get it directly from the


Dot-separated DNS name components aren't even necessarily subdomains, illustrated

I recently wrote an entry about my pragmatic sysadmin view onsubdomains and DNS zones . At the end of theentry I mentioned that we had a case where we had DNS name componentsthat didn't create what I thought of as a subdomain, in the formof the hostnames we assign for the IPMIs of our servers. These names are in the form '.ipmi.core.sandbox'(in one of our internal sandboxes ), but I saidthat 'ipmi.core.sandbox'


My pragmatic sysadmin view on subdomains and DNS zones

Over on Twitter, Julia Evans had an interesting poll and comment :

computer language poll: is mail.google.com a subdomain ofgoogle.com? (not a trick question, no wrong answers, pleasedon't argue about it in the replies, I'm just curious what differentpeople think the word "subdomain" means :) )

the ambiguity here is that mail.google.com doesn't have itsown NS/SOA record. An example of a subdomain that does have thosethings


My Firefox addons as of Firefox 86 (and the current development version)

I was recently reminded that mymost recent entry on what Firefox addons I use is now a bit over a year old. Firefox has had 14 releases sincethen and it feels the start of January 2020 was an entirely differentage, but my Firefox addons have barely changed in the year and abit since that entry . Since they have updateda very small amount, I'll repeat the whole list just so I have itin one spot for the next time around.

My core addons,


The HTTP Referer header is fading away (at least as a useful thing)

The HTTP Referer header onrequests is famously misspelled (it should be Referrer ), and alsofamously not liked because of privacy and security concerns .The privacy and security concerns are especially strong with external('cross-origin') Referers, which is also the ones that many peoplefind most useful because they tell you where visitors to your pagesare coming from and let you find places where people have linkedto you or are mentioning you.

I've been reading my Referer logs for essentially as long as Wandering


How (and where) Prometheus alerts get their labels

In Prometheus , you can and usually dohave alerting rules that evaluate expressions to create alerts. These alerts are usuallypassed to Alertmanager and theyare visible in Prometheus itself as a couple of metrics, ALERTS and ALERTS_FOR_STATE . These metrics can be used to do thingslike find out the start time of alerts or just display a count of currently active alerts on your dashboard . Alerts almost always have labels(and values for those labels), which tend to be used in Alertmanagertemplates to provide additional information


How convenience in Prometheus labels for alerts led me into a quiet mistake

In our Prometheus setup , we have asystem of alerts that are in testing, not in production. As Idescribed recently , this is implementedby attaching a special label with a special value to each alert,in our case a ' send ' label with the value of ' testing '; thisis set up in our Prometheus alert rules. This is perfectly sensible.

In addition to alerts that are in testing, we also have some machinesthat aren't in production or that I'm only monitoring on


How I set up testing alerts in our Prometheus environment

One of the things I mentioned in my entry on how our alerts arequiet most of the time is that I have somePrometheus infrastructure for 'testing' alerts. Rather than being routedto everyone (via the normal email destination), these alerts go to aspecial destination that only goes to interested parties (ie, me).There are a number of different ways to implement this in Prometheus, sothe way I picked to do it isn't necessarily the best one (and in fact itenables a


The mhbuild directives I want for sending MIME attachments with MH

I use and like (N)MH for any numberof reasons (it's a very Unix and command line focused mail system,although I often use it with exmh ).However, for my sins I sometimes have to send people email with(MIME) attachments of things like PDFs and images, especially thesedays when I can't just give them physical printouts. This is possiblein NMH, but the manual page for mhbuild , thecore program you need to do this, is both relatively opaque


Modern software controls dependencies because it helps software authors

Over on Twitter I had a hot take :

Hot take: Every distribution packager who's saying "you shouldn'tbundle dependencies" is implicitly telling software authors "youshould do more work for us and limit the features (and reliability) ofyour software".

(This was sparked by reading The modern packager’s securitynightmare , via .I'm not exactly on one side or the other, but I do think distributionsshould be honest about what they're asking for and Idon'