Let's Encrypt is preparing for an emergency and that's good for TLS in general
Recently I read Let's Encrypt's Preparing to Issue 200 MillionCertificates in 24 Hours ( via ), which is a highlevel view of exactly what the title says. Let's Encrypt isn'tanywhere near that volume level in normal operation, but theirreason to prepare for much, much more is a good one, so good thatI'll just quote the start of their article:
On a normal day Let’s Encrypt issues nearly two millioncertificates . When we think
The issue of IOPS versus latency on SSDs and NVMe drives
Famously, SSDs and especially NVMe drives are very good at handlingrandom IO, unlike spinning rust. If you look at performanceinformation for drives and Wikipedia information on IOPS , you canfind very large and very impressive numbers. You'll also usually findfootnotes or side notes to the effect that these numbers are usuallyachieved with high queue depths and concurrency, in order to keep thesevoraciously fast storage systems fed at all times with the IO requeststhey need to deliver maximum performance.
In the process of writing another entry
Normal situations should not be warnings (especially not repeated ones)
Every so often (or really, too often), people with good intentionsbuild a program that looks at some things or does some things, andthey decide to have that program emit warnings or set status resultsif things are not quite perfect and as expected. This is a mistake,and it makes system administrators who have to deal with the programunhappy. An ordinary system configuration should not cause aprogram to raise warnings or error markers , even if it doesn'tallow all of the things that a program
Strict SameSite web cookie policies probably don't do much for us
I recently read The great SameSite confusion ( via ). Tosummarize badly, this article is about how it's easy to misunderstandexactly what the SameSite cookie attribute does due to a distinction that web security draws between the ideasof 'origin' and 'site'. The simple version of the difference isthat 'origin' means the exact website (the same scheme, host, andport), while 'site' simply means the domain name (which is determinedbased on the public suffix list ).
Talkd and 'mesg n': a story from the old Unix days
An ancient Unix habit: I often still reflexively run 'mesg n' on my(single-user) workstation before starting screen, even though it'sbeen a very long time since I ran talkd and so had any worries aboutthat.
Back in the old days of Unix there was a program called talk ,which actually made it into the POSIX standard (which I was surprised to discover just now). Talk enabled live twoway communication, instead of the one way communication of write (
Limiting what branches I track from an upstream Git repository
I track a number of upstream Git repositories for software we use orthat I'm interested in, where by 'track' I mean that I keep a local copyand update it periodically. I've been growing more and more unhappy withhow noisy this process has been getting, so recently I did some workon making this tracking quieter . Sadly thisleft me with one remaining pain point, the repository for Grafana .
Grafana's repository is unusual because the Grafana developers workin a profusion of short lived
There are limitations to what expendable addresses can help with
I'm a long time advocate of using expendable addresses for as manythings as possible (and then making sure youcan turn them off ). However, yesterday'sincident of junk email as a cover for worse also shows some of the limitations of using expendable addresses,because they wouldn't really have avoided this situation.
The first way they wouldn't have avoided the situation (of having aflood of junk email sent to someone to distract them) is that generallyexpendable addresses in all of their
Junk email as a cover for more nefarious things
This morning, we got a call (through a Point of Contact ) that one of the people here was being absolutely flooded byincoming spam and junk email. It was a real flood, too; in total theyreceived over 1,200 email messages that made it past our anti-spamdefenses, most of them over about an hour and a half (I'll let you dothe math on the messages per minute rate, and then think about trying todo anything about it in a mail
The small oddity in the Unix exec*() family
When I recently wrote about find's -exec option , I casually talked about 'the exec() family of system calls'. This is an odd phrasing and sort of an oddthing to say about Unix system calls, because they don't usuallycome in families. So let's list off the exec() family:
execv()execve()execvp()execvpe()
execl()execlp()execle()
(This is the list on Linux and OpenBSD; the FreeBSD
Go 1.16 will make system calls through libc on OpenBSD
One of the unusual things about Go is thatit started out with the approach of directly making system callson Unix, instead of calling the standard C library functions thatcorrespond to those system calls. There are reasonably good reasonsfor Go to make direct system calls and thisworks well on Linux, but other Unixes are different. The officialAPI for Illumos and Solaris system calls requires you to use theirC library, and OpenBSD wants you to do this as well for securityreasons (for OpenBSD system call origin verification )