Modern single sign on specifications such as OIDC and SAML and systems built on top of them are fairly complex things with alot of moving parts. It's possible to have a somewhat simplesurface appearance for using them in web servers , but the actual behind the scenesimplementation is typically complicated, and of course you need anidentity provider server and its supporting environment as well( which can get complicated ).One reaction to this is to suggest using X.509 certificates toauthenticate people (as a recent

Sometimes, people in technology believe that we can solve problems bygetting people to pay attention. This comes up in security, anti-virusefforts, anti-phish efforts, monitoring and alert handling, warningmessages emitted by programs, warning messages emitted by compilersand interpreters, and many other specific contexts. We are basicallyalways wrong.

One of the core, foundational results from human factors research,research into human vision, the psychology of perceptions, and otherrelated fields, is that human brains are a mess of

Recently I wrote about how Linux network interface names have alength limit , of 15 characters.You can work around this limit by giving network interfaces an'altname' property, as exposed in (for example) 'ip link' . Whileyou can't work around this at all in Canonical's Netplan , it looks like you can have this for yourVLANs in systemd-networkd, since there's AlternativeName= in the systemd.link manual page.

Except, if you look at an actual

Recently, Verisimilitude left acomment on this entry of mine about binding TCP and UDP ports to a specific address. That got methinking about features that have become standard elements of thingsdespite not being officially specified and required.

TCP and UDP are more or less officially specified in various RFCsand are implicitly specified by what happens on the wire. As faras I know, nowhere in these standards (or wire behavior) doesanything require that a multi-address host machine allow you tolisten for incoming TCP or UDP

Over on the Fediverse, I shared a discovery :

This is my (sad) face that Linux interfaces have a maximumname length. What do you mean I can't call this VLAN interface'vlan22-matterlab'?

Also, this is my annoyed face that Canonical Netplan doesn't checkor report this problem/restriction. Instead your VLAN interface justdoesn't get created, and you have to go look at system logs to findsystemd-networkd telling you about it.

(This is

Over on the Fediverse, I shared a discovery :

This is my (sad) face that Linux interfaces have a maximumname length. What do you mean I can't call this VLAN interface'vlan22-matterlab'?

Also, this is my annoyed face that Canonical Netplan doesn't checkor report this problem/restriction. Instead your VLAN interface justdoesn't get created, and you have to go look at system logs to findsystemd-networkd telling you about it.

(This is

When querying Spamhaus DNS blocklists, either their public mirrorsor through a DQS account, the DNS blocklists can potentially return error codes in 127.255.255.0/24 ( also ).Although Exim has a variety of DNS blocklist features, it doesn't yetlet you match return codes based on CIDR netblocks. However, it does havea magic way of doing this.

The magic way is to stick '!&0.255.255

For reasons outside the scope of this entry, we recently switched from Spamhaus 's traditional public DNS (what is now calledthe 'public mirrors') to an account with their Data Query Service.The DQS data can still be queried via DNS, which presents a problem:DNS queries have no way to carry any sort of access key with them.Spamhaus has solved this problem by embedding your unique accesskey in the zone name you must use. Rather than querying, say,zen.spamhaus.org,

Netplan is Canonical's more or less mandatorymethod of specifying networking on Ubuntu. Netplan has a collection oflimitations and irritations, and recently I ran into a new one, whichis how VLANs can and can't be specified. To explain this, I can startwith the YAML configuration language . To quotethe top level version, it looks like:

network:  version: NUMBER  renderer: STRING  [...]  ethernets: MAPPING  [...]  vlans: MAPPING  [...]

To