C's main() is one of the places where Unix's user and kernel APIs differ

Modern Unixes often like to draw a legalistic distinction betweenthe API provided to user space by the kernel and the Unix APIprovided to programs by the 'standard library', by which they meanthe standard C library. Some people, me included, don't entirelylike this (I've written about whether the C runtime and libraryis a legitimate part of the Unix API ). However,regardless of what I might think about it, Unix has long had atleast one place where there was a real


Contrasting the two common approaches to where programs start running

When a program (in a broad sense) is executed, it must start runningsomewhere. There are two common approaches for choosing what code isthe first code executed, each with different tradeoffs that make somelanguages and system environments pick one over the other.

The simplest approach is to say that the first code in the programstarts running. This is what Python, Perl, many versions of BASIC,and shell scripts all do; execution starts from the top of yourfile and marches down. This is also something


An exploration of why Python doesn't require a 'main' function

Many languages start running your program by calling a function ofyours that must have a specific name. In C (and many C derivedlanguages), this is just called main() ; in Go, it's main.main() (the main() function in the main package). Python famouslydoesn't require any such function, and won't automatically call afunction called main() even if you create it. Recently I read Why doesn’t Python have a main function


In praise of ZFS On Linux's ZED 'ZFS Event Daemon'

I've written before ( here ) about how ourcurrent Linux ZFS fileservers work muchlike our old OmniOS fileservers .However, not everything is quite the same between ZFS on Linux andtraditional Solaris/OmniOS ZFS. One of the most welcome differencesfor us is ZED ,the ZFS Event Daemon. What ZED does that is so great is that it providesa very simple way to take action when ZFS events happen.

When a ZFS event happens, ZED looks through a directory (generally /etc/zfs/zed


Using Go build directives to optionally use new APIs in the standard library

I mentioned recently that new APIs in the Go standard library wererelatively easy to optionally support, because such new APIs onlyappear in new Go releases and you can conditionally build filesbased on the Go release that's building your program. But that's apretty abstract description, so let's make it concrete.

One of the long time limitations of the crypto/tls package was that it only gaveyou numbers for TLS cipher suites , notany sort of names, and for logging and reporting things to


Not all sysadmin tools should be silent by default

As a long term Unix person, I have wound up with a reflexiveassumption that all of the programs and tools I write should besilent by default. This is the traditional Unix approach; Unixprograms are supposed to be silent if all goes well and only printthings if asked to or if something goes wrong, for good reasons.However, lately I've began thinking that this is not necessarilyalways correct and that under some circumstances my programs andtools should be somewhat verbose by default (with an option to


Malware spammers put .exe Windows executables in everything

Recently, for reasons beyond the scope of this entry , I've beenexpanding our system for recording email attachment type information to be ableto look inside more archive formats to get the file extensions offiles inside them. The most significant format I wanted to be ableto peer inside was 7zip archives ,because 7zip archives are one of the big areas where ClamAV differsfrom our current commercial solution by recognizing fewer things, but I added support for ISO 9660 imagesand CAB files while I was


A piece of phish spam with some clever URL obfuscation

We were the target of a phish spam run today. In many respects itwas a standard modern phish; it was specifically targeted to us,with a message and claimed sender tuned to here, it was in HTML,and the inducement to click was a claim of 'go here to retrieve avoicemail message'. However, it had one interesting trick that Ihaven't seen before, and that was how it obfuscated its target URL.

The first level of obfuscation was that the target in the


Link: The Anatomy of a PromQL Query

The Anatomy of a PromQL Query ( via )is a very clear and nice explanation of what goes into a PromQL query. It covers both the elements (metrics, functions, and so on)and the Prometheus data types you use (such instant vectors andrange vectors). This is a very useful article because while PromQLis solidly documented, it doesn't have a concept overview that'sas clear and straightforward as this.


Today I learned that Python's argparse module allows you to abbreviate long command line options

Argparse is thestandard Python library for Unix style command line argument handling;I use it in all of my Python programs these days. As part of thisit supports the now standard long options, so you can have optionslike ' --dead-disks ' instead of just ' -D ' (there are only somany single characters to go around, and they can be hard toremember). Today I learned that argparse accepts abbreviationsfor these long options, provided that they're unambiguous. If you