One of the things that you'll generally wind up doing with Prometheus 's Alertmanager is creatingcustom alert messages (in whatever medium you send alerts, whetherthat's email or something else). Alertmanager comes with some defaulttemplates for various alerting destinations, but they're very genericand not all that useful in many situations. If you're customizingalert messages, one thing you might want to put in is when thealerts started (and possibly when they ended, if you send messageswhen alerts

Let's start with what I said in the Fediverse today :

Today I learned that you should have SPF records for your HELO names,not just for your MAIL FROM domains. I guess I have some DNS recordsto add now.

When I learned about SPF , back whenit was very new, I at least understood it as being about preventingforgery of SMTP envelope sender domains (ie, SMTP MAIL FROM domains).In modern usage, this is no longer the case; even the 'proposedstandard'

Let's say that you have a Go time.Time value, tstamp , that you happento know for sure was collected at 18:00 and some seconds (in yourtime zone). Now suppose that you use time.Time.Format() on tstamp to get astring form of its hours and minutes (using the format string "15:04" ). Will you always get the string '18:00' as the outputfrom formatting tstamp this way

The news of the recent past is that the old 'AddTrust ExternalCA Root' root certificate expired on May 30th (at 10:48:48 UTC). Before this happened, Iconfidently told more than one person that one reason I was confidentthat our TLS certificate environment wasn't affected by this wasthat our Prometheus based monitoring system specifically looks at all of the TLS certificates in a certificatevalidation chain, not just only the first ('leaf') certificate forthe server

Yesterday I wrote about the mechanics of us DKIM signing some ofour email , and mentioned that we're definitelynot signing email that merely passes through us, for example whenan outside person emails a person here and that person forwardstheir email elsewhere. Such mail forwarding is reasonably popular here ; a lot of people forwardtheir email to other places. Some of them have moved (by graduationor whatever), some of them prefer having their email elsewhere, andso on. We officially support this mail forwarding in

For years, we have more or less deliberately not set up DKIM signingfor any of our outgoing email,for various reasons (see my current views on using DKIM here , from 2015). For various local reasons beyond the scopeof this entry, we may be about to change our view and start DKIMsigning some things.

The actual mechanics of configuring basic DKIM signing in Exim turn out to be pleasantly simple. Exim evendocuments the OpenSSL and GNU TLS commands that you need to run togenerate

Yesterday I wrote about the surprisingly persistence of RSA keysin SSH in general terms. Today I'mgoing to make that concrete, by looking at what sorts of SSH keys our users have in theirauthorized_keys files and have used for authenticating to oursystems in 2020. Unsurprisingly, these turn out to be not quitethe same.

Based on some fairly brute force grep'ing of authorized_keysfiles, we have 729 people with authorized keys files that have(theoretically) live

Generally speaking, SSH the protocol and OpenSSH the leadingimplementation of it have (or have had) four different types ofSSH keys : RSA, DSA (which has now beendeprecated), ECDSA, and Ed25519, listed here in the order of whenthey were added to SSH (with Ed25519 being the most recent). SinceRSA is the oldest, you might reasonably expect that it was the leastused of the three that are still actively supported. Instead it

Back when I got my HiDPI display (a 27" Dell P2715Q), I wrote anentry about what the core practical problems with HiDPI seemedto be on Linux and talked in general terms aboutwhat HiDPI related settings were available but I never wrote aboutwhat specific things I was setting and where. Today I'm going toremedy this, partly for my own future use for the hopeful futureday when I need to duplicate this at work. Since I'm doing this two