As someone who made significant use of locally written DTracescripts on OmniOS and has since moved fromOmniOS to Linux for our current generation of fileservers , I've naturally been watching thegrowth of Linux's eBPF tooling with significant interest (and somedisappointment, since they're still sort of a work in progress ). This has left me with some thoughts onthe DTrace experience on Solaris and then OmniOS as contrasted with theeBPF experience on Linux.

On Linux, eBPF and the tools surrounding it are a lot

Firefox, along with all other browsers, are trying to move awayfrom supporting older TLS versions, which means means anythingbefore TLS 1.2. In Firefox, the minimum acceptable TLS version iscontrolled about the about:config preference security.tls.version.min ;in released versions of Firefox this is still '1' (for TLS 1.0),while in non-release versions it's '3' (for TLS 1.2). If you'reusing a non-

The people running GMail are neither stupid nor ignorant, sopresumably they had good reason for GMail not verifying TLS serverhostnames until recently . When I wasthinking about this yesterday, it occurred to me that one approachto safely accept TLS certificates even with mis-matched hostnamesmight be to look up the IP address of the host the certificate isfor and accept it if the IP address is the same as what you'reconnecting to. Unfortunately, I then realized that this is notsafe, at least in general

One of the famous big splits between the BSD Unix world and theSystem V world is whether ordinary users can use chown (the commandand the system call) to give away their own files. In System V derivedUnixes you were generally allowed to; in BSD derived Unixes you weren't.Until I looked it up now to make sure, I thought that BSD changed thisbehavior from V7 and that V7 had an unrestricted chown. However, thisturns out to be wrong; in V7 Unix

One of the things that writing Wandering Thoughts does isgive me the opportunity to be inaccurate in public. Yesterday I wroteabout how you should use ' -h ' with chown , especially for recursivechowns so that you don't change the ownership ofthings that symlinks point to. As it happens, I was mistaken about someaspects of the situation with chown .

First off, I stand by my overall recommendation that you shouldmake a habit of always using ' chown -h ' . Although using it with-

Today I had a little Twitter exchange about a little (or not so little)thing that is not as well known as it should be:

@thatcks :Ah yes, the eternal question: is it 'chown -Hr' or 'chown -hR' that Iwant?

(Answer: the second. Also, -h should be the default, at least with-R.)

@mrhoten : TIL I have run some pretty dang risky chown-R's and not even known it.

For

I tweeted recently :

TIL that GMail has apparently spent years notverifying that the hostname of the remote POP server it was connectingto was included in the server's TLS certificate.

Like the more common and more recent IMAP , POP is aprotocol used to retrieve email from email servers. GMail has formany years supported pulling email from your account elsewhere intoGMail by logging in to it with POP and directly grabbing the mail(presumably using POP instead of IMAP because the POP protocol isa lot simpler).

(

One of the two parts of verifying a TLS server certificate is what I described as 'making sure thatthis valid certificate is actually for the server you're talkingto'. This is done by verifying that the hostname you're connectingto appears in the TLS certificate's Common Name or Subject AlternativeNames fields (CN and SAN respective), which is how TLS certificatesspecify what hosts they're for . I havecome to feel that there are two reasons for doing this verification,and doing it

In late March, there was a Linux kernel security issue, CVE-2020-8835 ( also ).This was, to quote the Ubuntu CVE description:

In the Linux kernel 5.5.0 and newer, the bpf verifier(kernel/bpf/verifier.c) did not properly restrict the register boundsfor 32-bit operations, leading to out-of-bounds reads and writes inkernel memory. The vulnerability also affects the Linux 5.4 stableseries