When I set up my HiDPI display on my home Linux machine , I had to do some wrestling with general DPIand scaling settings but after that mosteverything just worked and I didn't think about it. Due to worldand local events , Ispent a chunk of today getting set up for an extended period ofworking from home, including getting my work exmh configured todisplay properly over remote X on my HiDPI home display .

( Exmh is one of the things that Ireally miss when I don't

On the surface, one of the challenges for Firefox automaticallyusing different DNS over HTTPS servers is that Firefox considersyour ISP to be a threat. This means that Firefox doesn't want tojust use your local DNS over HTTPS server any more than it wantsto just use your normal local DNS server. Firefox's use of DNS overHTTPS is explicitly to avoid surveillance from various parties,including the local network, so to do this it needs to go straightto a trusted (public) DNS over HTTPS server

At a general level, what DNS servers you should (and sometimes can)use depends on what network you're connected to. If you're connectedto a network that just gives you general Internet access, then you(just) need a DNS server that gives you general public IP addresses.If you're connected to some sort of internal network, your networkmay have both special DNS names that aren't visible in the publicDNS and special resolution for DNS names that are visible in thepublic

When I wrote about how sensible heuristics for when to use DNSover HTTPS can't work for us ,in a comment Guus asked about us setting up a DNS over HTTPS services along sideour existing resolver. Depending on your perspective, this is eitheran obvious good question or one with an obvious answer, and thething is, neither of those perspectives are wrong. In common usagetoday, 'DNS over HTTPS' has become ambiguous; depending on contextit can mean one of two things.

The first thing

If Firefox is using DNS over HTTPS in general, it has variousheuristics for whether or not to use it to resolve any particularname; for instance, right now it doesn't use DNS over HTTPS for anydomain in your DNS suffixes (this happens even if you explicitlyturned on DNS over HTTPS, which disables checking for the canarydomain ). Presumably other browsers willalso have their own set of heuristics when they implement DNS overHTTPS, and at some point the set of heuristics that various browsersuse may

I recently wrote about how browsers are probably running the TLSshow now , and then recently realizedthat that is only somewhat true. In practice, I think that TLS nowincreasingly exists in at least three different worlds that are atleast somewhat disconnected from each other, and what's true forone world may not be entirely true for the others.

The first world is web TLS , which is dominated by browsers. Thisis the familiar world of public HTTPS, with public CertificateAuthorities, requirements for certificate transparency,

Recently, we decided to add the magic marker that's used toexplicitly disable DNS over HTTPS to our local DNS resolvers as a precaution against various things.Being sensible people, we then attempted to verify that we'd gottenit right, by explicitly enabling DNS over HTTPS in a sysadmin'stest Firefox and then trying things with and without the canarydomain . This failed and left usvery puzzled, and it was only through a lucky bit of happenstancethat we kind of discovered what seems to be going

In response to yesterday's entry on how we sort of automate Ubuntupackage updates , which involves a complicateddriver program (written in Python) to control a bunch of ssh's to ourmachines, a commentator asked the perfectly sensible and obviousquestion:

Is there a reason this couldn’t be a bash script that invokes pdsh ?

Ultimately the complexity of our driver program is caused by how theUbuntu package update process is flawed .We might still have a Python program instead of a shell script ifthe process

We make significant use of HTTP Basic Authentication in our local web servers, because if you use Apacheit's a nice simple way of putting arbitrary things behind passwordprotection. It's not the most user-friendly thing these days and it'sprobably not what you want if you also need to handle things like userregistration and password resets, but in our environment all of thoseare handled separately. However, it does have one little drawback,which is logging out.

Normal user web authentication schemes are