Some thoughts on the pragmatics of classifying phish spam as malware
We are currently looking at how ClamAV would do at checking our incoming email for malware and other things that it has signatures for. As I noticedonce we started doing this, third party ClamAV signatures seemto include a lot of phish and other spam .One of the questions this raises is whether this matters on apragmatic level, and how.
On the one hand, I am a big believer in the idea that most peopledon't care about how you break up the various components of yourspam filtering and
Chrony has been working well for us (on Linux, where we use it)
We have a variety of machines around here that run NTP servers, for variousreasons. In the beginning they all ran some version of the classicNTP daemon, NTPD , basically because that wasyour only option and was what everyone provided. Later, OpenBSDchanged over to OpenNTPD and so our OpenBSD machines followed alongas they were upgraded. Then various Linuxes started switching theirdefault NTP daemon to chrony , andeventually that spread to our usage ( first for me personally and then for our servers). These days,when
Netplan's interface naming and issues with it
Back in March, I wrote an entry about our problem with Netplanand routes on Ubuntu 18.04 . In a comment onthe entry, Trent Lloyd wrote a longand quite detailed reply that covered how netplan actually works here. If you use Netplan to any deep level, it iswell worth reading in whole. My short and perhaps inaccurate summaryis that Netplan is mostly a configuration translation layer on topof networkd ,and its translation is relatively blind and brute force. This straighttranslation then puts limits
One of XHTML's practical problems was its implications for web page generation
I recently ran across The evolution of the web, and a eulogy forXHTML2 , which has a much morepositive view of XHTML(2) than I do; my view is not positive atall . In the ensuing discussion on lobste.rs Irealized a new aspect of the practical problems with XHTML, whichis the page creation side.
(My usual XHTML objections focus on the web user side of things, whereXHTML's nominal requirement for draconian error handling (any XHTMLerrors would cause browsers to
My common patterns in shell script verbosity (for sysadmin programs)
As a system administrator, I wind up writing a fair number of scriptsthat exist to automate or encapsulate some underlying command orset of commands. This is the pattern of shell scripts as wrapperscripts or driver scripts, where you could issue the real commandsby hand but it's too annoying (or too open to mistakes ). In this sort of script, I'vewound up generally wanting one of three different modes for verbosity;let's call them 'quiet', 'dryrun', and
An interesting little glitch in how Firefox sometimes handles updates to addons
Every so often I run into a bug where the implementation showsthrough, or at least it looks like it does. Today's is in Firefox.On Twitter, I said :
It's pretty clear that the Firefox developers don't both leave theirFirefox sessions running all the time and use addons that updatefrequently. I could file a bug, but bleah.
There's an additional condition for this glitch that I forgot toput in my first tweet, which is that you almost certainly need to
An incorrect superstition about running commands in the Bourne shell
Every so often, I wind up writing some bit of shell script thatwants to execute an entire command line that it has been passed(program and all). For years I have written this as follows:
# re-execute the command linecmd="$1"; shift"$cmd" "$@"
Some version of this has crept into innumerable shell scripts,partly for reasons beyond the scope of this entry. I've alwaysconsidered it just a little Bourne irritation that "$@
Third party ClamAV signatures seem to include a lot of phish and other spam
For reasons well beyond the scope of this entry, we are currentlylooking at how ClamAV would do atchecking our incoming email for malware,or at least the portion of our incoming email that remains after we immediately reject messages with certain sorts of bad attachments . Our initial experimentation justused whatever collection of signatures the Ubuntu 18.04 LTS packageof ClamAV downloads and uses by default, which rapidly demonstratedthat this was nowhere near good enough.
(We determined this by cross comparing ClamAV's results against the
The DBus daemon and out of memory conditions (and systemd)
We have a number of systems where for reasons beyond the scope ofthis entry, we enable strict overcommit . Inthis mode, when you reach the system's memory limits the Linuxkernel will deny memory allocations but usually not trigger theOOM killer to terminate processes . It's upto programs to deal with failed memory allocations as best theycan, which doesn't always go very well. In our current setup on themost common machines we operate this way, we've set the vm.admin
Groups of processes are a frequent and fundamental thing in Unix
Recently, I wrote about a gotcha when catching Control-C inprograms that are run from scripts , wherethings could go wrong because the Control-C was delivered not justto the program but also to the shell script, which wasn't expectingit (while the program was). From the way I wrote that entry (whichfocused on a gotcha involving this group signalling behavior), youmight wind up with the impression that this behavior of Unix signalsis a wart in Unix. In fact, it