David Crawshaw's The asymmetry of Internet identity is, among other things,a marvelously cynical yet pretty much completely accurate reviewof people's identity on the modern Internet in practice. I wishit didn't work the way Crawshaw describes it, but it does.

(Via lobste.rs .)

Every so often (currently monthly), there is an " OpenZFS leadership meeting". Whatthis really means is 'lead developers from the various ZFSimplementations get together to talk about things'. Announcementsand meeting notes from these meetings get sent out to various mailinglists, including the ZFS on Linux ones. In the September meeting notes,I read a very interesting (to me) agenda item:

• Relax quota semantics for improved performance (Allan Jude)
  • Problem: As you approach quotas, ZFS performance degrades.
  • Proposal

On Twitter, I said :

These days, I think of many of our alerts as tests, like code tests toverify that bugs don't come back. If we broke something in the pastand didn't notice or couldn't easily spot what was wrong, we add analert (and a metric or check for it to use, if necessary).

So we have an alert for 'can we log in with POP3' (guess what I brokeonce, and surprise, GMail uses

A while back I wrote some notes on understanding how to use flock(1) , but those notes omitted a potentiallyimportant option, partly because that option was added somewherein between version util-linux version 2.27.1 (which is what Ubuntu16.04 has) and version 2.31.1 (Ubuntu 18.04). That is the -F option, which is described in the manpage as:

Do not fork before executing command . Upon execution the

As I mentioned in my entry on how we implement per-user CPU and memorylimits , we have a number of shared generaluse servers where we've decided we need to impose limits on everyone allof the time so no one person can blow up the machine. Over the course ofdoing this, we've built up some practical experience and discovered asurprise or two.

As discussed , we impose our memorylimits by setting systemd's MemoryLimit .In theory perhaps we should use MemoryMax ,but for

The more we use Certbot, the more I become convinced that it isn'twritten by people who actually operate it in anything like the kindof environment that we do (and perhaps not at all, although I hopethat the EFF uses it for their own web serving). I say this becausewhile Certbot works, there are all sorts of little awkward bitsaround the edges in practical operation ( eg ).Today's particular issue is a two part issue concerning filepermissions on TLS certificates and keys (

A few years ago I wrote about how and why systemd on Ubuntu 16.04couldn't reliably reboot some of our servers . At the time I finished off the entryby suggesting that we'd live with the intermittent failures thatcaused some of our systems to hang during reboot attempts, forcingus to go power cycle them. Shortly afterward, we changed our mindsand decided to work around the situation by resorting to a biggerhammer. These days we use our bigger hammer on both Ubuntu 16

A certain amount of malware these days likes 7z files , or at least things that claimto be 7z files with their file extension. We've been getting a runof malware that claims its file extension is .pdf.7z and thatSophos PureMessage detects as 'CXmail/MalPE-AS', which I suspectmeans that there's actually a Windows executable in there. We'vealso got others that are being reported by our attachment logger as simply .7z files (and also

A while back I wrote about imposing temporary CPU and memorylimits on a user , using cgroups and systemd's features tofiddle around with them. Since then we have wound up with a numberof shared general use machines where we've decided it's wiser toimpose limits on everyone all of the time, so that one person can'tblow up a general use server through either excessive CPU usage orexcessive memory usage. We've done this on Ubuntu 16.04 and now1