I recently ran across Is chroot a security feature? ( via ); following Betteridge's law of headlines ,the article's answer is 'no', for good reasons that I will let youread in the article. However, I mildly disagree with the articleon a philosophical level for the case of anonymous ftp and thingslike it. Chroot is a security feature for ftpd because ftpd doessomething special; anonymous ftp adds an additional securitycontext to your system that wasn't there before .

Before you

One of the unusual and sometimes troublesome parts of TLS is thatverifying a TLS server's certificate actually has two separateparts, each critical. The first part is verifying that you have avalid certificate, one that is signed by a certificate chain thatruns up to a known CA, hasn't expired, hasn't been revoked (or isasserted as valid ),perhaps appears in a CT log , and soon. The second, equally critical part is making sure that this validcertificate is actually

We have a Django web app forhandling requests for Unix accounts, which has some HTML forms (infact it's basically half HTML form filling). These forms (and allof the app's HTML) were put together years ago and only looked aton the desktop at the time. Recently, I poked around the app's formson the work iPad to see how it would go. Even after I fixed thetraditional viewport issue (see the comments),there were little irritations; for

Over on r/golang, an interesting question was asked :

[Is it] possible to parse a struct or interface to get its pointeraddress as an integer? [...]

The practical answer today is yes, as noted in the answers to thequestion. You can convert any Go pointer to uintptr by going through unsafe.Pointer() ,and then convert the uintptr into some more conventional integertype if you want. If you're going to convert to another integertype, you should probably

The news of the time interval is that Mozilla will soon startrolling out DNS over HTTPS for US users ,where by 'rolling out' Mozilla means 'enabling by default'. To theirminimum credit, Mozilla says that they will explicitly notify peopleof this change and give them the opportunity to opt out. I hope andassume that this will work much like how Mozilla rolled out varioustracking protection measures, including with how thoroughly informativethat was.

(Clearly notifying people and giving them the chance to opt out is

One of the things you can abuse metrics for in Prometheus is toconfigure different alert levels, alert destinations, and so on fordifferent labels within the same metric, as I wrote about back inmy entry on using group_* vector matching for database lookups . The example in that entry used two metricsfor filesystems, our_zfs_avail_gb and our_zfs_minfree_gb ,the former showing the current available space and the latterdescribing the alert levels and so on we want. Once we

In my entry on our use of bidirectional NAT and split horizon DNS , I mentioned that we couldn'tapply our bidirectional NAT translation to all of our internaltraffic in the way that we can for external traffic for two reasons,an obvious one and a subtle one. The obvious reason is our currentnetwork topology, which I'm going to discuss in a sidebar below.The more interesting subtle reason is the general problem of whatI'm going to call triangular NAT .

Normally when you NAT something in

I'll start with the background. I keep around a bunch of third partyprograms written in Go, and one of the things that I do periodicallyis rebuild them, possibly because I've updated some of them totheir latest versions . When doing this,it's useful to have a way to report the package that a Go binary wasbuilt from, ideally a fast way. I have traditionally used binstale for this, but it's notfast. Recently I tried out gobin ,which is

Like many other places, we havefar too many machines to give them all public IPs (or at leastpublic IPv4 IPs), especially since they're spread across multiplegroups and each group should get its own isolated subnet. Oursolution is the traditional one; we use RFC 1918 IPv4 address space behindfirewalls, give groups subnets within it (these days generally/16s), and put each group in what we call a sandbox .Outgoing traffic from each sandbox subnet is