A Let's Encrypt client feature I always want for easy standard deployment

On Twitter, I said :

It bums me out that Certbot (the 'official' Let's Encrypt client) doesnot have a built-in option to combine trying a standalone HTTP serverwith a webroot if the standalone HTTP server can't start.

(As far as I can see.)

For Let's Encrypt authentication, 'try a standalone server, then fallback to webroot' lets you create a single setup that works in a hugenumber of cases, including on initial installs before Apache


How Bash decides it's being invoked through sshd and sources your .bashrc

Under normal circumstances, Bash only sources your .bashrc whenit's run as an interactive non-login shell; for example, this iswhat the Bash manual says about startup files .Well, it is most of what the manual says, because there is animportant exception, which the Bash manual describes as 'Invokedby remote shell daemon':

Bash attempts to determine when it is being run with its standardinput connected to a network connection, as when executed by theremote shell daemon, usually rshd,


My Mastodon remark about tiling window managers

Over on Mastodon, I said :

Two reasons that I'm unlikely to like tiling window managers arethat I like empty space (and lack of clutter) on my desktop and Idon't like too-large windows. Filling all the space with windows ofsome size is thus very much not what I want, and I definitely havepreferred sizes and shapes for my common windows.

On the one hand, I've already written an entry on my views ontiling window managers . On theother hand


Intel

Sometimes, the problem is in a system's BIOS

We have quite a number of donated Dell C6220 blade servers, eachof which is a dual socket machine with Xeon E5-2680s. Each E5-2680 is an 8-core CPU with HyperThreads, so before we turned SMT off the machines reported as having 32 CPUs,or 16 if you either turned SMT off or had to disable one socket (and once you have to do both,you're down to 8 CPUs).


Firefox and my views on the tradeoffs of using DNS over HTTPS

For those who have not heard, Mozilla is (still) planning to haveFirefox support and likely default to resolving DNS names through DNS over HTTPS using Cloudflare'sDoH server (see eg this news article ).The alternate, more scary way of putting this is that Mozilla isplanning to send all of your DNS lookups (well, for web browsing)to Cloudflare, instead of your own ISP or your own DNS server.People have mixed feelings about Cloudflare, and beyond that issueand the issue of privacy


Some notes on Intel's CPUID and how to get it for your CPUs

In things like Intel's MDS security advisory ,Intel likes to identify CPU families with what they call a 'CPUID',which is a hex number. For example, the CPUID of the Sandy BridgeXeon E5 'Server Embedded' product family is listed by Intel as206D7, the CPUID of the Westmere Xeon E7 family is 206F2, and theCPUID of the Ivy Bridge Xeon E7 v2 family is 306E7. Given that oneof


Intel

Intel's MDS issues have now made some old servers almost completely useless to us

Over on Twitter, I said :

One unpleasant effect of MDS is that old Intel-based machines (oneswith CPUs that will not get microcode updates) are now effectivelyuseless to us, unlike before, because it's been decided that thesecurity risks are too high for almost everything we use machines for.

If Intel releases all of the MDS microcode updates they've promisedto do (sometime), this will have only a small impact on our availableservers. If they decide not to update some older


Intel

Intel's approach to naming Xeon CPUs is pretty annoying

Suppose, hypothetically, that someone offers to pass on to you (bywhich I mean your group ) an oldserver or two, and casually says that they have 'Xeon E7-4830' CPUs.Do you want the machines?

Well, that depends. As I found out in the process of writing yesterday's entry on the effects of MDS on our server fleet , a Xeon that is calledan 'E7-4830' may be anything from a first generation


An interesting Fedora 29 DNF update loop with the createrepo package

For a while, my Fedora 29 home and work machines have been complainingduring ' dnf update ' with a very peculiar complaint:

# dnf updateLast metadata expiration check: 0:09:16 ago [...]Dependencies resolved. Problem: cannot install both createrepo_c-0.11.1-1.fc29.x86_64 and createrepo_c-0.13.2-2.fc29.x86_

My weird problem with the Fedora 29 version of Firefox 67

On Twitter, I said :

So the Fedora version of Firefox 67 (or perhaps all versions ofFirefox 67) have a little issue where starting Firefox with a URL, as'firefox SOME-URL', will sometimes start Firefox without loading theweb page properly. This is very irritating for me, so back to Firefox66.

While the effect here is reproducible from the command line (well,for me), it comes up for me because I have a bunch of tools, dmenusetups