Committed address space versus active anonymous pages in Linux: a mystery

Wandering Thoughts | May 12, 2019, 1:18 a.m. | Original

In Linux, there are at least two things that can happen when your systemruns out of memory (or the kernel at least thinks it has); the kernelcan activate the Out-of-Memory killer, killing one or more processesbut leaving the rest alone, or it can start denying new allocationrequests, which causes a random assortment of programs to startfailing . As I found out recently, systems with strict overcommit on can still trigger the OOMkiller, depending on your settings for how much memory the

Continue reading...

What we'll want in a new Let's Encrypt client

Wandering Thoughts | May 12, 2019, 1:18 a.m. | Original

Over on Twitter, I said :

It looks like we're going to need a new Let's Encrypt client toreplace acmetool (which we love);acmetool uses the v1 API and seems to no longer be actively developed,and the v1 API runs into problems in November:

(There is an unfinished ACMEv2 branch of acmetool, but , and also . It would beideal if the community stepped forward to continue acmetooldevelopment, but

Continue reading...

Some thoughts on Red Hat Enterprise 8 including Python 2 and what it means

Wandering Thoughts | May 10, 2019, 1:18 a.m. | Original

Red Hat Enterprise 8 was released the other day, and now Red Hathas published an article on Python 2 (and 3) in RHEL 8 ( via ).The short version is that they aren't providing a package called'python' but instead two packages called 'python3' and 'python2'(or two 'application streams' for Python 2 and 3, which come with additional packages). Althoughit's not entirely clear, Red Hat is apparently not going to have a /

Continue reading...

Firefox versus Chrome (my 2019 view)

Wandering Thoughts | May 10, 2019, 1:18 a.m. | Original

On Twitter, I said :

I continue to believe that Firefox is your best browser option,despite the addons screwup. Mozilla at least tries to be good (andusually is), while Chrome is straight up one tentacle of the giant,privacy invading, advertising company giant vampire squid of Google.

I'm sure there are plenty of good, passionate, well-intended peoplewho work on Chrome, and they care a lot about privacy, user choice,and so on. But existing within the giant vampire

Continue reading...

A Linux machine with a strict overcommit limit can still trigger the OOM killer

Wandering Thoughts | May 8, 2019, 1:18 a.m. | Original

We've been running our general use compute servers with strictovercommit handling for total virtual memory for years, because on compute servers we feel we have to assumethat if you ask for a lot of memory, you're going to use it foryour compute job. As we discovered last fall, hitting the strictovercommit limit doesn't trigger the OOM killer ,which can be inconvenient since instead all sorts of random processesstart failing since they can't get any more memory. However, we've

Continue reading...

Some general things and views on DNS over HTTPS

Wandering Thoughts | May 8, 2019, 1:18 a.m. | Original

Over on Twitter I said something and then Brad Beyenhof asked me a sensible question related to DNS overHTTPS .Before I elaborate my Twitter answers to that specific question, Iwant to do an overview of some general views on DNS over HTTPS on the whole.

DNS over HTTPS (hereafter DoH) is what it sounds like; it's aprotocol for making DNS queries over a HTTPS connection. There isalso the older DNS over TLS ,but my impression is that DoH has become more popular, perhapspartly because

Continue reading...

Some weird and dubious syndication feed fetching from SBL-listed IPs

Wandering Thoughts | May 7, 2019, 1:18 a.m. | Original

For reasons beyond the scope of this entry (partly 'because Icould'), I've recently been checking to see if any of the IPs thatvisit Wandering Thoughts are on the Spamhaus SBL . As a preemptive note, using theSBL to block web access is not necessarily a good idea, as I'vefound out in the past ; it's specifically focusedon email, not any other sorts of abuse. However, perhaps you don'twant to accept web traffic from networks that Spamhaus

Continue reading...

TLS certificate rollover outside of the web is complex and tangled

Wandering Thoughts | May 5, 2019, 1:18 a.m. | Original

On the web, renewing and rolling over TLS certificates is a wellunderstood thing, with best practices that are exemplified by aLet's Encrypt based system. There is a chain of trust starting from the server's certificate and running up to a rootcertificate that browsers know, and everything except the rootcertificate is provided to the browser by the web site. Servercertificates are rolled over regularly and automatically, andwhen this happens the website is also provided with the rest ofthe certificate chain, which it can

Continue reading...

What usually identifies an intermediate or root TLS certificate

Wandering Thoughts | May 5, 2019, 1:18 a.m. | Original

The usual way of describing TLS certificates for things like websitesis that they are a chain of trust , where yourwebsite's TLS certificate is signed by a Certificate Authority'scurrent intermediate certificate and then that intermediate certificateis signed by the CA's root certificate. For example, you can readabout Let's Encrypt's chain of certificates . Some CAs use a chain ofmultiple intermediate certificates.

(Modern TLS certificates often include a URL to fetch their parentcertificate, as covered here .)

But

Continue reading...

In Go, unsafe type conversions are still garbage collection safe

Wandering Thoughts | May 3, 2019, 1:18 a.m. | Original

I was recently reading to slice or not to slice ( via ), where one of theexample ways of going from a slice to an array is the non copyingbrute force approach with unsafe .To quote the first part of the example code:

bufarrayptr := (*[32]byte)(unsafe.Pointer(&buf[0])) // *[32]byte (same memory region)

(Here buf is a slice, and we'll assume that we've

Continue reading...