You can't (easily) ignore errors in Python
Yesterday I wrote about how there's always going to be a way tonot write code for error handling . When I wrote thatentry I deliberately didn't phrase it as 'ignoring errors', becausein some languages it's either not possible to do that or at leastvery difficult, and one of them is Python.
As every Python programmer knows, errors raise exceptions in Pythonand you can catch those exceptions, either narrowly or (very)broadly ( possibly by accident ). Ifyou don
There's always going to be a way to not code error handling
Over on the Fediverse, I said something :
My hot take on Rust .unwrap(): no matter what you do, people wantconvenient shortcut ways of not explicitly handling errors inprogramming languages. And then people will use them in what turn outto be inappropriate places, because people aren't always right andsometimes make mistakes.
Every popular programming language lets your code not handle errors insome way, taking an optimistic approach. If you're lucky, your programnotices at runtime when there actually is
Automatically scrubbing ZFS pools periodically on FreeBSD
We've been moving from OpenBSD to FreeBSD for firewalls . One advantage of this is givingus a mirrored ZFS pool for the machine's filesystems ; we have a lot of experience operating ZFSand it's a simple, reliable, and fully supported way of gettingmirrored system disks on important machines. ZFS has checksums andyou want to periodically 'scrub' your ZFS pools to verify all ofyour data (in all of its copies) through these checksums ( ideallyrelatively frequently ). Allof this is
We're (now) moving from OpenBSD to FreeBSD for firewalls
A bit over a year ago I wrote about why we'd become interestedin FreeBSD ; to summarize, FreeBSDappeared promising as a better, easier to manage host operatingsystem for PF-based things. Since then we've done enough with FreeBSDto have decided that we actively prefer it to OpenBSD. It's beenrelatively straightforward to convert our firewall OpenBSD PFrulesets to FreeBSD PF and the resulting firewalls have clearlybetter performance on our 10G network than our older OpenBSD onesdid (with less tuning
A surprise with how '#!' handles its program argument in practice
Every so often I get to be surprised about some Unix thing. Today'ssurprise is the actual behavior of '#!' in practice on at leastLinux, FreeBSD, and OpenBSD, which I learned about from a commentby Aristotle Pagaltzis on my entryon (not) using '#!/usr/bin/env' . I'll quotethe starting part here:
In fact the shebang line doesn’t require absolute paths, you canuse relative paths too. The path is simply resolved
People are sending HTTP requests with X-Forwarded-For across the Internet
Over on the Fediverse, I shared a discovery that came fromturning over some rocks here on Wandering Thoughts:
This is my face when some people out there on the Internet sendout HTTP requests with X-Forwarded-For headers, and maybe even notmaliciously or lying. Take a bow, ZScaler.
The HTTP X-Forwarded-For header is something that I normally expect to see only on somethingbehind a reverse proxy, where the reverse proxy frontend is usingit to tell the backend the real originating IP (
We haven't seen ZFS checksum failures for a couple of years
Over on the Fediverse I mentioned something about our regular ZFSscrubs :
Another weekend, another set of ZFS scrubs of work 's multipleterabytes of data sitting on a collection of consumer 4 TB SSDs(mirrored, we aren't crazy, and also we have backups). As usual thereis not a checksum error to be seen. I think it's been years since anycame up.
I accept that SSDs decay (we've had some die, of course) and randomread errors happen,
OIDC, Identity Providers, and avoiding some obvious security exposures
OIDC (and OAuth2 ) hassome frustrating elements that make it harder for programs to supportarbitrary identity providers (as discussed in my entry on theproblems facing MFA-enabled IMAP in early 2025 ).However, my view is that these elements exist for good reason, andthe ultimate reason is that an OIDC-like environment is by defaultan obvious security exposure (or several of them). I'm not surethere's any easy way around the entire set of problems that push
My script to 'activate' Python virtual environments
After I wrote about Python virtual environments and source codetrees , I impulsively decided to set up thedevelopment tree of our Django application to use a Django venv instead of a 'pip install --user' version ofDjango. Once I started doing this, I quickly decided that I wanteda general script that would switch me into a venv. This sounds alittle bit peculiar if you know Python virtual environments so let me explain.
Activating a Python virtual environment mostly means making surethat its 'bin' directory is
Getting feedback as a small web crawler operator
Suppose, hypothetically, that you're trying to set up a small webcrawler for a good purpose. These days you might be focused on websearch for text focused sites, or small human written sites, orsimilar things, and certainly given the bad things that are happeningwith the major crawlers we could use them. As a small crawler, youmight want to get feedback and problem reports from web site operatorsabout what your crawler is doing (or not doing). As it happens, Ihave some