DKIM provides sender attribution (for both spam and not necessarily spam)
The presence of a valid DKIM signatureon incoming email doesn't mean anything much about whether or notit's spam, or even if it comes from dedicated spam senders. Spammerscan and do add proper DKIM signatures to their messages, and manylegitimate senders don't use DKIM or don't have valid DKIM signatures,as our recent DKIM stats demonstrate.For that matter, some spam comes from legitimate places which DKIMsign all of their outgoing email (such as GMail). However, it has
Metadata that you can't commit into a VCS is a mistake (for file based websites)
I'll start with my tweet and @rt2800pci1 's (first) reply:
@thatcks :I like having a file-based blog engine, but mine does make changingthe 'category' of a post somewhat painful and a bit disruptive (itre-appears in syndication feeds). Still, I'm too annoyed by my ownmistakes to not do it.
@rt2800pci1 :Have you thought of using extended attributes on those files to
In Linux, hitting a strict overcommit limit doesn't trigger the OOM killer
By now, we're kind of used to our Linux machines running out ofmemory, because people or runaway processes periodically do it (toour primary login server, to our primary web server, or sometimesother service machines). It has a familiar litany of symptoms,starting with massive delays and failures in things like SSH loginsand ending with Linux's OOM killer activatingto terminate some heavy processes. If we're lucky the OOM killerwill get the big process right away; if we're
Do I feel uncertain about CentOS's future now? Yes, a bit
I was going to write an entry about how CentOS remains quietlyimportant to us because of its long support period, with CentOS 7supported through 2024 or so for security updates (per the CentOSwiki and FAQ ).Then I paused to think about that in light of IBM buying Red Hat.
The end of 2023 is five years from now. A lot of things can happenin five years after a company is acquired, and a lot of intentionsand plans can change. IBM is
OpenSSH has broader key revocation than I thought
A while back, OpenSSH gained support for doing host and userauthentication through a local Certificate Authority. Instead ofdirectly trusting public keys, you configured a CA (or more than one)and then trusted anything signed by that CA. For user keys, this hasthe usual weakness of the basic CA model ;for host keys, it's probably an improvement in practice but I'd like toknow what happens if you get handed a new CA-signed host key for a hostthat you already saw one
Shooting myself in the foot by cargo-culting Apache configuration bits
I spent part of today working to put Prometheus's Blackbox proberexporter behinda reverse proxy in Apache (to add TLS and some security to it).Unlike some other pieces of Prometheus, the Blackbox exporter isnot designed for this and so its little web server generates HTMLpages with absolute urls like /metrics and /config , which doesn'twork too well when you've relocated it to be under /blackbox/ inyour reverse proxying rules. Years and years ago I would have justbeen out
Link: HiDPI on dual 4K monitors with Linux
Vincent Bernat's article HiDPI on dual 4K monitors with Linux ( via )is about what you'd expect it to be about and is, as they say,relevant to my interests. Especially relevant to me is the sectionon HiDPI support on Linux with X11, which runs down a collectionof issues and contains a very useful chart about what is supportedin what application and toolkit, which added some information thatI hadn't known.
Note that Bernat's experience with xterm and rxvt
The obviousness of inheritance blinded me to the right solution
This is a Python programming war story.
I recently wrote a program to generate things to drive low diskspace alerts for our ZFS filesystems in our in-progress Prometheus monitoringsystem. ZFS filesystems are grouped together into ZFS pools, andin our environment it makes sense to alert on low free space ineither or both (ZFS filesystems can run out of space without theirpool running out of space). Since we have a lot of filesystems andmany fewer pools, it also makes sense to be able to set a
How I'm visualizing health check history in Grafana
In our in-progress Prometheus and Grafana setup, we're doing an assortment of black-boxhealth checks on various machines and services. Once you have healthchecks, one of the obvious things to want is a visualization oftheir history; when did health checks fail, and how many failed atthat time, and so on. Among other things, this is useful if youwant to look for flaky health checks that fail sometimes but notfor long enough to trigger alerts. Do your pings or DNS lookups
What 'dependency' means in Unix init systems is underspecified
I was reading Davin McCall's On the vagaries of init systems ( via ) whenI ran across the following, about the relationship between variousdaemons (services, etc):
I do not see any compelling reason for having ordering relationshipswithout actual dependency, as both Nosh and Systemd provide for. Incomparison, Dinit’s dependencies also imply an ordering,which obviates the need to list a dependency twice in the servicedescription.
Well, this may be an easy one but it depends on what an init system