Trying to understand Firefox's approaches to tracking cookie isolation
As I learned recently , modernversions of Firefox have two different techniques that try to defeat(unknown) tracking cookies. As covered in the browser addon JavaScriptAPI documentation, in Tracking protection ,these are called first-party isolation and dynamic partitioning (or storage partitioning , the documentation seems to use both).Of these two, first party isolation is the easier to describe and understand. To quote the documentation:
When first-party isolation is on, cookies are qualified by the domainof the original page the user
My mistake with swallowing EnvironmentError errors in our Django application
We have a little Django application to handle request for Unix accounts .Once upon a time it was genuinely little, but it's slowly accretedfeatures over the years. One of the features it grew over the yearswas a command line program (a Django management command )to bulk-load account request information from files. We use thisto handle things like each year's new group of incoming graduatestudents; rather than force the new graduate students to find theweb form on their own, we get information
Removing Fedora's selinux-policy-targeted package is mostly harmless so far
A while back I discussed why I might want to remove theselinux-policy-targeted RPM package for a Fedora 42 upgrade . Today, I upgraded my office workstationfrom Fedora 41 to Fedora 42 , and as part ofpreparing for that upgrade I removed the selinux-policy-targetedpolicy (and all of the packages that depended on it). The resultappears to work, although there were a few things that came upduring the upgrade and I may reinstall at least selinux-policy-targeted
Firefox, the Cookie AutoDelete add-on, and "Total Cookie Protection"
In a comment on my entry on flailing around with Firefox's Multi-AccountContainers , Ian Z aka nobrowser asked a good question:
The Cookie Autodelete instructions with respect to Total Cookie Protection mode are veryconfusing. Reading them makes me think this extension is not for me,as I have Strict Mode on in all windows, private or not. [...]
This is an interesting question (and, it turns out, relevant to myusage too) so I did some digging. The short answer
My flailing around with Firefox's Multi-Account Containers
I have two separate Firefox environments .One of them is quite locked down so that it blocks JavaScript bydefault , doesn't accept cookies, and so on.Naturally this breaks a lot of things, so I have a second "justmake it work" environment that runs all the JavaScript, accepts allthe cookies, and so on (although of course I use uBlock Origin ,I'm not crazy). This second environment is pretty risky in the sensethat it's going to be heavily contaminated
I wish Firefox Profiles supported assigning websites to profiles
One of the things that Firefox is working on these days is improvingFirefox's profiles feature so thatit's easier to use them. Firefox also has an existing feature thatis similar to profiles, in containers and the Multi-AccountContainers extension . Thereason Firefox is tuning up profiles is that containers only separatesome things, while profiles separate pretty much everything. Aprofile has a separate set of about:config settings, add-ons, add-onsettings, memorized logins, and so on.
Modern Linux filesystem mounts are rather complex things
Once upon a time, Unix filesystem mounts worked by putting oneinode on top of another , and thiswas also how they worked in very early Linux. It wasn't wrong tosay that mounts were really about inodes, with the names only beingused to find the inodes. This is no longer how things work in Linux(and perhaps other Unixes, but Linux is what I'm most familiar withfor this). Today, I believe that filesystem mounts in Linux arebest understood as namespace operations.
You can add arbitrary zones to NSD (without any glue records)
Suppose, not hypothetically, that you have a very small DNS serverfor a captive network situation, where the DNS server exists onlyto give clients answers for a small set of hosts. One of the waysyou can implement this is with an authoritative DNS servers, suchas NSD , that simplyhas an extremely minimal set of DNS data. If you're using NSD forthis, you might be curious how minimal you can be and how much youneed to mimic ordinary DNS structure.
Here, by 'mimic
Some of the things that ZFS scrubs will detect
Recently I saw a discussion of my entry on how ZFS scrubs don'treally check the filesystem structure wheresomeone thought that ZFS scrubs only protected you from the diskcorrupting data at rest, for example due to sectors starting tofail ( here ).While ZFS scrubs have their limits, they do manage to check somewhatmore than this.
To start with, ZFS scrubs check the end to end hardware path forreading all your data (and implicitly for writing it). There are avariety of ways that things
What little I want out of web "passkeys" in my environment
WebAuthn is yet anotherattempt to do an API for web authentication that doesn't involvepasswords but that instead allows browsers, hardware tokens, andso on to do things more securely. "Passkeys" ( also ) is the marketing term for a"WebAuthn credential", and an increasing number of websites really,really want you to use a passkey for authentication instead of anyother form of multi-factor authentication (they may or may not stillrequire your password).
Most everyone that wants you to use passkeys