Why Let's Encrypt's short certificate lifetimes are a great thing

I recently had a conversation on Twitter about whatwe care about in TLS certificate sources, and it got me to realizesomething. I've written before about how our attraction to Let'sEncrypt has become all about the greatautomation , but what I hadn'treally thought about back then was how important the short certificatelifetimes are. What got me to really thinking about it was ahypothetical; suppose we could get completely automatically issued andrenewed free certificates but they had the typical one or more yearlifetime


A spammer misses a glorious opportunity

Most of the spam that I collect on the machines that I run mysinkhole SMTP server onis boring spam . Since it's boring, I've triedto block as much of it as possible; still, there are plenty of casesthat get through, because that sort of spam can come from all over.Today I got what initially looked like one of those boring spams thatsneak through. It appeared in my log like this:

[...] from 196.15.


Linux is good at exposing the truth of how motherboards are wired

One of the things I've learned over time, sometimes the hard way,is that Linux (and other open source operating systems) are brutallyhonest about how various things on motherboards are actually hookedup. As a result, they are a good way of exposing any, well, let uscall them 'convenient inaccuracies' in how motherboard manualspresent things. The major source of inaccuracies that I've tendedto run across has been SATA port numbering, and on servers we'vealso had Ethernet port


A bad web scraper operating out of OVH IP address space

I'll start with my tweet :

I've now escalated to blocking entire OVH /16s to deal with thereferer-forging web scraper that keeps hitting my techblog from OVHnetwork space; they keep moving around too much for /24s.

I have strong views on forged HTTP referers ,largely because I look at my Referer logs regularly and bogus entriesdestroy the usefulness of those logs. Making my logs noisy or uselessis a fast and reliable way to get me to block sources from Wandering


In Fedora, your initramfs contains a copy of your sysctl settings

It all started when I discovered that my office workstation hadwound up with its maximum PID value set to a very large number (asmentioned in passing in this entry ). I managedto track this down to a sysctl.d file from Fedora's ceph-osd RPM package, which I had installedfor reasons that are not entirely clear to me. That was straightforward.So I removed the package, along with all of the other ceph packages,and rebooted for other reasons. To my surprise, this


Some questions I have about DDR4 RAM speed and latency in underclocked memory

Suppose, not hypothetically , thatyou're putting together an Intel Core i7 based machine, specificallyan i7-8700, and you're not planning to overclock. All Coffee Lake CPUs have an officially supported maximum memory rate of 2666 MHz(regardless of how many DIMMs or what sort of DIMM they are, unlikeRyzens ), so normally you'd just buy somesuitable DDR4 2666 MHz modules. However, suppose that the placeyou'd


The lie in Ubuntu source packages (and probably Debian ones as well)

I tweeted :

One of the things that pisses me off about the Debian and Ubuntusource package format is that people clearly do not actually use itto build packages; they use other tools. You can tell because of howthings are broken.

(I may have been hasty in tarring Debian with this particularbrush but it definitely applies to Ubuntu.)

Several years ago I wrote about one problem with how Debian buildsfrom source packages , which is thatit doesn't have a distinction between the package's source


Some things I mean when I talk about 'forged HTTP referers'

One of the most reliable and often the fastest ways to get me toblock people from Wandering Thoughts is to do somethingthat causes my logs to become noisy or useless. One of those thingsis persistently making requests with inaccurate Referer headers ,because I look at my Referer logs on a regular basis. When I talkabout this ,I'll often use the term 'forged' here, as in 'forged referers' or'referer-forging web spider'.

(I've been grumpy about this for


Getting chrony to not try to use IPv6 time sources on Fedora

Ever since I switched over to chrony ,one of the quiet little irritations of its setup on my officeworkstation has been that it tried to use IPv6 time sources alongside the IPv4 ones. It got these time sources from the defaultFedora pool I'd left it using along side our local time sources(because I'm the kind of person who thinks the more time sourcesthe merrier), and at one level looking up IPv6 addresses as wellas IPv4 addresses is perfectly sensible. At


The value locked up in the Unix API makes it pretty durable

Every so often someone proposes or muses about replacing Unix withsomething more modern and better, or is surprised when new surfaceOSes (such as ChromeOS ) arebased on Unix (often Linux, although not always). One reason thatthis keeps happening and that some form of Unix is probably goingto be with us for decades to come is that there is a huge amountof value locked up in the Unix API, and in more ways than areperhaps obvious.

The obvious way that a great deal of value is