Acmetool is my preferred clientfor Let's Encrypt and the one we'veadopted for our switch to Let's Encrypt at work .If you know acmetool, talking about automating it sounds like acontradiction in terms, because the entire design of acmetool isabout automating everything already; you put it in cron (or moreexactly you let it put itself in cron as part of setup with ' acmetoolquickstart '), and then you forget about it. Perhaps you have towrite a hook script or two

Unusually, I'll lead with what I think that you should do and explainthe background afterward. In Firefox, go to about:preferences#privacy(the Privacy & Security tab of Firefox Preferences), scroll downalmost to the bottom to the 'Firefox Data Collection and Use'section, and untick 'Allow Firefox to install and run studies'. Tobe safe, you probably want to also untick 'Allow Firefox toautomatically send technical and interaction data to Mozilla'.

(Apparently you're going

I'll start with the tweets, where I sort of hijacked something glyphsaid with my own grump:

@glyph :Reminder: even ridiculous genius galaxy brain distributed systemsspace alien scientists can't figure out how to make and ship a fuckingbasic python executable. Not only do we need to make this easy we needan AGGRESSIVE marketing push once actually viable usable tools exist.

@thatcks :As a sysadmin, it’s a subtle disincentive to writing well structuredPython utilities. The moment I

One of the servers we run for our department is an old-fashioned general purposeweb server that hosts things like people's home pages and the web pages for(some) research groups. In terms of content, we have a mix of staticfiles, old-fashioned CGIs (run through suexec ),and reverse proxies to user run web servers .One of the things people here do with this web server is use it toshare research data files and datasets, generally through theirpersonal home page because that

My office workstation's upgrade to Fedora 27 resulted in a littleincident with NetworkManager, which I complained about on Twitter ; the resultingTwitter conversation brought systemd-resolved to my attention . My initialviews weren't all that positive (becauseI'm biased here; systemd's recent inventions have often not beengood things) but I didn't fully understand its state on my systems,so I wound up doing some digging. I'm still not too enthused, butI've wound

If you don't dig into it, a PC that boots with UEFI seemsbasically the same as one that uses BIOS MBR booting , even if you have multiple OSes installed(for example, Linux and Windows 10). In either case, with Linux youboot into a GRUB boot menu with entries for Linux kernels and alsoWindows, and you can go on to boot either. However, under the hoodthis is an illusion and there are some important differences, as Ilearned in a recent UEFI adventure

Make no mistake, Let's Encrypt is greatand I love them. I probably wouldn't currently have TLS certificateson my personal websites without them (since the free options havemostly dried up), and we've switched over to them at work , primarily because of theautomation. However, there's something that I worry about from timeto time with Let's Encrypt, and that's how their success may createsomething of a TLS monoculture.

In general it's clear that

A commentator on yesterday's entry broughtup the issue of authorizing internal-only machines, ones that arein DNS but that aren't otherwise reachable from the Internet.Although we haven't actually done this, in general it's possibleto do Let's Encrypt 's authorizationfor a particular machine on an entirely different machine, evenwithout using the DNS-based authorization method. All you need isthat HTTP requests from the Internet go somewhere where you canhandle them in something you control.

Over the years, we 've used awhole collection of different TLS CAs .We've preferred free ones where we could, for good reasons , which meant that we've usedboth ipsCA ( until they exploded ) and StartSSL( aka StartCom ), but we've also paid forTLS certificates when we had to; modern TLS certificates are prettyaffordable even for us if we don't go crazy. And these days we evenhave access to free TLS certificates through the university'scentral IT