A few months ago I wrote an entry about my views on Shellcheck where I said that I found it too noisyto be interesting or useful to me. Well, you know what, I have totake that back. What happened is that as I've been writing variousshell scripts since then, I've increasingly found myself reachingfor Shellcheck as a quick syntax andcode check that I could use without trying to run my script.Shellcheck is a great tool for this, and as a bonus it can

Various local events recently made me think a bit about the futureof Python at work. We're in a situation where a number of ourexisting tools will likely get drastically revised or entirelythrown away and replaced, and that raises local issues with Python3 as well as questions of whether I shouldargue for changing our list of standard languages . I have some technical viewson the answer, but thinking through this has made me realize somethingon a more personal level. Namely, I still like Python and it'

I tweeted :

My lesson learned from the Infineon HSM issue is to never trust a HSMto generate keys, just to store them. Generate keys on a real machine.

In my usual manner, this is perhaps overstated for Twitter. So let'selaborate on it a bit, starting with the background.

When I first heard about the Infineon TPM key generation issue (see also the technical blog article ), I wasn't veryconcerned, since we don't have sophisticated crypto smartcards orelectronic ID cards

I tweeted :

I have just been through an extensive yak-shaving exercise to usessh-agent with Cinnamon and have it actually work reliably on Fedora26.

The first question you might ask is why even use ssh-agent insteadof the default of gnome-keyring-daemon. That's straightforward ;gnome-keyring-daemon still doesn't support ed25519 keys , despite a very long standing open bugabout it (and another bug for ECDSA keys ). I'm

When I was looking at the write volume figures for yesterday'sentry , one additional thing thatjumped out at me is that on our central mail server, reads werevery unbalanced between its two system SSDs. This machine, as withmany of our important servers, has a pair of SSDs set up as mirrorswith Linux software RAID. In theory I'd expect reads to be aboutevenly distributed across each side of the mirror; in practice,well:

242 Total_LBAs_Read [.

Once upon a time, hard drives and SSDs just had time-based warranties.These days, many SSDs have warranties that are more like cars;they're good for so much time or so many terabytes written, whichevercomes first, and different SSD makers and models can have decidedlydifferent maximum figures for this. So, as part of investigatingwhat SSDs to get for future usage here, we've been looking intowhat sort of write volume we see on both our ZFS fileservers (well, on the

PCI Express sort ofcrept up on me while I wasn't looking. One day everything was PCIand AGP, then there was some PCI-X in our servers, and then my then-new home machine had PCIe instead but I didn't reallyhave anything to put in those slots so I didn't pay attention.With a new home machine in my future, I've been working to finallyunderstand all of this better. Based on my current understanding,there are two sides here.

These days, my reaction to hearing about new systemd features isusually somewhere between indifference and irritation (I'm goingto avoid giving examples, for various reasons). The new IP accesslists feature is a rare exception; as a sysadmin, I'm actually reasonablyenthused about it. What makes systemd's version of IP accessrestrictions special and interesting is that they can be be imposed per service , not just globally (and socket units having differentIP access restrictions than the service implementing them adds extrapossibilities

Modern desktop motherboards feature 'M.2' sockets (or slots) forstorage in addition to some number of traditional SATA ports (and not always as many of them as I'd like ).This has been confusing me lately as Iplan a future PC out, so today I sat down and did some reading tounderstand the situation both in theory and in practice.

M.2 is more or less a connector(and mounting) standard. Like USB-C ports with their alternate mode , M