A hack: outsourcing web browser/client checking to another web server
A while back on the Fediverse, I shared a semi-cursed cleveridea :
Today I realized that given the world's simplest OIDCIdP (one user, no password, no prompting, the IdP just'logs you in' if your browser hits the login URL), youcould put @cadey 's Anubis in front of anything you can protectwith OIDC authentication, including anything at all on an Apacheserver (via mod_auth_openidc). No need to put Anubis 'in front'
Unix mail programs have had two approaches to handling your mail
Historically, Unix mail programs (what we call 'mail clients' or'mail user agents' today) have had two different approaches tohandling your email, what I'll call the shared approach and the exclusive approach, with the shared approach being the dominantone. To explain the shared approach, I have to back up to talk aboutwhat Unix mail transfer agents (MTAs) traditionally did. When aUnix MTA delivered email to you, at first it delivered email intoa single file in a specific location
Maybe I should add new access control rules at the front of rule lists
Not infrequently I wind up maintaining slowly growing lists offiltering rules to either allow good things or weed out bad things.Not infrequently, traffic can potentially match more than onefiltering rule, either because it has multiple bad (or good)characteristics or because some of the match rules overlap. My usualhabit has been to add new rules to the end of my rule lists (or therelevant section of them), so the oldest rules are at the top andthe newest ones are at the bottom.
After writing
Our Django model class fields should include private, internal names
Let me tell you about a database design mistake I made in ourDjango web application for handling requests for Unix accounts . Our current account request app evolvedfrom a series of earlier systems , and one of the thingsthat these earlier systems asked people for was their 'status' withthe university; were they visitors, graduate students, undergraduatestudents, (new) staff, or so on. When I created the current systemI copied this and so the database schema includes a 'Status' modelclass. The only
These days, systemd can be a cause of restrictions on daemons
One of the traditional rites of passage for Linux system administratorsis having a daemon not work in the normal system configuration (eg,when you boot the system) but work when you manually run it as root.The classical cause of this on Unix was that $PATH wasn't fully setin the environment the daemon was running in but was in your rootshell. On Linux, another traditional cause of this sort of thinghas been SELinux and a more modern source (onUbuntu) has sometimes been AppArmor.
Some stuff on how Linux consoles interact with the mouse
On at least x86 PCs, Linux text consoles ('TTY' consoles or 'virtual consoles') support some surprisingthings. One of them is doing some useful stuff with your mouse, ifyou run an additional daemon such as gpm or themore modern consolation . This issupported on both framebuffer consoles and old 'VGA' text consoles. The experience is fairly straightforward;you install and activate one of the daemons, and afterward you canwave your mouse around, select and paste text, and so
Free and open source software is incompatible with (security) guarantees
If you've been following the tech news, one of the recent thingsthat's happened is that there has been another incident where abunch of popular and widely used packages on a popular packagerepository for a popular language were compromised, this time witha self-replicating worm .This is very inconvenient to some people, especially to companiesin Europe, for some reason , and so somepeople have been making the usual noises .On the Fediverse, I had a hot take :
Hot take: free and
My Fedora machines need a cleanup of their /usr/sbin for Fedora 42
One of the things that Fedora is trying to do in Fedora 42 is unifying /usr/bin and /usr/sbin . In anideal (Fedora) world, your Fedora machines will have /usr/sbin bea symbolic link to /usr/bin after they're upgraded to Fedora 42.However, if your Fedora machines have been around for a while, orperhaps have some third party packages installed, what you'llactually wind up with is a /usr/sbin that is
Access control rules need some form of usage counters
Today, for reasons outside the scope of this entry, I decided tospend some time maintaining and pruning the access control rulesfor Wandering Thoughts , this blog. Due to the ongoingcrawler plague (and past abuses), Wandering Thoughts has hadto build up quite a collection of access control rules, which aremostly implemented as a bunch of things in an Apache .htaccess file(partly 'Deny from ...' for IP address ranges and partly as rewriterules based on other characteristics). The experience has
The idea of /usr/sbin has failed in practice
One of the changes in Fedora Linux 42 is unifying /usr/bin and/usr/sbin ,by moving everything in /usr/sbin to /usr/bin. To some people, thisprobably smacks of anathema, and to be honest, my first reactionwas to bristle at the idea. However, the more I thought about it,the more I had to concede that the idea of /usr/sbin has failed inpractice.
We can tell /usr/sbin has failed in practice by