In a comment on my entry on generating self-signed TLS certificatestoday , James suggested:

My go-to tool is OpenVPN's EasyRSA. Admittedly that creates a CA whichyou can then sign certificates with, but for your internal hosts itwould mean you could install said CA into your browser and then trustthem all.

Superficially, this is certainly an appealing idea. If you have afleet of IPMIs or other internal websites that need TLS certificatesand that have names where you can't get public certificates

Any TLS-like system of public key cryptography plus CertificateAuthorities that vouch for your identity needs a format forcertificates. When Netscape came up with the very first version ofSSL, they opted not to invent a certificate format to go with theirnew encryption protocol; instead they reused the certificate formatthat had already been proposed for email in 1993 in RFC 1422 (as part of PEM ). Thisfoundational work didn't define its own certificate format either;instead it opted to politely

In the spirit of the single email message with a lot of malware , I'll once again show you the log messagesfirst:

1cwivp-0006vh-1M attachment application/zip; MIME file ext: .zip; zip exts: .jar; inner zip exts: .ai .b .box .class[35] .download .drive .mf .phrejected 1cwivp-0006vh-1M from 74.208.1

Someone recently brought a problem to the Exim mailing list where,as we originally understood it, they wanted to reject messages atSMTP time if they had a certain sender, went to certain recipients,and had a specific message in their Subject: . This is actually alittle bit difficult to do straightforwardly in Exim because of therecipients condition.

In order to check the Subject: header, your ACL condition mustrun in the DATA phase (which is the earliest that the messageheaders are available). If you don

The big Unix graphics news of the past week is that Ubuntu threwin the towel on their Unity GUI and with it their Mir display server (see the Ars story for more analysis). I say 'Unix' instead of 'Linux' here because Ithink this is going to have consequences well beyond Linux.

While there was a three-way fight for the future between Wayland , Ubuntu's Mir , and the default ofX, it was reasonably likely that support for X was going to remainactive in

As I sort of mentioned in yesterday's entry , I have historically written SMTPtime rejection messages and other things with an eye towards denyingspammers information about exactly why their attempts were rejected.This certainly looks like a perfectly rational decision; if we leak(detailed) information about rejection reasons, we give spammers ahead start on working out what about their attempts needs to changein order to get their spam through. And indeed you can find plentyof large sites, like GMail and Yahoo, that absolutely refuse to

Our external mail gateway will reject (some) incoming messages duringthe SMTP conversation if our anti-spam system thinks they have too high a spam score. Until today, they were rejectedwith a deliberately bland and uninformative SMTP error message:

550 Rejected: this message looks too much like spam

When I designed this message, I wrote a comment about it saying'rejections for spam deliberately give the sender an uninformativemessage because I don't feel like giving spammers clues'. Thentoday we got called in

In the beginning, all chown(1) did was change the owner of a file;if you wanted to change a file's group too, you had to use chgrp(1) as well. This is actually more unusual than I realized before I startedto write this entry, because even in V7 Unix the chown(2) system callitself could change both user and group, per the V7 chown(2) manpage .Restricting chown(1) to only changing the owner did make

A while back I wrote an entry about how modules should never raisecore Python exceptions . Recently via myReferer logs I found out that some people aren't convinced bymy entry ,so I feel like taking another run at this topic, this time approachingit from the perspective of someone using your module.

If I'm invoking some function or method from your module and wantto trap errors, I need to write code like this:

import yourmod

def fred():  try:    res = yourmod.some