Lizzie Dixon's Linux Containers in 500 lines of code is exactlywhat it says in the title, namely an example of setting up arelatively complete Linux container in 500 lines of code or so. Thewhole thing is interesting, but for me the really useful bits arethe code examples and careful discussion of things like droppingcapabilities and installing seccomp filters to block system calls.

(I feel I have a broad understanding of how Linux containers workand the general kernel pieces used to set them up

I generally like DKMS , Ireally do. Almost all of the time it provides a friction-free wayfor me to have ZFS on Linux in the faceof both kernel upgrades (including upgrading Fedora distributions)and ZoL updates (which happen reasonably frequently, because Igenerally track the development version). But once in a while things don't go so well, and whenthis happens the error messages that DKMS spits out are not sohelpful at identifying the cause (and how to fix things).

The

Nftables probably first came to myattention in comments on my recent entry about how I don'tunderstand Linux NAT as well as I should ,although I may have heard of it in passing before then. At leastin theory, it's the next generation replacement for iptables, whichis broadly held to have some architectural issues and limitations.In practice, who knows, since nftables has been in progress forsome time now ( per the history section of the Wikipedia page ). My current interestwas sparked by

Sometimes I write blog entries without doing (enough) research, andthis results me in getting to be wrong in public. Yesterday I wroteabout how I thought SSH had to protect public key authenticationagainst some forms of attacks that are closely related to man in themiddle attacks ; in comments, David Young noted:

The "challenge" [to prove the client has its keys] is built bythe client, not supplied from the server, and part of it is a hashof a string that includes the server

Several years ago, I wrote an entry on the (apparent) resistance ofSSH public key authentication to man in the middle attacks .In this entry I concluded:

[...] I believe that if you use public key authentication you'reprobably immune to man in the middle attacks.

I think I was too cautious here, because I've recently come torealize that for public key authentication the SSH protocol musthave a very closely related property that I'm going to call 'connectionlaundering resistance

The other day my DSL connection went down (as it has before).However, this time around I have a smartphone so I was able to putinto action my plan for a backup Internet connection , namely tethering my home machine through my phone .The basic mechanics were as straightforward as the various commentatorssaid they'd be; I plugged my phone into a USB cable to my computer,turned on the phone's personal hotspot feature, and my machine magicallyhad a new Ethernet device I could talk to

A few years ago, I wrote about a problem with how Debian buildsfrom source packages , namely thatit builds your binary packages in the source package working areaand this can lead to contamination of your source package workingarea. Fast-forward to today:

@thatcks :Current status: really hating the Debian approach to building packagesbecause it commingling source & build areas has blown up in my face.

@thatcks :I think I'm going to have to extract my change, nuke the entirepackage area,

On my desktop machines, I run a fully custom window manager environmentwhere I had almost no problems integrating my Yubikey into my regularenvironment; most of what it took was some mild hacks to my specialscreensaver stuff . However, I also havean office laptop that uses a Cinnamon-based environment and I wanted to be able to use theYubikey there. That turned out to be rather more difficult, becauseCinnamon normally handles SSH agent stuff through gnome-keyring-daemon .

The problem with using g-k-

Back a number of years ago I noted that our commercial anti-spamfilter was counting some varieties of phish spam as 'viruses' , and I wrote some thoughts on why this might makesense. I now think that I was partly wrong about some of why thefilter was acting this way. What's happened since then is that wenow log some information about the structure of incoming messagesas part of logging MIME attachment type information , which has given me theopportunity to see more information about the structure of