Presented in the traditional illustrated form, more or less:

; dig ns megabulkmessage218.com @a.gtld-servers.net.[...]megabulkmessage218.com. IN NS ns1.megabulkmessage218.com.megabulkmessage218.com. IN NS ns2.megabulkmessage218.com.[...]ns1.megabulkmessage218.com. IN A 5.8.32.218ns

In response to my entry on our Unbound caching problem with localzones , Jean Paul Galea left a commentwith the good suggestion of running two copies of Unbound withdifferent caching policies. One instance, with normal caching, wouldbe used to resolve everything but our local zones; the secondinstance, with no caching, would simply forward queries to eitherthe authoritative server for our local zones or the general resolverinstance, depending on what the query was for.

(Everything would be running on a single host, so the

Many protocols involve some sort of namespace for resources. Forexample, in DNS this is names to be resolved and in HTTP, this isURLs (and distinct hosts). One of the questions you can ask aboutsuch protocols is this:

When a request enters a particular part of the namespace, canhandling it ever require the server to go back outside thatpart of the namespace?

If the answer is 'no, handling the request can never escape', let'ssay that the protocol can be segmented

Like many people, we have internal resolving DNS servers thateveryone's laptops and so on are supposed to use for their DNS.These used to run Bind and now run Unbound, mostly because OpenBSDswitched which nameservers they like. Also like many people, wehave a collection of internal zones and internal zone views, whichare managed from a private internal master DNS server. This has ledto a problem with our Unbound setup that we actually don't know howto solve.

When we make an update to

Sudo has a well known, even famous default behavior; if you try touse sudo and you don't have sudo privileges, it sends an emailalert off to the sysadmins ( sometimes these are useful ). In my view, this is the signof a fundamental assumption in sudo's security model, namely thatit's only going to be used by authorized people or by maliciousparties. If you're not a sysadmin or an operator or so on, you knowthat you have no business

Every so often I learn something by having something brought to myawareness. Today's version is that one surprising side effect ofoptimization in C compilers can be to make your program compile.The story starts with John Regehr 'stweets:

@johnregehr :tonight I am annoyed by: a program that both gcc and clang compileat -O2 and neither compiles at -O0

@johnregehr :easier to arrange than you might think

void bar(void);
static int x;
int main(void)

Recently, our monitoring system alerted us that our central webserver wasn't responding. This has happened before and so I was able to immediately use our mod_status URL to seethat yep, all of the workers were busy. This time around it wasn'tfrom a popular but slow CGI or a single IP address;instead, a bunch of people were downloading PDFs of slides for acourse here. Slowly, apparently (although the PDFs aren't all thatbig).

This time around I

Last time around I talked about the options you have for how tolog attachment information in an Exim environment . Out of our possible choices, weopted to do attachment logging using an external program that's runthrough Exim's MIME ACL, and to report the result to syslog in theprogram. All of this is essentially the least-effort choice. Eximparses MIME for us, and having the program do the logging meansthat it gets to make the decisions about just what to log.

However, the

I mentioned in passing here that peopleare working on Python equivalents of Go's gofmt and since thenI've played around a bit with yapf ,which was the most well developed one that I could find. Playingaround with yapf (and thinking more about how to deal with myPython autoindent problem ) brought homea realization, which is that Python fundamentally can't have a full,true equivalent of gofmt .

In Go, you can be totally sloppy in your pre- gofmt code; basicallyanything goes