Let's start with Aaron Meurer's Moving Away from Python 2 in which I read, in passing:

• Python 2.7 support ends in 2020. That means all updates, includingsecurity updates. For all intents and purposes, Python 2.7 becomesan insecure language to use at that point in time.

There is no nice way to put it: this is security scaremongering .

It is security scaremongering for three good reasons. First, by2020 Python 2.7 is

What you are theoretically supposed to use pexpect for is to have yourprogram automatically interact with interactive programs. When theyproduce certain sorts of output, you recognize it and take action;when you see prompts, you can automatically answer them. Pexpectis often used this way to automate things that expect to be operatedmanually by a real person. This is not what I'm using pexpect for.What I'm using it for is to start a program in what it thinks isan interactive environment, capture its

After my previous exploration of the Spamhaus DBL , I wound up adding it as anotherDNS blocklist in our overall spam filtering setup .Because we don't have a mandate for it, none of our DNS blocklistsapply to all email, only to email for people who have opted in tosome amount of server side spam filtering. Because the DBL applieson a per-recipient basis, the comparison I'm going to use here isagainst the overall recipient count (not the overall message count).I'

Suppose, hypothetically, that you have a structure full of expvarvariables . You would like to exposeall of them in one operation with expvar.Func , using some code thatgoes roughly like this:

var events struct {   Var1, Var2, Var3 expvar.Int}func ReportStats() interface{} {   return events}

Ignoring for the moment how this won't work , let'sask a more fundamental question: is this a safe, race-free operation ?

On first blush it

Suppose, not entirely hypothetically, that you have a bunch of expvar statistics variables inyour program that you're registering yourself inorder to create good names for them in the exposed JSON. Implementednormally, this probably leaves you with a bunch of global variablesfor various things that your program is tracking. Just like anyother jumble of global variables, this is unaesthetic and it wouldbe nice if we could do better.

Well, we can, due to Go's support for unnamed struct types.We can

Sometimes finding out about hardware and software cause you to findout things about yourself too. In my case, discovering and readingup on two-factor authentication tokens that you can use to hold yourSSH keys ( as I more or less want ) led me todiscover the limits of how much I care about my personal security.

To be specific, it turns out that I don't care enough to pay for a2FA token for personal use ( cf ). It's notthat they're

I've been using a filtering HTTP proxy for a very long time now inorder to filter out various sorts of things I didn't want from mybrowsing experience (most prominently cookies). I probably haven'tbeen doing this for quite as long as filtering proxies have beenavailable, but I now suspect that it's actually close, because itturns out that the filtering proxy I use was last updated in 1998 . Increasingly,this long stasis in my filtering proxy is kind of

I say, have said, and will say a lot of negative things about IPv6deployment and usability. I'm on record as believing that largescale IPv6 usage will cause lots of problems in the field, with allsorts of weird failures and broken software (and some software thatis not broken as such but is IPv4 only), and that in practice lotsof people will be very slow to update to IPv6 and there will beplenty of IPv4 only places for, oh, the

It started with some tweets and somedata by Julia Evans . In the data she mentions:

and here are a few hundred lines of strace output. What's going on?it is running bind() all the time, but it's making outgoing HTTPconnections. that makes no sense!!

It turns out that this is valid behavior according to the Unix API,but you probably don't want to do this for a number of reasons.

First off, let's note more specifically what