We're never going to be able to have everyone use two factor authentication

Every so often I think about two-factor authentication here or talk to people about it. Inthe process of doing this, I've come around to an importantrealization:

We're never going to be able to have all our users use two factorauthentication .

The largest fundamental issue is cost. If we require universal twofactor authentication, the department needs to provide 2FA tokensto everyone (and then manage them, of course). Current typicalprices are $50 US one time costs plus


The difference between 'Delete' and 'Destroy' in X window managers

If you use a certain sort of window manager (generally an old schoolone), you may have discovered that there are two operations thewindow manager supports to tell X applications to close themselves.Names for these operations vary, but I will go with 'Delete' and'Destroy' for them because this is fvwm 'sterminology. Perhaps you've wondered why there are two ways to dothis, or what the difference is. As you might guess, the answersare closely tied to each other.


You can't use expvar.Func to expose a bunch of expvar types

Suppose, hypothetically, that you have a collection of statisticsthat are each one of the expvar package 's types. You want to put them ina namespace (so they are all ' mything.var1 ', ' mything.var2 ' andso on), but you'd like to avoid the tedious clutter of registering each expvar variable by hand with .Set() . So youhave a clever idea.

First, you will embed all of the variables in a structure:

var somestats struct

An Apache trick: using directories to create redirections

Suppose, not entirely hypothetically, that you're using ApacheProxyPass directives as a reverse proxy to map /someurl/ on yourwebsite to another web server. You generally have to redirect theURL with the trailing slash , but of course youwould like a request for a plain ' /someurl ' to also work rightinstead of just getting a 404 status response. Here, 'work right'means that you'll generate a redirection from ' /someurl ' to' /someurl/ '.

It


Issues in fair share scheduling of RAM via resident set sizes

Yesterday I talked about how fair share allocation of things needsa dynamic situation and how memorywas not necessarily all that dynamic and flow-based. One possibleapproach to fair share allocation of memory is to do it on ResidentSet Size . If you look at things from theright angle, RSS is sort of a flow in that the kernel and userprograms already push it back and forth dynamically.

(Let's ignore all of the complications introduced on modernsystems by memory sharing .)

While there has been some


'Fair share' scheduling pretty much requires a dynamic situation

When I was writing about fair share scheduling with systemd the other day, I rambledin passing about how I wished Linux had fair share memory allocation.Considering what fair share memory allocation would involve set offa cascade of actual thought, and so today I have what is probably anobvious observation.

In general what we mean by 'fair share' scheduling or allocationis something where your share of a resource is not staticallyassigned but is instead dynamically determined based on how muchother people also want. Rather than saying that


A weird little Firefox glitch with cut and paste

Yesterday I wrote about Chrome's cut and paste , so to be fair today is about my longstanding little irritation with Firefox's cut and paste. Firefoxdoesn't have Chrome's problem; I can cut and paste from xterm toit without issues. It's going the other way that there's a littleissue under what I've now determined are some odd and very limitedcircumstances.

The simplest way to discuss this is to show you the minimal HTMLto reproduce this issue.


The better way to clear SMART disk complaints, with safety provided by ZFS

A couple of months ago I wrote about clearing SMART complaintsabout one of my disks by very carefullyoverwriting sectors on it, and how ZFS made this kind of safe. Ina comment, Leah Neukirchen recommended using hdparm --write-sector to overwrite sectors withread errors instead of the complicated dance with dd that I usedin my entry . As it happens, that diskcoughed up a hairball of smartd complaints today, so I got achance to go through my procedures again and the advice is spot on.


My annoyance with Chrome's cut and paste support under X

In the past I've vaguely alluded to having problems getting xterm and Chrome to play nicely together for selecting text in xterm andpasting it into Chrome (eg here ).At the time I couldn't clearly reproduce my problems, so I wrote itoff as due to fallible memory. Well, my memory may be fallible but Ialso wasn't wrong about Chrome not playing nice with xterm 's normalselections. It definitely happens and it's one of the real irritationswith using Chrome for me


How I think you set up fair share scheduling under systemd

When I started writing this entry, I was going to say that systemdautomatically does fair share scheduling between and describe themechanisms that make that work. However, this turns out to be falseas far as I can see; systemd can easily do fair share scheduling,but it doesn't do this by default.

The basic mechanics of fair share scheduling are straightforward.If you put all of each user's processes into a separate cgroup ithappens automatically . Well. Sort of. You see,it'