One of the additional security measures you can take for a HTTPSweb site is HTTP Public Key Pinning . HPKP isdesigned to guard against the fundamental SSL CA problem by limiting what validly signed keys can be usedfor your website. This way it doesn't matter if an attacker getsone of the zillion different CAs out there to issue a certificatefor your website; hopefully a lot of browsers won't accept it anywaysbecause you've told them better. A number of people like the ideaof HPKP and

SPF is one of my hot button issues, or rather how all too often influential people seem to think that SPF is a good idea .A lot of the time these people seem to think that a hard-fail SPFpolicy is a security feature, something that will prevent forgeryof email as being from their company or organization. These peopleare wrong, at least in any practical sense.

The problem with SPF as a security feature is that it protects thewrong thing. To the extent that it does anything,

Yesterday I wrote on how to shoot yourself in the foot by makinga mistake in /etc/network/interfaces .I kept digging into this today, and so now I can tell you why thishappens and what you can do about it. The simple answer is that itcomes from /etc/init/failsafe.conf .

What failsafe.conf is trying to do is kind of hard to explainwithout a background in Upstart (Ubuntu's 'traditional' init system).A real System V init

Today I had one of those self inflicted learning experiences thatI get myself into from time to time. I will start with the summaryand then tell you the story of how I did this to myself.

The summary is that errors in /etc/network/interfaces can causeyour system to stall silently during boot for a potentially significantamount of time .

One sort of error is a syntax error or omitting a line. Anothersort of error is accidentally duplicating an IP address between aninterface's primary address and

In my recent entry on argparse I mentionedthat it didn't have really top notch handling of conflicting options;instead it only has relatively basic support for this. You mightreasonably wonder what it's missing, and thus what top notch argumentconflict handling is.

My programs tend to wind up with three sorts of options (command lineswitches):

• general switches that affect almost everything
• mode-selection switches that pick a major mode of operation
• mode-modifying switches that change how one or more particular majormodes work

Perhaps you have seen this somewhat odd Unix error before:

# cp prog /usr/local/bin/progcp: cannot create regular file 'prog': Text file is busy

This is not just an unusual error message, it's also a rare instanceof Unix being friendly and not letting you blow your foot off witha perfectly valid operation that just happens to be (highly) unwise.To understand it, let's first work out what exact operation isfailing. I'll do this

I recently decided to add accessible statistics to my sinkholeSMTP server by using theexpvar package . In the process ofexperimenting with this, I've wound up with a collection of notesthat I want to write down while I remember them.

First up is my discovery about expvar.Var ,namely that it wants you to return properly quoted JSON instead ofjust a string. You can read the entry for more details.

The expvar package exposes a lot of 'New' functions togive you new