Adding a new template filter in Django 1.9, and a template tag annoyance
As the result of my discovery about Django's timesince introducingnonbreaking spaces , I wanted to fix this.Fixing this requires coding up a new template filter and then wiringit into Django, which took me a little bit of flailing around. Ispecifically picked Django 1.9 as my target, because 1.9 supportsmaking your new template filters and tags available by default withouta ' {% load ... %} ' statement and this matters to us.
When you are load 'ing new template
We need to deploy anti-spam precautions even if they're a bit imperfect
A few years ago we had a local spam incident .In its wake, we made some configuration changes and started exploring things like ratelimiting outgoing email .Our first step in this was to set our Exim configuration to trackrate limits without enforcing them, so that we could figure outwhat limits to set that would stop spammers without causing problemsfor our users.
At one level, this was a sensible decision. Causing disruptions toour users might create political pressure that would stop us fromtaking any precautions against future spam runs
My current views on using OpenSSH with CA-based host and user authentication
Recent versions of OpenSSH have support for doing host and userauthentication via a local CA . Insteadof directly listing trusted public keys, you configure a CA andthen trust anything signed by the CA. This is explained terselyprimarily in the ssh-keygen manpage andat somewhat more length in articles like How to Harden SSH withIdentities and Certificates ( via , via a comment by Patrick here ). As you might guess , I have some opinions on this.
I'm fine with using CA certs to authenticate hosts to
The fundamental practical problem with the Certificate Authority model
Let's start with my tweet :
This is my sad face when people sing the praises of SSH certificatesand a SSH CA as a replacement for personal SSH keypairs.
There is nothing in specific wrong with the OpenSSH CA model.Instead it simply has the fundamental problem of the basicCA model.
The basic Certificate Authority model is straightforward: you havea CA, it signs things, and you accept that the CA's signature onthose things is by itself an authorization. TLS is the most widelyknown protocol
Clearing SMART disk complaints, with safety provided by ZFS
Recently, my office machine's smartd began complaining about problemson one of my drives ( again ):
Device: /dev/sdc [SAT], 5 Currently unreadable (pending) sectors
Device: /dev/sdc [SAT], 5 Offline uncorrectable sectors
As it happens, I was eventually able to make all of these complaintsgo away (I won't say I fixed the problem, because the disk isundoubtedly still slowly failing). This took a number of steps andsome of them were
Old Unix filesystems and byte order
It all started with a tweet by @JeffSipek :
illumos/solaris UFS don't use a fixed byte order. SPARC producesstructs in BE, x86 writes them out in LE. I was happier before I knewthis.
As they say, welcome to old time Unix filesystems. Solaris UFS isfar from the only filesystem defined this way; in fact, most oldtime Unix filesystems are probably defined in host byte order.
Today this strikes us as crazy, but that's because we now exist
Your SSH keys are a (potential) information leak
One of the things I've decided I want to do to improve my SSHsecurity is to stop offering my keys to basically everything. Rightnow, I have a general keypair that I use on most machines; as aresult of using it so generally, I have it set up as my defaultidentity and I offer it to everything I connect to. There's noparticular reason for this, it's just the most convenient way toconfigure OpenSSH.
Some people will ask what the harm is in
You can have many matching stanzas in your ssh_config
When I started writing my And so Recently, I needed to create a SMF manifest to run a script at boot . In most initsystems, this is simple. SMF is not most init systems.SMF requires services (including scripts run at boot) to be definedin XML manifests. Being XML, they are verbose and picky, butfortunately there are some good general guidelines on what goes inthem; the one I started from is Ben Rockwood's An SMF ManifestCheatsheet .But there are a number of things it didn't say explicitly Our Django application uses Django'stemplating system for more than just generating HTML pages. One ofthe extra things is generating the text of some plaintext emailmessages. This trundled along for years, and then a Django versionor two ago I noticed that some of those plaintext emails had startedshowing up not as plain ASCII but as quoted-printable with someembedded characters that did not cut and paste well. (One reason I noticed is that I sometimes scan through my incomingemail with plain Here' ssh_config , years and years ago, Ibasically assumed that how you used it was that you had a ' Host* ' stanza that set defaults and then for each host you might havea specific ' Host Host * StrictHostKeyChecking no ForwardX11 no Compression onHost github.com IdentityFile /u/cks/.ssh/ids/github
Some notes on SMF manifests (on OmniOS) and what goes in them
Django, the timesince template filter, and non-breaking spaces
less .) Menu