Years ago I described an odd Linux behavior which attached thewrong source IP to ARP replies and said thatI had a justification for why this wasn't quite as crazy as itsounds. The setup is that we have a dual-homed machine on twonetworks, call them net-3 and net-5. If another machine on net-3tries to talk to the dual-homed machine's net-5 IP address, itwould send out an ARP request on net-3 of the form

I generally like Fedora, but there are things that they don't seemto do well. Unfortunately one of them is prompt security updates,especially for nominally supported but not current versions (suchas Fedora 22 right now).

At the best of times I can generally expect a multi-day delay forsecurity updates. Consider OpenSSL CVE-2016-0701 . This was warnedabout in advance and announced on Thursday. Most distributions hadimmediate updates out that day (Ubuntu,

Once you are following the initial good practices for handlingSSH keys , you have a big decision to make:will you access all of your encrypted keys via ssh-agent, or willat least some of them be handled only by ssh? I don't think thatthis is a slam dunk decision, so I want to write down both sidesof this (and then give my views at the end).

The first and biggest thing that might keep you from using ssh-agentfor everything is if you

It all started with Ryan Zezeski's question on Twitter :

Twitter friends: I want to better manage my SSH keys. E.g. differentpairs for different things. Looking for good resources. Links please.

I have opinions on this (of course) but it turns out that I've neveractually written them all down for various reasons, including thatsome of them feel obvious to me by now. So this is my shot at writingup what I see as good practices for OpenSSH keypairs. This

I've already written an entry on what SSH keys in your .ssh/configwill be offered to servers , but it wasn't quitecomplete and I still managed to confuse myself about this recently. Sotoday I'm going to try to write down in one place more or lesseverything I know about this.

Assuming that you're using ssh-agent and you don't have IdentitiesOnly set anywhere, the following is what keyswill be offered to the remote server:

1. All keys from ssh

One of the things that basically all web frameworks do is URLrouting, where they let you specify how various different URLpatterns are handled by various different functions, classes, orwhatever. Once you have URL routing, you inevitably wind up wantingreverse URL routing: given a handler function or some abstract namefor it (and perhaps some parameters), the framework will generatethe actual URL that refers to it. This avoids forcing you to hard-codeURLs into both code (for eg HTTP redirections) and templates

In this recent entry I mentionedthat my home backup strategy is an awkward subject. Today I wantto talk about why that is so, which has two or perhaps three sides;the annoyances of hardware, that disks are slow, and that softwaredoesn't just do what I want , partlybecause I want contradictory things.

In theory, the way to good backups is straightforward. You buy anexternal disk drive enclosure and a disk for it, connect it to yourmachine periodically, and 'do a backup

Let's start with my tweet from yesterday :

So the recently released Fedora 22 libreswan update appears to have broken IPSec tunnels for me. Goodgoing. Debugging this will be hell.

This was quite consistent: if I installed the latest Fedora 22update to libreswan, my IPSec based point to point tunnel stopped working. More specifically,my home end (running Fedora 22) could not do an IKE negotiationwith my office machine. If I reverted back to the older libreswanversion, everything worked.

Years ago I wrote a grumpy entry about Django 1.4's restructureddirectory layout and mentionedthat I was not reorganizing our Django web app to match. In the time since then, it has become completely obviousthat grimly sticking to my guns here is not a viable answer overthe long term; sooner or later, ideally sooner, I need to restructurethe app into what is now the proper Django directory layout.

One of the reasons that I objected to this (and still do)is the problem of