SSL has a number of old, dark corners. One of them is 'SSL2handshake compatibility' ,where clients that want to be able to talk to a SSLv2 server muststart their conversation out with a (special) SSLv2 ClientHello.Of course this means that a SSL v3 or TLS server that wants to beable to talk to such clients needs to accept the SSLv2 ClientHelloand then upgrade the connection to SSLv3 or TLS afterwards, in acoordinated dance with the client. Now,

There has recently been a bit of commotion about whether or not todeprecate ' SHA1 certificates'for TLS, or at least how fast to do so. If you know something aboutTLS in general, this may sound a bit peculiar, because TLS certificatesare based on public key cryptography (and public key signatures,where the CA signs your certificateand public key to say that they approve of it). SHA1 is not a publickey system (that would be eg RSA), it is a well

Good package management systems allow you to selectively pin orfreeze the versions of some packages. Over time I have evolved someopinions on how this should work, usually by getting irritated bythe limitations of some tool in doing this (which is what happenedtoday). So here is the minimum things that your package managementtool should support around this.

First, you should be able to pin a package at a version that is notthe currently installed version. Such a pin means that the packagesystem is allowed to upgrade

We run a shared web server where ourusers can run CGIs and so on in response to incoming HTTP requests.This presents several obvious potential problems, and recently weran into one of them. A user had a quite slow CGI (although not aCPU-consuming one) and, as sometimes happens when your users arecomputer scientists sharing their hot research results, it gotlinked to from a popular place and a result the requests for itjust poured in. In not very much time at all, the slow

These days, there are three different places where (anti-)spamfiltering can happen in an email system:

1. In the user's mail client, assuming that you let them run one thathas filtering rules (and most of them do). It's worth noting thatthere is effectively no client side filtering in webmail systems.

2. On the server once the email has been accepted at the SMTP level.This is the domain of people running procmail from their .forward s,as well as various sorts of

Yesterday I mentioned the XSettingsstandard forexposing (some) toolkit related configuration options to theoreticallyinterested parties in a theoretically toolkit-independent way. Thereare some slightly non-obvious or not entirely documented things aboutthis and daemon support for it.

First, as hinted by the 'X' in the name, this is is not a DBus-basedsystem. Instead it uses the old-fashioned approach of setting an Xproperty on the root window and having programs read this property.Because this is an X property

The following is not my story; it comes from my co-workers, who hadthe real fun of trying to figure this one out and then finding afix.

To start with, let's set the background. We have an (OpenBSD) routingfirewall machine that sits on a network segment whose egress routeris not under our control. Actually, we have two of them, one activeand one as a warm spare (it's on and being updated, but it is notconnected to any

When I upgraded my office machine from Fedora 22 to Fedora 23, onething I noticed immediately is that some of the fonts in a numberof my applications had changed. After I looked at things for awhile, it was clear that the font used for UI elements in GTK basedapplications had shrunk between Fedora 22 and Fedora 23. This fontis used, for example, for Firefox's URL bar and in much of Liferea 's interface, although in both cases theactual content (

When I gave in to temptation and started using ZFS on Linux , one of my big concerns was whether itwould cause problems when I upgraded from one Fedora version toanother. In my initial report on my experiences I wasn't able to say anything here because I hadn't done a versionupgrade yet. Well, now I have; in fact, I've gone through three ofthem now (to Fedora 21, 22, and now 23). So I can say that for