Anyone who works with systemd soon comes to realize that systemdjust doesn't like syslog very much. In fact systemd is so unhappywith syslog that it invented its own logging mechanism (in the formof journald). This is not news. What people who don't have to lookdeeply into the situation often don't realize is that systemd'sdislike is sufficiently deep that systemd just doesn't interactvery well with syslog.

I won't say that bugs and glitches 'abound',

A lot has changed in less than a year since I last tried to do acomprehensive inventory of my extensions , soI've decided it's time for an update since things seem to havestabilized for the moment. I'm labeling this as for Firefox 37since that's the just out latest version, but I'm actually runningFirefox Nightly (although for me it's more like 'Firefox Weekly',since I only bother quitting Firefox to switch to the very latestbuild once

Packaging schemes like RPM and Debian debs split full package namesup into three components: the name, the (upstream) version, and the(distribution) release of the package. Back when people startedmaking RPM packages, the release component tended to be just anumber, giving you full names like liferea-1.0.9-1 (this isrelease 1 of Liferea 1.0.9). As I mentioned recently , the modern practice of Fedora releasenumbers has changed to include the distribution version

Let's start with something that I tweeted :

Today's security sadface: joyent's Illumos pkgsrc download page is not available over https, so all those checksums/etc could be MITMd.

Perhaps it is not obvious what's wrong here. Well, let's work backwards.The Joyent pkgsrc bootstrap tar archive is served over plain HTTP, so aman in the middle attacker can serve us a compromised tarball when weuse curl to fetch it. That's obvious, and the page gives

I feel the need to say things about the Ubuntu (and I believe Debian)kernel update process, but before I do that I want to write downhow kernel packages look on Ubuntu and Fedora from a sysadmin'sperspective because I think a number of people have only been exposedto one or the other. The Fedora approach to kernel packages is alsoused by Red Hat Enterprise Linux (and CentOS) and probably otherLinux distributions that use yum and RPMs. I believe that theUbuntu approach is also used by

The thing about adblockers is that they don't really block ads;determining what is and isn't an ad is an AI problem and we'renowhere near solving those. So what adblockers really block is signsand patterns that designate or suggest ads. The primary patternsthat adblockers can use are URLs of resources being requested (suchas images and other additional content) and the surrounding HTMLcontext of these requests (including things like CSS tags).

(Many adblockers will allow you to inspect the patterns that

While adblockers make some people quite happy, there are othersthat consider them immoral; see for example this tweet .Let's set aside the security issues andother counter-arguments to note something important: much as in another case , it's extremelydisingenuous to discuss morality here without mentioning the blatantamorality of advertising on the web itself. To put it simply, thead industry and its supporters are coming to the table with extremelyunclean hands .

By and large, the story of web advertising and ad companies

Back when I first wrote up my IKE configuration for my point topoint GRE tunnel , I restricted the IKE IPSecconfiguration so that it would only apply IPSec to the GRE trafficwith:

conn cksgre   [...]   leftprotoport=gre   rightprotoport=gre   [...]

I only did this restriction out of caution and matching my oldmanual configuration. A while later I decided that it was a littlesilly; although I basically didn't do any unencrypted traffic tothe special GRE touchdown IP address I use

Suppose, hypothetically, that you think your IPSec GRE tunnel may be contributing to some weird connectionproblem you're having . In order to get it outof the picture, you want to shut it down ( which will still leaveyou able to reach things ). Thereare three ways you can do this: you can use ' ipsec whack --terminate 'to ask your local pluto to shut down this specific IKE connection(which you've engineered to stop the GRE tunnel), you can shut your