How a Firefox update just damaged practical security

Recently, Mozilla pushed out Firefox 34 as one of their periodicregular Firefox updates. Unfortunately this shipped with a knownincompatible change that broke several extensions, including the popular Flashblock extension. Mozilla had known about this problem for months beforethe release; in fact the bug report was essentiallyfiled immediately after the change in question landed inthe tree, and the breakage was known when the change was proposed.Mozilla people didn't care enough to do anything in particular aboutthis beyond (I think) blacklisting the extension


How init wound up as Unix's daemon manager

If you think about it, it's at least a little bit odd that PID 1wound up as the de facto daemon manager for Unix. While I believethat the role itself is part of the init system as a whole , this is not the same thing as havingPID 1 do the job and in many ways you'd kind of expect it to bedone in another process. As with many things about Unix, I thinkthat this can be attributed to the historical evolution Unix hasgone through.


There are two parts to making your code work with Python 3

In my not terribly extensive experience so far, in the general caseporting your code to Python 3 is really two steps in one, not a singleprocess. First, you need to revise your code so that it runs on Python 3at all; it uses print() , it imports modules under their new names, andso on. Some amount of this can be automated by 2to3 and similar tools,although not all of it. As I discovered , agreat deal of this is basically synonymous


The bad side of systemd: two recent systemd failures

In the past I've written a number of favorable entries about systemd.In the interests of balance, among other things, I now feel that Ishould rake it over the coals for today's bad experiences that Iran into in the course of trying to do a yum upgrade of one systemfrom Fedora 20 to Fedora 21, which did not go well .

The first and worst failure is that I've consistently had systemd'smaster process (ie, PID 1, the true init


What good kernel messages should be about and be like

Linux is unfortunately a haven of terrible kernel messages and terriblekernel message handling, as I have brought up before . In a spirit of shouting at the sea, today Ifeel like writing down my principles of good kernel messages.

The first and most important rule of kernel messages is that anykernel message that is emitted by default should be aimed at systemadministrators, not kernel developers. There are very few kerneldevelopers and they do not look at very many systems, so it's prettymuch guaranteed that most kernel


How to delay your fileserver replacement project by six months or so

This is not exactly an embarrassing confession, because I think wemade the right decisions for the long term, but it is at least anillustration of how a project can get significantly delayed onelittle bit at a time. The story starts back in early January , where we had basically finalized the broaddetails of our new fileserver environment; we had the hardwarepicked out and we knew we'd run OmniOSon the fileservers and our current iSCSI target software on somedistribution of Linux. But what Linux?

At first


Why I do unit tests from inside my modules, not outside them

In reading about how to do unit testing, one of the divisions I've runinto is between people who believe that you should unit test your codestrictly through its external API boundaries and people who will unittest code 'inside' the module itself, taking advantage of internalfeatures and so on. The usual arguments I've seen for doing unit testsfrom outside the module are that your API working is what people reallycare about and this avoids coupling your tests too closely to yourimplementation, so that you


Why I don't believe in generic TLS terminator programs

In some security circles it's popular to terminate TLS connectionswith standalone generic programs such as stunnel ( cf ).The stated reason for this boils down to 'separation of concerns';since TLS is an encrypted TCP session, we can split TLS terminationfrom actually understanding the data streams that are being transportedover. A weakness in the TLS terminator doesn't compromise the actualapplication and vice versa. I've seen people harsh on protocolsthat entangle the two issues , suchas SMTP with STARTTLS.

I


How we install Ubuntu machines here

We have a standard install system for our Ubuntu machines (which are themajority of machines that we build). I wouldn't call it an automatedinstall system (in the past I've used the term 'scripted'), but itis mostly automated with only a relatively modest amount of humanintervention. The choice of partially automated installs may seem odd topeople, but in our case it meets our needs and is easy to work with.

Our install process runs in three stages. First we have


Browser addons can effectively create a new browser

In many ways, what a browser is is defined by its user interface.These days all browsers display web pages and run JavaScript; whatreally differentiates them is the experience of using them. Thelogical consequence of this is that there are any number of browseraddons that change either the user interface itself or just theexperience of using the browser to such a degree that you can windup with what might as well be a different browser. Your browser isstill based on Chrome or Firefox but it is not Chrome or