The weakness of doing authentication over a side channel
Yesterday I mentioned our method of authenticating NFS client hosts ; fundamentally it operates by everyso often verifying that the client host knows a secret. Suppose thatwe had a slightly improved version of this, where the NFS fileserverholds an authenticated TCP connection open with the client andperiodically exchanges authenticated and encrypted packets with it; thesimple version of this would just be a SSH connection with SSH levelkeepalives. Is this a reasonably secure system or is it attackable?
(A system without a continuous authentication connection is triviallyattackable;
(Probably) Why Bash imports functions from the environment
In the wake of the Shellshock issues , alot of people started asking why Bash even had a feature to importfunctions from the environment. The obvious answer is to allowsubshell Bashes to inherit functions from parent shells. Now, youcan come up with some clever uses for this feature (eg to pass verycomplex options down from parents to children), but as it happensI have my own views about why this feature probably originally cameto exist.
Let us rewind to a time very long ago, like 1
What I'm worried about with retina displays on Linux
I've been waiting for high-DPI LCD panels to appear for years, so I'mboth happy and excited to see 'retina' displays start to appear ondesktop machines. Recent announcements even put a usable such panelwithin theoretical reach. But this means that I have to start worryingabout one of the problems I may have with them, namely whether or notI'll be able to drive such a high-resolution panel under Linux.
Mac and Windows people don't really have any worries
Hassles with getting our NFS mount authentication working on Linux
Our existing Solaris NFS fileservers have a custom NFS mount authentication method to do relatively strongauthentication of a machine's identity before we allow it to establisha NFS mount from us. For various reasons we've started looking atdoing NFS service from Linux machines and so we need to implementsome version of our NFS mount authentication for them (ideally onethat looks exactly the same from the client side).
Our existing Solaris mechanism uses a NSS netgroup module that does the authentication as part ofchecking netgroup membership. Given
A drawback in how DWiki parses its wikitext
In my initial installment on how DWiki parses its wikitext I said that one important thing DWiki does is that it has two separateparsers:
[...] One parser handles embedded formatting in running text (thingslike fonts, links, and so on) and the other one handles all of theline oriented block level structures like paragraphs, headers,blockquotes, lists, etc. What makes it work is that the block levelparser doesn't parse running text immediately for multi-line thingslike paragraphs; [
A drawback to handling errors via exceptions
Recently I discovered an interesting and long standing bug in DWiki . DWiki is essentially a mature program, so this one was uncoveredthrough the common mechanism of someone using invalid input, in thiscase a specific sort of invalid URL. DWiki creates time-based viewsof this blog through synthetic parts of the URLs thatend in things like, for example, '.../2014/10/' for entries fromOctober 2014. Someone came along and requested a URL that looked
With ZFS, rewriting a file in place might make you run out of space
Here's an interesting little issue that I confirmed recently: ifyou rewrite an existing file in place with random IO on a plain ZFSfilesystem, you can wind up using extra space and even run out ofspace. This is a little bit surprising but is not a bug; it's justfallout from how ZFS works.
It's easy to see how this can happen if you have compression ordeduplication turned on on the filesystem and you rewrite differentdata; the new data might compress or deduplicate less
Quick notes on the Linux iptables 'ipset' extension
For a long time Linux's iptables firewall had an annoying lack in thatit had no way to do efficient matching against a set of IP addresses.If you had a lot of IP addresses to match things against (for exampleif you were firewalling hundreds or thousands of IP addresses and IPaddress ranges off from your SMTP port), you needed one iptables rulefor each entry and then they were all checked sequentially. This didn'tmake your life happy, to put it one way. In modern Linuxes
Unnoticed nonportability in Bourne shell code (and elsewhere)
In response to my entry on how Bashisms in #!/bin/sh scripts aren'tnecessarily bugs , FiL wrote:
If you gonna use bashism in your script why don't you make it clear inthe header specifying #!/bin/bash instead [of] #!/bin/sh? [...]
One of the historical hard problems for Unix portability is peoplewriting non-portable code without realizing it, and Bourne shell code isno exception. This is true for even
My current somewhat tangled feelings on operator.attrgetter
In a comment on my recent entry on sort comparison functions , Peter Donis asked a good question:
Is there a reason you're not using operator.attrgetter for the keyfunctions? It's faster than a lambda.
One answer is that until now I hadn't heard of operator.attrgetter .Now that I have it's something I'll probably consider in the future.
But another answer is embedded in the reason Peter Donis gave forusing it. Using operator.attrgetter is clearly a speed