Practical security and automatic updates

One of the most important contributors to practical, real world securityis automatically applied updates. This is because most people will nottake action to apply security fixes; in fact most people will probablynot do so even if asked directly and just required to click 'yes, goahead'. The more work people have to go through to apply security fixes,the fewer people will do so. Ergo you maximize security fixes whenpeople are required to take no action at all.

(Please note that sysadmins and developers are


Things that can happen when (and as) your ZFS pool fills up

There's a shortage of authoritative information on what actually happensif you fill up a ZFS pool, so here is what I've both gathered about itfrom other people's information and experienced.

The most often cited problem is bad performance, with the usualcause being ZFS needing to do an increasing amount of searchingthrough ZFS metaslab space maps to find freespace. If not all of these are in memory, a write may require pullingsome or all of them into memory, searching through them, and


The difference in available pool space between zfs list and zpool list

For a while I've noticed that ' zpool list ' would report that our poolshad more available space than ' zfs list ' did and I've vaguely wonderedabout why. We recently had a very serious issue due to a pool fillingup, so suddenly I became very interested in the whole issue and didsome digging. It turns out that there are two sources of the differencedepending on how your vdevs are set up.

For raidz vdevs, the simple version is that ' zpool list ' reports more


In Go I've given up and I'm now using standard packages

In my Go programming, I've come around to an attitude that I'llsummarize as 'there's no point in fighting city hall'. What this meansis that I'm now consciously using standard packages that I don'tparticularly like just because they are the standard packages.

I'm on record as disliking the standard flag package, for example, and while I still believe in my reasonsfor this I've decided that it'ssimply not worth going out of my way


The clarity drawback of allowing comparison functions for sorting

I've written before about my unhappinessthat Python 3 dropped support for using a comparison function. Well,let me take that back a bit, because I've come around to the ideathat there are some real drawbacks to supporting a comparisonfunction here. Not drawbacks in performance (which are comparativelyunimportant here) but drawbacks in code clarity.

DWiki 's code is sufficiently old that it uses only .sort() cmp functions simply because, well, that's what I had (or at least


Exim's (log) identifiers are basically unique on a given machine

Exim gives each incoming email message an identifier; these looklike '1XgWdJ-00020d-7g'. Among other things, this identifier isused for all log messages about the particular email message. SinceExim normally splits information about each message across multiplelines, you routinely need to reassemble or at least match multiplelines for a single message. As a result of this need to aggregatemultiple lines, I've quietly wondered for a long time just howunique these log identifiers were


Revisiting Python's string concatenation optimization

Back in Python 2.4, CPython introduced an optimization for stringconcatenation that was designed to reduce memory churn in thisoperation and I got curious enough about this to examine it insome detail . Python 2.4 is a long timeago and I recently was prompted towonder what had changed since then, if anything, in both Python 2and Python 3.

To quickly summarize my earlier entry ,CPython only optimizes string concatenations by attempting to growthe left side in place instead of making a new string and copying


Some numbers on our inbound and outbound TLS usage in SMTP

As a result of POODLE ,it's suddenly rather interesting to find out the volume of SSLv3usage that you're seeing. Fortunately for us, Exim directly logsthe SSL/TLS protocol version in a relatively easy to search forformat; it's recorded as the ' X=... ' parameter for both inboundand outbound email. So here's some statistics, first from our externalMX gateway for inbound messages and then from our other servers forexternal deliveries.

Over the past 9


Vegeta, a tool for web server stress testing

Standard stress testing tools like siege (or the venerable ab , whichyou shouldn't use ) are all systems that do Nconcurrent requests at once and see how your website stands up tothis. This model is a fine one for putting a consistent load onyour website for a stress test, but it's not actually representativeof how the real world acts. In the real world you generally don'thave, say, 50 clients all trying to repeatedly make and re-make onerequest to


During your crisis, remember to look for anomalies

This is a war story.

Today I had one of those valuable learning experiences for a systemadministrator. What happened is that one of our old fileservers locked up mysteriously, so we powercycled it. Then it locked up again. And again (and an attempt toget a crash dump failed). We thought it might be hardware related,so we transplanted the system disks into an entirely new chassis(with more memory, because there was some indications that it mightbe running out of memory somehow). It