My views on the choice of name for SMTP senders to use in TLS SNI

TLS SNI (Server Name Indication) is somethingthat a significant minority of sending mail servers use when they do TLS with SMTP. One of thereasons that it's not used more generally is apparently that there'sconfusion about what TLS SNI name to use .Based on our logs, in practiceessentially everyone using TLS SNI uses the MX target name as theSNI name; if something is MX'd to 'inbound.example.org', then sendingmailers with send the SNI name 'inbound.


Revisiting ZFS's ZIL, separate log devices, and writes

Many years ago I wrote a couple of entries about ZFS's ZILoptimizations for writes and then an update forseparate log devices . In completely unsurprisingnews, OpenZFS's behavior has changed since then and gotten simpler.The basic background for this entry is the flow of activity inthe ZIL (ZFS Intent Log) .

When you write data to a ZFS filesystem, your write will be classifiedas 'indirect', 'copied', or 'needcopy'. A 'copied' write is immediatelyput into


Will (more) powerful discrete GPUs become required in practice in PCs?

One of the slow discussions I'm involved in over on the Fediversestarted with someone wondering what modern GPU to get to run Linuxon Wayland (the current answer is said to be an Intel Arc B580, ifyou have a modern distribution version). I'm a bit interested inthis question but not very much, because I've traditionally consideredbig discrete GPU cards to be vast overkill for my needs. I use anold, text-focused type of X environment and I don


What would a multi-user web server look like? (A thought experiment)

Every so often my thoughts turn to absurd ideas. Today's absurdidea is sparked by my silly systemd wish for moving processesbetween systemd units , whichin turn was sparked by a local issue with Apache CGIs (and suexec).This got me thinking about what a modern 'multi-user' web serverwould look like, where by multi-user I mean a web server that'sintended to serve content operated by many different people (suchas many different people's CGIs). Today you


Some thoughts on GNOME's systemd dependencies and non-Linux Unixes

One of the pieces of news of the time interval is (GNOME is)Introducing stronger dependencies on systemd ( via ).Back in the old days, GNOME was a reasonably cross-platform Unixdesktop environment, one that you could run on, for example, FreeBSD.I believe that's been less and less true over time already (although the FreeBSD handbook has no disclaimers ), but GNOMEadding more relatively hard dependencies on systemd really puts astake in it, since systemd is emphatically Linux-only.


Python argparse has a limitation on argument groups that makes me sad

Argparse is thestraightforward standard library module for handling command linearguments, with a number of nice features. One of those nice featuresis groups of mutually exclusive arguments . Ifpeople can only give one of '--quiet' and '--verbose' and bothtogether make no sense, you can put them in a mutually exclusivegroup and argparse will check for you and generate an appropriate error. However, mutuallyexclusive groups have a little limitation that makes me sad.

Suppose, not hypothetically, that you have


Potential issues in running your own identity provider

Over on the Fediverse, Simon Tatham had a comment about (using)cloud identity providers that's sparkedsome discussion. Yesterday I wrote about the facets of identityproviders . Today I'm sort of writingabout why you might not want to run your own identity provider,despite the hazards of depending on the security of some outsidethird party. I'll do this by talking about what I see as beinginvolved in the whole thing.

The hardcore option is to rely on no outside services at all,


Thinking about facets of (cloud) identity providers

Over on the Fediverse, Simon Tatham had a comment about cloudidentity providers ,and this sparked some thoughts of my own . One of my thoughtsis that in today's world, a sufficiently large organization mayhave a number of facets to its identity provider situation (whichis certainly the case for my institution ).Breaking up identity provision into multiple facets can leave itnot clear if and to what extend you could be said to be using a'cloud identity provider'.

First off, you may outsource '


A silly systemd wish for moving new processes around systemd units

Linux cgroups offer a bunch of robust features for limiting resourceusage and handling resource contention between different groups ofprocesses, which you can use to implement things like per-usermemory and CPU resource limits . On asystemd based system, which is to say basically almost all Linuxestoday, systemd more or less completely owns the cgroup hierarchyand using cgroups for resource limits requires that the processesinvolved be placed inside relevant systemd units, and for thatmatter that the systemd units exist.

Unfortunately, the mechanisms for doing this are


Adding your own attributes to Python functions and Python typing

Every so often I have some Python code where I have a collectionof functions and along with the functions, some additional informationabout them. For example, the functions might implement subcommandsand there might be information about help text, the number of commandline arguments, and so on. There are a variety of approaches forthis , but a very simple one I'vetended to use is to put one or more additional attributes on thefunctions. This looks like:

def dosomething(....):