Once upon a time, young languages showed their youth by having coreincapabilities (important features not implemented, importantplatforms not supported, or the like). This is no longer reallythe case today; now languages generally show their youth throughlimitations in their standard library. The reality is that a standardlibrary that deals with the world of the modern Internet is both alot of work and the expression of a lot of (painful) experiencewith corner cases, how specifications work out in practice, and soon.

Back in 2009 I tested ssh cipher speeds (although itlater turned out to be somewhat incomplete ). RecentlyI redid those tests on OmniOS , withsome interesting results. I was able to do this (and do it easily)because I originally did something that I don't do often enough: Isaved the script I used to run the tests for my original entry . I didn't save full information, though; I didn't saveinformation on exactly how I ran it (

If you look at the manpage and so on, it's sort of obvious that theIllumos and thus OmniOS version of SSH is rather behind the times;Sun branched from OpenSSH years ago to add some features they feltwere important and it has not really been resynchronized since then.It (and before it the Solaris version) also has transfer speedsthat are kind of slow due to the SSH cipher et al overhead . I tested this years ago (I believe closeto the beginning of our ZFS fileservers ),

Today we ran into an interesting bug in one of our internal shellscripts. The script had worked for years on our Solaris 10 machines,but on a new OmniOS fileserver it suddenly reported an error:

script[77]: [: 232G: arithmetic syntax error

Cognoscenti of ksh error messages have probably already recognizedthis one and can tell me the exact problem. To show it to everyoneelse, here is line 77:

if [ "$qsize" -eq "none" ]

People occasionally push SELinux as the cure for security problemsand look down on people who routinely disable it (as we do). I have some previously expressed views on thisgeneral attitude, but what I feel like pointing out today is thatSELinux's security has some important intrinsic limits. One big oneis that SELinux only acts at process boundaries .

By its nature, SELinux exists to stop a process (or a collection ofthem) from doing 'bad things' to the rest of the system and to the

A number of years ago I wrote How fast various ssh ciphers are because I was curious about just how fast you could dobulk SSH transfers and how to get them to go fast under variouscircumstances. Since then I have learned somewhat more about SSHspeed and what controls what things you have available and canget.

To start with, my years ago entry was naively incomplete becauseSSH encryption has two components: it has both a cipher and acryptographic hash used as the MAC . Thechoice of both of them can

Modern versions of SSH support up to four different types of SSHkeys (both for host keys to identify servers and for personal keys):RSA, DSA, ECDSA, and as of OpenSSH 6.5 we have ED25519 keys as well.Both ECDSA and ED25519 uses elliptic curve cryptography , DSAuses finite fields , and RSA is based on integer factorization . EC cryptographyis said to have a number of advantages, particularly in that ituses smaller key sizes (and

As I write this, a number of IP addresses in 128.100.1.0/24 are listedin the CBL, and various of them have been listed for some time. Thereis a problem with this: these CBL-listed IP addresses don't exist .I don't mean 'they aren't supposed to exist'; I mean 'they could onlytheoretically exist on a secure subnet in our machine room and even ifthey did exist our firewall wouldn

I recently ran across Mozilla Bug 1041087 ( via HN ), which has the sortof harmless sound title of 'Switch generic icon to negative feedbackfor non-https sites'. Let me translate this to English: 'try toscare users if they're connecting to a non-https site'. For anyonewho finds this attractive, let me say it flat out; this is a stupididea on today's web.

(For the record, I don't