Some consequences of widespread use of OCSP for HTTPS
OCSP is an attempt to solve some of the problems of certificaterevocation . The simple version of how itworks is that when your browser contacts a HTTPS website, it asksthe issuer of the site's certificate if the certificate is bothknown and still valid. One important advantage of OCSP over CRLs that the CA now hasan avenue to 'revoke' certificates that it doesn't know about.If the CA doesn't have a certificate in its database, it can assert'unknown certificate' in reply
In practice, 10G-T today can be finicky
Not all that long ago I wrote an entry about why I think that10G-T will be the dominant form of 10G Ethernet .While I still believe in the fundamental premise of that entry,since then I've also learned that 10G-T today can be kind of finickyin practice (regardless of what the theory says) and this canpotentially make 10G-T deployments harder to do and to get reliablethan SFP-based ones.
So far we've
My (somewhat silly) SSD dilemma
The world has reached the point where I want to move my home machinefrom using spinning rust to using SSDs; in fact it's starting toreach the point where sticking on spinning rust seems dowdy anddecidedly behind the times. I certainly would like extremely fastIO and no seek overheads and so on, especially when I do crazythings like rebuild Firefox from source on a regular basis.Unfortunately I have a dilemma because of a combination of threethings:
- I insist on mirrored disks for anything I value, for
A data point on how rapidly spammers pick up addresses from the web
On June 15, what is almost exactly a month ago now, I wrote an entryon a weird non-relaying relay attempt I saw.In the entry I quoted a SMTP conversation, including a local addresshandled by my sinkhole SMTP server. As I was writing the entry Idecided to change the local part of the address to an obviouslybogus 'XXXX' and then see if spammers picked up that address andstarted trying to deliver things to that new address.
I am now able to report that it
Unmounting recoverable stale NFS mounts on Linux
Suppose that you have NFS mounts go stale on your Linux clients byaccident; perhaps you have disabled sharing of some filesystem onthe fileserver without quite unmounting it on all the clients first.Now you try to unmount them on the clients and you get the cheerfulerror message:
# umount /cs/dtr/cs/dtr was not found in /proc/mounts
You have two problems here. The first problem is in umount.nfs and it is producing the error message you see here. This errormessage happens
Early impressions of CentOS 7
For reasons involving us being unimpressed with Ubuntu 14.04 , we're building our second generation iSCSIbackends on top of CentOS 7 (basically because it just came out intime). We have recently put the first couple of them into productionso now seems a good time to report my early impressions of CentOS 7.
I'll start with the installation, which has impressed me in twodifferent ways. The first is that it does RAID setup the rightway : you define filesystems (or swap
An obvious reminder: disks can and do die abruptly
Modern disks have a fearsome array of monitoring features in theform of all of their SMART attributes, and hopefully you are runningsomething that monitors them and alerts you to trouble. In an idealworld, disks would decay gradually and give you plenty of advancewarning about an impending death, letting you make backups andprepare the replacement and so on. And sometimes this does happen(and you get warnings from your SMART monitoring software about'impending failure, back up your data now ').
Sometimes, though, it
You want to turn console blanking off on your Linux servers
Let's start with the tweets:
@thatcks : Everyoneshould strongly consider adding 'consoleblank=0' to the kernel commandline on your Linux servers. #sysadmin
@thatcks : The Linuxkernel blanking the console screen is both unnecessary and dangerouson modern servers and modern setups. You want it off.
By default if you leave a Linux machine sitting idle at a textconsole, the kernel will blank the display after a while (I believeit's normally ten minutes of inactivity); Linux has probably
Some notes on bisecting a modified Firefox source base with Mercurial
Suppose, not hypothetically, that you maintain your own copy of theFirefox master source (aka 'Nightly') with private modificationson top of the Mozilla version. Of course you don't commit yourmodifications, because that would lead to a huge tangle of mergesover time. Now suppose that Mozilla breaks something and you wantto use Mercurial bisection to find it.
The first thing you need is to figure out the last good version. What Ido is I don't run my modified Firefox version directly
The core security problem of SSL on the web is too much trust
Every so often I'm surprised by what people don't already know(although I really shouldn't be). Today's surprise, due to TimBray's Blow up the Cert Business ,is that people don't understand the core security problem with SSLon the web. I generally operate in an environment where this iscommon shared information, something that everyone just knows, butthis is not the world in general.
So let's be explicit about what the real problem is: