I've mentioned before that one of ourproblems is that explicit ' zpool import ' commands are very slowin our environment, so slow that we don't try to do failover although we're theoretically set up todo it. At least back in the Solaris era and I assume still in theOmniOS one, this came about because of two reasons .First, when you run ' zpool import ' (for basically any reason) itchecks every disk you have, one at a time , to build

Anyone who uses a mainline Linux desktop may have noticed a trend wheremore and more the system wants you to either reboot the system or logout and log back in again after you apply distribution updates (the twoare roughly equivalent in terms of disrupting you, so I'm going to treatthem the same). You might wonder why Linux has been shifting towardsthis increasingly, well, Windows-like experience. While I don't havedirect knowledge of the internal decisions of Linux distributions, as asystem

Once upon what is now a very long time ago, it appears back in 1987or so, Robert Ward wrote a better version of BSD ps that he called sps ( cf ).The highly useful signature feature of sps was that it displayedprocesses in sort of a tree form, with UID transitions marked. Thiswas in the days before pstree and equivalents were even a gleamin anyone's eye, and anyways I maintain that sps 's display isbetter than pstree , ptree , or the

In the wake of Firefox's decision to support EME ( cf )a number of people have been angrily advocating for switching awayfrom Firefox to another browser. I think that this is wrong-headed(see here ( via )for one cogent explanation of why), but let's set that aside fornow and merely ask what it would take for something to replaceFirefox as my web browser.

At one level the answer can be garnered from the Firefox extensionsthat I use . I don't just

One of the things that I do from home is that I log in to my officeworkstation and then from my office workstation I log in to othermachines. This works conveniently when I have unencrypted SSH keyson the office workstation, but problems develop in a straightforwardimplementation of encrypted keys; now I can no longer ssh from myoffice workstation to other machines without being challenged foreither the passphrase to the keys or the remote password.

Part of this can be solved with SSH agent forwarding. If I enableit for

I'll start with the admission: up until now I've used unencryptedSSH keys on my home and office workstations, ultimately because Ididn't think that doing so made the risks particularly worse than usingencrypted keys and it's undeniably more convenient. For hand-wavingreasons I've recently decided to experiment with encrypted keys on atleast my home machine so this is a collection of early notes on theprocess.

The most important part of making encrypted SSH keys convenient is tobe running ssh

I am an old fashioned Unix sysadmin so I have not really become veryenthused about using sudo as a replacement for su . I could make lotsof excuses for this but what it boils down to is that I'm very used tousing su and I haven't felt like trying to readjust my entire set ofreflexes and my environment to using sudo instead. This doesn't meanthat I don't like sudo or that I don't use it at all. Instead I merelyuse sudo as

As I noted in my entry on how DMARC would affect us , modern mail forwarding is now leaky inpractice. In the old days, if you forwarded your mail from addressA to address B you could be reasonably sure that everything thatmade it to address A would also make it to address B. In the modernworld this is no longer necessarily so; it's quite likely that someamount of the mail that was accepted by the mail system for addressA will not get accepted by address B. This

Some time ago I wrote about the three faces of sudo ,where one of the faces was basically ' sudo as the replacement for su in how sysadmins get unrestricted root privileges' and I saidthat this created a different security model than with su . TodayI want to talk about what that new model is and how I see it differingfrom su 's in a way that makes me like it less.

To start with we need to talk about the security model of su . Suhas a simple security model: