The TLS news of the time interval is that Let's Encrypt certificates willno longer be usable to authenticate your client to a TLS server (viaa number of people on the Fediverse). This is driven by a changein Chrome's "Root Program", covered in section 3.2 ,with a further discussion of this in Chrome's charmingly named Moving Forward, Together in the "Understanding dedicated hierarchies" section; apparentlyonly half of the current root Certificate Authorities actually issueTLS server certificates.

Every so often people yearn for a lost (1980s or so) era of 'singleuser computers', whether these are simple personal computers orhigh end things like Lisp machines and Smalltalk workstations. It'smy view that the whole idea of a 1980s style "single user computer"is not what we actually want and has some significant flaws inpractice.

The platonic image of a single user computer in this style was onewhere everything about the computer (or at least

In this modern age, more and more people are facing more and morepressure to have pervasive Multi-Factor Authentication, with everyauthentication your people perform protected by MFA in some way.I've come to feel that there are two broad approaches to achievingthis and one of them is more realistic than the other, althoughit's also less appealing in some ways and less neat (and arguablyless secure).

The 'proper' way to protect everything with MFA is to separatelyand individually add MFA to

Suppose, not hypothetically, that you have a shell script with arelatively simple configuration file format that people can stillaccidentally get wrong. You'd like to check the configuration filefor problems before you use it in the rest of your script, forexample by using it with 'join' (where things like the wrong number or type of fields will be aproblem). Recently on the Fediverse I shared how I was doingthis with awk ,so here's a slightly more elaborate and filled out version

In a comment on my entry on how WireGuard mesh networks need aprovisioning system , vcarcelerpointed me to Innernet ( also ), an interestingbut opinionated provisioning system for WireGuard. However, twobits of it combined made me twitch a bit; Innernet only allows youto provision a given node once, and once a node is assigned aninternal IP, that IP is never reused. This lack of support forre-provisioning machines would be a problem for us and we'd likelyhave to do something about it

One thing I've seen repeatedly is that companies that sellSaaS or SaaS like things and offer educational pricing (becausethey want to sell to universities too) are setting (initial)educational pricing that is in practice much too high. Today I'mgoing to work through a schematic example to explain what I mean.All of this is based on how it works in Canadian and I believe USuniversities; other university systems may be somewhat different.

Let's suppose that you're a SaaS vendor and

One thing that my recent experience expanding our WireGuard meshnetwork has driven home tome is how (and why) WireGuard needs a provisioning system, especiallyif you're using it as a mesh networking system. In fact I thinkthat if you use a mesh WireGuard setup at any real scale, you'regoing to wind up either adopting or building such a provisioningsystem.

In a 'VPN' WireGuard setup with a bunch of clients and one or asmall number of gateway servers, adding a new client

Recently I said something vaguely grumpy about the venerable Unix' join ' tool . As the POSIX specification page for join will unhelpfully tell you, join is a 'relational database operator',which means that it implements the rough equivalent of SQL joins. Oneway to use join is to add additional information for some lines inyour input data.

Suppose, not entirely hypothetically, that we have an input file(or data stream) that starts with a login name and contains someadditional information, and that for some logins

In my earlier installment, I wrote about my views on the commonApache modules for SAML and OIDC authentication , where I concluded that OpenIDC was generally easierto use than Mellon (for SAML). Recently I came up with another reason to prefer OIDC,one sufficiently strong enough that we converted one of our remainingMellon uses over to OIDC. The advantage is that OIDC is easier totest if you're building a new version of your web server underanother name.

Suppose that you're (re)building