Phish spam and outside events
I wrote my advance fee fraud spam aphorism abouthow advance fee spammers take advantage of world events for theircome-ons. It strikes me as interesting that I've never seen phishspammers do that. I actually thought I had a case from this weekend andI was going to write it up here, but on looking at the phish spam againit's merely trying to get my Apple ID, not my Apple Developer ID (thelatter would be topical given the commotion with the Apple DeveloperCenter security issue
A consistent preference in APIs for kernel and other low-level APIs
One of the things that API Design Matters made me think aboutis how programmers seem to have a distinct preference in interfacesto low-level APIs: almost all of the time, people very much seemto prefer interfaces that are as close as possible to the actualunderlying API. The article's criticism of the .NET socket select() API is spot on, yet you'll find very similar versions of select() (with very similar issues) in any number of high level languages.Almost always
The constraints shaping kernel APIs
I was recently reading API Design Matters , which uses the .NETsocket select() function as an example of a sub-par API. As partof thinking about how it wound up with that API, one of the thingsI wound up mulling over is the constraints that generally shapekernel APIs (as this .NET API is ultimately descended from the Unix select() API ).
The first big constraint on system calls is that the actual callitself cannot allocate memory in your process under essentially anycircumstances.
The easy path versus the virtuous path (in system setup)
For reasons beyond the scope of this entry I've decided that it's timefor me to get my own server somewhere. At one level this is easy; anynumber of places will give you, say, Ubuntu 12.04 machines and I'd haveno problem setting up the relatively minimal web server environment Iwant from there.
At another level, this is not the virtuous way to set up your servertoday (especially if it's a virtual server). There are several
Communication is work and a corollary
Hopefully it is not news to anyone that communication takes work (whichis to say that it takes time, effort, and attention, all of which arelimited resources). After all, Fred Brooks was pointing this out in The Mythical Man-Month as one of the reasons that adding people to alate project generally makes it later (because when you add people youincrease the amount of communication and coordination that needs to bedone, which decreases the amount of actual work that everyone has timefor).
There
An important thing about security issues in HTTP error responses
Although I mentioned this in passing in my first entry on this subject , it is worth talking about how Unix login attempts differfrom HTTP requests for most websites. The obvious difference is thatinnocent people make requests for bad URLs much more frequently thanthey use bad logins on Unix machines. The second difference can be putin two ways, either that people make plenty of unauthenticated requestsor that (unlike in Unix) it is not necessarily obvious when you need toauthenticate to do something unless you're told explicitly.
Why vendor prices are important things to have
I have been looking into various bits of hardware lately and I'venoticed an irritating trend : equipmentvendors that don't list any sort of price on their website. To getpricing information you need to find their VARs or resellers andthen find a reseller that lists those prices online. This is absurdlydifficult and annoying.
(I award a special bonus prize to vendors whose VAR reseller pagecontains links to websites that aren't there. Yes, I've run intothis.)
The reason I
When Python regexp alternation is faster than separate regexps
In Eli Bendersky's Regex-based lexical analysis in Python and Javascript he wrote:
Shortly after I started using it, it was suggested that combining allthe regexes into a single regex with alternation (the | regex syntax)and using named groups to know which one matched would make the lexerfaster. [...]
This optimization makes the lexer more than twice as fast! [...]
At first I was going to write an entry explicitly noting that Benderskyhad demonstrated that you should use regex
External disk enclosures versus disk servers
We're finally looking at renewing our fileserver infrastructure because the hardware is five years old andwe're running a version of Solaris that is now laughable. As part ofthat we're revisiting decisions we made in the original version to seeif we still like them. One of those decisions is the issue of how weattach a fair number of data disks to a server.
Generally you have two decent options. You can either get external diskenclosures and connect them to a generic server somehow (these days
A fun problem: monitoring randomness reduces it
The Linux kernel exports a /proc entry that reports on how manybits of entropy are in the kernel's randomness pool, /proc/sys/kernel/random/entropy_avail . Recently, Matt Simmonsnoticed his server monitoring looking at this and noticed that when he checked the /proc entry by hand thereported entropy went down. It turns out that this was not randomfluctuations and the explanation for it is rather interesting, aspointed out by @rejectreality on Twitter .
As a security measure, modern