Years ago I mentioned in passing thatSELinux should have its own errno value. Today I feel like runningdown both the technical details of how I think it should work and why itmakes sense.

First, I don't think this should be specific to just SELinux. Thereality is that Unix kernels are increasingly growing securityrestrictions over and above standard Unix permissions, all of whichsuffer from the same visibility problems that SELinux has. Rather thangive them all different errno values, I think that there should be a

You may have heard that Flickr recently did a major site redesign thatsignificantly changed the look and the experience of the site (of coursemany long-term users are up in arms over it). I'm not sure how I feelabout it myself, but after interacting with the new Flickr for a whileI've realized something: the new Flickr is very strongly focused onlooking at photographs.

This might sound obvious, but the old Flickr wasn't this way. Theeasiest way to explain it

I've been hearing about 'software defined networking' (hereafterSDN) for a while, but it's never been entirely clear just what itwas and what people meant when they talked about it. Partly thisis because by the time I started hearing about SDN it had alreadybecome encrusted in a thick layer of marketing and insider jargondue to being the hot new thing. I've recently been poking aroundsome things and this is what I've gathered ( after a misstep and a correction or

I was recently grumbling about howdifficult it is to build 32-bit x86 RPMs on a 64-bit x86 Fedorasystem. The short version is that despite the presence of variousthings to help cross-building, like setarch and rpmbuild--target=... , the only way I've found to cross-build binary RPMsis to use mock to create an entire minimal 32-bit Fedora installin a buildroot and then use that minimal install to recompile your

The trail of this thought starts with Matt Gemmell's Designingblogs for readers ,which advocates strongly against blog sidebars, and continues withDr Drang's Blogging and readability , whichpushes back against the anti-sidebar sentiments. In the process DrDrang agrees that blog sidebars only work on relatively wide screens;on the small and narrow screens typical of smartphones (for example),a visible sidebar is a waste of precious space that should be goingto the content.

(Apparently smartphone browsers may be smart enough to

Okay, it's not SELinux's (the technology's) mistake. It's the mistake ofpeople who support SELinux, what outsiders see as the SELinux community.From an outside perspective it's basically the same thing. The toxicmistake is this :

Seriously, stop disabling SELinux. Learn how to use it before you blindly shutit off.

( via ,which is another illustration of this, from @jordansissel .)

Let me translate this: 'the beatings will continue until moraleimproves

I've had an IPSec tunnel between my home machine and work for a fairlylong time now . Now, I have a confession:during all of this time, the tunnel has had fixed keys.

If you don't know IPSec you may not understand what this means, solet me explain. To simplify a bit IPSec connections are protected bysymmetric stream ciphers, which require keys for those ciphers; this isvery similar to SSH, TLS, and any other network encryption protocol. Butin those other

I'm a security aware sysadmin and yet yesterday I casually admitted that I made less-secure choices because thereally secure option was too annoying and potentially inconvenient.In fact this is not the only case where I make this tradeoff, pickinga less secure but more convenient option.

This shouldn't really surprise people. In real life security isalmost never the most important thing to people , even to securityaware people. Even aware, knowledgeable people prioritize other thingsover security; we disable SELinux, we use

Recently my corner of the Twitter-verse has been moderately aflamewith a number of people pointing and laughing at a chunk of MongoDBsource code; this example istypical. At first I automatically accepted that the code was laughable(and you have to admit that seeing a call to random() in databaseclient code is odd) but when the link kept cropping up I got curiousenough to start reading the surrounding code. Unfortunately themore I read the more sane the code looked . Since thedetails don't