When I wrote about what systemd got right I alsomentioned in passing that it wasn't without flaws. It's time (and reallypast time) to start doing some elaboration on that, and I'm going tostart with systemd's problem with documenting dependencies.

Systemd is fundamentally a dependency-based init mechanism; it startsthings and orders startup based on what service needs what other service(among other things this determines what can start in parallel). All ofthis is well and good but

In theory, a nice proper network is supposed to have only a singleIP(v4) subnet running over any given network segment. But this is notactually fully required; if you're sufficiently perverse you can runmultiple subnets over the same physical network. Some people are nowasking how on earth you would ever get into such a crazy situation.Well, sit back, I have a story for you.

Suppose that you use private subnets and inparticular you put each group in your organization in its

The other day I tweeted :

Thesis: every .rpmsave file on a #Fedora system represents a packagingfailure. The package should have provided a better override method.

(I made a mistake in this tweet; I actually meant .rpmnew files.Sadly I only noticed this mistake now .)

I should give at least one person a fullexplanation what I mean by this (and besides, I alluded to it lastentry ).In my traditional way, I'll start with a question: what creates .

For reasons involving upgrading my office workstation to Fedora 18,I've had to deal with the stock Fedora Apache configuration setup forthe first time in a long time. And oh boy, is it bad. It's a beautifulexample of how not to do configuration files in a modern package managerworld and is all the more shocking because I'm used to the UbuntuApache setup (which is the Debian Apache setup), which basically getseverything right.

Here is how Debian splits Apache configuration up

Today I got around to something on my office and home workstations thatI should have done years ago: I turned off all delays after you mistypea password, both for ssh logins and for local things like su .

I've been an advocate against network authentication delays for quitesome time . Over time I've come torealize that the same logic more or less applied to local authenticationdelays too. In theory they're there to slow down mass password guessingattacks, but in practice all they were doing

Under certain circumstances it's possible to get bounce loops; amessage bounces, the bounce for the message bounces, the bounce ofthe bounce then bounces, and you repeat endlessly (possibly untilsomething explodes). When this happened to us, we decided to fix ourExim configuration so that it would detect and suppress these bounceloops (or at least as many of them as possible).

How we do it is a close relative of how we make Exim discard bouncesof spam . First, we created a

Every so often some sysadmin has a problem configuring program A to runa command in just the right way. Maybe they decide they need to runmultiple commands, or they need a complex command line, or there's anynumber of other reasons. So they decide to get out the big guns to solvetheir problem:

some_option = /bin/sh -c "CMD ARG 'arg 2' $somevar ....."

WRONG . This is a terrible idea ( as I mentioned before

One of the reddit suggestions in response to my entry on usingtype assertions to reach through interfaces noted that you could embed one interface inside another one, effectivelyextending the interface that you embed, so my Closer interfacecould have been:

type ConnCloser interface {    net.Conn    CloseWrite() error}

When I saw this my instinctive reaction was that this was wrong for mysituation; since then I've spent some time thinking about why I feelthat way. My conclusion is that I think I have good reasons but

When I talked about my first Go experience , Imentioned in passing that a netcat-like program is actually not a badtest program for a language (or for certain sorts of libraries in, egC). Today I feel like explaining that.

To start with, it's not an empty and artificial challenge; a netcat-likeprogram does something meaningful and practical (although it may notbe necessary if you already have netcat). The problem itself touchesmany levels of a language and its library,