As I discovered recently , OpenSSHmakes some unusual choices for the ordering of configurationdirectives in its configuration files, both sshd_config and ssh_config (and files they include).Today I want to write down what I know about the result (whichis partly things I've learned researching this entry).

For sshd_config , the situation is relatively straightforward.There are what we could call 'global options' (things you setnormally, outside of 'Match' blocks) and 'matching Match

I've said in the past that Go is not our language ,and I still stand by that. At the same time, the Go developers doeventually respond to the clamour from the community, which Imaintain that we've seen with both Go's eventual addition of genericsand the change to Go modules and Go dependency handling ( whereGo started with one story until it clearly didn't work and they hadto change ). This leads me to two relatedviews.

First, I think that

Today, for reasons beyond the scope of this entry, I took somethingI'd been running by hand from the command line for testing and triedto set it up under systemd. This is normally straightforward, andit should have been extra straightforward because the thing camewith a .service file. But that .service file used a lot of systemd'sfeatures for restricting what programs can do, and for my sins I'ddecided to set up the program with its binary, configuration file,and so

Today, for reasons ,I found myself reflecting that OIDC / OAuth2 seems to have becometoday's all purpose authentication method, rather than just being a web authentication and Single Sign On system . Obviously you can authenticatewebsites with OIDC , as wellas anything that you can reasonably implement using a website aspart of things, but it goes beyond this. You can use OIDC/OAuth2tokens to authenticate IMAP, POP3, and authenticated SMTP ( althoughsubstantial restrictions apply ), you can(probably)

Suppose, not entirely hypothetically, that you have an Ubuntu 24.04server system where you want to disable SSH passwords for theInternet but allow them for your local LAN. This looks straightforwardbased on sshd_config ,given the PasswordAuthentication and Match directives:

PasswordAuthentication noMatch 127.0.0.0/8,192.168.0.0/16  PasswordAuthentication yes

Since I'm an innocent person, I put this in a file in/etc

When I wrote about how error handling isn't a solved problem , I said some things about Rust'serror handling that were flat out wrong, which I had in my mindthrough superstition . Today is abrief correction on that, since I looked it up.

Rust's usual way of signalling ( recoverable ) errorsis to use the Result type ,which is an enum with one option for errors and one option for success (so it is theGo 'result, err := call(.

I've been using wget for a long time now, which means that I'vedeveloped a lot of habits, reflexes and even little scripts around it. Then wget2 happened, ormore exactly Fedora switched from wget to wget2 (and Ubuntu isprobably going to follow along). I'm very much not a fan of wget2 ( also ); I find it hasboth worse behavior and worse output than classical wget, in waysthat routinely get in my way. Or got in my

When I wrote about how it's complicated to count how many professorsare in our department , Imentioned that the issues involved would definitely complicate thelife of any IAM system thattried to understand all of this, but that we had a much simplerview of things. Today I'm going to explain that, with a little biton its historical evolution (as I understand it).

All Unix accounts on our haveto be 'sponsored' by someone, their 'sponsor'. Roughly speaking,all

My university has standardized on aninstitutional MFA system that's based on institutional identifiers and Duo (a SaaS company, as iscommonly necessary these days to support push MFA ). We have our own logins and passwords, but wanted to add full Duo MFAauthentication to (as a first step) various of our web applications.We were eventually able to work out how to do this, which I'm goingto summarize here because although this is a very specific need,maybe someone else in the world also