Me on Twitter earlier today :

Protip: if your software's build process involves patching the sourcein place, sooner or later a sysadmin will hunt you down.

Perhaps it is not obvious why this is a bad idea, so let me go on atmore length than a tweet allows.

The problem with patching in place is not so much that patching yoursource as part of building it is a bad idea in general (sometimes it'snecessary), it is that patching in place makes it really hard

As an example of what a custom environment needs on a modern Linuxdesktop , here is a list of all of thevarious things I need to do and run to make my custom environment workon Fedora 16.

• I start my X session by hand from a text login, which means thatmy startup script has to run some extra programs. The details ofthis are unchanged since Fedora 8 and probably don't apply to anyone else.

  (If you need to know this sort of stuff, poke around in

At one level, doing a custom X environment on top of Fedora is easy(as I alluded to in reply to a comment on this earlier entry ). I do it in a perverse way with my desktop , and people who are sane enough to use thestandard graphical login can do it by simply writing a script thatstarts everything (including their window manager) and putting anappropriately formatted file in /usr/share/xsessions (as of Fedora16).

But all of that is the simple part

Periodically we need to set up reverse proxies with Apache'sProxyPass directive (to support our solution to the multiuserPHP problem ). On the surface doing this fairlysimple and straightforward; however, the important devil is in thisspotlighted bit in the documentation :

If the first argument ends with a trailing / , the second argumentshould also end with a trailing / and vice versa. Otherwise theresulting requests to the backend may miss some needed slashes and donot deliver the expected results.

Since I have now stubbed my

For those of you who have not heard, GitHub was compromised today, or more exactly a long-standing vulnerability was demonstratedtoday. They were compromised because of a feature in Rails called' mass assignment 'that by default allows web operations to update any field of themodel record.

(I don't know enough Rails to confidently say what web operations inspecific allow this, although some sources suggest PUT operations. Ialso don't know if they're tied to forms or can be submitted just out

In reaction to the recent GitHub Rails vulnerability, raganwaldwrote in part (about the Rails security issue) :

The Rails team went with the original Rails perspective on this: Railsdevelopers are required to act like adults and be careful when workingwith sharp tools.

I understand why this view of insecure-by-default is popular, butit's making a fundamental mistake. The problem with the 'insecurityas a sharp tool' view is that insecurity is not like the other sharptools in Rails' toolbox.

It figures that shortly after I wrote The (future) problem with Python2.7 , I found out that the Python people had announceda release candidate for what will be Python 2.7.3 when it's releasedofficially. The direct cause of this is likely some security fixes(especially the hash table issue ),but it also includes quite a number of other bugfixes.

All of this made me realize that I didn't actually understand thenormal Python support periods. The Python people have never

It's time for me to toss some pennies into the pond of advice aboutgood ways to use SSH securely and conveniently. However, I firstneed to point to my general remarks about SSH personal keys ; the following things I do are a tradeoff. Theywork for me but they may not be right for you.

Here are two things that I do with SSH personal keys (aka SSHidentities) that I don't think are always done. Both of them are usefulfor increasing security.

First,

Suppose that you have a bunch of lines in what I've sort of described as a 'key=value' format, that looklike this:

key1=value1 key2=value2 key3=value3 ...

Also, let's suppose that the fields and their ordering isn't constant,for example some lines omit key2 and its value. If it wasn't for thisinconsistency, there's lots of Unix tools that you could use;

Continue reading...

Menu

• Home
• List View
• Feed
• Category
  TechNewsPhotographyBlog

---

• Accounts
  Login