OIDC (OpenID Connect) istoday's better or best regarded standard for (web-based) authentication.When a website ( or something ) authenticatesyou through an OpenID (identity) Provider (OP), one of the thingsit gets back is a bunch of 'claims', which is to say informationabout the authenticated person. One of the core claims is'sub', which is vaguely described as a string that is 'subject -identifier for the end-user at the issuer'.

Suppose that you have an IMAP server and you would like to add MFA(Multi-Factor Authentication) protection to it. I believe that intheory the IMAP protocol supports multi-step 'challenge and response'style authentication, so again in theory you could implement MFAthis way, but in practice this is unworkable because people wouldbe constantly facing challenges. Modern IMAP clients (and servers)expect to be able to open and close connections more or less ondemand, rather than opening one connection, holding it open

Suppose, not entirely hypothetically, that you have some backupservers that use swappable HDDs as their backup media and expose that 'media' as mounted filesystems. Because you keepswapping media around, you don't automatically mount these filesystemsand when you do manually try to mount them, it's possible to havesome missing (if, for example, a HDD didn't get fully inserted andengaged with the hot-swap bay). To deal with this, you'd like towrite a Prometheus

SimpleSAMLphp is a SAML identityprovider (and other stuff). It's of deep interest to us becauseit's about the only SAML or OIDC IdP I can find that will authenticateusers and passwords against LDAP and has a plugin that will doadditional full MFA authentication against the university's chosenMFA provider ( although you need to use a feature branch ).In the process of doing this MFA authentication, we need to extractthe university identifier to use for MFA authentication from ourlocal LDAP data. Conveniently

Some day, you may be in an organization that's about to add somemore fiber cabling between two rooms in the same building, or maybetwo close by buildings, and someone may ask you for your opinionabout many fiber pairs should be run. My personal advice is simple: run more fiber than you think you need, ideally a bunch more(this generalizes to network cabling in general, but copper cablingis a lot more bulky and so harder to run (much) more of). THere is

One of the things I do with Git is maintain personal changes locallyon top of the upstream version, with my changes updated via rebasingevery time I pull upstream to update it. In the simple case, I haveonly a single local change and commit, but in more complex cases Isplit my changes into multiple local commits; my local versionof Firefox currently carries 12 separatepersonal commits. Every so often, upstream changes something thatcauses one of those personal changes to need an update, withoutactually breaking the

Over on the Fediverse, I said :

A fun Python error some code can make and not notice until you runit under PyPy is a function that has 'f.close' at the end instead of'f.close()' where f is an open()'d file.

(Normal CPython will immediately close the file when the functionreturns due to refcounted GC. PyPy uses non-refcounted GC so the fileremains open until GC happens, and so you can get too many files openat

Today I learned of a new way to accidentally lose data 'written'to disk , courtesyof this Fediverse post summarizing a longer article about CouchDB and this issue .Because this is so nifty and startling when I encountered it, yetso simple, I'm going to re-explain the issue in my own words andexplain how it leads to the title of this entry.

Suppose that you have a program that makes data it writes to diskdurable through some form of journal, write ahead log (WAL)

For reasons outside the scope of this entry, I recently needed toset up WireGuard on an Ubuntu 22.04 machine. When I did thisbefore for an IPv6 gateway , I used systemd-networkd directly. This time around I wasn't going to set up a single peerand stop; I expected to iterate and add peers several times, whichmade netplan 's ability to update and re-doyour network configuration look attractive. Also, our machines arealready using Netplan for their basic