I use a non-standard shell and have for a long time ,which means that I have to write and maintain my own set of dotfiles( which sometimes has advantages ).In the long ago days when I started doing this, I had a bunch ofaccounts on different Unixes around the university (as was thefashion at the time, especially if you were a sysadmin). So I decidedthat I was going to simplify my life by having one set of dotfilesfor rc that I used on all of

In the beginning, which is to say the early days of Bell LabsResearch Unix, life was simple and there was only /bin. Soonafterwards that disk ran out of space and we got /usr/bin (andall of /usr) , and some people might even haveput /etc on their $PATH. When UCB released BSD Unix, they added/usr/ucb as a place for (some of) their new programs and put somemore useful programs in /etc (and at some

In the comments on my entry on how you should respond toauthentication failures depends on the circumstances , sapphirepaw said something that triggereda belated realization in my mind:

Probably less of a concern for IMAP, but in a web app, one must takecare to hide the information completely . I was recently at a sitethat wouldn't say whether the provided email was valid for passwordreset, but would reveal it was in use when trying to create a newaccount.

The realization this sparked is that we can divide

A discussion broke out in the comments on my entry on how everythingshould be able to ratelimit authentication failures , and one thing that came up wasthe standard advice that when authentication fails, the serviceshouldn't give you any indication of why. You shouldn't react anydifferently if it's a bad password for an existing account, anaccount that doesn't exist any more (perhaps with the correctpassword for the account when it existed), an account that neverexisted, and so on.

Over on the Fediverse, I shared a discovery :

This is my face when rspamd will apparently pattern-match a mention of'test@test' in the body of an email, extract 'test', try that againstthe multi.surbl.org DNS blocklist (which includes it), and decide thatincoming email is spam as a result.

Although I didn't mention it in the post, I assume that rspamd 's goal is to extract the domain from emailaddresses and see if the domain

One of the things that I've come to believe in is that everything,basically without exception, should be able to rate-limit authenticationfailures, at least when you're authenticating people. Things don'thave to make this rate-limiting mandatory, but it should be possible.I'm okay with basic per-IP or so rate limiting, although it wouldbe great if systems could do better and be able to limit differentlybased on different criteria, such as whether the target login exists

DWiki is the general filesystem based wiki engine that underlies this blog , and for various reasons having to do with howold it is, it lacks a number of features. One of the features thatI've wanted for more than a decade has been some kind of support for attaching tags to entries andthen navigating around using them ( although doing this well isn'tentirely easy ). However, it was alwaysa big feature, both in implementing external files of tags and in tagging entries, and so I

Over on the Fediverse I said :

This is my face when the Prometheus host agent provides very incompletemonitoring of NFS v4 RPC operations on modern kernels that can likelyhide problems. For NFS servers I believe that you get only NFS v4.0ops, no NFS v4.1 or v4.2 ones. For NFS v4 clients things confuse mebut you certainly don't get all of the stats as far as I can see.

When I wrote that Fediverse post, I hadn'

So what happened is that Leah Neukirchen ran a Fediverse poll onhow many routes your most complex web app had , and I said that I wasn'tgoing to try to count how many DWiki had and then gave an exampleof combining two things in a way that I felt was a 'route' (partlybecause 'I'm still optimizing the router' was one poll answer).This resulted in a discussion where one of the questions I drawfrom it is "what is a route, exactly"