We got hit by an alarmingly well-prepared phish spammer

Yesterday evening, we were hitby a run of phish spam that I would call 'vaguely customized' forus, for example the display name in the From: header was "U of T |CS Dept" (but then the actual email address was that of the compromisedaccount elsewhere that was used to send the phish spam). Thedestination addresses here weren't particularly well chosen, andsome of them didn't even exist. So far, so normal. One person herefell for the phish


How to accidentally get yourself with '<code>find ... -name something*</code>'

Suppose that you're in some subdirectory /a/b/c, and you want tosearch all of /a for the presence of files for any version of someprogram:

u@h:/a/b/c$ find /a -name program* -print

This reports '/a/b/c/program-1.2.tar' and '/a/b/f/program-1.2.tar',but you happen to know that there are


Some learning experiences with HTTP cookies in practice

Suppose, not hypothetically, that you have a dynamic web site that makes minor use of HTTP cookies in a way that variesthe output, and also this site has a caching layer. Naturally youneed your caching layer to only serve 'standard' requests fromcache, not requests that should get something non-standard. Oneobvious and simple approach is to skip your cache layer for anyrequest that has a HTTP cookie. If you (I) do this, I have bad newsabout HTTP requests in practice,


Syndication feeds here are now rate-limited on a per-IP basis

For a long time I didn't look very much at the server traffic logsfor Wandering Thoughts , including what was fetching mysyndication feeds and how, partly because I knew that looking atweb server logs invariably turns over a rock or two. In the pastfew months I started looking at my feed logs , and then I spent some time tryingto get some high traffic sources to slow down on an ad-hoc basis , which didn't have much success( partly because browser feed reader addons seem bad


Languages don't version themselves using semantic versioning

A number of modern languages have effectively a single officialcompiler or interpreter, and they version this toolchain with whatlooks like a semantic version (semver) . Sowe have (C)Python 3.12.8, Go 1.23.5, Rust(c) 1.84.0, and so on,which certainly look like a semver major.minor.patchlevel triplet.In practice, this is not how languages think of their versionnumbers.

In practice, the version number


Sometimes you need to (or have to) run old binaries of programs

Something that is probably not news to system administrators who'vebeen doing this long enough is that sometimes, you need to or haveto run old binaries of programs. I don't mean that you need to runold versions of things (although since the program binaries areold, they will be old versions); I mean that you literally need torun old binaries, ones that were built years ago.

The obvious situation where this can happen is if you have commercialsoftware and the vendor either goes out


More features for web page generation systems doing URL remapping

A few years ago I wrote about how web page generation systemsshould support remapping external URLs (this includes systems that convert some form of wikitext to HTML).At the time I was mostly thinking about remapping single URLs andmentioned things like remapping prefixes (so you could remap anentire domain into web.archive.org) as something for a fancierversion. Well, the world turns and things happen and I now thinkthat such prefix remapping is essential; even if you don't startout with it,


A change in the handling of PYTHONPATH between Python 3.10 and 3.12

Our long time custom for installing Django for our Django based webapplication was to install it with 'python3 setup.py install --prefix/some/where', and then set a PYTHONPATH environment variable thatpointed to /some/where/lib/python/site-packages. Up throughat least Python 3.10 (in Ubuntu 22.04), you could start Python 3and then successfully do 'import django' with this; in fact, itworked


The (potential) complexity of good runqueue latency measurement in Linux

Run queue latency is the timebetween when a Linux task becomes ready to run and when it actuallyruns. If you want good responsiveness, you want a low runqueuelatency, so for a while I've been tracking a histogram of it witheBPF , and I put some graphs of itup on some Grafana dashboards I look at. Then recently I improvedthe responsiveness of my desktop with the cgroup V2 'cpu.idle'setting , and questions came upabout how this different from process niceness . When


Sometimes print-based debugging is your only choice

Recently I had to investigate a mysterious issue in our Djangobased Python web application .This issue happened only when the application was actually runningas part of the web server (using mod_wsgi , which effectively runs as anApache process). The only particularly feasible way to dig intowhat was going on was everyone's stand-by, print based debugging(because I could print into Apache's error log; I could have usedany form of logging that would surface the information). Even ifI