On the Fediverse, I recently saw a poll about whether people leftSSH generally accessible on its normal port or if they moved it;one of the replies was that the person left SSH on the normal portbut disallowed password based authentication and only allowed publickey authentication. This almost led to me posting a hot take, butthen I decided that things were a bit more nuanced than my firstreaction.

As everyone with an Internet-exposed SSH daemon knows, attackersare constantly attempting password guesses against various accounts.But

We use mod_wsgi to host our Django application , but if Iunderstood the various mod_wsgi settings for how to run your PythonWSGI application when I originally set it up, I've forgotten it allsince then. Due to recent events , exactly how mod-wsgi runs ourapplication and what we can control about that is now quite relevant,so I spent some time looking into things and trying to understandsettings. Now it's time to write all of this down before I forget it(

The ultimate cause of our mystery with Django on Ubuntu 24.04 is that versions of Python 3.12before 3.12.5 have a bug where builtin types in sub-interpretersget unexpected additional slot wrappers ( also ), and Ubuntu 24.04has 3.12.3. Under normal circumstances, ' list ' itself doesn'thave a ' __str__ ' method but instead inherits it from ' object ',so if you have a

These days, I almost entirely report bugs in open source softwareas part of my work. A significant part of this is that most of whatI stumble over bugs in are things that work uses (such as Ubuntuor OpenBSD), or at least things that I mostly use as part of work.There are some consequences of this that I feel like noting today.

The first is that I do bug investigation and bug reporting on worktime during work hours, and I don't work on "work bugs

We have a long standing Django web application that these days runs under Python 3 and a more modern version ofDjango . For as long as it has existed, it'shad some forms that were rendered to HTML through templates, andit has rendered errors in those forms in what I think of as thestandard way:

{{ form.non_field_errors }}{% for field in form %}  [...]  {{ field.errors }}  [...]{

One of the innovations that the V7 Bourne shell introduced was builtin shell wildcard globbing, which is to say expanding things like * , ? , and so on. Of course Unix had shell wildcards wellbefore V7, but in V6 and earlier, the shell didn't implement globbingitself; instead this was delegated to an external program, /etc/glob (this affects things like looking into the history of Unix shellwildcards , because you have to know to look atthe glob source, not

For reasons outside of the scope of this entry, we recently modifiedour IMAP server so that it would only return 20,000 results froman IMAP LIST command (technically 20,001 results). In our environment,an IMAP LIST operation that generates this many results is because one of the people who can hit this haverun into our IMAP server backward compatibility problem . When we made this change, we had achoice for what would happen when the limit was hit, and specifically

A famous issue when setting up DNS records for domains is that youcan't combine a CNAME record with any other type, such as a MX record or a SOA (which is required atthe top level of a domain). One modern reason that you would wantsuch a CNAME record is that you're hosting your domain's web siteat some provider and the provider wants to be able to change whatIP addresses it uses for this, so from the provider's perspectivethey want you to

Recently I read Rust, reflection and access rules . Amongother things, it describes how a hypothetical Rust reflection systemcouldn't safely allow access to private fields of things, andespecially how it couldn't allow code to set them through reflection.My short paraphrase of the article's discussion is that in Rust,private fields can be in use as part of invariants that allow unsafeoperations to be done safely through suitable public APIs. Thisbrought into clarity what had previously been a somewhat odd seemingrestriction in