The annoying timing of future SSL certificate renewals
One of the most annoying things about the whole ipsCAsituation for me is what it's goingto do to our SSL certificate renewal timing (ipsCA gaveeducational institutions free SSL certificates, so we have abunch from them). In his entry about ipsCA, Bob Plankers commented:
It would also be nice to have all those SSL certificates co-terminate,so we can renew them all at once.
This is not an attractive idea for me. There's two problems with this,one general one and
Some OpenSSL and SSL certificate basics
I'm writing this down for the traditional reason, that being to try tofix it in my mind for the next time I have to deal with all of thisstuff (which will probably be in about a year):
- a SSL key is basically a blob of data. It has no interesting attributesassociated with it, and it is thus reusable if you want to. There areprobably OpenSSL commands to dump key information, but I haven't looked.
SSL keys are generated with
openssl genrsa. It
Things that limit the performance of hardware acceleration
Suppose that you have an infinitely fast hardware accelerator, one thatcan compute something of interest in no time at all. What externalissues limit the total performance advantage that you can get by puttingthis hardware accelerator in a system?
I can think of the following limiters:
- main memory speed limits , the latency andbandwidth limits of system RAM. This limits how fast you caninteract with system memory.
- the speed limits of the underlying hardware that you're talking to,if you are. For example, hardware RAID
Linux's non-strict overcommit is the right default
I've written before about Linux's overcommit settings and the general background of virtual memorylimits . Several years of experience ofrunning various general use systems with strict overcommit and payingattention to the numbers have convinced me of something: non-strictovercommit is the right default on Linux , and probably on any modernUnix in general.
I have come to this view through experimental evidence, namely thatall of our user login machines generally run with significant amountsof committed address space, yet they have lots of free memory
The advantages of open source software RAID
In light of a recent entry , I feel likesinging the praises of software RAID, especially open source softwareRAID. For the moment, let's set aside the performance and cost issues of software RAID versus hardware RAID, becauseit's honestly not what I really care most about.
Software RAID in general has two major advantages:
- much more of what is going on is exposed, instead of being lockedaway inside a black box. For example, you are guaranteed to seethe raw disk status and error
Another demonstration of SSL Certification Authority (in)competence
Every so often, another SSL CA provides a demonstration that they arerun by baboons, and not very smart ones at that. Past demonstrationshave involved security, or the lack of it ; the currentone involves terrible business practices, which is arguably worse (atleast in terms of how large a failure it is).
Put simply, the current root CA certificate for ipsCA expires onDecember 29th. This will orphan and invalidate all SSL certificatessigned (directly or indirectly) with it, which is almost
How not to set up your DNS (part 20)
I call this one the case of the non-redundant redundant MX; it's muchlike the first time except more thorough:
; sdig mx mumble.utoronto.ca.0 mail.mumble.utoronto.ca.0 jackson.mumble.utoronto.ca.5 mail.mumble.utoronto.ca.; sdig a mail.mumble.utoronto.ca.128.100.X.Y; sdig a jackson.mumble.utoronto.ca.128.1
Do you have a network layout diagram?
Here's a not entirely hypothetical question: suppose that your machinesare coming up after a building-wide power outage, except that ascattering of them (on various different networks) are either not up ornot reachable. Could you look at what machines are failing to appear andidentify whether there's likely to be a switch that's failed, and if so,where that switch would be?
(This happened to us yesterday. There was some confusion, because guesswhat we don't have
Using OpenID for local web application authentication
We have a problem, and that problem is authentication. In a not uncommonpattern, we have a central set of core services, run by a core group;email, fileservers, the login servers, and so on. Then we have a bunchof other people who want to build various web applications, rangingfrom departmental things all the way down to graduate students puttingtogether projects.
Many of these web applications need accounts and authentication. Thenatural and best logins and passwords to use are people's existingdepartmental
Some things about getting useful output from time
No version of time has ever had what you could call a genuinely usefuldefault output format, at least not for benchmarking and testing. ThePOSIX (and System V) standard format has all of the information you wantin the right format (the times in simple seconds), but spreads it acrossmultiple lines; the BSD format used by csh puts the times in 'humanreadable' format of hours, minutes, and seconds, and includes a bunchof additional information (much of which is inaccurate, useless,