Here is another consequence of the Debian OpenSSL security bug that I did not hearabout (or realize) until recently: it lets an attacker steal any ofyour SSL certificates that were created with the broken (weak) OpenSSLversions. This includes signed certificates, with all that thatentails .

How the attacker does it is simple. They get your actual certificatesimply by connecting to your SSL-protected service (such as yourwebsite); the SSL protocol exchange necessarily sends them a copy ofyour certificate, complete with

I have a new-found interest in finding outwhat ciphers various SSL servers around here are using in some easy andconvenient way. Doing this in Perl is easy (there's an example here ), but I prefer Python.I'd normally use pyOpenSSL , my favorite Python OpenSSL module , butunfortunately it doesn't (currently) have an interface to thenecessary 'get the connection's cipher' OpenSSL routine, andthere's no visible substitute for it.

(While the .get

Suppose that your web server's SSL certificate's private key iscompromised and stolen by an attacker. Further suppose that you detectthis and replace the compromised certificate with a new one. Now, here'sa question: what damage can the attacker still do with their stolencertificate?

• they can impersonate your web server. In theory they can only do thisuntil their stolen certificate expires; in practice, I think that manyusers ignore 'expired certificate' errors because they are relativelycommon.

  (SSL certificate

Here is an interesting question: does SSL have perfect forward secrecy , so that anattacker who compromises a server key still can't decrypt the server'sconversations?

(While lots of people talk about SSL, thereal name of the whole protocol is TLS , more orless. 'SSL' is the name Netscape gave to the original protocol; TLS isthe name that it was officially standardized as.)

The answer turns out to be 'sort of', as I have found out through abunch

I have a production Solaris 10 x86 server with an onboard serial port. Iwant to make the Solaris 10 equivalent of a getty process listen onit, so that I can still log in when the system's network falls off acliff. Ideally it would do so with a (fixed) baud rate of my choice.This is all that I want to do; in particular, I do not want to makethe serial port into the system console (especially as this wouldrequire a

Here's one of my Linux peculiarities: I don't like initrds. Not becausethey're inefficient or anything like that, but because they are anothermoving part in an already complicated boot process. Worse, they aregenerally a black box moving part; it is pretty difficult to peer insidean initrd to see what it is doing and to make sure that it is correct.

In fact, initrds are so hard to inspect and manipulate that almost noone does, not even distributions. Instead initrds are

The Unix test program makes for a great illustration of the aestheticimportance of syntactic sugar, to go along with its pragmatic effects . Consider the following two shell script lines:

if test -f /some/file; then ...

if [ -f /some/file ]; then ...

In any Bourne shell environment worth its name, these two haveexactly the same results and in fact run exactly the same program(or an imitation of it ), because [ is just another name for test

Here's a statement that's going to get me disliked: qmail is no longer suitable as an Internet mailtransport agent, especially not as an inbound MTA (something thatreceives email from the outside world). There are two reasons for this,the direct problem and then the deeper problem.

The direct problem is that a default, unpatched qmail setup handlesunknown local addresses by accepting them at SMTP time and then bouncingthem. This was okay when qmail was new a decade ago but it is nolonger

I spent part of today updating the system that generates data files forour mail system to add a new computed data file. This system is builtaround a Makefile , and so I added a new rule, which looks like this:

$(CL): $(DL) $(AUXFILE)    crunch-dl $(DL) $(AUXFILE) >$(CL).new    mv -f $(CL).new $(CL)

(The rule is done in two stages so that we