Keeping your site accessible to old browsers is non-trivial
One of the questions you could ask about whether or not to blockHTTP/1.0 requests is what this does to oldbrowsers and your site's accessibility to (or from) them (see eg the lobste.rs comments on my entry ). Thereason one might care about this is that old systems can usuallyonly use old browsers, so to keep it possible to still use oldsystems you want to accommodate old browsers. Unfortunately the newsthere is not really great, and taking old browsers and
Doing general address matching against varying address lists in Exim
In various Exim setups, you sometimes wantto match an email address against a file (or in general a list) ofaddresses and some sort of address patterns; for example, you mighthave a file of addresses and so on that you will never accept assender addresses. Exim has two different mechanisms for doing this, address lists and nwildlsearch lookups in files that are performed through the '${lookup}' string expansion item .Generally it's better to use address lists, because they have awildcard
The question of whether to still allow HTTP/1.0 requests or block them
Recently, I discovered something and noted it on the Fediverse :
There are still a small number of things making HTTP/1.0 requests tomy techblog. Many of them claim to be 'Chrome/124.
'. Youknow, I don't think I believe you, and I'm not sure my techblog shouldstill accept HTTP/1.0 requests if all or almost all of them aremalicious and/or forged. The pure, standards-compliant answer to
Linux's /dev/disk/by-id unfortunately often puts the transport in the name
Filippo Valsorda ran into an issue that involved, in part, the namingof USB disk drives . To quote therelevant bit:
I can't quite get my head around the zfs import/export concept.
When I replace a drive I like to first resilver the new one as a USBdrive, then swap it in. This changes the device name (even usingby-id).
[...]
My first reaction was that something funny must be going on. Mysecond reaction was to look
The importance of name-based virtual hosts (websites)
I recently read Geoff Huston's The IPv6 Transition , whichis actually about why that transition isn't happening. A largereason for that is that we've found ways to cope with the shortageof IPv4 addresses, and one of the things Huston points to here isthe introduction of the TLS ServerName Indicator (SNI) as drastically reducing the demand for IPv4 addresses for webservers. This is a nice story, but in actuality, TLS SNI was lateto the party. The real
Using pam_access to sometimes not use another PAM module
Suppose that you want to authenticate SSH logins to your Linuxsystems using some form of multi-factor authentication (MFA). Thenormal way to do this is touse 'password' authentication and then in the PAM stack for sshd, use boththe regular PAM authentication module(s) of your system and anadditional PAM module that requires your MFA (in another entryabout this I used the module name pam_mfa).However, in your particular MFA environment it's been decided thatyou don'
Having an emergency backup DNS resolver with systemd-resolved
At work we have a number of internal DNS resolvers , which you very much want touse to resolve DNS names if you're inside our networks for variousreasons (including our split-horizon DNS setup ). Purely internal DNS names aren'tresolvable by the outside world at all, and some DNS names resolvedifferently . However, at thesame time a lot of the host names that are very important to me arein our public DNS because they have public IPs (sort of for historicalreasons),
Doing basic policy based routing on FreeBSD with PF rules
Suppose, not hypothetically, that you have a FreeBSD machine thathas two interfaces and these two interfaces are reached throughdifferent firewalls. You would like to ping both of the interfacesfrom your monitoring server because both of them matter for the machine's proper operation, butto make this work you need replies to your pings to be routed outthe right interface on the FreeBSD machine. This is broadly knownas policy based routing and is oftencomplicated to set up. Fortunately FreeBSD's version of PF supportsa basic
Having rate-limits on failed authentication attempts is reassuring
A while back I added rate-limits to failed SMTP authenticationattempts . Mostly I did it because I wasirritated at seeing all of the failed (SMTP) authentication attemptsin logs and activity summaries; I didn't think we were in any actualdanger from the usual brute force mass password guessing attackswe see on the Internet. To my surprise, having this rate-limit inplace has been quite reassuring, to the point where I no longereven bother looking at the overall rate of SMTP authenticationfailures or
Quoting and not quoting command substitution in the Bourne shell
Over on the Fediverse, I said something :
Bourne shell trivia of the day:
var=$(program ...)
is the same as
var="$(program ...)"
so the quotes are unnecessary.But:
program2 $(program ...)
is not the same as:
program2 "$(program ..)"
and often the quotes are vital.(I have been writing the variable assignment as var="$(...)" for
Menu