Two visions of 'software supply chain security'
Although the website that is insisting I use MFA if I want to useit to file bug reports doesn't use thewords in its messages to me, we all know that the reason it issuddenly demanding I use MFA is what is broadly known as "softwaresupply chain security" and the 'software supply chain' (which is a contentious name for deciding that you're going to rely on otherpeople's open source code ). In thinkingabout this, I feel that you can have (
Apache's odd behavior for requests with a domain with a dot at the end
When I wrote about the fun fact that domains can end in dots andhow this affects URLs , I confidentlysaid that Wandering Thoughts (this blog) reacted to beingrequested through 'utcc.utoronto.ca.' (with a dot at the end) byredirecting you to the canonical form, without the final dot. Thenin comments, Alex reported that they got a Apache '400 Bad Request'response when they did it. From there, things got confusing (andare still confusing).
The status of putting a '.' at the end of domain names
A variety of things that interact with DNS interpret the host ordomain name 'host.domain.' (with a '.' at the end) as the same asthe fully qualified name 'host.domain'; for example this appearsin web browsers and web servers .At this point one might wonder whether this is an official thingin DNS or merely a common convention and practice. The answer issomewhat mixed.
In the DNS wire protocol, initially described in RFC 1035 , we can
In practice, abstractions hide their underlying details
Very broadly, there are two conflicting views of abstractions incomputing. One camp says that abstractions simplify the underlyingcomplexity but people still should know about what is behind thecurtain, because all abstractions are leaky. The other camp says thatabstractions should hide the underlying complexity entirely and dotheir best not to leak the details through, and that people using theabstraction should not need to know those underlying details. I don'tparticularly have a side, but I do have a pragmatic view, which is that many people
Mercurial's extdiff extension and reporting filenames in diffs
We have a long standing Mercurial 'alias' (it's not an alias in theGit sense) called ' hg sdiff ' that provides diffsin non-context form, because for system administrator usage we're often changing things where thecontext of standard (context) diffs isn't useful and we want theterseness of standard diffs. For a long time we've had a littleirritation, where if you changed only one file in a Mercurialrepository 'hg sdiff' wouldn't show you
The web fun fact that domains can end in dots and canonicalization failures
Recently, my section of the Fediverse learned that the paywall ofa large US-based news company could be bypassed simply byputting a '.' at the end of the website name. That is to say, youasked for 'https://newssite.com./article' instead of'https://newssite.com/article'. People had a bit of a laugh (myselfincluded) and also sympathized, because this is relatively obscureDNS trivia. Later, I found myself with
How not to upgrade (some) held packages on Ubuntu (and Debian)
We hold a number of packagesacross our Ubuntu fleet ( for good reasons ),so that they're only upgraded under controlled circumstances. Whichpackages are held varies, but they always include the kernel packages(among other issues, we don't want machines to reboot into newkernels by surprise, for example after a crash or a power issue).Some of our hosts are used for testing, and I generally update theirkernels (far) more often than our regular machines for variousreasons. Until recently
Some reasons why we mostly collect IPMI sensor data locally
Most servers these days support IPMI and can report various sensor readings through it, which you oftenwant to use . In general, you can collect IPMIsensor readings either on the host itself through the host OS orover the network using standard IPMI networking protocols (thereare several generations of them). Locally, we have almost always collected thisinformation locally (and then fed it into our Prometheus basedmonitoring system ), for an assortmentof reasons, some of them general and some of them specific to us.
When
What's going on with 'quit' in an interactive CPython session (as of 3.12)
We're probably all been there at some time or the other:
$ python[...]>>> quitUse quit() or Ctrl-D (i.e. EOF) to exit
It's an infamous and frustrating 'error' message and we've probablyall seen it (there's a similar one for ' exit '). Today I wasreminded of this CPython behavior by a Fediverse conversation and as I wasthinking about it, the penny belatedly dropped on what
How to talk to a local IPMI under FreeBSD 14
Much like Linux and OpenBSD, FreeBSD is able to talk to a localIPMI using the ipmi kernel driver (or device, if youprefer). This is imprecise although widely understood terminology;in more precise terms , FreeBSDcan talk to a machine's BMC (Baseboard Management Controller) thatimplements the IPMI specification in various ways which you seemto normally not need to care about (for information on 'KCS' and'SMIC', see the "System Interfaces" section of OpenBSD's ipmi(4