Two visions of 'software supply chain security'

Although the website that is insisting I use MFA if I want to useit to file bug reports doesn't use thewords in its messages to me, we all know that the reason it issuddenly demanding I use MFA is what is broadly known as "softwaresupply chain security" and the 'software supply chain' (which is a contentious name for deciding that you're going to rely on otherpeople's open source code ). In thinkingabout this, I feel that you can have (


Apache's odd behavior for requests with a domain with a dot at the end

When I wrote about the fun fact that domains can end in dots andhow this affects URLs , I confidentlysaid that Wandering Thoughts (this blog) reacted to beingrequested through 'utcc.utoronto.ca.' (with a dot at the end) byredirecting you to the canonical form, without the final dot. Thenin comments, Alex reported that they got a Apache '400 Bad Request'response when they did it. From there, things got confusing (andare still confusing).


The status of putting a '.' at the end of domain names

A variety of things that interact with DNS interpret the host ordomain name 'host.domain.' (with a '.' at the end) as the same asthe fully qualified name 'host.domain'; for example this appearsin web browsers and web servers .At this point one might wonder whether this is an official thingin DNS or merely a common convention and practice. The answer issomewhat mixed.

In the DNS wire protocol, initially described in RFC 1035 , we can


In practice, abstractions hide their underlying details

Very broadly, there are two conflicting views of abstractions incomputing. One camp says that abstractions simplify the underlyingcomplexity but people still should know about what is behind thecurtain, because all abstractions are leaky. The other camp says thatabstractions should hide the underlying complexity entirely and dotheir best not to leak the details through, and that people using theabstraction should not need to know those underlying details. I don'tparticularly have a side, but I do have a pragmatic view, which is that many people


Mercurial's extdiff extension and reporting filenames in diffs

We have a long standing Mercurial 'alias' (it's not an alias in theGit sense) called ' hg sdiff ' that provides diffsin non-context form, because for system administrator usage we're often changing things where thecontext of standard (context) diffs isn't useful and we want theterseness of standard diffs. For a long time we've had a littleirritation, where if you changed only one file in a Mercurialrepository 'hg sdiff' wouldn't show you


The web fun fact that domains can end in dots and canonicalization failures

Recently, my section of the Fediverse learned that the paywall ofa large US-based news company could be bypassed simply byputting a '.' at the end of the website name. That is to say, youasked for 'https://newssite.com./article' instead of'https://newssite.com/article'. People had a bit of a laugh (myselfincluded) and also sympathized, because this is relatively obscureDNS trivia. Later, I found myself with


How not to upgrade (some) held packages on Ubuntu (and Debian)

We hold a number of packagesacross our Ubuntu fleet ( for good reasons ),so that they're only upgraded under controlled circumstances. Whichpackages are held varies, but they always include the kernel packages(among other issues, we don't want machines to reboot into newkernels by surprise, for example after a crash or a power issue).Some of our hosts are used for testing, and I generally update theirkernels (far) more often than our regular machines for variousreasons. Until recently


Some reasons why we mostly collect IPMI sensor data locally

Most servers these days support IPMI and can report various sensor readings through it, which you oftenwant to use . In general, you can collect IPMIsensor readings either on the host itself through the host OS orover the network using standard IPMI networking protocols (thereare several generations of them). Locally, we have almost always collected thisinformation locally (and then fed it into our Prometheus basedmonitoring system ), for an assortmentof reasons, some of them general and some of them specific to us.

When


What's going on with 'quit' in an interactive CPython session (as of 3.12)

We're probably all been there at some time or the other:

$ python[...]>>> quitUse quit() or Ctrl-D (i.e. EOF) to exit

It's an infamous and frustrating 'error' message and we've probablyall seen it (there's a similar one for ' exit '). Today I wasreminded of this CPython behavior by a Fediverse conversation and as I wasthinking about it, the penny belatedly dropped on what


How to talk to a local IPMI under FreeBSD 14

Much like Linux and OpenBSD, FreeBSD is able to talk to a localIPMI using the ipmi kernel driver (or device, if youprefer). This is imprecise although widely understood terminology;in more precise terms , FreeBSDcan talk to a machine's BMC (Baseboard Management Controller) thatimplements the IPMI specification in various ways which you seemto normally not need to care about (for information on 'KCS' and'SMIC', see the "System Interfaces" section of OpenBSD's ipmi(4