As a side note to looking up hostnames from IP addresses for people who use /etc/hosts , note that /etc/hosts lookups work badly in the presence of hosts with multipleIP address, since most gethostbyname() implementations will onlyreturn the first IP address that they find in /etc/hosts . These daysyou really want a minimal /etc/hosts and a reliable DNS server, unlessyou have special concerns .

(The gethostbyname() behavior is sensible, since otherwise it wouldalways have to

By a persistent VNC session, I mean a session that you can connect yourVNC viewer to, do stuff, disconnect from, and then later come back toconnect to it again. This makes it the graphical equivalent of screen , at least for me.

(Much like screen , it also gives you a certain amount of immunityagainst network and workstation stability problems for critical tasksthat you don't want interrupted. More and more, systems have to bemanaged graphically instead of through text interfaces, which means that

In succinct form:

The problem with Solaris 10 x86's boot process is not so much that itis trying to pretend that it has OpenBoot, the problem is that it isdoing such a clumsy and awkward job of faking it.

I will admit that I am not a fan of the Solaris 10 x86 boot process. Iunderstand why it is trying very hard to pretend that it is just likeSPARC hardware with OpenBoot, and I can even sympathize with Sun'smotivations for

Here is something that has struck me recently: virtualization andabstraction cannot eliminate security concerns, they can only move themfrom one place to another . In other words, virtualization by itselfdoesn't do anything to prevent security bugs; it just means that theyhappen in a different place.

(By virtualization I mean more than hardware and OS virtualization, Ialso include things like the JVM.)

The advantage of virtualization is that it moves the problem inwards,towards the center of the security onion, where fewer people

Yesterday I said that the kerneldirectly executes programs in place. Because I feel like walkingthrough the details, here is what the kernel does to start ELF programs onx86 Linux; for simplicity, I'm going to talk about 32-bit programs.

• First, the kernel maps the program's text, data, and BSS into memory. Almost allprograms require these to be mapped at fixed addressesstarting from 0x08048000 (128 Mb)

The real problem with setuid scripts on Unix isnot that writing secure shell scripts is challenging and obscure, itis that they are fundamentally insecure because of how the kernel runsthem. While the kernel runs programs by directly loading them intomemory , it runs scripts by running thescript's interpreter with the filename of the script, leaving it up tothe interpreter to read and execute the script itself. As is normal onUnix, there is nothing that keeps what file the filename points tothe same between these two

There's a lot of argument in general about what is (merely) a 'scriptinglanguage' and what is a fully fledged programming language, deservingto hold its head up high besides grown up languages like C, Java, andPascal.

Unix is a simpler place, because it has a simple and very cleardefinition of what is a script versus what is a program. To wit: if thekernel can directly exec() you in place as is, you are a program. Ifnot, you

I've recently been writing some small programs to digest multilinerecords which don't have an end of record marker, just a start of recordone (in my case, the output of Solaris iostat ). People who've writtenawk probably know the natural structure that results from dealing withthis purely line at a time; you wind up with a situation where youaccumulate information over the course of the record, and then use the'start of new record' line to print out everything, reset counters

Every so often, people do silly things in the name of anti-spamwork. While we can curse the creators of stupid polices like 'sendnotification email to the envelope origin address of mail scored asspam' as idiots, people aren't really, and I think it is more fruitfulto consider why such policies get created.

(There is a university subdomain in Texas that does this. Really.When we started getting these notices, I almost wrote them a verygrumpy letter asking what sort of idiots