I can think of at least three things that NAT is good for:

• it compacts address space; many machines can be behind a single IPaddress.
• it makes a decent outgoing-traffic-only firewall, which provides asignificant amount of protection to machines.
• to some degree it denies outsiders what I'll call 'trafficintelligence'; how many machines you have, how they're grouped,and what machine or group is responsible for what traffic.

(Sometimes the lack of traffic intelligence can be a problem

Although fork() theoretically copies the address space of the parentprocess to create the child's address space, Unix normally does notactually make a real copy. Instead it marks everything as copy onwrite and then waits foreither the parent or the child to dirty a page, whereupon it does copiesonly as much as it has to. This makes forks much faster, which is veryimportant since things in Unix fork a lot.

(Disclaimer: this is the traditional implementation for paged virtualmemory. I don

One of the interesting challenges in writing shell scripts isfiguring out how to do as much as is practical with shell builtinsand primitives. Since Bourne shell builtins are such a limited andconstrained environment, the results can be somewhat perverse andpeculiar and thus neat and amusing.

(If you can find an efficient way of doing things, using builtins ismuch faster than having to resort to external programs, especially whenthe system is loaded.)

My challenge today was checking whether a word was in a list of words(

The fork() system call presents a problem for strict virtual memoryovercommit . Because it duplicates a process's virtualaddress space, strictly correct accounting requires that the childprocess be instantly charged for however much committed address space theparent process has; if this puts the system over the commit limit, the fork() should fail.

At the same time, in practice most fork() child processes don't usevery much of the memory that they're being charged for; almost all thetime they

Rejecting supposed spam at SMTP time is somewhat controversial (withthe risk being that you will reject legitimate email). What is lessappreciated is that not rejecting spam at SMTP time is also dangerous;it just has different and less obvious risks.

The problem is that if you do not reject spam you will wind up filteringspam, and the consequences of mis-characterizing legitimate email asspam are much worse if you filter than if you reject. If you rejectoutright, the sender of such email knows that it didn

Being written in Python, DWiki uses a certain amount of object orienteddesign (not huge amounts; it has basically no inheritance hierarchyamong its classes, although they have various interrelations). Inparticular, it has a Page class that represents a particular real pageat the model level (not the presentation level, which is where templateprocessing and so on happens).

Here is a trick question: is a page's URL a property of the page?(That is, should the Page class have a url

Following up yesterday's entry on the general background of system virtual memory limits, here's howLinux deals with this issue. In its traditional way, Linux gives youthree options for what happens when a process tries to allocate somemore memory, controlled by the value of the vm.overcommit_memory sysctl:

• the kernel gives you the memory unless it thinks you would clearlyovercommit the system (mode 0, the default, 'heuristic overcommit').

• the kernel always gives you the memory (mode 1

First, a definition: the committed address space is the total amountof virtual memory that the kernel might have to supply real memory pagesfor, either in swap space or in RAM. In other words, this is how muchmemory the kernel has committed to supplying to programs if they alldecide to touch all of the memory they've requested from the kernel.

(This is less than the total amount of virtual memory used in thesystem, since some things, like program code and memory mapped files,don

Roughly speaking, I can think of two different market segments thatmight be attracted to Red Hat Enterprise Linux:

• the people who need official support and certification, whether forthe base operating system or for some commercial package like Oracleor SAP.
• the people who merely want to put a box in a corner and forget aboutit for three to five years.

Red Hat's pricing for RHEL is clearly pitched at the former market, notthe latter, quite possibly because Red Hat has determined that theycannot charge enough to