Everything you never wanted to know about PKI but were forced to findout [PDF]by Peter Gutmann is a set of slides about just that: a pile of the wartsand issues with PKI in general and the SSL model in specific.If you're interested in the whole field, his home page has links to enough additionalpapers to keep you reading for some time.

(From Chris Samuel ,and that in turn from Russell Coker .)

The common SSL model is that you verify someone's good nature bychecking to see that their certificate is signed by an approved CA.For example, if you are verifying that hosts you are connecting toare approved you would make up a CA certificate, then make up a bunchof host certificates and sign them with the CA certificate. When youconnect to a machine, you verify that its certificate is signed by yourCA certificate.

(Except that that's a simplification; you actually need to verify that

It is nice that Python's socket module has simple SSL support (although it has some limitations ). My grump is that it doesn't giveyou any good way of checking the identity of the server'scertificate, which is especially annoying as the SSL codedoesn't do any certificate verification.

(This matters to me because I have recently become quiteinterested in being able to verify machines by checkingthat they have a specific SSL certificate.)

What SSL objects have is .issuer( ) and

In theory I ought to be just the sort of person who has a GPG key; afterall, I'm geeky, quite aware of how easy it is to impersonate people onthe Internet, reasonably concerned about privacy, and so on. But inpractice I don't have one because I don't feel I could keep it secureenough for what people believe a digital signature implies.

As a system administrator, I get to be quite aware of all the waysthat a bad guy could attack the

Interactive VLAN configuration is done with the vconfig program. Thebasic usage is ' vconfig add eth0 6 '; this makes a new Ethernet devicecalled eth0.6 (by default; vconfig can change this, but you probablydon't want to). ' vconfig rem eth0.6 ' will then remove the VLAN.

A configured VLAN is up enough so that you can receive traffic on it. Ifall you're interested in is doing things like bridging virtual machinesonto the VLAN's

I have somewhat recently written a program that makes heavy use of Python's xmlrpclib module . While thexmlrpclib module is very nice, the whole experience has given me somestrong views on how it does exception handling.

The basic problem with xmlrpclib's error handling is that it doesn'tcapture exceptions from stuff that it calls, so they leak out to you.Fortunately I don't think xmlrpclib calls anything that can raise errorsexcept the socket module, but I'm not sure (so my program

It makes me nervous that my fingers appear to feel that the rightthing to type after ' find . type f -print | ' is ' xargs rm -f '.Sometimes they're quite insistent about it.

I am not sure where this reflex comes from, because I don't thinkI've done that particular operation that many times. It certainlymakes typing 'for all files' find operations a twitchy exercise, andI get to worry that someday I will, eg, accidentally delete all

This week, we:

• got 14,362 messages from 263 different IP addresses.
• handled 18,805 sessions from 1,257 different IP addresses.
• received 232,353 connections from at least 81,631 different IPaddresses.
• hit a highwater of 26 connections being checked at once.

Weekly email volume has returned to normal, which is not surprising(the university is back in full session). Total volume is up a

It's simple: just don't offer any sort of comment preview option.

This insures that I will never leave a comment, no matter how much Ihave something I want to say. Without the chance to preview my workbefore I'm committed to it, I feel too nervous and it becomes too muchof an annoyance.

This is one of those blog software things that really puzzle me. It isnot as if blogs all format comments in the same way, so I would thinkthat software