In some organizations, a foundational principle of their networksecurity (both internal and external) is that you should knowabout everything that is happening on the network. No program, nonetwork service, no system should be accepting or sending unknownnetwork traffic, and you should be able to completely inventoryyour expected traffic patterns. In some environments, this willinclude not just protocol level knowledge but also things like whatDNS names should be being looked up. This detailed knowledge isobviously great for network security and for detecting intrusions

To simplify, mixed content happens when a web page is loaded over HTTPS but it uses 'http:'URLs to access resources like images, CSS, Javascript, and otherthings included on the page. Mixed content is a particularhistorical concern of ours for moving our main web server to HTTPS , because of pages maintained by peoplehere that were originally written for a non-HTTPS world and whichuse those 'http:' URLs. Mixed content came to my mind recentlybecause of Mozilla's announce that Firefox

When I wrote about the current size of our Prometheus setup I mentioned that some of our Prometheus scrape intervals (how often metrics arecollected from a metrics source) were unusual looking numbers like59 seconds and 89 seconds, instead of conventional ones like 15,30, or 60 seconds. These intervals are prime numbers, and we usethem deliberately so that our metrics collection and checks can'tbecome synchronized to some regular process that happens, forexample, once a minute.

Prometheus already scatters

Unlike some other Unix NFS servers, the Linux kernel NFS serverattempts to solve the NFS server 'subtree' export problem , along with a related permissionsproblem that is covered in the exportfs(5) manual pagesection on no_subtree_check. To quote the manual page on thisadditional check:

subtree checking is also used to make sure that files insidedirectories to which only root has access can only be accessed if thefilesystem is exported with no_root_squash (see below), even ifthe

At this point we've been running our Prometheus setup since November 21st 2018, and havestill not expired any metrics, so we have full resolution metricsdata right back to the beginning. Three years ago, I wrote howbig our setup was as of May 2021 , and sincesomeone on the Prometheus mailing list was recently asking how biga Prometheus setup you could run, I'm going to do an update on ournumbers.

Our core Prometheus server is still a

NFS servershave a variety of interesting problems that ultimately exist becauseNFS was first defined a long time ago in a world where (Unix)filesystems were simpler and security was perhaps less of a concern.One of their classical problems is that how NFS clients identifyfiles is surprisingly limited . Anotherproblem is what I will call the 'subtree export' issue.

Suppose that you have a filesystem called '/special', and thisfilesystem contains directory trees '/special/a' and '/special/b'

One of the perhaps less known and under-utilized features of OpenSSHis that you can make connections using specific authorized SSH keysuse specific 'shells', although actually using this may be a littlebit tricky. The basic ingredient to do this is a command= setting on thespecific key in your .ssh/authorized_keys file , but ofcourse there are some wrinkles and you may not be happy if you justset this to a shell-like program.

The first wrinkle is that sshd runs this command

A while back I wrote about how metrics have many different uses , not all of them actionable ones, and usednetwork bandwidth as an example of a non-actionable metric. In acomment, it was suggested that network bandwidth was sort ofactionable in that if we reached capacity limits, that should causeus to add more capacity in one of several ways. My first reactionwas that this was non-actionable for us because it's mostly somethingwe're not in a position to do. My second

Soatok recently published their work on a part of end to endencryption for the Fediverse, Towards Federated Key Transparency .To summarize the article, it is about the need for a Fediversepublic key directory and a proposal for how to build one (this isa necessary ingredient for trustworthy end to end encryption).Soatok is a cryptographer and security expert and I'm not, so Ihave nothing to say about the specifics of the proposed protocoland so on. But as a system administrator, one thing did catch