Web applications should support being used behind a reverse proxy
I recently wrote about the power of using external authenticationin a web application . The shortversion is that this lets you support any authentication systemthat someone can put together with a front end web server, withlittle to no work on your part (it also means that the security ofthat authentication code is not your problem). However, supportingthis in your web application does have one important requirement,which is that you have to support being run behind a front end webserver, which normally means having the front
Maybe understanding uname(1)'s platform and machine fields
When I wrote about some history and limitations of uname(1) fields , I was puzzled by the differences between'uname -m', 'uname -i', and 'uname -p' in the two variants of unamethat have all three, Linux uname and Illumosuname . Illumos is descended from(Open)Solaris, and although I can't find manual pages for old Solarisversions of uname online, I suspect that Solaris is probably theorigin of both '-i' and '-
Some history and limitations of uname(1) fields
Uname(1) isa command that hypothetically prints some potentially usefulinformation about your system. In practice what information itprints, how useful that information is, and what command line optionsit supports varies widely between both different sorts of Unixesand between different versions of Linux (due to using differentversions of GNU Coreutils ,and different patches for it). I was asked recently if this situationever made any sense and the general answer is 'maybe'.
In POSIX, uname(1) ismore or less
CVEs are not what I'll call security reports
Today I read Josh Bressers' Why are vulnerabilities out of controlin 2024? ( via ),which made me realize that I, along with other people, had beenunintentionally propagating a misinterpretation of what a CVE was(for example when I talked about the Linux kernel giving CVEs toall bugfixes ). To put it simply,a CVE is not what I'll call a (fully baked) security report. It'smore or less in the name, as 'CVE' is short
Stand-alone downloads of program assets has a security implication
I recently read Engineering for Slow Internet ( via ), whichis about what it talks about and also about the practical experienceof trying to use the Internet in Antarctica (in 2023), which has(or had) challenging network conditions. One of the recommendationsin the article was that as much as possible you allow people to dostand-alone downloads with their own tools for it, rather thanforcing them to download assets through your program (which, to putit kindly, may not be
Phish tests and (not) getting people to report successful phish attacks
One of the very important things for dealing with phish attacks isfor people to rapidly self-report successful phish attacks, onesthat obtained their password or other access token. If you don'tknow that an access token has been compromised, even briefly, youcan't take steps to investigate any access it may have been usedfor, mitigate it, and so on. And the sooner you know about it, thebetter.
So called "phish tests" in their current form are basically excusesto explicitly
Spammers do forge various noreply@<you> sender addresses
It is probably not news to anyone reading this that some of thetime, spammers sending you email will forge the email as being fromvarious addresses at your domain, for either or both of the SMTP'MAIL FROM' envelope sender address and the From: header address.Spammers have been doing this to us for years. What I hadn't realized until now, when I looked at theactual addresses being forged, was that spammers were forging variousvariations on 'noreply@ Google recently wrote a (blog) article, On Fire Drills and PhishingTests ,which discusses the early history of what we now call fire drills.As the article covers, the early "fire evacuation tests" focusedmostly on how individual people performed, complete with tellingpeople that things were their own fault for not doing the evacuationwell enough. It then analogizes this to the current way "phish tests"are done. As I read this, I had a reaction on the Fediverse to thegeneral thought of fire A number of years ago I switched to installing various Pythonprograms through pipx so that eachof them got their own automatically managed virtual environment,rather than me having to wrestle with various issues from alternateapproaches . On our Ubuntu servers , it wound up being simpler to dothis using my own version of PyPy insteadof Ubuntu's CPython, for various reasons . I've beenoperating this way for long enough that I didn't really remember howlong. Recently we got our first cloud server , and I I said recently on the Fediverse that ZFS'stransactional guarantees were rather complicated both with andwithout fsync(). I've written about these before in terms of transaction groups and the ZFS Intent Log (ZIL) ,but that obscured the user visible behavior under the technicaldetails. So here's an attempt at describing just the visiblebehavior, hopefully in a way that people can follow despite howit gets complicated. ZFS has two levels of transactional behavior. The basic layer iswhat happens when you don
Phish tests aren't like fire drills
PyPy has been quietly working for me for several years now
ZFS's transactional guarantees from a user perspective
Menu