Some notes on Solaris 9's Sunscreen IP filtering package

I spent today reading up on Sunscreen, the Solaris 9 bundled IPfiltering system. It's been interesting, partly because Sunscreen'sbuilt around a different packet matching model than I'm used to, anduses a great deal of different terminology (for example, what I thinkof as 'transparent bridging' is called 'stealth mode').

Sunscreen doesn't actually match packets as such. Instead you define'services', for which you specify some combination of destinationand/or source ports


The old nameserver glue record hell

A recent commentator on HowNotToDoDNSI has prompted me to write aboutthe hell that glue records could be in in the Internet's old days. Toreally cover the horror, I'll start with the ordinary glue recordhorror.

Glue records are additional A records that get returned by higherlevel nameservers when people ask for NS records to avoid recursionproblems that would otherwise ensue when, eg, foo.com has www.foo.com as its nameserver. This can be exploited to optimize DNSlookups a bit, as


Is concurrency 'hard'?

Is concurrency hard? You can certainly find people arguing both sidesof the issue if you look hard enough (mostly for rather than against).But I think the question may be blurring two things together that areworthwhile to separate: 'concurrency is difficult to learn andunderstand', and 'concurrency is tricky to implement correctly'.

For example, in his reaction to Joel Spolsky's Java Schools article ,Tim Bray gives a little taxonomy of difficulty:

My experience differs from Joel's in another respect:


Python synergies in list addressing

Something I took from this Ian Bicking entry is that synergies and elegance don't just happen; someone usually workedhard to make it all come out neatly. Python lists have an interestingcase of this; some apparently odd decisions in other places turn out tobe needed to create useful (and error-avoiding )synergies.

Python lists (and sequences in general) are indexed from 0. Zero-basedindexing presents a problem, which can be succinctly stated as this:list element indexes run from 0 to len


In practice, there are multiple namespaces for URLs

In theory, the HTTP and URI/URL standards say that URLs are all in asingle namespace, as opposed to GET , POST , etc all using differentURL namespaces, where some URLs only exist for POST and some onlyexist for GET .

In practice, I believe that web traversal software should behave as ifthere were two URL namespaces on websites: one for GET and HEAD requests, and a completely independent one for POST requests.Crawling software should not issue 'cross-namespace' URL requests,because you


Universities are peculiar places

In particular, universities have a computing environment that is morepeculiar than I think a lot of people realize (sometimes even peopleinside universities, because from some angles it is very easy tomiss). I wrote about one example of this (and the practical effects ithas) back in UniversityFirewalls .

One of the ways that they are peculiar, a way that I think is at thecore of a lot of things, is this:

In most parts of most companies, communicating with the rest of thecompany is


Weekly spam summary on December 31st, 2005

This week we received 12,270 email messages from 159 different IPaddresses. Our SMTP server handled 31,972 sessions from 2,643different IP addresses. Session volume is down from last week , which is a relief, although it'snot back down to the historical levels yet.

However, connection volume has not dropped substantially from last week : 260,000 connections from at least 53,760 different IPaddresses,


A logical consequence of def being an executable statement

I've mentioned before that in Python, def is actually an executablestatement (in FunctionDefinitionOrder ). A logical consequences of thisis that default values for function arguments are evaluated only once,when the def runs.

I say this because expressions generally get evaluated when any Python statement runs, so the expressions in things like ' deffoobar(a, b=greeble(c), d=None): ' are not being an exception. Theexception would be if they were not evaluated then and were instead


Notes on getting a Solaris hardware inventory

Being able to find out what hardware is in a random machine is one ofthose things you don't think about very much until you inheritresponsibility for a bunch of machines that you didn't build yourself.

The best hardware inventory program I've used is SGI's hinv (although it doesn't have enough disk information). Linux has decenthardware inventory support, but not bundled into a single command; youhave to look through a bunch of /proc files and know a few commandslike


On Lisp's fundamental data structure

One of the joys of learning new programming languages is the ahamoments when something really clicks. The biggest aha moment I've everhad was with Prolog, when an assignment went from nigh impossible totrivial in a blinding flash of obvious insight.

But the one I remember most distinctly is from years ago, when I waslooking at Lisp (again), and finally realized that the fundamentaldata structure of Lisp is not lists but cons cells .

While the major use of cons cells is building lists, cons cells