I recently set up our first cloud server , in a flailingway that's probably familiar to anyone who still remembers theirfirst cloud VM (complete with a later discovery of cloud provider'upsell' ). Thebackground for this cloud server is that we want to check externalreachability of some of our systems , in addition tothe internal reachability already checked by our metrics andmonitoring system . The actualimplementation of this is quite simple; the cloud server runs aninstance of the Prometheus Blackbox agent for service checks ,

In the process of upgraded my office desktop to Fedora 40, I woundup needing to turn off the X server's CapsLock modifier . For people witha normal keyboard setup, this is simple; to turn off the CapsLockmodifier, you tap the CapsLock key. However, I turn CapsLock intoanother Ctrl key (and then I make heavyuse of tapping CapsLock to start dmenu ( also )), which leaves theregular CapsLock functionality unavailable to me under normalcircumstances. Since I don't have a

In X, like probably any graphical environment, there are a varietyof layers to keys and characters that you type .One of the layers is the input events that the X server sends toapplications. As covered in the xlib manual ,these contain a keycode ,representing the nominal physical key, a keysym , representingwhat is nominally printed on the key, and a bitmap of the modifiers currently in effect, which are things like 'Shift' or 'Ctrl' ( cf ).The separation between keycodes and keysyms

In a comment on my entry on how the current Linux kernel CVEpolicy is sort of predictable , Ian Z akanobrowser asked what a distribution like Debian is supposed to dotoday, now that the kernel developers are not going to be providingsecurity analysis of fixes, especially for unsupported kernels (thisis a concise way of describing the new kernel CVE policy ). I don'tparticularly have answers, but I have some thoughts.

The options I can see today are:

• More or less carrying on with a distribution

One of the controversial recent developments in the (Linux kernel)security world is that the Linux kernel developers have somewhatrecently switched to a policy of issuing CVEs for basically allbugfixes made to stable kernels . This causes thekernel people to issue a lot of CVEs and means that every new stablekernel patch release officially fixes a bunch of them, and both ofthese are making some people annoyed. This development doesn'treally surprise me (although I wouldn't have predicted it in advance),because I feel

Suppose, not hypothetically , that you'retrying to check the NS records for a bunchof subdomains to see if one particular DNS server is listed (becauseit shouldn't be). In DNS, there are two places that have NS recordsfor a subdomain; the nameservers for the subdomain itself (whichlists NS records as part of the zone's full data), and the nameserversfor the parent domain, which have to tell resolvers what theauthoritative DNS servers for the subdomain are. Today I

One of the controversial recent developments in the (Linux kernel)security world is that the Linux kernel developers have somewhatrecently switched to a policy of aggressively issuing CVEs forkernel changes. It's simplest to quote straight from the officialkernel.org documentation :

Note, due to the layer at which the Linux kernel is in a system,almost any bug might be exploitable to compromise the security of thekernel, but the possibility of exploitation is often not evident whenthe bug is fixed. Because of this, the

To simplify greatly, OCSP isa set of ways to check whether or not a (public) TLS certificatehas been revoked. It's most commonly considered in the context ofweb sites and things that talk to them. Today I had yet anotherproblem because something was trying to check the OCSP status ofa website and it didn't work . I'm sure there'sa variety of contributing factors to this, but it struck me thatone of them is that Chrome, the dominant browser,

Over on the Fediverse, I said something :

Every configuration file format should have a general 'includethis file' feature, and it should support wildcards (for 'includesubdir/*.conf'). Sooner or later people are going to need it,especially if your software gets popular.

It's unfortunate that standard YAML does not support this, althoughit's also sort of inevitable (YAML doesn't require files at all). Thisleaves everyone using YAML for their configuration file format to