On blocking access from large IP ranges
The Register recently republished a SecurityFocus article by ScottGranneman, called On blocking Chinese IP addresses ,discussing the implications of blocking essentially all of Chinafrom accessing a web host due to the number of spam attacks fromChinese networks.
In the course of the article, Mr Granneman asks:
Here's a good question. What needs to come first: the needs of the webservers my friends run, or the needs of a guy sitting in Shanghai thatwants to view the content of that web site?
In my opinion
LILO vs GRUB: why LILO still wins for servers
IBM Developerworks recently carried an article comparing the LILO and GRUB Linux bootloaders that wound up concludingthere was nothing LILO did better than GRUB.
I beg to disagree, and strongly. LILO has two important features forserver operation:
First, a one-shot mode, where LILO tries booting a particular kernelonly once ; after that, it goes back to its normal default. This isa reassuring way of trying new kernels that you are not entirely surewill work. If you set the kernel up to reboot on panics
The Version Control System dependency problem
One of the aphorisms of HCI design is that if users keep making the sameerror with a program, it's the program and not the users that's actuallywrong. By this standard, almost all version control systems really needan HCI makeover, because there is one classical mistake that users keepmaking over and over.
The mistake: make a change, then make an unrelated change, then make athird unrelated change (perhaps fix three different and independent bugsin entirely different files). You get a
Python's dangerous automatic Unicode conversions
I'm a little bit late to the Unicode in Python debate party; Ian Bicking and others were writingabout it back in early August, for example here and here .By now, lots of people around the Python blog community have weighedin on the high-level issues.My grumbles about Python's Unicode support are more low-level, likethe problem with Unicode in hashes that Ian Bicking found.
Specifically, I think that Python is too helpful with automaticconversions between Unicode strings and byte strings,
Weekly spam summary on August 27th, 2005
The overall SMTP connection rate is up from last week , as we hit 213,000 SMTPconnections from at least 36,000 different IP addresses.The SMTP frontend hit a new highwater of 22 simultaneous connectionsbeing checked at once. It's possible that a lot of this is from spammersforging our domains as the MAIL FROM of their spams.
Top 10 kernel level SMTP rejections:
Host/Mask Packets Bytes213.4.149.1
How not to package software in RPMs
I spent today wrestling various pieces of commercial software into ourFedora Core 4 auto-install environment. In theory this should havebeen fast and dirt simple, because all of the vendors had thingspacked up in RPMs.
In practice, most vendors produce RPMs that are glowing examples ofhow not to package your software in RPM form. Instead of creating RPMsthat are fully installed software, they generally create RPMs that arelittle more than lightly packaged up files and then add huge amountsof post-install scripts to shuffle everything
Two faces of RSS
I recently came to a realization that RSS (and syndication in general)has two faces:
- notification of new information
- rearranging information from feeds
This neatly explains something that's been puzzling me for a while:why I find RSS sometimes very useful and sometimes very irritating.
Notification works great, except for web sites that already update asfrequently as I normally read them. (For example, Slashdot, which Ionly browse once or twice a day. If my RSS reader were to tell me thatSlashdot had no new
Explaining rubber duck debugging
Rubber duck debugging is the process of explaining your problem out loud to a suitableobject (a rubber ducky or another person, take your pick); thealternate version is to write down your problem, for example in agrumbling blog entry or an email. This may sound very peculiar ifyou've never done it, but it works surprisingly well.
(Obligatory attribution dammit to the Centresource.com blog entry on it.)
As it happens, my leading explanation for why this works so well hasalready been
Completely using an alternate yum configuration
As part of automatic installs of Fedora Core, our customization stepinstalls of the current Red Hat updates from a local mirror. We use yum for this, because it both handles dependencies and uses compactmetadata files instead of having to read all of the update and base OSRPMs themselves. (We have 100 megabit networks, but it still adds upand slows down installs.)
We do this by feeding yum a custom configuration file; basically wetake the standard /etc/yum.conf file and add
Another aphorism of system administration
If a piece of information doesn't have to be correct for the systemto work, sooner or later it won't be.
(Yanked out of my spam by ASN summary , where aversion of it got a mention in passing.)
It's easy to see this aphorism in action. For example, if yourhost/domain name to IP address mapping information is wrong you noticeright away. But nothing common breaks if the information to map froman IP address to a hostname is missing,