It's recently struck me that one of the things limiting the evolutionof what is called Web PKI , thegeneral infrastructure of TLS on the web ( cf ),is that it has turned out that in practice, almost anything thatrequires (code) changes to web servers is a non-starter. This ishandily illustrated by the fate of OCSP Stapling .

One way to make Web PKI better is to make certificate revocationwork better, which is to say more or less at all . The Online Certificate Status

Famously, TLS certificates expire, which even today can take websites offline becausethey didn't renew their TLS certificate in time. This doesn't just affectwebsites; people not infrequently create certificates that are supposed tobe long lived, except sometimes they make them last (only) ten years,which isn't long enough . When peopleargue about this, let's be clear; TLS certificate expiry times, like mostforms of key expiry, are fundamentally a hack that exists to deal with theimperfections

Our current ZFS fileserver hardware is getting long in the tooth, so we're working on moving to newhardware (with the same software and operational setup, which we'rehappy with). This new hardware has 512 GB of RAM instead of the 192GB of RAM in our current fileservers, which means that we're goingto have a very big ZFS filesystem cache. Today, I was idly wonderinghow long it would take to fill the cache to a reasonable level withNFS

I've been using virtual machines for various sorts of testing andscratch development for a long time. For many years, that was doneusing VMWare Workstation on my work desktop machine, but in early2022 I reached a tipping point of unhappiness with it and subsequently switchedover to Linux's libvirt . It didn'ttake me long to realize that I could do this on one of our servers,not just my desktop, and I built out a VM host server . Both the VM host

I recently read Aaron Ballman's Musings on the C charter ( via ). As partof musing on backward compatibility in new versions of the C standard,Ballman wrote:

[...] I would love to see this principle updated to set a time limit,along the lines of: existing code that has been maintained to not usefeatures marked deprecated, obsolescent, or removed in the past tenyears is important; unmaintained code and existing implementationsare not. If you cannot update your code to stop relying

The recent news of the time interval is that a ten year certificatebuilt into every Keybase client expired at the end of 2023 . I had a littlereaction to this :

So much quiet damage has been done to so many people's pinned cert orprivate CA deployments by ten-year defaults. So much.

(It happened to us so now our private OpenVPN CA root is much, muchlonger.)

If you're making an internal thing good for ten years, don't (

Over on the Fediverse Matthew Garrett said something whichsparked a question from Nicolás Alvarez :

@mjg59 :This has been bothering me for literally decades, but: why is thenaming for fstat/lstat not consistent with fseek/lseek

@nicolas17 :why is it even called lseek instead of seek?

The most comprehensive answer to both questions came from ZackWeinberg's post ,with a posting by наб and also some things from me adding additional historical information about lseek() .

One of the concepts and jargon of NTP (the Network Time Protocol) is a NTPserver's stratum , which is roughly how far away (in NTP servers)you are from an external source of time. External sources of timeare stratum 0, NTP servers that are directly connected to them arestratum 1, servers that talk to those are stratum 2, and so on.For load reasons, organizations with stratum 0 time sources oftenput an extra level of NTP server in between the public and thosetime

Back at the start of this year I moved my (software RAID) rootfilesystem on my home Fedora desktop from amirrored pair of SATA SSDs to a pair of NVMe drives, and this timeI kept notes (although I didn't necessarily follow them). For myfuture use, I'm going to write this up, complete with the stepsthat I should have done but didn't.

(In this switch, my new disks are nvme0n1p3 and nvme1n1