Email addresses are not good 'permanent' identifiers for accounts
Every so often someone needs to create a more or less permanentinternal identifier in their system every person's account. Someof the time they look at how authentication systems like OIDCreturn email addresses among other data and decide that since prettymuch everyone is giving them an email address, they'll use the emailaddress as the account's permanent internal identification.As the famous saying goes,now you have two problems.
The biggest problem with email addresses as 'permanent' identifiersis that people's email
Your kernel panics in ZFS on Linux probably aren't actual kernel panics
Suppose that you have a ZFS based server andone day its kernel messages contain the following:
VERIFY3(sa.sa_magic == SA_MAGIC) failed (1446876386 == 3100762)PANIC at zfs_quota.c:89:zpl_get_file_info()Showing stack for process 6711CPU: 13 PID: 6711 Comm: dp_sync_taskq Tainted
The various phases of Prometheus Blackbox's HTTP probe
Prometheus's Blackbox exporter ( Blackbox ) is the Prometheus component that you usually use to makeexternal checks on services, such as whether a HTTP URL is respondingthe way it should. Blackbox's various ways of checking things arecalled probes (or probers) , and theycan report various sorts of metrics; for instance, any Blackboxcheck involving TLS will provide you with some TLS expiry metrics . One of the HTTP metrics that Blackboxprovides is probe_http_duration_seconds, which reports on howlong
Web CGI programs aren't particularly slow these days
I recently read Reminiscing CGI scripts ( via ), which talkedabout CGI scripts and inpassing mentioned that they fell out of favour for, well, let mequote:
CGI scripts have fallen out of favor primarily due to concerns relatedto performance and security. [...]
This is in one sense true. Back in the era when CGIs were pushedaside by PHP and other more complex deployment environments likeApache's mod_perl and mod_wsgi , their performance was an issue,especially under what
Maybe learning to let new environments be themselves (more or less)
I've been using exmh to read and handle my email forwhat is now a very long time, and I'm completely used to its specificfeatures and behaviors. Or rather that was true until very recently,when for reasons beyond the scope of this entry I switched more or less completelyaway from exmh to MH-E in GNU Emacs .Me being me and GNU Emacs being GNU Emacs, this immediately set meoff on an extended process of customizing MH-E to work better forme .
When
Standards often provide little guidance for handling 'bad' content
In a comment on my entry on what I think SMTP Smuggling enables , Leah Neukirchen noted something important, which isthat SMTP messages that contain a CR or a LF by itself aren't legal:
I disagree. The first mail server is also accepting a messagewith a non-CRLF LF, which violates RFC 5322 section 2.3
CR and LF MUST only occur together as CRLF; they MUST NOT appear independently in the body.
The capitalization in the RFC quote is original, the emphasis is
Do we actually need negative access control rules (in general)?
Every so often, someone has the great idea to simplify how to specifyaccess controls; they will make their overall policy to deny accessby default, and then have all of their access control rules bepositive ones. My reaction to date to these systems is that they'vejust made my life harder, and I was all set to write an entry aboutit except that as I started writing out the details I realized thatI wasn't sure I had a convincing case when negative access rulesmade things much
A DKIM signature on email by itself means very little
In yesterday's entry on what I think the SMTP Smuggling attackenables , I casually said that you weresafe if you ignored SPF results andonly paid attention to DKIM . Assometimes happens, this was my thoughts eliding some importantqualifications that I just take as given when talking about DKIM,but that I should spell out. The most important qualification isthat a (valid) DKIM signature by itself means almost nothing ,which is a bit unlike how SPF works.
First off, anyone can DKIM sign a message
What I think the 'SMTP Smuggling' attack enables
The very brief summary of SEC Consult's "SMTP Smuggling" attack is that under the right circumstances,it allows you (the attacker) to cause one mail server to 'submit'an email with contents and SMTP envelope information that you provideto a second mail server. To the second email server, this smuggledemail will appear to have come from the first mail server (becauseit did), and can inherit some of the authentication the first mailserver has.
(It's important to understand that
Systemd will block a service's start if you manually restart it too fast
Over on the Fediverse, I said something :
Recently I learned that if you manually restart a systemd service toooften (with 'systemctl restart ...'), systemd will by default stopstarting it:
.service: Start request repeated too quickly. .service: Failed with result 'start-limit-hit'.Failed to start .service - Whatever it is. Why would you do that, you ask? Well, consider scripts that updatesome data
Menu
![]()