The (historical) background of 'SMTP Smuggling'
The recent email news is SEC Consult's SMTP Smuggling - SpoofingE-Mails Worldwide ( via ),which I had a reaction to . I found thearticle's explanation of SMTP Smuggling a little hard to follow,so for reasons that don't fit within the scope of today's entry,I'm going to re-explain the central issue in my own way.
SMTP is a very old Internet protocol, and like a variety of old Internetprotocols it has what is now an odd
Why grub-install can give you an "unknown filesystem" error
Over on the Fediverse, I said something :
I hope that the Grub developers will someday fix grub-install so thatthe "unknown filesystem" error is replaced with a better one, like"Grub doesn't have the driver(s) necessary to use your / (or /boot)filesystem" or even "Grub doesn't currently support some filesystemfeatures that are enabled on your / (or /boot) filesystem". Ideallywith the right filesystem name.
This has certainly been coming up and
In Go, constant variables are not used for optimization
Recently I wrote about partially emulating #ifdef with build tagsand consts , exploiting Go's support for dead code elimination , and I saidthat this technique didn't work with variables. That's actually asomewhat interesting result. To see how it is, let's start with asimple Go program, where the following code is the entire program:
package mainimport "fmt"var doThing boolfunc main() { fmt.Println("We may or may not do the thing."Prometheus's group_left() and group_right() operators
I'll start with the motivating story. Suppose, not hypothetically , that you have some Bind nameservers and a Prometheus environment , so you'remonitoring those nameservers with the Bind exporter . One thingthe Bind exporter does is provide the DNS SOA serial number forevery zone Bind is configured to be a primary or a secondary for.If you have a primary and some internal secondaries (as we do),you'd like to be sure that your secondaries have the same DNS SOAserial numbers as your primary
The three email addresses of OpenID Connect (OIDC) in practice
One of the popular forms of web Single Sign On (SSO) systems is OpenID Connect (OIDC) . OIDChas multiple components and is normally used with email addresses,or at least things that look like them, in the form of ' WebFinger is a generalweb protocol for obtaining various sorts of information about'people' and things, including someone's OpenID Connect (OIDC)identity provider .For example, if you want to find things out about 'brad@example.org',you can make a HTTPS query to example.org for/.well-known/webfinger?resource=acct%3Abrad%40example.org and seewhat you get back. WebFinger is on my mind lately as part of medealing with Recently on the Fediverse, Tim Bray wished for #ifdef in Go code : I would really REALLY like to have #ifdef in this Go code I’mworking on - there’s this fairly heavyweight debugging stuff thatI regularly switch in to chase a particular class of problems, butdon’t want active in production code. #ifdef would have exactly theright semantics. Yeah, I know about tags. Thanks to modern compiler technology in the Go toolchain, we cansort of emulate #ifdef through the Suppose, not hypothetically, that you use systemd-resolved and you have a long standing practice of specific DNS search pathso that people can use short domain names. In this environment youprobably need to use systemd-resolved purely through /etc/resolv.conf , and if you do this you may experience anoddity: If you try ' As part of our local network environment ,we have some local DNS resolvers that people here use (or at leastare supposed to use). These resolvers handle multiple jobs; theyresolve our own normal DNS names ( or some of them ), our internal only DNS names, and handleall of the recursion for lookups for external names. Originally weran these resolvers using Bind on OpenBSD. When OpenBSD stoppedsupporting Bind, we switched to a setup using Unbound and NSD . We needed NSD as well as Unbound because For reasons outside the scope of this entry I spent some time today setting up a new Apache-based web server.More specifically, I spent some time setting up a new virtual hoston a web server I'd set up last Friday . Of course thisvirtual host had a TLS certificate, or at least was going to onceI had Let's Encrypt issue me one. Some of the time I'm a littlead-hoc with the process of setting up a HTTPS site; I'll
What /.well-known/ URL queries people make against our web servers
Partially emulating #ifdef in Go with build tags and consts
Why systemd-resolved can give weird results for nonexistent bare hostnames
$ ping nosuchnameping: nosuchname: Temporary failure in name resolution
resolvectl query nosuchname ' it will tell you that the nameis not found, but if you directly query the
We've switched (back) to using Bind for our local DNS resolvers
Seeing how fast people will probe you after you get a new TLS certificate
Menu