Backup systems and how much they do or don't know about storage formats

One of the divides in large scale systems for handling backups iswhether they have their own custom storage format (or formats) forbackups, or whether they rely on outside tools to create what I'llcall 'backup blobs' that the backup system then manages. Thisdivision is fractal, because sometimes what you're backing up is,for example, database snapshots or dumps, and even if the backupsystem has its own custom storage format it may well treat thedatabase dump as an opaque blob of a


Brief early impressions of Emacs' evil Vim emulation

Emacs has a third party package called evil ( also , also ) that is "an extensible vilayer for emacs". Faced with such a pitch I couldn't resist tryingit out just to see it do Vim tricks, and then I experimented to seeif it would be useful in one narrow specific situation for me, withinconclusive but educational results. The short summary is that evil is an impressively comprehensive vim emulation (it passes my vim noticeable features checks ),but I apparently have deeply embedded Emacs reflexes


Holding packages in Debian (and Ubuntu) has gotten easier over the years

In Debian (and thus Ubuntu), apt-get itself has no support forselectively upgrading packages, unlike DNF based distributions. InDNF, you can say 'dnf update package' or 'dnf update --excludepackage' (with wildcards) to only update the package or to temporarilyexclude package(s) from being updated. In apt-get, 'apt-get upgrade'upgrades everything. In order to selectively upgrade packages inmodern apt-get, you can do 'apt-get install


The Vim features that make me a Vim user instead of a Vi user

Over on the Fediverse there was a little Vim versus Vi discussion,and in response to seeing it I posted something :

I used to be a minimal vi user. Over the years I've drifted to beinga not so minimal vim user, and I think the vim features that I'm nowaddicted to are:

  • infinite undo and redo (and a tree view of undo)
  • unlimited backspacing in insert mode (true vi only lets youbackspace so far)
  • vim windows , which let me havemultiple files on

What client host keys OpenSSH ssh uses for host based authentication

One of the authentication options of OpenSSH, if it's enabled onboth the server and the client, is host based authentication usingthe client's SSH host keys. On the client, this is controlled by EnableSSHKeysign and HostbasedAuthentication ; on the server,by HostbasedAuthentication and perhaps IgnoreRhosts . Suppose,not hypothetically, that you use this along with some personal SSHkeys, and some day you try to connect to some new system and getrudely disconnected before you get prompted for a password. Thedirect answer to what


Exim's options for how to DKIM sign various email headers

Recently, I became aware that Exim has a relatively aggressivelist of message headers to sign with DKIM , and as a result we somewhatreduced the list of headers to sign in our environment. As ithappens, Exim has several options for how it signs headers, whichare briefly covered in the documentation for the dkim_sign_headers setting in (DKIM) Signing outgoing messages .The effects of these options aren't really clear until we understand the various meanings of DKIM signing message headers .

When you list a


The various meanings of DKIM signing message headers

When I talked about the issue of what headers to include in emailDKIM signatures , I didn't really coverthe specifics of how you DKIM signemail headers and what the various options mean. The specifics canmatter, especially since they help you (me) understand and navigatethrough the options that mailers (such as Exim )offer here.

In email messages, DKIM signatures appear in a DKIM-Signature header, which lists a bunch of parameters:

DKIM-Signature: v=1; a=rsa-

Our varying levels of what you could charitably call 'physical security'

As I mentioned way back when I discussed how rogue wireless accesspoints are a bigger risk at universities ,one of the unusual things about universities is that we usuallydon't have anywhere near as much physical security as, say, a typicalcompany does. This is because in practice most university buildingsare open to the public, where anyone can walk in the front door (orany of the generally many side doors) and wander through most orall of the halls. This is especially so for the University of


Network firewalls and Ethernet addresses

Over on the Fediverse I mentioned that on some networks we authorizemachines by controlling what Ethernet addresses ('MACs') get whatIP addresses . Inresponse, I was asked a very good question about why not have thefirewall work by Ethernet address instead of IP . A startinganswer is that firewalls have traditionally not had particular goodsupport for working on MACs, and have instead focused on IPs. Butwhy do firewalls prefer to work this way? There are probably severalreasons, but I will theorize that a good


People do change what a particular version is of a Go module

I'll start with an illustration.

; cd /tmp; git clone https://github.com/golangci/golangci-lint; cd golangci-lint; git checkout ab3c3cd6; cd cmd/golangci-lint; go build[succeeds with no error]; go clean -modcache; GOPROXY=direct go build[...]verifying github.com/butuzov/ireturn@v0.2.1: checksum mismatch        downloaded: h1:QXLHriOCzRI8VN