@cks@mastodon.social avatar

cks

@cks@mastodon.social

That cks. Overcommitted sysadmin, photographer, bicyclist, and other multitudes. I write a lot of words for a programmer. he/him

This profile is from a federated server and may be incomplete. Browse more on the original instance.

cks, to random
@cks@mastodon.social avatar

In re comparing fire drills to phishing tests[1], if phishing tests were like fire drills, they would test the response to a successful phish. Was the person phished able to rapidly report and mitigate things? Do the organization's phish alarms work and reach people? Etc etc.

Current "phishing tests" are like testing people to see if they accidentally start fires if they're handed (dangerously) flammable materials. That's not a fire drill.

1: https://infosec.exchange/@sambowne/112513766095541271

mhoye, to random
@mhoye@mastodon.social avatar

I do love this city in the summer tho

cks,
@cks@mastodon.social avatar

@mhoye @bitprophet I'm going to go out on a bit of a limb and guess that this is more or less from here: https://maps.app.goo.gl/fRsE3yhPY5fNdk2DA

(With the actual real photograph/pano not having random clutter in it.)

cks,
@cks@mastodon.social avatar

@bitprophet @mhoye I have the advantage that my bike club has historically started a lot of weeknight group rides (some of which I've led) from a place just down the street from this vantage point. So I looked at the original pano, even in potato form, and thought 'that looks familiar ... wait'.

cks,
@cks@mastodon.social avatar

@mhoye @bitprophet It really is a fantastic spot, especially in the evening, and this is a beautiful picture.

cks, to random
@cks@mastodon.social avatar

Pretty much every time I change the time of an alarm on my phone I am irritated all over again at the fundamental laziness and robotic computer-ness of time controls. What I want to do is move the time forward or backward, not to separately change (or set) the hours and the minutes. But separate 'hour' and 'minutes' spinners or options are the easy computer way out so that's how UIs implement it.

cks, to random
@cks@mastodon.social avatar

Dear self, just because you have finished listening (once) to all of the new music you picked up last BC Friday is no reason to go pick up more. Among other things, you still have ~400 or so releases not listened to from two 'buy our 250-release catalog for cheap' offers in the past. So at least listen to some more of them before giving in to temptation. (Yes I have a 'to purchase' list.)

(Normally I would hold off for the next BC Friday but that's not going to be for months.)

cks, to random
@cks@mastodon.social avatar

It's surprisingly difficult to bicycle at 10 km/h and no more, at least on my bike with standard 700c wheels. It generally feels like if I sneeze I'll go clearly over and it's easy to drift into too fast.

(Toronto's Mt. Pleasant cemetery has an official bike speed limit of 10 km/h. One of my personal perverse acts is that when I go through it riding by myself, as I did today, I try to stick to this speed limit. It's absurdly hard to go that slow but oddly fun.)

cks, to random
@cks@mastodon.social avatar

It has been '0' days since I wrote 'Oath' when I meant to write 'OAuth'. Such a tempting not exactly a typo, more a mind slip.

(Also, don't ask me to describe the differences between OIDC and OAuth2, and I suspect that all sorts of documentation blurs the two and talks about 'OAuth2' when it really means 'OIDC'. For example, I'm not sure Grafana would be happy with a pure OAuth2 provider that didn't add the extra OIDC stuff, although maybe it would be.)

Binder, to random
@Binder@petrous.vislae.town avatar

Carefully generating all TLS certs to expire in 2038

cks,
@cks@mastodon.social avatar

@Binder Live daringly, make your TLS certificates expire in 2051. Then you can find two sorts of bugs at once!

cf: https://utcc.utoronto.ca/~cks/space/blog/tech/TLSTimeRepresentations
(tl;dr: TLS certificates switch internal time representation for 2050 (UTC) and later.)

cks,
@cks@mastodon.social avatar

@puppygirlhornypost @Binder And why bother monitoring the expiry time of private TLS certificates that expire in +10 years or more? Surely we'll remember then, if we even need them any more.

(Spoiler: no, and also ten years is not enough as we learned the hard way, https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TenYearsNotLongEnough (and other people too).)

cks, to random
@cks@mastodon.social avatar

Happy or unhappy "first day of AC" for those people in Toronto who are reluctantly observing it. Yes, I'm a wimp, but my place heats up easily and 80 F / 26.5 C in my little home office makes me unhappy. (Although now I look that's about the outside temperature too.)

Maybe I can get away with just running AC for not too long to knock down the heat. And the weather forecast has us returning to low-20s or below weather for the weekend.

Toronto's temperate spring: enjoy it while it lasts.

gvwilson, to music
@gvwilson@mastodon.social avatar

Stewart Copeland "Koteja (Oh Bolilla)" https://www.youtube.com/watch?v=MmTXgmRfeyc

cks,
@cks@mastodon.social avatar

@gvwilson The entire album is such an amazing thing that I've loved for years. (I should re-listen to it one of these days, somehow; my CD copy is still packed away.)

I like much of Copeland's work in general, but for this album in particular he hit out of the park right into my section of the stands.

cks, to random
@cks@mastodon.social avatar

Toronto's waterfront fog can sometimes give you absolutely marvelous photos and moments, as I was reminded by posts yesterday evening by @nev . Many years ago I was lucky enough to take a photo in mid-summer evening fog along the waterfront that I rather like:
https://www.flickr.com/photos/22276923@N06/4788499989/

bitprophet, to random
@bitprophet@social.coop avatar

Really feeling my failing eyesight now that I'm having to choose between foggy glasses and no glasses. Wish some of the fancier masks I tried had actually fit me.

cks,
@cks@mastodon.social avatar

@bitprophet @basepi My Auras have been fog-free for me so far (even in demanding winter conditions that fogged everything else). I have to make sure the fit is right, but once it was I could even do things like bike (in the winter) in them. It was amazing.

gnomon, to random
@gnomon@mastodon.social avatar

Is there an idiomatic SQL (sqlite3) way of mapping a subset of selected records from a large table ("users") to unique values in a smaller table ("coupons")? It's easy enough to select all the user records not yet mapped, and to select all as-yet unmapped coupons, but then what's a nice clean way of mapping one to the other? Order doesn't matter, only that the mapping once established can be queried again in the future.

My brain is stuck thinking sequentially about this, frustratingly.

cks,
@cks@mastodon.social avatar

@gnomon My intuition is that a truly stable mapping is impossible with purely read access; you have to write back some sort of thing to freeze it. I don't know if there's some clever way with left or right or outer/inner/upside down joins to get some sort of thing with unmapped users matched up to unmapped coupons, but it feels like probably not if there's not necessarily the same number of them on each side.

cks,
@cks@mastodon.social avatar

@gnomon @glyph @jalefkowit TIL about row_number() in SQL. And that is truly a neat, all in one solution. SQL continues to amaze me.

(I'll need to re-learn modern SQL if I ever need to do anything serious with it again.)

dan, to random
@dan@discuss.systems avatar

currently attempting to use an ethernet interface called "enp8s0f0npf0vf1" and cannot help but think

STATEMENTS DREAMED UP BY THE UTTERLY DERANGED

THEY HAVE PLAYED US FOR ABSOLUTE FOOLS

cks,
@cks@mastodon.social avatar

@Doomed_Daniel @vees @dan The extra challenge round is that people want to be able to pull a network card, replace it with an identical spare one, and get the same interface names rather than new ones (or swap system disks into a new set of identical hardware, for motherboard ports). This makes MACs and other serial numbers bad. Unfortunately PCIe enumeration isn't stable if there are any hardware changes (not just the network card), for reasons.

And now you're mostly stuck.

cks,
@cks@mastodon.social avatar

@Doomed_Daniel @vees @dan Server environments don't necessarily do MAC registration, and not all DHCP environments do authentication by MAC (but a machine may still want to keep a stable NIC name for eg its own firewall config).

Broadly: writing the new MAC somewhere is doable but it makes a stressful situation (hardware failure and replacement) worse. I once ran systems that needed this and it was a pain in the rear.

cks,
@cks@mastodon.social avatar

@Doomed_Daniel @vees @dan If you burn the MAC into the network device name, every system has a different name for its network interface, even on the same hardware, which is a sysadmin pain in the rear. If you freeze a simple network name based on the MAC and add a new network name if you see a new MAC, systems can wind up with network names depending on their history; reinstalling the system will give it different network names (because old MACs won't be claiming the good ones any more).

cks,
@cks@mastodon.social avatar

@Doomed_Daniel @vees @dan In many situations you don't want to keep the mapping file, because it creates differences between identical hardware based on the history of a particular server. One out of your eight hardware-identical fileservers having a different network name because you had to move it to the spare chassis (or swap its add-on network card) at one point is a special sort of hell.

(Also, not all reinstalls are planned in advance. Sometimes the disk blows up.)

cks,
@cks@mastodon.social avatar

@Doomed_Daniel @vees @dan I believe systemd creates aliases, or at least lets you set naming policies for devices, so if you want to use MAC-based names you can fairly easily. And the default PCIe based names are mostly stable, and sometimes systemd can actually detect that a network port is a motherboard port and give it a truly stable name.

(This depends on vendors getting various BIOS data right, which is rather variable.)

cks, to random
@cks@mastodon.social avatar

Half formed hot take: the Linux kernel CVE situation is the tip of an emerging iceberg as OSS people push back and refuse to do supply chain/security work for free just because third parties want it.

(AFAIK, the ultimate trigger was third party maintainers of old kernels wanting the mainstream kernel to note all changes that turned out to be security fixes so the 3rd parties could backport them and only them. Identifying what is actually a security fix is non-trivial extra work (& fallible).)

cks,
@cks@mastodon.social avatar

How good was (is) the Linux kernel at security assessments? Well, between 2006 and 2018, 41% of kernel CVEs had already been fixed in the main kernel by the time they were reported as security issues (in someone's kernel), and the overall average 'time to fix' was -100 days. Clearly a lot of security fixes were not being recognized as such. Which is not a surprise; modern exploit developers are extremely clever.

Source: this 2019 Greg KH presentation: https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-live-the-cve/

cks,
@cks@mastodon.social avatar

Blog post: Some ideas on what Linux distributions can do about the new kernel situation https://utcc.utoronto.ca/~cks/space/blog/linux/DistributionKernelHandling2024
tl;dr: distributions can longer release whenever they want, have the same kernel version for years and years, and have great security (unless they want to do a lot of work themselves). But realistically they never could.

Volunteer run distributions should probably get used to updating their kernel versions over the lifetime of a release. Commercial ones? Whatever you'll pay for.

cks, to random
@cks@mastodon.social avatar

TIL that Lustmord is on Bandcamp, https://lustmord.bandcamp.com/music
Now I have some catching up to do (and a Bandcamp Friday coming up, conveniently).

cks,
@cks@mastodon.social avatar

Shonen Knife is on Bandcamp, although not with their full discography (I assume some combination of rights issues and preparing digital releases). https://shonenknife.bandcamp.com/music
Shonen Knife makes great music that is not in the least bit ambient, and I have fond memories of seeing them live once.

I found this out via https://ourislandgeorgia.net/@Wolven/112440773491791984 (via @mhoye ) mentioning that Bikini Kill are on BC. Say "feminist punk band" and I'll immediately think of Shonen Knife, so I checked and yep.

cks, to random
@cks@mastodon.social avatar

Welcome to the cursed knowledge show, X Window System edition, featuring "backing store" and "save-under".

cks,
@cks@mastodon.social avatar

Blog post: The X Window System and the curse of NumLock https://utcc.utoronto.ca/~cks/space/blog/unix/XNumlockCurse
tl;dr: having NumLock on can more or less invisibly break key bindings because 'NumLock' is treated more or less like a modifier such as 'Shift'. And things can turn NumLock on for you, because they feel helpful. All of this is tangled up in how X turns keycodes into 'what they mean', or doesn't.

(Maybe X could do with another layer of translation; keycode → keycap label → actual meaning considering modifiers.)

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • khanakhh
  • kavyap
  • thenastyranch
  • everett
  • tacticalgear
  • rosin
  • Durango
  • DreamBathrooms
  • mdbf
  • magazineikmin
  • InstantRegret
  • Youngstown
  • slotface
  • megavids
  • ethstaker
  • ngwrru68w68
  • cisconetworking
  • modclub
  • tester
  • osvaldo12
  • cubers
  • GTA5RPClips
  • normalnudes
  • Leos
  • provamag3
  • anitta
  • lostlight
  • All magazines
    •