Flameeyes

I mean, I have done that in the past, when I was writing about more technical topics, too: https://flameeyes.blog/2010/09/04/linux-containers-and-networking/ https://flameeyes.blog/2011/04/14/additional-notes-about-the-smartcard… But as it's visible above, my artistry leaves a lot to be desired. So for something like this I commissioned it. The artist is https://twitter.com/FurryViza and she did a great job.

I Would love to migrate 50+ KVM VMs to LXC-Containers, but there seem to be some problems left with security[1][2]. I cant wait to get my hands on Docker, but I lack the SELinux knowledge to secure everything the 'proper' way. Is LXC (and therefore Docker) really ready for Production yet? Edit: Formatting. --- [1] http://mattoncloud.org/2012/07/16/are-lxc-containers-enough/ [2] https://blog.flameeyes.eu/2010/06/lxc-and-why-it-s-not-prime-time-yet

I'd say ssh keys generally don't have 2fa. A passphrase doesn't really turn a ssh-key into 2fa. It's still really only "something you have (access to)": the plaintext of the private half of the key. Granted, you can use ssh-keys with tokens -- my recommendation is to use encrypted ssh-keys paired with a recent[1] openssh server that allows stacking OTP on top, for 2fa with the RequiredAuthentication-directive (well, OTP is generally code for: can demonstrate access to OTP secret) -- but at least it is rather easy to store the two on separate devices (say a phone, and on the filesystem of your workstation/laptop). Not really maximum security, but quite a lot better than traditional passwords. Until you store both the key and the authenticator on your phone, in order to use ssh from your phone. At which point you end up with "rather convoluted 1fa" -- which might still be marginally better than traditional passwords (along with a warm fuzzy feeling of false security :-). Other than that I've been looking into using openssh certificates with openssh, but it still looks like it's rather complicated -- and for a single-/few-user setup it's questionable if the expiration etc really adds much actual security. Maybe the best would be to apply some of the kerberos design lessons to openssh with certificates, issuing short-lived certs much like kerberos ticket-granting tickets (so have an easy way to get a user certificate that's valid for 8 hours or so...). Not sure the added…

> There are a few walled gardens with great payment experiences (the App Store, Amazon) I'm of a different opinion: Amazon is much stricter than other online merchants, and they don't give you meaningful errors when something goes wrong with your billing. When I was back in europe, I had to rely on a relative's credit card to make a payment, since my debit card was being refused. Now that I'm travelling in the US, the situation is even worse: they locked my account 2 times already, and they request information that (due to the privacy laws in my home country) can't be easily accessed and returned by my bank. Apparently there're differences with credit cards, debit cards and atm cards... but as long as you have enough money/credit on your account, I cannot see how the payment process should be different, and no one has been able to explain it to me yet (an interesting blog post about how things can go wrong when paying in person with a card is this one btw: https://blog.flameeyes.eu/2014/04/my-time-abroad-chip-n-pin it deals with "Cardholder Verification Method" which I never even heard of before reading it) Trying to pay for an order on Lenovo is even worse: they don't accept non-US issued cards (unless it's an american express) and my bank doesn't let me do a wire transfer to the US online (you have to phisically go to their desks and ask for the wire transfer to be sent) It's mind boggling the amount of manual work and custom e-mails sent back & forth needed for…

> I don't know where you get that "it makes no difference" opinion. It was a far hotter topic back when. After so many years, the only article I could locate (but unfortunately not one I did comment on) that I remember is this one: https://flameeyes.blog/2012/06/19/is-x32-for-me-short-answer-no/ There are other commenters though that mention the cache pressure and performance difference.

"Or you could create a shell script in your $PATH named ungron or norg to affect all users" You could also check argv[0] for if you were called via the `ungron` name. Then it would be as simple as a symlink, which is very easy to add at install/packaging time. (I know it's fairly broadly known, but this is the "multicall binary" pattern: https://flameeyes.blog/2009/10/19/multicall-binaries/)

To add to this, couple of good guides on using GPG Agent forwarding: - https://blog.flameeyes.eu/2016/10/gnupg-agent-forwarding-with-openpgp-… - https://www.isi.edu/~calvin/gpgagent.htm (Mac OS) I broke my head recently trying to get this to work recently. The error was in 2 different gpg binaries that ubuntu ships with. Using gpg2 instead of gpg gets it working.

Like all things, it's not a panacea: https://blog.flameeyes.eu/2010/07/debunking-ccache-myths-redux Of course, if you're rebuilding the same code over and over it can be a net win, but -in the comments- it is mentioned that the obvious things -that one might end up doing somewhat frequently in C/C++ development- invalidate the cache.

Regarding -Werror, its considered by some to be bad practice for releases [1]. [1] https://blog.flameeyes.eu/2009/02/future-proof-your-code-dont-use-werr…

Really good article, but if you're going to bundle libraries, PLEASE provide a way to make configuration fail if you can't get to the system copy. A lot of projects (libgroove included) will try the system copy and then fall back to the bundled copy if the system one wasn't found. That's nice for users (maybe), but it's a pain for packagers. If the packager just happens to have one of the dependencies installed, the package will automagically find it but it will have incorrect deps. Further reading: https://blog.flameeyes.eu/2009/01/bundling-libraries-for-despair-and-i…

> Joe GNU/Linux User has just downloaded and untared this package. Regular users are not supposed to install software like this. The only sane way to administer a distribution is to make sure everything passes through the official package manager. This leaves the developers and package maintainers to deal with autotools and I don't hear them complaining (very loud[1]). Autotools is simply good enough for the job and instead of being some sort of hated legacy it's being sometimes preferred for new projects (cough [2] cough). [1]: https://blog.flameeyes.eu/tag/autotoolsmythbuster/ [2]: https://github.com/stefantalpalaru/vala-skeleton-autotools

That interesting question was asked on Stack Overflow, and closed as off topic. (http://stackoverflow.com/questions/13170334/reading-entropy-avail-file… A comment says that cat is consuming the entropy, not reading the file. An answer links to (https://blog.flameeyes.eu/2011/03/entropy-broken) which says "starting a process consumes entropy" but otherwise didn't seem to have an answer. (But I only skimmed.) This thread (http://www.standalone-sysadmin.com/blog/2013/07/monitoring-entropy-but… says that you're just using cat while entropy is being used, and if you keep using cat you see the numbers go down and up.

> All this for the possibility of interposition? Yes, it seems so. The impact is there for this little-known and little-used feature. Instead of optimising for the common-case scenario where the symbols are not overridden, the ABI optimises for the corner case. It also looks like PIE+PIC is required if you want a secure system with ASLR: <http://blog.flameeyes.eu/2009/11/02/the-pie-is-not-exactly-a-lie>. Flameeyes (Gentoo dev) has sent patches to all the main library developer that make sure only the necessary number of symbols is exposed and as much data as possible is marked as read-only. I think this effort is more valuable than proposing a very unlikely ABI change.

http://blog.flameeyes.eu/2009/04/22/shared-object-version Perhaps upstream is doing some magic. Like applying patches to the distros official version and making sure it's compatible before distributing a binary.