Jan-Piet Mens

I don't know any blog quite like Raymond's, but the more technical ones I like are: Jan-Piet Mens (mostly protocols and IoT) - http://jpmens.net/ Absorptions (Oona Räisänen's excellent hacking around signals of all kinds) - http://www.windytan.com/

I am just stopping by to say that this is actually a thing. It is called hesiod and works great in small, maybe air-gapped networks. As a side note, anything security related exists in the reality of uncertainty. It is expected that sharing properly secured secrets is reasonably safe, but day after day we discover "we didn't know". Sometimes simplicity for a particular application is worth certain amount of risk. Sometimes, you need to take the server out of its box, out of the bunker, and plug it to both the power distribution network, and of course... a LAN... For quick reference: - https://en.m.wikipedia.org/wiki/Hesiod_(name_service) - https://jpmens.net/2012/06/28/hesiod-a-lightweight-directory-service-o…

To be fair, dma has been in the base system for a long time. Now (well sometime in the future) I can remove half of my Ansible role for setting up dma on my systems, just skipping disabling sendmail. I learned about dma here, a great blog btw! https://jpmens.net/2020/03/05/simple-solution-for-outgoing-mail-from-a…

The linked article https://jpmens.net/2019/06/21/i-care-about-ansible/ describes my issues with Ansible, it's still the best for what I use it for but it's started to become very painful at times and the constant "You used foo, foo was deprecated use bar" where bar is some minor variant of foo. That and yaml but that's a battle I'm losing (I really don't like yaml) mean I'm keeping an eye on alternatives in the hope something else will arise at some point.

If it is for executing some script on successful connection of any device to wifi (and thus an IP is assigned), with dhcpd, it can be achieved with the following config: subnet 192.168.1.0 netmask 255.255.255.0 { on commit { set ip = binary-to-ascii (10, 8, ".", leased-address); execute ("/usr/local/bin/on-device-connect", "commit", ip); } } I have setup exactly this to automate stuff unlocking the door in my office (in the morning, whenever some one arrives and phone connects to wifi). My original source: http://jpmens.net/2011/07/06/execute-a-script-when-isc-dhcp-hands-out-… Edit: Fix code formatting.

Well, ansible by default runs with paramiko which is a python implementation of SSH protocol. It will also keep connections open for multiple commands. It also has a pull mode and it also has a fireball mode which uses 0mq: http://jpmens.net/2012/10/01/dramatically-speeding-up-ansible-runs/ However, you're not forced to use this. In the beginning, you can just seed your CentOS or debian with a Kickstarter or seed file and then run your inital thing with ansible simply over ssh (using all the goodies, ssh-agent, password less ssh etc..). One huge plus for ansible is also that it used yaml which is rather simple. I've been following both project for >1 year and it seems that recently ansible has picked up a lot and will probably make the "race" (IMO).

I'm going to refer to Philosophy of Computer Science ( https://news.ycombinator.com/item?id=20912718 https://news.ycombinator.com/item?id=10388603 ) and say "its not an easy or decided problem". Section 3 has about 100 pages (in the pdf - I'd have to dig around to find the hard copy) that tries to look into what computer science is. Section 3.10 starts comparing it with engineering... and noting that it's looking at computer science rather than programing aspect of it. Part of the questions being asked is "is computer science a science?" I'm going to highly recommend the book for those interested in these questions. I'll also point out that across its thousand(!) pages, this book is in large part a survey of the literature of tens of thousands of more pages on the subjects. I don't believe that most people are approaching software development (be it called computer science or software engineering) with either the mindset of a scientist or an engineer (there are times when one of those mindsets is necessary) Rather, I agree with a later section in it... 3.14.7 Is CS Magic? The great science-fiction author Arthur C. Clarke famously said that “Any sufficiently advanced technology is indistinguishable from magic” (http://en.wikipedia.org/wiki/Clarke’s_three_laws). Could it be that the advanced technology of CS is not only indistinguishable from magic, but really is magic? Not magic as in tricks, but magic as in Merlin or Harry Potter? As one CS student put it, …

Another option is to stand up a DNS server that knows how to do something like BIND 9's Response Policy Zone [0][1]. Although figuring out how to propagate RPZ changes to them isn't exactly straightforward (more on this below), if you're using BIND, you can set up views that match certain clients and provide one mix of RPZs to one set, and another to another set. On updating RPZs in a view (warning: BIND 9-specific instructions follow) : So, BIND has this nifty option for a zone called "in-view". This lets you say "The data for this particular zone lives in this other view, so when requests come in for this zone, in this view, use the data in this other view.". It might sound complicated, but it's really just a pointer to a pre-existing zone definition. This lets you define your master zones in one big "zone definition" view, and have client-specific views refer back to those definitions. However, you can't use in-view with RPZs. Why? Who knows? [2] But, what you can do is this: * Create one unique RNDC key per view * Add an allow-notify and match-clients entry in each view with that view's key * In the appropriate views, add a slave zone definition for each relevant RPZ, with localhost as the master, and whatever is your usual domain xfer key as the key [3] * Back up in your "zone definition" view, add to your also-notify list for each master RPZ definition an entry for localhost and each view key. [4] Having an ACL just for these RPZ slaves cleans up the RPZ…

Oh yeah, you are better off having a separate but hardened SSH authentication server that is to be consulted by such SSH gateways, just to protect the private keys. And use DTLS (two sets of client and server PKI , one for each direction) to guard that link between SSH gatewat(s) and SSH authentication (certificate-based) server. The starting point of all this: https://jpmens.net/2019/03/02/sshd-and-authorizedkeyscommand/

Sounds like something we need :) If you want a picture in your head, the Unix Magic Poster isn't a bad one :) https://jpmens.net/2021/04/09/the-unix-magic-poster/

Weird that no one seems to have mentioned the Unix Wizard poster: https://jpmens.net/2021/04/09/the-unix-magic-poster/

Unix Magic is pretty good. https://jpmens.net/2021/04/09/the-unix-magic-poster/

There’s also Hesiod (HS) records: https://jpmens.net/2012/06/28/hesiod-a-lightweight-directory-service-o…

> @jpmens @svnr2000 ; was chosen as a comment in zone files because that's what the PDP10 and other macro assemblers used in those days. * https://twitter.com/paulvixie/status/659934566883328000 Via: * https://jpmens.net/2015/10/28/the-semicolon-in-zone-master-files-some-…

It's a damn shame it took until this article for me (and it appears some others) to learn about the console and the debugger; those seem like massive time savers! My own biggest helper has been to use "ANSIBLE_STDOUT_CALLBACK=yaml" wherever "ansible-playbook" is called (https://jpmens.net/2021/03/12/alter-ansible-s-output-on-debugging/). It makes the verbose output much more readable and is especially handy for tasks that can spew thousands of lines at ones (e.g. "apt update/upgrade").

More things about Ansible vault that are a shame: - no file encryption, only YML - no separate values, only entire file - OMG it's s...l...o...w... - password based instead of certs - only one password - password cannot even stored in an env var More: http://jpmens.net/2014/02/22/my-thoughts-on-ansible-s-vault/

I moved most of my projects to Ansible, but I have a project that is still on Puppet and I really would like to move on. The reason is that I need a centrally managed server where clients pull for changes because the clients are not online all of the time. Does anybody have experience with Ansibles pull model explained here http://jpmens.net/2012/07/14/ansible-pull-instead-of-push/ ?

A good overview of BIND 10's architecture: http://jpmens.net/2012/12/21/completely-different-bind-10/ It seems that all apart from the performance critical parts are written in Python 3.1

This is really nice information. Thank you! FWIW we have recently acquired funding to demonstrate that GNS can handle large size zones by migrating TLD zones (available through AXFR for now, the number of zones supporting hat is, eh, marginal [1]) to GNS which delegate back into DNS (using [2]). This allows GNS users to (partially) circumvent the root and manually manage their local root namespace as envisioned for GNS [3]. We think that shipping default configurations and allowing users to modify/enhance that locally is how governance should look like from the user's perspective. If you want ICANN as default -> use the ICANN default configuration... if you need to override a censored/censoring registry, you can do that too... etc [1] https://jpmens.net/2021/05/18/dns-open-zone-data/ [2] https://www.ietf.org/archive/id/draft-schanzen-gns-21.html#name-gns2dn… [3] https://www.ietf.org/archive/id/draft-schanzen-gns-21.html#name-start-…

In case you were wondering what Nokia's Mobile Web Service looked like. http://www.allaboutsymbian.com/features/item/Previewing_Nokias_Mobile_… https://jpmens.net/2007/05/03/mobile-web-server-apache-on-a-s60-phone-… https://en.wikipedia.org/wiki/Mobile_Web_Server Heyday: https://web.archive.org/web/20090214014049/https://mymobilesite.net/ 2010 Goodbye (via redirect): https://web.archive.org/web/20100621023623/http://betalabs.nokia.com/b…