Notices by Chris Siebenmann (cks@mastodon.social), page 5

@ireneista @dr2chase @dave_andersen When I started noticing that Gatorade was tasting good even when I didn't feel really thirsty, I decided that my rule of thumb was that anything being sold in supermarkets wasn't really being sold to serious athletes. There just aren't that many of them.

(I'm not sure I ever had Gatorade classic, but ~15 years or so ago I may have had something that was only part way to the modern supermarket formulation.)

Pretty much every time I change the time of an alarm on my phone I am irritated all over again at the fundamental laziness and robotic computer-ness of time controls. What I want to do is move the time forward or backward, not to separately change (or set) the hours and the minutes. But separate 'hour' and 'minutes' spinners or options are the easy computer way out so that's how UIs implement it.

Dear self, just because you have finished listening (once) to all of the new music you picked up last BC Friday is no reason to go pick up more. Among other things, you still have ~400 or so releases not listened to from two 'buy our 250-release catalog for cheap' offers in the past. So at least listen to some more of them before giving in to temptation. (Yes I have a 'to purchase' list.)

(Normally I would hold off for the next BC Friday but that's not going to be for months.)

It's surprisingly difficult to bicycle at 10 km/h and no more, at least on my bike with standard 700c wheels. It generally feels like if I sneeze I'll go clearly over and it's easy to drift into too fast.

(Toronto's Mt. Pleasant cemetery has an official bike speed limit of 10 km/h. One of my personal perverse acts is that when I go through it riding by myself, as I did today, I try to stick to this speed limit. It's absurdly hard to go that slow but oddly fun.)

It has been '0' days since I wrote 'Oath' when I meant to write 'OAuth'. Such a tempting not exactly a typo, more a mind slip.

(Also, don't ask me to describe the differences between OIDC and OAuth2, and I suspect that all sorts of documentation blurs the two and talks about 'OAuth2' when it really means 'OIDC'. For example, I'm not sure Grafana would be happy with a pure OAuth2 provider that didn't add the extra OIDC stuff, although maybe it would be.)

My first cloud VM isn't even in production yet and its external monitoring of our stuff already found a real problem. On the one hand, clearly it's valuable. On the other hand, I'd rather that this sort of problem wasn't there in the first place.

I've now created my first cloud (virtual) machine. It is of course a special snowflake, because I had no desire to try to simultaneously learn this cloud vendor's web UI, terminology, etc and also some cloud machine automation setup. At least it's an extremely simple special snowflake and I kept notes (and off-machine copies of everything important).

I suspect that it is terribly set up and there are much better ways to do what I want, but meh. It's simple.

@phillmv Yep, we're still on-premise (although I've used locally hosted VMs for testing for years). Partly this is because of (our) university funding model, where it's very hard to guarantee ongoing funding but it's comparatively easy to get one-time funding through grants. The cloud converting one-time capex into ongoing opex is terrible for us; we can't be sure of the opex funding, and if we stop paying the cloud goes away. Hardware is ours for as long as it keeps working.

How good was (is) the Linux kernel at security assessments? Well, between 2006 and 2018, 41% of kernel CVEs had already been fixed in the main kernel by the time they were reported as security issues (in someone's kernel), and the overall average 'time to fix' was -100 days. Clearly a lot of security fixes were not being recognized as such. Which is not a surprise; modern exploit developers are extremely clever.

Source: this 2019 Greg KH presentation: https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-live-the-cve/

A realization: One way to describe the Linux kernel CVE situation is that the Linux kernel developers aren't going to be providing security analysis of bugfixes (or kernel changes in general) any more, especially for unsupported kernel versions. This is not quite accurate; some fixes will certainly come with a security analysis (eg, ones reported to the kernel as unfixed security issues). But fewer will than before.

Is this bad? Well, the analysis before was not infrequently wrong, so.

Half formed hot take: the Linux kernel CVE situation is the tip of an emerging iceberg as OSS people push back and refuse to do supply chain/security work for free just because third parties want it.

(AFAIK, the ultimate trigger was third party maintainers of old kernels wanting the mainstream kernel to note all changes that turned out to be security fixes so the 3rd parties could backport them and only them. Identifying what is actually a security fix is non-trivial extra work (& fallible).)

Blog post: Some ideas on what Linux distributions can do about the new kernel situation https://utcc.utoronto.ca/~cks/space/blog/linux/DistributionKernelHandling2024
tl;dr: distributions can longer release whenever they want, have the same kernel version for years and years, and have great security (unless they want to do a lot of work themselves). But realistically they never could.

Volunteer run distributions should probably get used to updating their kernel versions over the lifetime of a release. Commercial ones? Whatever you'll pay for.

Today's cursed X Windows System knowledge is about how X has two cut and paste systems and they don't interoperate, because after people used the first system for a while they realized it had limitations and was kind of a bad idea but of course it couldn't be replaced. Do all programs support both? No, of course not.

Reading material: https://utcc.utoronto.ca/~cks/space/blog/sysadmin/XCutAndPasteHistory
https://www.uninformativ.de/blog/postings/2017-04-02/0/POSTING-en.html
https://utcc.utoronto.ca/~cks/space/blog/unix/XtermModernCutAndPaste

Blog post: The X Window System and the curse of NumLock https://utcc.utoronto.ca/~cks/space/blog/unix/XNumlockCurse
tl;dr: having NumLock on can more or less invisibly break key bindings because 'NumLock' is treated more or less like a modifier such as 'Shift'. And things can turn NumLock on for you, because they feel helpful. All of this is tangled up in how X turns keycodes into 'what they mean', or doesn't.

(Maybe X could do with another layer of translation; keycode → keycap label → actual meaning considering modifiers.)

@evert I have tire irons and all the usual flat-fix stuff (and replacement tubes, lots of spare tubes for reasons). I'm just a plodder where it comes to the mechanics of getting the wheel off the bike, getting one side of the tire off the wheel, ideally finding the flat spot in the tube and then carefully finding the matching spot on the tire, then reassembling everything end etc etc. The shop mechanics make it look like (fast) magic, with basically the same tools.

It's certainly better to discover that my commuter bike has a flat rear tire on a Sunday afternoon than on, say, a Tuesday morning when I'm about to commute with it. But I'd rather not have the flat.

(You know how the bike mechanic at your local bike shop can change your flat tire in no time at all and make it look like magic? Me with flat tires is the exact reverse of that. I will forever be the last place finisher in any flat-changing competition.)

Well, that was a learning experience not just about where DNS servers put information when you query them with 'what are the NS records for this subdomain', but also on how some of our local DNS servers are configured. (In a way that kind of surprises me, for one of them.)

TIL that if you ask a parent authoritative server for NS records for a subdomain, they show up in the 'authority' section of the reply, not the 'answer' section. For (perfectly good) DNS reasons.

Bonus: some of the people still querying our DNS server for domains we aren't authoritative for appear to be (other people's) within-university DNS servers. All I can say is WHAT.

We used to operate one of the university's authoritative secondary DNS servers for all of the university's domains. Many years ago, we ceased doing this, reducing the server to just being authoritative for our own domains. Today I learned that there are a lot of people on the Internet still querying us for other people's domains that we haven't been NS records for for years. Where are they picking this up from? It is a mystery.

Great moments in dry (Go) commit comments[1]:

runtime: remove note about goid reuse

Goids are designed to be big enough that they will never be reused: a uint64 is enough to generate a new goroutine every nanosecond for 500+ years before wrapping around, and after 500 years you should probably stop and pick up some security updates.

[...]

1: https://go.googlesource.com/go/+/8f71c7633fd70fffc5fa65e7865e763238fa6f46