fugue88

I agree with what you wrote, and add that you should make sure that your service's executables and scripts also should not be owned by the user they run as.

It's unfortunately very common to install, for example, a project as the "ubuntu" user and also run it as the "ubuntu" user. But this arrangement effectively turns any kind of file-overwrite vulnerability into a remote-execution vulnerability.

Owning executables as root:root, perms 0755, and running as a separate unprivileged user, is a standard approach.

All of recommendations about efficiency seem misguided to me.

I've seldom had to worry about the performance of my scripts. It almost always is dominated by the performance of whatever the script is running. I did have one very notable exception, though. It's kind of embarrassing.

On one project---for "reasons"---I had written several bash scripts to collect system performance metrics to push into Nagios or Graphite. A couple of these had to calculate some floating point, and I was invoking `dc` to do that, as bash only supports integer arithmetic. The script would loop once every 5 seconds or so, iirc, invoking dc each time. One small process every 5 seconds doesn't sound like a lot, but the systems also ran ClamAV---again, for "reasons"---and were already under high load, and that extra process invocation had a noticeable and significant impact on the system.

My workaround was to run a single instance of dc using bash's `coproc` keyword, then redirect all the calculations through the returned descriptors. This had a drastic improvement.

Except... it turns out that dc leaked 80 bytes of memory whenever it read and parsed a float. So, the long-running dc process would eventually get oom-killed. So, I added a check to restart the dc process every 5000 iterations, or something like that.

Which all sounds like a big headache, but for "reasons" this was far easier than getting some other solution into that environment.

I did submit a bug report (2020 Feb 19), and Ken Pizzini (dc's original author, I think) was kind enough to reply even though he wasn't the maintainer. Unfortunately, my patch never got upstreamed.

Then again, who else is crazy enough to use dc as long-running math server?

Thank you! I didn't have many options at the time, having a small family to provide for, so I went back to work as a software developer. The career has been good. I regret not being able to be a professor and devote more time to research, but I also try to make opportunities for those kinds activities in other ways.

I had picked my advisor at the start of my PhD. I also had 2 backups. My pick was on sabbatical my first year. He and I agreed I'd load up on the required classes that year.

He e-mailed me right before the year ended saying he had changed his mind and didn't want any more grad students, basically dumping me.

Right around the same time, my first backup decided to retire.

My second backup passed away.

I was left no longer making "sufficient progress" and no path to do so, losing my financial aid.

https://www.fugue88.ws/

I regret the TLD.

I also run my email server there. Telling people my email address, I have to go character by character. Oh well! :-)

I still run djbdns as well, as both an authoritative server and a caching resolver.

The biggest downside to djbdns, to me, is its lack of DNSSEC support. There are patches available for that, but my distro doesn't package them and I haven't gotten around to making my own package to include them.

The next biggest is related: djbdns lacks direct support for some newer Resource Records (like type 257 CAA) in its data file. However, the data file does allow you to encode arbitrary records directly, it's just a hassle to do it and to verify correctness.

Yes, rss2email (http://www.allthingsrss.com/rss2email/).

Instead of changing the escape, you can tap it one more time. So, to drop your 2nd (nested) connection: ~ ~ .

I like the color of fire, and I seem to be doing pretty well, if I do say so myself. :)

Yes, you're exposed to MITM. But if you permantly mark the cert as trusted, and the MITM goes away, you'll know somethings has changed. You'll be blind as to which way things changed, but at least you'll know to investigate.

Great question! Unfortunately, I don't think you can.

If you use CA certs to trust site certs, the site certs can change on the fly (i.e. be replaced with an NSA interloper) without you knowing.

If you kill your CA certs, and mark individual sites trusted, than at least your browser will notify you if the site's cert has changed since you lasted trusted it. Theoretically. I haven't actually tested this yet. :(

We could use GPG for normal e-mail correspondence. But I really don't know if this would do anything more than delay any problems.

In a similar vein, I've deleted all the trusted root CA certs from my computer, and am now marking individual certs trusted as I hit them. Not fail-safe, but safer, I think.

To be fair, naming a bill is a lot of work, maybe over half of what goes into the whole package.

Corn products are stuffed into maple syrup? I think you got that backwards: we stuff a little flavoring into corn syrup and then call it maple!

To use story points, you would have a linear model of some sort so that you could calculate how long, on average, a story point would take to complete.

If you know how to do that (the model), you could apply the exact same technique to the "estimated time" numbers to get a more realistic "expected time."

Changing from time to points won't improve the developer estimates at all; instead, it will further obfuscate them and reduce accountability, in my opinion.

So are us reader-only commenters!

P.S. I upvoted you. :)

Ditto.

When I had problems with my wrists, I started to play the piano, a lot. I would bang on the keys fortzando and make a lot of noise (the noise got better over time :).

I also had a small stress ball that I would squeeze as hard as I could several times throughout the day.

After two or three months, the pain, numbness, and swelling were gone, and have never come back these last dozen years.

We adjusted by changing the order to count, attack, place (cf attack, count, place, as I remember). If the 1st player goes on a major offensive their first turn, they end up spreading themselves thin, so this balanced things out a lot.

"Dramatically improve Sun's hardware performance...."

I think they're going to use the CPU simulator Sun used to design a processor (the T1) optimized for MySQL (I think it was) to make a new processor optimized for Oracle.

Just my 2 cents.

It seems that the more the site focuses on bids, the more likely this is to happen.

Bidding systems inherently ignore distinctive qualities of at least one side of the transaction. In this case, it treats programmers as commodities, and so the prices tend toward commodity prices.

Other: autodidact

Greater than any other "qualification...."

;)

man wget

wget --save-cookies cookies.txt ...

wget --load-cookies cookies.txt ...

It sounds like you want to rewrite Sandy (http://www.iwantsandy.com/), which is good because they're closing down.

They show several examples of commands that Sandy accepts. That might help give you a little direction designing your system.

That's called simple interest, as opposed to compounding interest.

They better ban all birds, too, then (see http://tools.ietf.org/html/rfc1149).

I've read that way the number is stated also affects the range. For example, 100 has a large negotiating range than 90, and 90 larger than 92.

I haven't had a change to use this yet, though....

I appreciate your comment and your reasoning.

Here is one argument for local taxes paying for local schools: it gives the influence over education to the locals.

It's conceivable that when schools accept federal funding, they are also obliged (somehow) to accept federal instruction.

If I disagree with current instruction, it is more difficult for me to change it when it comes from some larger far-away entity than when it comes from a board paid directly on my dime.

So I see two sides to this problem, but not (yet) a resolution.

Sent.

Nice idea.

The formatting is messed up in my browser, FF3: the star usually appears above the gig, sometimes to the left. Horizontal lines often run through the middle of the text.

I assume that clicking the star indicates your preference for that gig and similar. There are no instructions that I see. Can I unclick a star? I may have misclicked.

There should be some indication that the large box in the middle of the page is loading something when you first go there. I thought maybe it was a plugin that hadn't loaded, and while scrolling to the bottom, it got populated (surprise!).

But, yeah, a very nice idea.

That's a great idea! I sincerely think that you should do it.