The Grumpy Troll

Ramblings of a grumpy troll.

Archive for 2017

boot2docker xhyve DNS

Using macOS with Docker can be “interesting”. When I got started, I followed the useful advice at This approach appealed to me, especially the use of xhyve. Because sometimes I just make life difficult for myself. Thus my initial setup was: brew install docker docker-machine xhyve docker-machine-driver-xhyve f=/usr/local/opt/docker-machine-driver-xhyve/bin/docker-machine-driver-xhyve sudo chown root:wheel $f; sudo chmod u+s $f # because yay, more setuid root binaries; it's written in Go, which is # something at least.


Golang SSH Redux

I'd like to set a couple of things straight, for the record. I'll cover the post/blog, and then I'd like to counter some misconceptions. While part of me thinks “I must've been very unclear to have so many people misunderstand”, I also saw how many people commented without bothering to read, so really there's a limit to how much self-flagellation will happen. I am not a security researcher. I do not try to get bug bounties.


Golang SSH Security

This is a tale of two attitudes. Working on a project for a client recently, I needed to speak the SSH protocol in Golang code. So I started with the x/crypto/ssh package, part of the suite of libraries from the Golang developers which is not part of the standard library and not part of their usual compatibility guarantees, but more along the lines of “useful stuff which might graduate to the standard library”.


Docking Compute

What I would like to see emerge as technology is “compute docking”. A dock which provides, as part of the peripherals, more CPUs and RAM. This partially demonstrates a failure of software, in that the operating systems approaches in widespread use today have abandoned the idea of the OS and trust boundaries being spread over multiple machines. You get clusters, and software written to run across clusters with a lot of heavyweight infrastructure for scheduling, deployment, etc.


OCSP Oops!

Conceptual Background OCSP provides a means for a TLS client to check that a certificate issued to a server is still valid, by asking for a “current proof”. In its original form, it's a disaster: clients need to talk to the TLS server (typically a secure web server), find out who issued the certificates and where on the Internet they can talk to, to get a current cert, go off and talk to that OCSP server, get a current proof, then resume talking to the original server.


Jitsi & Certificates

I've been on the lookout for an XMPP client I could trust, for macOS. Trust is a loaded term, but in this context, it means: Either not written in C, or very proactive about security updates OTR support Source code available, should I choose If installing binary packages, signed releases which can be verified. Today I installed Jitsi. It's written in Java and is a little slow to start, but I'll take that if it means my account isn't compromised by anyone who can send me a friend request.


I'm Back

This blog saw a bit of a hiatus; I'm back, I might post a little more often. Longer version: I had used custom-patches to the engine's code-base to get group-by-time functionality for constructing the side-bar, but while I offered the patches upstream, I lost the time to write tests too. Life at a start-up, my time disappeared again and various factors led me decide to not spend what little time I had on the static site generator's codebase.