XZ Backdoor: we all were in a movie

The XZ backdoor has been covered extensively in various writings, but I had to listen to this episode because it features Andres Freund, who discovered the backdoor:

https://oxide.computer/podcasts/oxide-and-friends/1843393

And of course, Bryan Cantrill did not disappoint. His energy and passion, together with the unique views and understanding he has around topics that are otherwise trite and thought to be well understood, to me looks pretty much like how a reality distortion field would work.

The big revelation for me is that we've all been featured in a movie. You know the classic movie plot in which one person finds something out, and then they go about telling everybody about it, and nobody believes them but they take it upon themselves to save the world? That's what happened, well except everybody took Andres seriously from the beginning this time. And the world was saved. Pheeewww.

Well, it was saved this time.

Popular posts

A not so short guide to ZFS on Linux

Image
Updated Oct 16 2013: shadow copies, memory settings and links for further learning. Updated Nov 15 2013: shadow copies example, samba tuning. Unless you've been living under a rock you should have by now heard many stories about how awesome ZFS is and the many ways it can help with saving your bacon . The downside is that ZFS is not available (natively) for Linux because the CDDL license under which it is released is incompatible with the GPL. Assuming you are not interested in converting to one of the many Illumos distributions or FreeBSD this guide might serve you as a starting point if you are attracted  by ZFS features but are reluctant to try it out on production systems. Basically in this post I note down both the tought process and the actual commands for implementing a fileserver for a small office. The fileserver will run as a virtual machine in a large ESXi host and use ZFS as the filesystem for shared data.
Read more

Indexing Apache access logs with ELK (Elasticsearch+Logstash+Kibana)

Image
Who said that grepping Apache logs has to be boring? Sample of dashboard that can be created with ELK. Pretty impressive, huh? The truth is that, as Enteprise applications move to the browser too, Apache access logs are a gold mine, it does not matter what your role is: developer, support or sysadmin. If you are not mining them you are most likely missing out a ton of information and, probably, making the wrong decisions. ELK (Elasticsearch, Logstash, Kibana) is a terrific, Open Source stack for visually analyzing Apache (or nginx) logs (but also any other timestamped data).
Read more

Mirth: recover space when mirthdb grows out of control

I was recently asked to recover a mirth instance whose embedded database had grown to fill all available space so this is just a note-to-self kind of post. Btw: the recovery, depending on db size and disk speed, is going to take long. The problem A 1.8 Mirth Connect instance was started, then forgotten (well neglected, actually). The user also forgot to setup pruning so the messages filled the embedded Derby database until it grew to fill all the available space on the disk. The SO is linux. The solution First of all: free some disk space so that the database can be started in embedded mode from the cli. You can also copy the whole mirth install to another server if you cannot free space. Depending on db size you will need a corresponding amount of space: in my case a 5GB db required around 2GB to start, process logs and then store the temp files during shrinking. Then open a shell as the user that mirth runs as (you're not running it as root, are you?) and cd in
Read more