Full Width [alt+shift+f] Shortcuts [alt+shift+k]
Sign Up [alt+shift+s] Log In [alt+shift+l]

Tony Finch's blog

Tony Finch's blog
Migrating to BIND9 dnssec-policy Here are some notes on migrating a signed zone from BIND’s old auto-dnssec to its new...
9 months ago
89
9 months ago
Here are some notes on migrating a signed zone from BIND’s old auto-dnssec to its new dnssec-policy. I have been procrastinating this migration for years, and I avoided learning anything much about dnssec-policy until this month. I’m writing this from the perspective of a DNS...
Tony Finch's blog
Introducing BIND9 dnssec-policy Here are some notes about using BIND’s new-ish dnssec-policy feature to sign a DNS zone that is...
9 months ago
73
9 months ago
Here are some notes about using BIND’s new-ish dnssec-policy feature to sign a DNS zone that is currently unsigned. I am in the process of migrating my DNS zones from BIND’s old auto-dnssec to its new dnssec-policy, and writing a blog post about it. These introductory sections...
Tony Finch's blog
regpg-1.12 Yesterday I received a bug report for regpg, my program that safely stores server secrets encrypted...
9 months ago
73
9 months ago
Yesterday I received a bug report for regpg, my program that safely stores server secrets encrypted with gpg so they can be commited to a git repository. The bug was that I used the classic shell pipeline find | xargs grep with the classic Unix “who would want spaces in...
Tony Finch's blog
Unix version control lore: what, ident There are a couple of version control commands that deserve wider appreciation: SCCS what and RCS...
9 months ago
73
9 months ago
There are a couple of version control commands that deserve wider appreciation: SCCS what and RCS ident. They allow you to find out what source a binary was built from, without having to run it – handy if it is a library! keyword expansion SCCS, RCS, cvs, and svn all have a way...
Tony Finch's blog
BIND9 dnssec-policy appendices Here are some miscellaneous unsorted notes about BIND9’s dnssec-policy that turned out not to be...
9 months ago
71
9 months ago
Here are some miscellaneous unsorted notes about BIND9’s dnssec-policy that turned out not to be useful in my previous blog posts, but which some readers might find informative. Some of them I learned the hard way, so I hope I can make it easier for others! contents of key...
Tony Finch's blog
inlined nearly divisionless random numbers a blog post for international RNG day Lemire’s nearly-divisionless algorithm unbiased bounded...
8 months ago
70
8 months ago
a blog post for international RNG day Lemire’s nearly-divisionless algorithm unbiased bounded random numbers has a fast path and a slow path. In the fast path it gets a random number, does a multiplication, and a comparison. In the rarely-taken slow path, it calculates a...
Tony Finch's blog
On "the OSI deprogrammer" Back in December, George Michaelson posted an item on the APNIC blog titled “That OSI model refuses...
11 months ago
70
11 months ago
Back in December, George Michaelson posted an item on the APNIC blog titled “That OSI model refuses to die”, in reaction to Robert Graham’s “OSI Deprogrammer” published in September. I had discussed the OSI Deprogrammer on Lobsters, and George’s blog post prompted me to write an...
Tony Finch's blog
Moaning about YAML frontmatter As is typical for static site generators, each page on this web site is generated from a file...
9 months ago
64
9 months ago
As is typical for static site generators, each page on this web site is generated from a file containing markdown with YAML frontmatter. Neither markdown nor YAML are good. Markdown is very much the worse-is-better of markup languages; YAML, on the other hand, is more like...
Tony Finch's blog
semaphoreslo in Golang and GNU make Semaphores are one of the oldest concurrency primitives in computing, invented over 60 years ago....
7 months ago
56
7 months ago
Semaphores are one of the oldest concurrency primitives in computing, invented over 60 years ago. They are weird: usually the only numbers of concurrent processes we care about are zero, one, or many – but semaphores deal with those fussy finite numbers in between. Yesterday I...
Tony Finch's blog
against /tmp I commented on Lobsters that /tmp is usually a bad idea, which caused some surprise. I suppose /tmp...
4 months ago
55
4 months ago
I commented on Lobsters that /tmp is usually a bad idea, which caused some surprise. I suppose /tmp security bugs were common in the 1990s when I was learning Unix, but they are pretty rare now so I can see why less grizzled hackers might not be familiar with the problems. I...
Tony Finch's blog
tolower() with AVX-512 A couple of years ago I wrote about tolower() in bulk at speed using SWAR tricks. A couple of days...
6 months ago
53
6 months ago
A couple of years ago I wrote about tolower() in bulk at speed using SWAR tricks. A couple of days ago I was interested by Olivier Giniaux’s article about unsafe read beyond of death, an optimization for handling small strings with SIMD instructions, for a fast hash function...
Tony Finch's blog
getopt() but smaller The other day I learned about the Rust crate lexopt which describes itself as, A pathologically...
3 months ago
52
3 months ago
The other day I learned about the Rust crate lexopt which describes itself as, A pathologically simple command line argument parser. Most argument parsers are declarative: you tell them what to parse, and they do it. This one provides you with a stream of options and values and...
Tony Finch's blog
nsnotifyd-2.1 released I have made a new release of nsnotifyd, a tiny DNS server that just listens for NOTIFY messages and...
8 months ago
51
8 months ago
I have made a new release of nsnotifyd, a tiny DNS server that just listens for NOTIFY messages and runs a script when one of your zones changes. This nsnotifyd-2.1 release includes a few bugfixes: more lenient handling of trailing . in domain names on the command line avoid...
Tony Finch's blog
C is Turing complete Yesterday there was some discussion on the Orange Site about whether or not C is Turing...
6 months ago
51
6 months ago
Yesterday there was some discussion on the Orange Site about whether or not C is Turing complete. The consensus in the StackOverflow question is, no, because the C abstract machine is a (large) finite state machine, or maybe yes, if you believe that unaddressable local...
Tony Finch's blog
nsnotifyd-2.2 released I have made a new release of nsnotifyd, a tiny DNS server that just listens for NOTIFY messages and...
2 months ago
50
2 months ago
I have made a new release of nsnotifyd, a tiny DNS server that just listens for NOTIFY messages and runs a script when one of your zones changes. This nsnotifyd-2.2 release includes a new feature: nsnotify can now send NOTIFY messages from a specific source address Thanks to Adam...
Tony Finch's blog
petnames and Zooko's fan Recently the Spritely Institute published an introduction to Petnames, A humane approach to...
2 months ago
50
2 months ago
Recently the Spritely Institute published an introduction to Petnames, A humane approach to secure, decentralized naming. I have long been a fan of petnames, and graph naming systems in general. I first learned about them in the context of Mark Miller’s E programming language...
Tony Finch's blog
getentropy() vs RAND_bytes() A couple of notable things have happened in recent months: There is a new edition of POSIX for 2024....
4 months ago
50
4 months ago
A couple of notable things have happened in recent months: There is a new edition of POSIX for 2024. There’s lots of good stuff in it, but today I am writing about getentropy() which is the first officially standardized POSIX API for getting cryptographically secure random...
Tony Finch's blog
nsnotifyd-2.3 released D’oh, I lost track of a bug report that should have been fixed in nsnotifyd-2.2. Thus, hot on the...
2 months ago
48
2 months ago
D’oh, I lost track of a bug report that should have been fixed in nsnotifyd-2.2. Thus, hot on the heels of [the previous release][prev], here’s nsnotifyd-2.3. Sorry for causing extra work to my uncountably many users! The nsnotifyd daemon monitors a set of DNS zones and runs a...
Tony Finch's blog
exponential rate limiting Following my previous post on rate limiting with GCRA, leaky buckets without the buckets, I reviewed...
5 months ago
47
5 months ago
Following my previous post on rate limiting with GCRA, leaky buckets without the buckets, I reviewed my old notes on rate limiting for Exim. I thought I should do a new write-up of the ideas that I hope will be more broadly interesting. Exponential rate limiting uses an...
Tony Finch's blog
The unix69 keyboard layout: nerdy and nice A proper Unix keyboard layout must have escape next to 1 and control next to A. Compared to the...
a year ago
46
a year ago
A proper Unix keyboard layout must have escape next to 1 and control next to A. Compared to the usual ANSI layout, backquote is displaced from its common position next to 1. But a proper Unix keyboard should cover the entire ASCII repertoire, 94 printing characters on 47 keys,...
Tony Finch's blog
tolower() small string performance I’m pleased that so many people enjoyed my previous blog post on tolower() with AVX-512. Thanks for...
6 months ago
46
6 months ago
I’m pleased that so many people enjoyed my previous blog post on tolower() with AVX-512. Thanks for all the great comments and discussion! One aspect that needed more work was examining the performance for small strings. The previous blog post had a graph for strings up to about...
Tony Finch's blog
obfuscated C revisited The International Obfuscated C Code Contest has a newly revamped web site, and the Judges have...
a month ago
46
a month ago
The International Obfuscated C Code Contest has a newly revamped web site, and the Judges have announced the 28th contest, to coincide with its 40th anniversary. (Or 41st?) The Judges have also updated the archive of past winners so that as many of them as possible work on modern...
Tony Finch's blog
sudon't My opinion is not mainstream, but I think if you really examine the practices and security processes...
9 months ago
45
9 months ago
My opinion is not mainstream, but I think if you really examine the practices and security processes that use and recommend sudo, the reasons for using it are mostly bullshit. When I started my career in the late 1990s, I was already aware of really(8) and userv because one of my...
Tony Finch's blog
GCRA: leaky buckets without the buckets Yesterday I read an article describing the GCRA rate limiting algorithm. I thought it was really...
5 months ago
45
5 months ago
Yesterday I read an article describing the GCRA rate limiting algorithm. I thought it was really interesting, but I wasn’t entirely satisfied with Brandur’s explanation, and the Wikipedia articles on leaky buckets and GCRA are terrible, so here’s my version. what is GCRA? GCRA is...
Tony Finch's blog
My wireguard IPv6 tunnel Our net connection at home is not great: amongst its several misfeatures is a lack of IPv6....
9 months ago
43
9 months ago
Our net connection at home is not great: amongst its several misfeatures is a lack of IPv6. Yesterday I (at last!) got around to setting up a wireguard IPv6 VPN tunnel between my workstation and my Mythic Beasts virtual private server. There were a few, um, learning...
Tony Finch's blog
Popcorn Another recent food obsession! I think the instigation was a YouTube food video which led me to...
a year ago
43
a year ago
Another recent food obsession! I think the instigation was a YouTube food video which led me to try making popcorn at home from scratch with Nico. It was enormous fun! And several weeks later it’s still really entertaining to make (especially when a stray kernel pops after I take...
Tony Finch's blog
Joining ellipses with matching tangents In my previous entry I wrote about constructing a four-point egg, using curcular arcs that join...
a year ago
37
a year ago
In my previous entry I wrote about constructing a four-point egg, using curcular arcs that join where their tangents are at 45°. I wondered if I could do something similar with ellipses. As before, I made an interactive ellipse workbench to experiment with the problem. I got...
Tony Finch's blog
Constructing a four-point egg For reasons beyond the scope of this entry, I was investigating elliptical and ovoid shapes. The...
a year ago
37
a year ago
For reasons beyond the scope of this entry, I was investigating elliptical and ovoid shapes. The Wikipedia article for Moss’s egg has a link to a tutorial on Euclidean Eggs by Freyja Hreinsdóttir which (amongst other things) describes how to construct the “four point egg”. I...
Tony Finch's blog
Resurrected link log After an extremely long hiatus, I have resurrected my link log. As well as its web page,...
11 months ago
28
11 months ago
After an extremely long hiatus, I have resurrected my link log. As well as its web page, https://dotat.at/:/, my link log is shared via: an Atom feed https://dotat.at/:/feed.atom the fediverse https://mendeddrum.org/@fanf Dreamwidth...
Tony Finch's blog
Safe memory reclamation for BIND At the end of October, I finally got my multithreaded qp-trie working! It could be built with two...
over a year ago
19
over a year ago
At the end of October, I finally got my multithreaded qp-trie working! It could be built with two different concurrency control mechanisms: A reader/writer lock This has poor read-side scalability, because every thread is hammering on the same shared location. But its write...
Tony Finch's blog
Some subtleties of keycaps There’s plenty of material online about the bewildering variety of keycaps, eg, eg, but I learned a...
a year ago
18
a year ago
There’s plenty of material online about the bewildering variety of keycaps, eg, eg, but I learned a few things that surprised me when working on Keybird69. nightfox I found out that the remaining stock of Matteo Spinelli’s NightFox keyboards were being sold off cheap because of...
Tony Finch's blog
I made a keyboard! Another keyboard! HHKbeeb A couple of years ago I made a BBC Micro tribute keyboard in the runup to...
a year ago
18
a year ago
Another keyboard! HHKbeeb A couple of years ago I made a BBC Micro tribute keyboard in the runup to the beeb’s 40th anniversary. I called it HHKBeeb: The HHKBeeb is made from: keycaps designed by me and printed by WASD Yiancar HS60 PCB generic HHKB aluminium / acrylic sandwich...
Tony Finch's blog
BIND zone transfer performance This year I have rewritten BIND’s DNS name compression and decompression code. I didn’t plan to, it...
over a year ago
15
over a year ago
This year I have rewritten BIND’s DNS name compression and decompression code. I didn’t plan to, it just sort of happened! Anyway, last week my colleague Petr was doing some benchmarking, and he produced some numbers that seemed too good to be true, so I have re-done the...
Tony Finch's blog
libc delenda est Chris Wellons posted a good review of why large chunks of the C library are terrible, especially if...
over a year ago
15
over a year ago
Chris Wellons posted a good review of why large chunks of the C library are terrible, especially if you are coding on Windows - good fun if you like staring into the abyss. He followed up with let’s write a setjmp which is fun in a more positive way. I was also pleased to learn...
Tony Finch's blog
Where does "where does my computer get the time from?" come from? I am pleased that so many people enjoyed my talk about time at RIPE86. I thought I would write a few...
a year ago
15
a year ago
I am pleased that so many people enjoyed my talk about time at RIPE86. I thought I would write a few notes on some of the things I left out. genesis Essen & Markowitz Galileo zones BIH irony genesis There were a couple of things that I thought would make a fun talk: Just how many...
Tony Finch's blog
What does it mean to be an RCU implementation? The other day, Paul McKenney posted an article on LiveJournal about different flavours of RCU,...
over a year ago
15
over a year ago
The other day, Paul McKenney posted an article on LiveJournal about different flavours of RCU, prompted by a question about couple of Rust RCU crates. (There are a few comments about it on LWN.) McKenney goes on to propose an RCU classification system based on the API an...
Tony Finch's blog
An update on leap seconds It has been a couple of years since my previous blog post about leap seconds, though I have been...
over a year ago
15
over a year ago
It has been a couple of years since my previous blog post about leap seconds, though I have been tweeting on the topic fairly frequently: see my page on date, time, and leap seconds for an index of threads. But Twitter now seems a lot less likely to stick around, so I’ll aim to...
Tony Finch's blog
Random floating point numbers Here are a couple of algorithms for generating uniformly distributed floating point numbers 0.0 <= n...
a year ago
15
a year ago
Here are a couple of algorithms for generating uniformly distributed floating point numbers 0.0 <= n < 1.0 using an unbiased random bit generator and IEEE 754 double precision arithmetic. Both of them depend on details of how floating point numbers work, so before getting into...
Tony Finch's blog
Purple PCBs for Keybird69 I’m a beginner at PCB design, or rather, I haven’t made a PCB since I was at school 30 years ago,...
a year ago
15
a year ago
I’m a beginner at PCB design, or rather, I haven’t made a PCB since I was at school 30 years ago, and a lot has changed since then! So my aim for Keybird69’s PCB was to learn my way around the design, manufacturing, and assembly process. microcontroller other components key...
Tony Finch's blog
RIPE DNS Hackathon This weekend I was in Rotterdam for the RIPE DNS Hackathon. About 50 people gathered with several...
a year ago
15
a year ago
This weekend I was in Rotterdam for the RIPE DNS Hackathon. About 50 people gathered with several ideas for potential projects: things like easier DNSSEC provisioning, monitoring DNS activity in the network, what is the environmental cost of the DNS, … At the start of the weekend...
Tony Finch's blog
LEGO Technic beam sandwich keyboard case My Keybird69 uses LEGO in its enclosure, in an unconventional way. story time Two years ago I...
a year ago
15
a year ago
My Keybird69 uses LEGO in its enclosure, in an unconventional way. story time Two years ago I planned to make a typical acrylic sandwich case for HHKBeeb, in the style of the BBC Micro’s black and yellowish beige case. But that never happened because it was too hard to choose...
Tony Finch's blog
Novelkeys Kailh Big Switch build howto main img { border: 1px solid var(--fg); width: 100%; } The Novelkeys Kailh Big Switch is a...
a year ago
14
a year ago
main img { border: 1px solid var(--fg); width: 100%; } The Novelkeys Kailh Big Switch is a working MX-style mechanical keyboard switch, but 4x larger in every dimension. I realised at the weekend that the Big Switch should fit nicely in a simple Lego enclosure. Because an...
Tony Finch's blog
A qp-trie for BIND In 2021, I came up with a design for a new memory layout for a qp-trie, and I implemented a...
a year ago
14
a year ago
In 2021, I came up with a design for a new memory layout for a qp-trie, and I implemented a prototype of the design in NLnet Labs NSD (see my git repo or github). Since I started work at ISC my main project has been to adapt the NSD prototype into a qp-trie for use in BIND. The...
Tony Finch's blog
Where does my computer get the time from? This week I was in Rotterdam for a RIPE meeting. On Friday morning I gave a lightning talk called...
a year ago
14
a year ago
This week I was in Rotterdam for a RIPE meeting. On Friday morning I gave a lightning talk called where does my computer get the time from? The RIPE meeting website has a copy of my slides and a video of the talk; this is a blogified low-res version of the slides with a rough and...
Tony Finch's blog
Cataract surgery Previously, I wrote about my cataract and its assessment at Addenbrooke’s cataract clinic. I had my...
over a year ago
14
over a year ago
Previously, I wrote about my cataract and its assessment at Addenbrooke’s cataract clinic. I had my cataract removed a couple of weeks ago, and so far things are going well, though there is still some follow-up work needed. timing My cataract op was originally planned for the end...
Tony Finch's blog
Blue paint in the C preprocessor In the C preprocessor, after a macro has been expanded the result is rescanned for further macros....
9 months ago
14
9 months ago
In the C preprocessor, after a macro has been expanded the result is rescanned for further macros. To prevent recursion, [the C standard][n3220] says the following in section 6.10.5.4p2. (This text has been basically the same since C89.) If the name of the macro being replaced is...
Tony Finch's blog
My spaghetti carbonara recipe In recent weeks I have been obsessed with carbonara: I have probably been eating it far too...
a year ago
13
a year ago
In recent weeks I have been obsessed with carbonara: I have probably been eating it far too frequently. Here’s my recipe. It works well for 1 - 3 people but gets unweildy at larger quantities. ingredients Rough quantities per person: 100g pasta Spaghetti is traditional but I’ll...
Tony Finch's blog
More random floating point numbers I got some interesting comments about my previous notes on random floating point numbers on...
a year ago
13
a year ago
I got some interesting comments about my previous notes on random floating point numbers on Lobsters, Dreamwidth, and from Pete Cawley on Twitter. Here’s an addendum about an alternative model of uniformity. There are 2^62 double precision floats between 0.0 and 1.0, but as...
Tony Finch's blog
PCG64 DXSM random number generator Last week I was interested to read about the proposed math/rand/v2 for Golang’s standard library. It...
a year ago
12
a year ago
Last week I was interested to read about the proposed math/rand/v2 for Golang’s standard library. It mentioned a new-ish flavour of PCG random number generator which I had not previously encountered, called PCG64 DXSM. This blog post collects what I have learned about it. (I have...
Tony Finch's blog
Slower DNS name decompression In a previous entry, I wrote about making DNS name decompression faster by moving work left on this...
over a year ago
12
over a year ago
In a previous entry, I wrote about making DNS name decompression faster by moving work left on this diagram so that we do less of it: names < pointers < labels < bytes Last week I had a bright idea about that leftmost step, moving per-pointer work to per-name, using some...
Tony Finch's blog
Concurrent qp-trie performance numbers Previously, I wrote about implementing safe memory reclamation for my qp-trie code in BIND. I have...
over a year ago
12
over a year ago
Previously, I wrote about implementing safe memory reclamation for my qp-trie code in BIND. I have now got it working with a refactored qp-trie that has been changed to support asynchronous memory reclamation - working to the point where I can run some benchmarks to compare the...
Tony Finch's blog
random numbers from pcg32 at 200 Gbit/s One of the neat things about the PCG random number generator by Melissa O’Neill is its use of...
a week ago
9
a week ago
One of the neat things about the PCG random number generator by Melissa O’Neill is its use of instruction-level parallelism: the PCG state update can run in parallel with its output permutation. However, PCG only has a limited amount of ILP, about 3 instructions. Its overall...