Reddit has been tweaking their site layout, and they've added a big yellow block at the top of the page for logged-out visitors. In addition, even after opting out of the garish new redesign, a bright red "try the redesign" banner appears in the upper left corner of the page.

While I was in the Stylish editor adding some new rules, I figured I'd post my ad-blocking recipe here. This should suppress much of the advertising and promoted content on Reddit's web interface, as well as the yellow signup promo and the "try the redesign" banner.

@namespace url(http://www.w3.org/1999/xhtml);
@-moz-document domain("reddit.com") {
    div#siteTable_organic {
        display: none !important;
    }
    span#sponsored-indicator {
        display: none;
    }
    div#sponsorship {
        display: none;
    }
    div#sponsorshipbox {
        display: none;
    }
    iframe#ad_main {
        display: none;
    }
    iframe#ad_sponsorship {
        disp...

When downloading and compiling software, it's always a good idea to verify the integrity of the source files you obtain. Package handlers like yum and apt handle this automatically, but it must be done manually when you download software yourself.

ISC, the publisher of the BIND DNS server, provides cryptographic signatures with each release. If you have gpg installed, you can use the signature to validate your downloaded BIND tarball. ISC's download URLs follow a consistent naming pattern; simply change the version number in the URLs below to match the version you need.

Download the BIND source

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.4/bind-9.11.4.tar.gz
  `bind-9.11.4.tar.gz' saved [9621408/9621408]

Download the associated signature file

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.4/bind-9.11.4.tar.gz.sha256.asc
  `bind-9.11.4.tar.gz.sha256.asc' saved [873/873]

Down...

This article outlines the deployment of a recursive, caching, authoritative DNS server running BIND 9.11.x on CentOS 6.10. Why this combination? The BIND name server is the most feature-rich open source resolver, with decades of development behind it. And despite closing in on its nominal end-of-life, CentOS 6 remains a popular server OS due to its proven stability and the absence of systemd.

Preparing your environment

In order to set up your DNS server, you're going to need:

• A server running CentOS 6.10 (bare metal, VM, or VPS will all work)
• root ssh access to your server
• At least 64MB of available RAM for the named process
• wget or some other utility to download a file

There are also some software dependencies:

• The gcc compiler (yum -y install gcc)
• The file utility (yum -y install file)
• OpenSSL header files (yum -y install openssl-devel)

You don't necessarily n...

In an age where SSL/TLS certificates are free via Let's Encrypt, if you're running a Postfix mail server, you should make sure it's capable of speaking TLS.

Here's the output from postconf -n | grep tls on my machine, which lists all of the TLS options in main.cf that I've changed from their defaults:

smtp_tls_CAfile = /etc/pki/tls/cert.pem
smtp_tls_ciphers = medium
smtp_tls_loglevel = 1
smtp_tls_mandatory_protocols = !TLSv1, !SSLv2, !SSLv3
smtp_tls_note_starttls_offer = yes
smtp_tls_protocols = !SSLv2, !SSLv3
smtp_tls_security_level = may
smtpd_tls_CAfile = /etc/pki/tls/cert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/letsencrypt/live/my.example.com/fullchain.pem
smtpd_tls_ciphers = medium
smtpd_tls_dh1024_param_file = /etc/postfix/ssl/dh_2048.pem
smtpd_tls_dh512_param_file = /etc/postfix/ssl/dh_512.pem
smtpd_tls_eecdh_grade = strong
smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, CAM...

For a long time, I could do a packet capture on a Linux machine by redirecting the output of tcpdump to a file, and Ethereal would open it up no problem. Somewhere along the way, Wireshark started choking on these files. Every now and then I still forget and try to do something like this:

tcpdump -nn -vv -S -X -s0 -i eth0 port 53 > /tmp/dns.cap

That captures a bunch of packets in human-readable form, but Wireshark refuses to open the file. It gives an error along the lines of:

The capture file appears to be damaged or corrupt.
(stanag4607: File has 976238138d-byte packet, bigger than maximum of 262144)

If you find yourself looking at this error, make sure to use the -w flag to tcpdump instead of redirecting stdout:

tcpdump -nn -vv -S -X -s0 -i eth0 port 53 -w /tmp/dns.cap

This generates a binary pcap file that Wireshark happily opens up.

Given an error from chronyd that looks like this:

Sep 17 10:31:12 kitch chronyd[1355]: Could not write to temporary driftfile /var/lib/chrony/drift.tmp

The likely cause is that the filesystem where the driftfile lives (in this case /var) is full. Inspect the filesystem and free up some space.

I discovered by accident that PHP allows you to format the iterator in a for loop with sprintf(), as long as the result of sprintf() can evaluate to the same numeric type as your step value. As a contrived example, consider the following loop used to build out the options in a "months of the year" select list:

$month = '<select name="month">';
for ($i = 1; $i < 13; $i++) {
    $month .= '<option value="' . sprintf('%02d', $i) . '">' . sprintf('%02d', $i);
}
$month .= '</select>';

The same loop can be written this way:

$month = '<select name="month">';
for ($i = sprintf('%02d', 1); $i < sprintf('%02d', 13); $i = sprintf('%02d', ++$i)) {
    $month .= '<option value="' . $i . '">' . $i;
}
$month .= '</select>';

That is, the formatting of $i into a two-digit zero-padded integer is being done inside of the control block itself, instead of as a separate instruction inside the loop.

In this specific example, there's no benefit (and in fact there is some detri...