Abhijit Menon-Sen

> Is the cookie's value mapped to some in-memory entry in the application server, is it stored in a database, etc?

Neither. At login the server signs the new session cookie with a secret application key. Later, when a client requests a page and sends over the session cookie, the server verifies the signature. If it matches, the data in the session cookie -- which usually includes the username, whether they're logged in, and for how long -- can be trusted.

This is nice because it makes scaling a stateful site easier. Server-side session stores often become the bottleneck. Also, from a REST standpoint, updating a session database during a GET request (eg to freshen the session) is problematic.

ASP.net was the first time I remember seeing the signed session cookie trick, but most web frameworks have it now:

django -- https://docs.djangoproject.com/en/dev/topics/http/sessions/#using-cookie-based-sessions

rails -- http://guides.rubyonrails.org/security.html#session-storage

flask -- http://flask.pocoo.org/docs/api/#sessions

node -- https://github.com/mozilla/node-client-sessions

mojolicious -- http://toroid.org/ams/etc/mojolicious-session-cookies

I limit my subs to mostly tech and feeds that post infrequently but well.

I go back and forth between enabling Hacker News and disabling it. It's too busy and distracting sometimes when I need to get things done and I don't want to get lost it some lengthy article somewhere.

Here are my current feeds sans HN

http://abstrusegoose.com

http://xkcd.com/

http://cmurphycode.posterous.com

http://acmel.wordpress.com

http://bsdpunk.blogspot.com/

http://saintaardvarkthecarpeted.com/blog/

http://www.cpeterson.org

http://www.codinghorror.com/blog/

http://blogs.iss.net

http://ignorethecode.net

http://blog.lastinfirstout.net/

http://linuxsysadminblog.com

http://www.mysqlperformanceblog.com

http://planetsysadmin.com/

http://teddziuba.com/

http://toroid.org/ams/etc

> Encrypting Files
> This really is a problem. If you’re/not/ [...] then there’s no one good tool that does this now. Filippo Valsorda is working on “age” for these use cases, and I’m super optimistic about it, but it’s not there yet.

I've been (ab)using ansible-vault for this. It's apparently[1] now using reasonable primitives (PBKDF2+AES-CTR+HMAC-SHA256), but not necessarily the latest and bestest ones: https://github.com/ansible/ansible/blob/v2.8.1/lib/ansible/parsing/vault/__init__.py#L1108

The implemention is sub-optimal though, with some silly issues that haven't been fixed like https://github.com/ansible/ansible/issues/12121

[1] http://toroid.org/ansible-vault-strange-crypto

> Thanks for the awesome write-up.

Glad you enjoyed it. :-)

> I have considered doing something totally ridiculous like setting up a Raspberry Pi with a camera and machine vision software to watch the LED displays on these devices to glean status information. Silly, but...

Ha! I actually have a PoE camera pointed at the display of my UPS. Here's what it looks like right now: https://toroid.org/misc/ups-display.jpg

Notice that horizontal blank row of dead pixels halfway down the right side of the display? The one that makes "54.6" look like "51.6"? That gap defeated my naïve five-minute attempt to use image recognition to extract the battery voltage.

I think the general idea is that if you make your yield points explicit, you see them yourself, and if you generally try for 100% unit test coverage, you end up nudging yourself towards fewer yield points, a simpler state machine, and better karma overall.

The complexity you see affects yourself more than the complexity you don't.

I rather agree.

FWIW my friend Abhijit Menon-Sen wrote a blog post on the matter last year, about some code with excellent test coverage and explicit yield points: http://toroid.org/callback-heaven