Don't invert your security!

---

The most striking lesson I think that anyone can take from the recent apache compromise is this:

The more secure zone should have credentials for the less secure one, not the other way round, and the more secure zone should be responsible for controlling the processes that it is involved in.

This way the less secure zone doesn't have any influence over your more secure stuff.

If you, like me, spend your days making systems interact with one another this is reasonably fundamental stuff. But for those who aren't so paranoid its a lesson well worth heeding.

---

Danny strengthens in the Atlantic

---

Danny has maximum sustained winds of 60 mph (95 kph) early Thursday with slow strengthening expected over the next few days.

Its weird seeing your name used this way, but a great opportunity for toilet humour.

---

Use http AUTH for control of read and write access to multiple svn repos

---

I figured this out, and thought I share it, as I couldn't find anything remotely similar on the interweb.
OTOH I'm sure you all know all about this, and there are articles everywhere and I'm just being dumb.

I wanted a password protected svn, with some people read only and others read-write, across multiple repositories.



## your svn url is .../svn/repository/reponame
## first set up the /svn part
## enable DAV svn and require any user from the password file for any action
## this will allow everyone who logs in to do anything

<Location /svn>
DAV svn
SVNParentPath /wherever/svn/repository
AuthType Basic
AuthName "Subversion Repository"
AuthUserFile /etc/httpd/dav_svn.passwd
Require valid-user
</Location>


## now for each repo appy a stricter constraint

<Location /svn/infrastructure>
# only members of sysadmin group can access infra repo
AuthType Basic
AuthName "Subversion Infrastructure Repository"
AuthUserFile /etc/httpd/dav_svn.passwd

## create a groups file
AuthGroupFile /etc/httpd/dav_svn.groups
## the only people who can acces this one are the group members
Require group sysadmin
</Location>

<Location /svn/projects>
AuthType Basic
AuthName "Subversion Projects Repository"
AuthUserFile /etc/httpd/dav_svn.passwd
AuthGroupFile /etc/httpd/dav_svn.groups

## only members of commiters group can commit
## but any valid user can checkout and browse
## because we're using limit except to narrow
## the restrictions

<LimitExcept GET PROPFIND OPTIONS REPORT>
Require group committers
</LimitExcept>
</Location>



Neat?
Or weel kent?

---

at the third stroke it will be 123456789 o'clock

---

Yes folks, earlier today (I meant to post this then, but you know how it is) it was
12:34:56 7/8/9

this will happen again in 1000 years,

but we can look forward to
6:5:4 3/2/10
and
5:6:7 8/9/10 next year.

---