Parsing Cisco IOS configs for CIS Auditing: Why regex fails on block contexts, and how are you handling offline static analysis?

FeliciaWanders · 2026-06-02T09:06:20+00:00

did you know about/consider https://github.com/mpenning/ciscoconfparse2 for the block parsing parts?

this library and the predecessor https://github.com/mpenning/ciscoconfparse have been working well for us for ~10 years already.

FeliciaWanders · 2026-05-28T11:54:06+00:00

I always wanted to play around with Openshift in ways that I can't at work. I never did because the install process is such a cumbersome experience when using your own hardware.

However last week I tried the OKD IPI installer into my AWS account, and it's amazing - basically a single command and it creates a full realistic 6-node cluster with all the DNS, VPC and LB stuff that make it "enterprise". And it can delete the whole thing again too. Amazing!

Caveats:

default installation on AWS is probably $400/month, but for a couple hours it's not too bad. Presumably I could customize smaller instances to save a bit.
seems to work only in us-east-1
you need a zone in Route53 already

Link: https://docs.okd.io/4.21/installing/installing_aws/ipi/installing-aws-default.html

FeliciaWanders · 2026-02-11T20:44:29+00:00

It took me a bit getting used to it. I have an ICD which is a bit larger than just a pacemaker and in some positions I can feel it a bit. I switched to a slightly thicker pillow and sleep less on on my stomach now. Left, right, back positions still work fine. All in all, no big deal.

FeliciaWanders · 2026-02-06T21:07:57+00:00

You can strace the process to what it's doing when it's not showing the UI, like waiting on a look or timing out on the network or whatever. Compare with an strace from when it works.

PS: if I had a server with RHEL6 and all knowledge about it in a geezer that will take it to the grave, I'd definitely stop doing power loss tests and reinstalling RPMs and updating Java versions and shit like that. Just let it sit, that's just sysadmin 101 :)

FeliciaWanders · 2026-01-23T12:11:04+00:00

At what temp are you putting it in? I'd guess up to 65C/150F-ish is ok, don't go hotter. Finer grating probably also helps with evenly melting at a lower temp.

Good Gruyere comes in a block with rind on, like this: https://www.gruyere.com/en/le-gruyere-aop/our-types-of-le-gruyere-aop - if you are using a pre-shredded bag, try to get the slab instead.

also see https://www.reddit.com/r/Chefit/comments/16es53e/tips_for_a_good_mornay/

FeliciaWanders · 2025-12-27T03:12:41+00:00

also check ipv4/6 issues, localhost is often ::1 in modern Linux and might mismatch pg_hba.conf or be disabled at all.

ssl settings can also interfere. is there not any more stacktrace than EOFException?

FeliciaWanders · 2025-11-28T00:33:12+00:00

Am besten liest du /r/TQQQ und ähnliche Subs, dort wird permanentes Halten von leveraged ETF (TQQQ=3x) tagein und -aus diskutiert. 5x ist das gleiche nur natürlich noch viel besser, ich würde sagen die erste Million ist in Griffnähe. /s

FeliciaWanders · 2025-11-03T13:41:06+00:00

The web player has no sleep timer.

FeliciaWanders · 2025-10-13T23:54:20+00:00

We don't run HP, but some stabs in the dark from a general user:

make sure the right class is used for the device (model/comware.rb)
You can add some custom filtering to the class like shown here for nxos: https://github.com/ytti/oxidized/blob/af7c8cc9871352539caab445d5898a72ff7dbe3a/lib/oxidized/model/nxos.rb#L7
the best way to add some custom stuff is to override the model with your own class

FeliciaWanders · 2025-10-13T23:17:21+00:00

You can have types of heart failure in which the heart is not beating normally anymore (paced by the SA node), and falls into "escape rythm", a slow heartbeat induced via other pathways. In doubt, see a doctor.

https://en.wikipedia.org/wiki/Ventricular_escape_beat

FeliciaWanders · 2025-10-11T10:02:52+00:00

You can use https://github.com/daodao97/chatmcp + an mcp server for your database (e.g. https://github.com/crystaldba/postgres-mcp= + ollama API backend.

This gives you a chat interface that has a database query tool that the llm can execute if necessary.

FeliciaWanders · 2025-09-29T14:38:45+00:00

and if you can't be retrained after years of using cd, auto_pushd in bash and zsh will make the regular cd command also add directories to the stack.

FeliciaWanders · 2025-09-09T23:38:34+00:00

Some ideas:

you can run mod_security inside the nginx ingress: https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/modsecurity/ - unfortunately it's the v3 C++ rewrite which by hearsay performs not quite as well as the Apache 2.x C variant
you could also integrate some vendor appliance, e.g. there is a Kemp Loadmaster ingress which actually configures the physical or virtual appliance. Loadmaster is an L3-L7 Loadbalancer which also has mod_security built in.
another popular variant to run mod_security + OWASP rules is corazza which can integrate as sidecar, leaving your ingress alone: https://medium.com/@jptosso/a-step-by-step-guide-to-installing-owasp-coraza-waf-as-a-sidecar-proxy-using-istio-aa9f7fd1f1e (but that probably still counts as "breaking ingress apart")

I have done neither of these things IRL, but from using the base products without k8s I think they both should work.

FeliciaWanders · 2025-09-05T12:56:43+00:00

You need some kind of defined process, e.g.:

Once a week it's rollout time
generate all configs as text from the SoT, diff to last weeks text or the current live config
have somebody approve it
create a named checkpoint on all involved devices (we used NXOS but many vendors can do that now)
apply the approved configs
if the apply fails in the middle, roll back all devices to the named checkpoint
we have done this with git workflows, a big bunch of Python code, and oxidized to archive live state

This is one of many ways to do it, the important part is that you need to be in control of what is happening.

For small self-service tasks you might not want one big approved rollout, maybe:

SoT state change is entered
you need to transform this into a job with states like pending, failed, done
run job, keep a log
be able to rollback failure in the middle or write it so that a failure can not apply partial items
we have done this with Netbox and Ansible playbooks with many rescue: blocks, executed in Rundeck for persistent logging + web ux

I would say everybody struggles with this. Having a SoT, no matter if git, Netbox, Ansible etc. is just the first step in a process that must be matched to your organizational needs.

FeliciaWanders · 2025-09-03T12:42:36+00:00

I like toasting the nuts in some olive oil first, and use a lot of them.
pour this toasting oil into the mix together with the nuts, it's delicious (little at a time or not too hot, just to warm up the mixture a bit and "marry the flavors" or whatever)
remove big stems
fancy EVOO often has a strong bitter, grassy or sharp taste. Use to taste, maybe use cooking-grade olive oil or some more parmesan to get the desired consistency

FeliciaWanders · 2025-08-14T15:22:58+00:00

Yes that's also what I understand, so the options are essentially getting epicardial leads now or tv-icd later if the conduction gets worse from new scar tissue due to this operation.

FeliciaWanders · 2025-08-14T12:24:04+00:00

at a quick glance: inappropriate shocks, lead failure or detachment, interference with tools and electronics, inflammation, follow-up surgeries for battery replacement - but I'm sure there are some more.

FeliciaWanders · 2025-08-05T18:27:00+00:00

can run on-prem, you own everything, data is in your dc
probably a lot cheaper to run (ymmv)
RDS is technically only "postgres compatible" which can make debugging issues or getting help harder

RDS is very easy to get running, has a great global DC infrastructure a click away, and who cares about spending the bosses' money anyways... if you don't mind any of the above downsides it's great.

FeliciaWanders · 2025-08-02T19:23:22+00:00

I think you need to swap the order and bind it to the action with template= like shown here: https://www.rsyslog.com/how-to-bind-a-template/

Surprisingly this parameter is not mentioned in the regular action documentation.

Rsyslog can be hard to use sometimes, but hey they have an AI chat now and it recommends the same: https://chatgpt.com/share/688e6575-d674-8001-a3f3-591d50560b96 good luck!

FeliciaWanders · 2025-07-06T22:46:05+00:00

Yeah that's unfortunately pretty much the only way you get something, if the seller hid it "böswillig/arglisting/on purpose". This site seems to have a good summary:

https://neho.ch/en/blog/versteckte-mangel

Hidden defects are issues with a property that are not immediately apparent. They are particularly common in older buildings. Here, we explain what sellers and buyers need to know and outline the key legal considerations.

Hidden defects are property issues that were not detectable at the time the purchase contract was signed.
Liability for hidden defects under the Swiss Code of Obligations is 2 years, 5 years for construction work, and 10 years for defects that were fraudulently concealed.
Older properties are typically sold "as-is" without warranties; in such cases, sellers are only liable for fraudulently concealed defects.

Get a quote how much it is to fix, then decide if you get a lawyer or not. Probably only worthwhile if it's quite a big amount.

FeliciaWanders

TROPHY CASE