David Mentré's blog

Last entries

Sun 01 Jan 2017

A new PGP key

I started this new 2017 year by creating a new PGP key (with fingerprint 3EA1 53E8 9472 8519 CDD1 1B9D 45DD 2720 B15E CA67). My old key was made twelve years ago and was too weak. The new one should be stronger (RSA 4096 bits). You can find my new public key on key servers or on my contact page.

To make it, I followed this "Email Self-Defense" tutorial from FSF (which was a bit out-dated on the version of Enigmail I used). Thanks Gilles! (nearly one year ago: sic!)

Sun 29 May 2016

Little Guide on Software Engineering

As a programmer and as a researcher in the software field, I've always been interested in trying to understand why a program or a system is well designed, fits its intended use, is maintainable, is scalable, etc. In short, how to make a good software.

I tried to summarize what I found so far in a very small (two pages long) "Little Guide on Software Engineering": 11 rules of decreasing importance with some references for further digging.

Of course, no revelations here. All those rules are found here and there in good books of Software Engineering. But defining and sorting those rules was an interesting exercise. :-) I'm not fully satisfied with the rule order and might change it. It is version 0.4 up to now and is still Work in Progress.

I would be pleased to get your feedback on those rules, so don't hesitate to send an email. The document is under CC0 license and there is a GitHub repository.

Tue 23 Feb 2016

Why are OO programs scalable?

For once, I am going to ask a concrete question: why are Object-Oriented programs supposed to be scalable? LibreOffice has about 10 millions line of code and Firefox has more than 18 millions lines of code. They are written in object-oriented languages (C++ for both of them). Is an object-oriented language a need for writing such big programs as it is often said or could it be done in any other language with appropriate modularity programming features?

The probably most famous counter-example is the Linux Kernel, written in plain C language and counting more than 20 millions lines of code. But the Linux Kernel is probably a very rare case of this kind (would you have another example?), developed in a very specific way by the most talented people on Earth.

I discussed this point with colleagues having done a lot of object-oriented programming, they told me the usual argument: object-oriented programs allow grouping related data and code, abstracting details from the outside, thus their scalability. But a lot a programming languages have such modularity features, dating back to Ada in 1983 up to more modern ML-like languages with complex module system (e.g. functors).

So, is there another characteristic or usage of object-orientation that helps in program scalability? Or could the same principles be applied to any kind of language (which I think for now)?

For now, I don't understand why object-oriented programs should be more scalable. But I'm very bad at object-oriented programming. So if you have explanations, I would very please to hear them. You can add comments below or contact me directly.

Tue 16 Feb 2016

Open-source alternative to Trello: does it exist? Can we make it better?

I am a daily user of Trello, the visual online service to organize cards into lists. Trello is a very simple but neatly found idea: you use cards organized into lists to represent your things (e.g. to-do lists) and, more importantly, you re-organize them as you wish: moving cards, moving lists, putting colored labels, comments, due date, or check-lists on cards, ... That way, you can represent about any system and update it status very easily and visually. Trello has also filtering capabilities and, last but not least, collaborative capabilities by sharing boards of cards. Trello is visual, simple to use. You can organize both your private and professional life with it: bug tracker, to-do list, project management, holidays planning, etc. Trello is great!

Well, nearly. Trello has a big drawback: it is a proprietary product.

So, can we find an open-source alternative to Trello?

Looking for open-source Trello-like application

A friend of mine recommended me to look at AlternativeTo's suggested application for Trello. The listed applications can be classified in four categories:

  • Bug trackers and project management tools (Trac, Tuleap Open ALM, ...);
  • Kanban-like boards for Agile project management (Kanboard, TaskBoard, ...);
  • Some strange-application-in-that-category like Loomio, Agenda or ERPAL;
  • Two Trello-like applications: Restyaboard and Wekan!

Restyboard and Wekan are very similar, i.e. a very early prototype of Trello. You can create lists and cards, move them, add labels and do some filtering, share boards... and that's all! Moreover Restyboard is very slow and uneasy. So if you want a basic Trello-like open-source alternative to Trello, use Wekan.

But if you want the full power of Trello, you won't find any open-source alternative.

So we need to build it. :-)

Designing a better Free Software alternative to Trello

So, how could we improve Trello?

Firstly, take all the basics of Trello: lists, cards, due dates, filters, check-lists, board sharing, etc. Maybe some goodies like badges are not needed, but the core of our Free Software Trello should be very close to the current proprietary Trello.

Second step: make it real desktop application (and mobile App), not an online service. Why? Because in a post-Snowden era, you cannot trust any online server, not in the US, not in Europe, not even your own lovely-administrated-server. So edit your data locally, encrypt it and then upload it for sharing. For a local application, you can create a real desktop application, or a web application. The second one might be easier to create and is in the mainstream, but even if web-based application can be very powerful, there always are strange UI issues, like application "windows" not interacting similarly to your other desktop windows. So I vote for the real application.

Third step: add sharing capabilities. Data should be uploaded in encrypted form. On the server, you need a minimal platform to store pieces of data, maybe with some PHP to maximize hosting ability. That step might be a bit tricky: you need some crypto power, be astute and not re-invent the wheel (or you won't have any security) to be able to share data while keeping that data encrypted on server. But there is always a lot of fun in a technical challenge! :-) And other people are looking at this issue, like Mozilla's Firefox Sync.

Fourth step: add 2D capabilities. I always found Trello frustrating regarding list organization: I can put lists in column, but I cannot organize lists in two dimensions, as on a table. Sometimes lists are very short: I would like to group them together, one above the other. Trello does not allow that.

Fifth but not least step: add programming capabilities. You want to automatically move cards when a certain label is put on them? You want to create a card when an email is received? Take you favorite programming language (OCaml, Lua, Ruby, ...), use the API and program the behavior your want. Even better, publish the recipe online, in a public repository, that way other people can reuse your nice Agile Project Management Tool Manipulated With Only Five Keystrokes™.

With all of that, I think we'll have a better Free Software alternative to Trello.

By the way I propose its name, Tibett: Tibett is better than Trello and because with Tibbet you can go to high heights. :)

What do you think of it? Would you have other improvements to Trello?

Sun 14 Feb 2016

  • David Mentré

À écouter : France Inter, « État d’urgence, état de méfiance »

Reportage diffusé ce matin sur France Inter à écouter d'urgence : « État d’urgence, état de méfiance ».

Il est éclairant sur l'inutilité de l'état d'urgence, l'aveuglement et l'incompétence des préfets à comprendre la religion Musulmane et le salafisme (et donc à lutter efficacement contre le terrorisme), l'arbitraire des interventions policières et leur inutilité (3.000 interventions pour une seule arrestation) qui fatigue les policiers, l'utilisation des assignations à résidence pour contrer toute contestation (en l'occurrence écologiste lors de la COP21), et surtout les menaces à la démocratie.

L'État a des moyens mais ne l'utilise que pour faire de l'esbroufe. Il est temps que nos gouvernants arrêtent de gouverner par les sondages.

Arrêtons cet État d'urgence !

Tue 09 Feb 2016

The need for a new editor mixing texts and graphics

Every time you do some programming, you need a text editor (except when you program in graphical languages like SCADE). Some long-time well-known ones are Emacs (which I use) or VI. Such editors are focusing on their editing capabilities (you can edit huge files without any issue) and their ability to be programmed, for example they have dedicated modes to edit C language files or OCaml files. They are very versatile, you can find modes for obscure languages or even have dedicated mode for proof assistant (e.g. ProofGeneral for Emacs).

But those editors are focusing on the text. I think most if not all the time, they are using regex to match some specific keywords of a program and then color or indent them in a specific way, but they don't understand the program, e.g. what is a variable, an expression or a method call. Therefore people have proposed another kind of text editor dedicated to programming languages, like Eclipse or IntelliJ IDEA. Such editors are very powerful: they understand the program structure, propose useful contextual helps (like giving parameters of a method call) or help in code refactoring (e.g. encapsulating an object field so it can only be accessed to getter and setter methods).

Of course the distinction is not so binary: textual editor like Emacs or VI have advanced modes than can understand program structure and do refactoring.

But both kind of editors have a strong limitation: they focus on programming language and most of the time they are unable to mix text, graphics or other layouts like tables. This is not entirely true for Eclipse, but I'll come to that later. So, why would you like to mix text and graphics when editing a program? Because a program is more than just text! Wouldn't be useful to use a quick drawing to explain an algorithm? If you program manipulates state machines, wouldn't be useful to directly draw state machines and automatically convert them into code? That would certainly avoid some kind of programming errors. One could also imagine tables to specify the behavior of a function like Parnas tables (which could be even considered as a formal, albeit readily understandable, specification). Or one could imagine graphically draw the architecture of the system, then dive into usual text code to edit the software modules.

Such kind of editor exists, like mbeddr for C code or some Eclipse plug-ins like Rodin for Event-B formal language. But again I see a strong limitation to their use: they are storing the edited source code into a model generally saved in an XML file. It is very difficult to handle such XML files with usual programming tools. For example handling them in source control tool like Git is a nightmare, with merges very frequently corrupting the XML files.

So what would be the ideal programming editor mixing text, graphics and tables? I won't give precise specification :-) but only sketch here some characteristics:

  • Versatile, programmable, so as to handle various programming languages like Emacs or VI;
  • Able to directly draw graphics and edit tables, in a WYSIWYG way. For me this is a crucial point. Wiki-like approaches with special markers are not user friendly and practical enough. The ability to program the editor would allow transforming graphics or table into code text and vice-versa;
  • Store edited programs only in text files (and of course probably some binary files for graphics). One would probably need some tags stored as program comment to reference graphics within the code text and display it properly within the editor;
  • Hyperlink capabilities, to be able to navigate within the code, e.g. jump from a graphic element to the corresponding code text, maintain index and reference tables (for code documentation), ...
  • Fast, low on memory, disk and CPU resources. Everybody that has already used Eclipse understands what I mean. :-)

As far as I know, such a tool does not exist yet. If you have hints or even tool name that would be able to do what I would like, I'm very interested. ;-) Tell it to me through this blog comments or directly.

Tue 02 Feb 2016

"Software Aging"

In 1994, David L. Parnas published a provocative paper called "Software Aging". I recently read this paper and found it remarkably accurate!

Software is digital, so how could it age? Parnas identified two different causes for software getting "older" when time passes:

  • "Lack of Movement", i.e. the inability for the software to match evolving user or environment expectations. A computer environment evolves constantly; language and compiler changes, operating system and library changes. But this is also true for user expectations: in the 70' people expected a text interface, in the 90' a graphical interface and now they want a web interface accessible from any device or an App usable on their mobile devices;
  • "Ignorant Surgery", i.e. the inability to correctly adapt the software as time passes. When somebody modifies the software, probably not the original developer(s), she/he won't probably understand its design and probably modify it as she/he understand the software. At this point understanding the software means understanding the original design as well as the introduced new design. After several of such modifications, nobody can understand the software and in some cases it should be rewritten from scratch.

Although this idea of Software Aging was proposed 22 years ago (and appeared 47 years ago, the famous "Software Crisis", according to Parnas), it is striking to see that it is still true. When I see it takes nearly one year to make a new release of the Debian system, I view it at software aging at work: the environment evolves in unexpected ways and each software should be adapted to match its new environment. And sometimes, applying those changes can be very difficult and lead to Ignorant Surgery, like the famous Debian OpenSSL bug.

How to avoid this software decay? Parnas gives some advises, I just summarizes them here:

  1. Design for change, i.e. apply usual Software Engineering principles like Information Hiding, abstraction, separation of concerns, proper use of object orientation, etc.
  2. Document! Document your design, your choices and document for the people who'll come after you work on the software.
  3. Review! Review the design, code or other software artifacts by other members of your team, by experts in the domain on which your software is applying, etc.

Even for actual software, above principles can be applied, retro-actively. Parnas gives some advises.

All current software are aging. Hopefully, 22 years ago, Parnas gave some very good advises on how to develop and maintain software to limit this phenomenon. Listen to him, apply them.

Thu 28 Jan 2016

Fin du support des « vieux » Windows à partir de Skylake : un bon argument pour passer à Linux ?

Microsoft a annoncé récemment qu'ils ne feraient plus l'effort de supporter les nouveaux processeurs sur Windows 7 et 8.1 à partir de la génération « Skylake » des processeurs Intel. Bien sûr, Windows 7 ou 8 continuera de fonctionner sur le processeur lui-même grâce à la compatibilité x86 ascendante. Mais on peut s'interroger sur le support de tous les chipsets de support des périphériques comme les disque dur ou les chipsets graphiques intégrés. Est-ce que quand une nouvelle carte mère sortira Windows 7 sera supporté ? Vu le déploiement de Windows 7 en entreprise, cela pourrait être un réel problème.

Un bon argument pour passer à un système vraiment Libre comme Linux ?

Tue 26 Jan 2016

WE programming project: XKCD keyword index

With this post I'm starting a new kind of article: WE programming project. It's objective is to give ideas of programs that could be written over a WE, probably a lot more or lot less depending on your skill and willing to extend the idea.

Here is the first project proposal: an XKCD keyword index.


You probably known XKCD, "a webcomic of romance, sarcasm, math, and language". If not, I recommend it's reading. :-) All the XKCD comics are freely available, through an URL, e.g. "Asteroid" is available at URL https://imgs.xkcd.com/comics/asteroid.png.

Sometimes, I would like to illustrate a slide or blog item with one of XKCD comics. I know it exists, I saw it but I can no longer find it! So frustrating! So the main idea of this WE programming project is rather simple: make a keyword index of XKCD comics so that one could look for a comics over a theme or idea.


Here is some requirements for this project, feel free to adapt to your needs or your own ideas: ;-)

  • It is a web site on the Internet that displays each XKCD comics (with proper reference to original web site) with associated keywords
  • One can search comics on a set of keywords
  • One can associate keywords (a-z- character set, space separated list) to a given comics
  • Already given keywords are suggested
  • No need of account by default, everybody is free to add new keywords (for easy contribution)
  • Moderators (with dedicated account) can make previously added keywords public, can remove keywords
  • No use of database (for easy installation), keywords are saved into a simple file
  • One can download the whole association of keywords to comics (e.g. as a JSON data structure)
  • There is an API to control the web site (for use by others and integration into other sites)

Needed programming technology

Any programming language you want which have a well designed web framework: Ruby with Rails, Python with Django, Javascript with Meteor, OCaml with Ocsigen, ...

If you tackle this project proposal, let me know! ;-)

Tue 19 Jan 2016

  • David Mentré

Ajout de SPF pour bentobako.org

J'ai découvert récemment que GMail envoie directement le courriel reçu dans la boite SPAM si SPF n'est pas activé sur le domaine de l'envoyeur du courriel. J'ai donc activé SPF sur mon domaine bentobako.org :

  1. Aller dans l'interface d'administration du DNS de l'interface Manager d'OVH ;
  2. Ajouter une nouvelle entrée : Domaine : rien (i.e. bentobako.org), TTL : rien (par défaut), Type : SPF, Cible : v=spf1 mx -all
  3. Valider, et voilà !

Au total, 5 minutes de config, 15-20 minutes environ de lecture de doc. J'ai utilisé cette doc concise (et officielle ?) sur la syntaxe SPF. J'ai une config très simple où la machine qui envoie le courriel et aussi celle qui le reçoit et est donc référencée dans les champs MX du DNS.

Cela semble marcher... suite au prochain épisode. ;-)

PS : J'ai utilisé cet outil pour valider. Et aussi envoyé un courriel à check-auth@verifier.port25.com.

PPS : Je me suis rendu compte que cette config ne sert à rien pour mon adresse de courriel habituel qui n'utilise pas le domaine bentobako.org. :-) Pas grave, au moins comme ça c'est configuré pour le jour où je changerai d'adresse de courriel.

Thu 28 Aug 2014

DNSSEC Validator supporte DANE !

Après une mise à jour récente de Firefox, j'ai découvert avec plaisir que le plug-in DNSEC Validator (qui s'appelle maintenant DNSSEC/TLSA Validator) supporte le protocole DANE. Avec ce plug-in, vous pouvez voir que mon domaine www.bentobako.org est correctement vérifié par DNSSEC (et pas par DANE). Ce plug-in est disponible pour les principaux navigateurs du marchés (Internet Explorer, Mozilla Firefox, Google Chrome, Opera et Apple Safari)

DANE (DNS-based Authentication of Named Entities), reposant sur DNSSEC, permet de valider un certificat SSL/TLS d'un serveur web (pour HTTPS), email ou autre sans besoin d'utiliser des « autorités » de certification qui font payer très cher et à la confiance douteuse. En d'autres termes, on n'utilise pas de PKI (Public Key Infrastructure, Infrastructure de clés publiques) mais directement des signatures des certificats dans les champs du DNS, champs eux-mêmes vérifiés pas DNSSEC (on peut aussi combiner PKI et DANE si on veut).

Chacun est maître de son infrastructure et permet à ses « clients » de vérifier qu'ils accèdent bien au bon serveur web, en toute sécurité. C'est à mon avis une petite révolution dans les moyens permettant de chiffrer et authentifier les communications sur Internet : la sécurité gérée de manière décentralisée et à coût zéro. Bien évidemment, le protocole n'est pas encore largement déployé, d'où mon intérêt pour le plug-in DNSSEC/TLSA Validator.

Pour plus de détails sur DANE, lire les excellents comptes-rendus des RFC 6394 et RFC 6698 de Stéphane Brotzmeyer.

Il ne me reste « plus » qu'à configurer tout ça sur mon serveur web. Quelqu'un connaît-il une documentation simple pour faire sa propre autorité de certification avec en plus la configuration de DANE ?

Mon 25 Aug 2014

Améliorations des sauvegardes

J'ai récemment acheté un petit NAS pour faire mes sauvegardes en remplacement de mon vieux PC qui prenait une place folle et consommait comme une vache : un QNAP TS-112P. Plusieurs raisons pour ce choix:

  • un bon WAF (Wife (& husband! ;-) ) Acceptance Factor) car il est petit, joli et blanc ,
  • son aspect écologique, consommation de 7W seulement, peut-être un peu plus en fonction du disque dur, un Toshiba DT01ACA200 2 To,
  • et surtout un bon support Debian!

J'ai donc installé une Debian Wheezy 7.6 dessus en suivant les instructions de Martin Michlmayr pour les QNAP TS-11x/TS-12x (le TS-112P n'est pas officiellement listé, mais Martin m'a confirmé que cela marche sans problème). Grâce à un version récente de qcontrol, (quasiment) tout le matériel est pris en charge : les leds, la vitesse variable du ventilateur, etc.

J'ai ensuite installé BackupPC, mon logiciel de sauvegarde préféré. Et refait la configuration pour sauvegarder mon serveur sur Internet, un autre NAS et un PC Portable Windows.

Tout semble marcher correctement, on se sent plus tranquille avec une bonne sauvegarde. :-)

Wed 20 Aug 2014

HTTPS pris en compte pour la qualité d'un site web par Google

Le 6 août dernier, Google a annoncé qu'il favoriserait (faiblement) un site web en HTTPS dans son algorithme de recherche, par rapport à un site web standard sans HTTPS. Le but clairement affiché est d'inciter les site web à passer en HTTPS.

Deux remarques :

  • Je pense que c'est une bonne chose, tous les sites web devraient être en HTTPS. Cela gênerai (sans empêcher) les espionnages par la NSA et autres agences de renseignement ;
  • Un seul gros acteur du web peut influencer le comportement de nombreux autres sites. C'est glaçant (sans être d'une grande nouveauté).

Quelques remarques pertinentes aussi dans les commentaires du billet.

Au passage ce blog est aussi disponible en HTTPS, malheureusement avec un certificat auto-signé et une configuration faite avec les pieds.

Sat 04 Jan 2014

Server upgrade to Wheezy: beware of Dovecot!

Yesterday I upgraded my Debian server from Debian 6 (Squeeze) to Debian 7 (Wheezy). Overall it went fairly well, most probably because I don't use that much software. Another reason is that two main packages I use, Nginx and PostgreSQL, were drawn from Squeeze backports so they were close to Wheezy version.

Having the important upgrade notes of all packages at the very beginning of the upgrade was very helpful.

I had nonetheless two big issues with Dovecot and PHP as CGI.


I had to upgrade from Dovecot 1.x to 2.0 configuration file. Dovecot 2 is supposed to be able to read Dovecot 1 configuration file but it did not work for me. First of all, I had to fix the import of the SSL certificates (easily done with help from README.Debian.gz). Secondly, I use non-standard ports and I was not able to easily fix it.

Overall, it was much easier to write a new Dovecot 2 configuration file from scratch. Using doveconf -c -n (also mentioned in README.Debian.gz) was very helpful to get the items to modify/add.

I don't see what Debian developers could have done better, the issue was at least well documented.


I am using Nginx web server so I had a custom init.d script to launch PHP as Fast CGI, Nginx and PHP communicating through a Unix socket. I don't know why but my PHP as CGI set-up was broken after the upgrade.

I easily fixed this issue by installing php5-fpm package and using the proper socket (/var/run/php5-fpm.sock) for the Nginx to PHP link. My server configuration is thus more standard and easy to maintain. Good! :-)

Feature wish for Debian 8

For next Debian, it would be useful to have a script that scans the installed packages and prints some notes telling if the upgrade can be done automatically or need manual intervention (and why, pointing to some further documentation to read). It would be very useful to know issues before starting the upgrade.

Tue 17 Dec 2013

Book review: Better Embedded System Software

better_embedded_system_software_cover.gif Better Embedded System Software is a very good book if you write software, and not only embedded software!

I discover this book when following the Toyota Unintended Acceleration case where Philip Koopman, the author of this book, was a plaintiff's expert. Philip Koopman is an Associate Professor at the Carnegie Mellon University.

Why is this book so good? Because it explains in daily words what should be the ideal software development process. And not only it details the ideal process, but it gives concrete, down to earth advices on how to improve your current process and software development habits.

The book is divided into 30 small chapters, following the order of the usual V cycle (overall process, requirements and architecture, design, implementation, verification and validation, critical system properties). The chapters are very short, about 10 pages, and relatively independent. This one of the great point of the book: it is easy to read a chapter, there is not need to allocate a long time slot for it. You can pick the chapter that is most interesting to you. And as the chapters are right to the point, you immediately get useful advices and you can immediately start to apply them on your own development.

The other great quality of this book is that the author has a strong background in embedded software development. Therefore the advices are realistic and graduated. The author knows that you are going to find barriers and limitations in your work environment and he helps against them. For example, there are two chapters on producing some documentation but not too much. Even if you cannot apply the whole set of advices, you nonetheless get some ideas on own to improve your current software and what could be done in later steps.

I am not an expert on all the topics presented in this book (that's why I bought it!) but for the domains I knew (e.g. concurrent programming), the advices seem balanced and appropriate.

Of course, 10 pages for a chapter is very short and some subjects are so wide that they would deserve a book on their own (e.g. safety and security). In that case, Koopman's book give useful pointers to continue your reading and the summary he gives is an excellent introduction to the topic.

As I said many times, we are currently making very bad software and we should improve this situation. Better Embedded System Software is the one the very few books that you should keep close to your table and consult on a regular basis.

If you cannot afford the book, some quite detailed slides on Avoiding the 43 Top software risks have been made available by Philip Koopman.

Sun 01 Dec 2013

The day I left GMail

On Saturday 2013-11-30 at 16:06 I left GMail. Now all (or at least most of them) of my emails are sent to my own email server based on Postfix, Dovecot and a Debian server.

It is increased burden to have to manage such a server. It was much easier for me to let Google administrators handle all the issues. But now at least I know where my emails are stored (in France) and how they are handled. I will less fear to see my Google GMail emails read by American spy agencies through PRISM program. Or at least, it will be a little more difficult for those agencies to access them. Hopefully, I won't have too many administration issues with this server.

Introduction aux méthodes formelles actualisée

Comme en 2010 et 2011, j'ai faire une intervention de 2h pour présenter les méthodes formelles à l'ESIR, école d'ingénieur de Rennes 1. J'ai un peu actualisé la présentation, je pense qu'elle est plus illustrée et j'ai introduit quelques démonstrations d'utilisation des outils. La présentation est disponible en PDF ou en source au format PowerPoint (licence Art Libre, sauf pour les illustrations, que j'ai pioché à droite et à gauche sur le web).

Note pour les libristes : la plupart des logiciels mentionnées sont libres.

Fri 15 Nov 2013

Présentation de l'internationalisation dans MapOSMatic

Lors du DevCamp de ce mercredi 13 novembre à la Cantine numérique Rennaise, je faisais une courte présentation de l'internationalisation (i18n) dans MapOSMatic : comment c'est fait en pratique dans le code, le processus de traduction mis en œuvre et les résultats obtenus. Les transparents sont disponibles sous formes de sources LibreOffice ou en version PDF.

Wed 13 Nov 2013

Mozilla published a guide to help configure TLS on web servers

In a blog post called "Navigating the TLS landscape", Mozilla announced its Security/Server Side TLS guide.

The main objective of this guide is to help SysAdmin configure their web server in order to improve security for web server clients. The guide gives the preferred configuration as well as justification for choices made, which is a very good thing. There is a strong emphasis on forward secrecy. Configuration parameters for several web servers are provided (Nginx, Apache, Haproxy, Stud, ...). It also provide some tips to check the configuration.

Next step: apply it on my own server!

Thu 07 Nov 2013

Carte des zones d'exclusion autour des centrales nucléaires françaises

Suite à l'accident de Fukushima, je m'intéresse un peu plus aux centrales nucléaires et à leurs risques. J'avais vu une carte de zones d'exclusions de 100 et 150 km autour des centrales japonaises. J'ai refait cette carte pour les centrales nucléaires françaises avec des zones d'exclusion de 30, 100 et 150 km.

30 km est la zone d'exclusion autour de Tchernobyl. Pour Fukushima, on a des poches de radioactivité importante au moins dans un rayon de 100 km.

Peu de villes moyennes sont à plus de 150 km d'une centrale. En Bretagne, Rennes et Brest le sont mais à Brest il y a les bombinettes nucléaires de nos sous-marins tactiques, donc je ne suis pas sûr que ce soir beaucoup mieux. :-]

Merci à OpenStreetMap pour le fond cartographique et Leaflet pour la carte glissante. ;-)

page 1 / 14