Ace Hardware and Locking Down RustProxy
A normal shift, plus wrapping up a piece of security work I'd been building toward all week.
Ace Hardware
Worked at Ace Hardware from 08:00 to 17:00.
Making my login certificates say which organization they're from
Finished a piece of security work I'd started building toward over the last couple of days: the certificates I issue through TrustBridge (my own certificate service) for logging into my admin sites now carry an organization ID, not just the name of the person they belong to. Up until today, two certificates could share the same person's name with nothing distinguishing which organization actually issued them. Today I switched on the check — my sites only trust certificates carrying my own organization's ID, so even if somebody got hold of a certificate meant for someone else, it wouldn't work here. Tested it with throwaway certificates from a fake organization before trusting it with the real thing.
Blocking bad traffic before it even reaches a site
Also added a new way to block unwanted traffic in RustProxy, the tool that sits in front of all my websites — by single address, or by a whole provider's network at once, since a lot of the junk traffic I see comes in waves from the same few providers. A block can apply to just one site or to everything at once, and it's enforced twice over: the site software refuses it, and the firewall underneath refuses it too, so blocked traffic doesn't even get a chance to reach anything. Verified it worked before calling it done.
A name change and some overdue cleanup
Also gave the product a cleaner public name — RustProxy instead of "Rust-Proxy" — and rewrote its documentation to match, including an explanation of the new blocking and certificate features. Deleted the old documentation pages left over from before OmniBridge was renamed from its old name, since they'd just been sitting there unused.
Rounded out the day with a readability pass on the documentation site itself: pages now link to the previous and next entry, there's an "updated" date on each one, and the page list collapses into a proper dropdown on a phone instead of just being squeezed in.
A smaller fix to my VPN software's alerting
One more small one: a link that kept flickering around the edge of trouble was opening and closing the same alert over and over, filing a new ticket almost every few minutes. Fixed it so it only files once per real problem, even if that problem flickers for a while before settling down.