If you are regularly interested in "x became y percent faster" news, check out the vfs file updates from @brauner merged for #Linux 6.13:
'"Introduce a new reference counting mechanism for files. […] improvement up to 3-5% on workloads with loads of threads.
Add a fastpath for find_next_zero_bit(). […] This improves pts/blogbench-1.1.0 read by 8% and write by 4% on Intel ICX 160.
[…] improves pts/blogbench-1.1.0 read up to 13%, and write up to 5% on Intel ICX 160. […]"
Great, I made it. Created my own MOK key in Fedora:
$ sudo certutil -d /etc/pki/pesign -L
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Secure Boot Signing Key Pu,Pu,Pu
Steps:
openssl req -config ./MOK.cnf -new -x509 -newkey rsa:4096 -nodes \
-days 36500 -outform DER -keyout "MOK.priv" -out "MOK.der"
sudo certutil -A -i MOK.der -n "Secure Boot Signing Key" -d /etc/pki/pesign/ -t "Pu,Pu,Pu"
sudo openssl pkcs12 -export -out MOK.p12 -inkey MOK.priv -in MOK.der
sudo pk12util -i MOK.p12 -d /etc/pki/pesign
And yeah obviously you also want to do:
sudo mokutil --import MOK.der
x.x.x.x - - [10/Nov/2024:00:02:37 +0000] "GET / HTTP/1.1" 301 162 "-" "okhttp/4.9.0"
You know what’s interesting about this log line? It repeats 56,686,963 times in www.kernel.org logs for yesterday, across 4 nodes. That’s about 700 times a second, and this has been going on for months.
These requests aren’t intentionally malicious – they issue a simple GET /
, receive their 301 redirect, and terminate the connection. From what I can tell, this is some kind of appliance or software installed on mobile clients that uses “can I reach www.kernel.org” as a network test.
This wouldn’t be that big of a deal – a single plaintext “GET /“ that triggers an immediate 301 is very cheap for us to generate, but the number of these requests has been steadily growing.
If you have any idea what this is and how to make it stop, please reach out?