Carl's Whine Rack

setting the session.cookie_path in PHP (redirection loop)

2011-08-24T07:38:00.004-05:00

This is a quick note about a bug in some PHP code I was working on the other day. It took me a while to figure it out. I was developing and initially testing in google chrome, which is evidently forgiving of this kind of error. Maybe writing this will help someone (and maybe it'll help me not to make the same mistake again).

This was for an application which requires authentication. The controller sends the browser a redirect (to the login URL) if the user is not authenticated. I had set the cookie path with something like the following:

$baseUrl = 'https://www.example.com/gakkk/';

// several lines later...

ini_set('session.cookie_path', $baseUrl);

This worked OK in chrome, but Firefox and MSIE both got locked up in redirection loops. After scratching my head for a while, I finally figured out that I should be doing this:

ini_set('session.cookie_path', '/gakkk/');

The cookie_path (it has that name for a reason) should exclude the protocol, hostname, and port. Information security auditors like to complain about web applications that don't set the cookie path.

Testing an SSL-enabled service for cipher strength

2011-07-14T07:39:00.001-05:00

Vulnerability scans sometimes find that an SSL-enabled service allows clients to connect using ciphers which have key lengths shorter than 128 bits. Most services have configuration directives to disable these connections. Here's how to test a service for key length (without doing a new nessus scan, or whatever).

openssl ciphers -v

This gives a list of ciphers that the openssl client can use, and the output indicates the key length. openssl's s_client command can take an argument which specifies the cipher(s) to use. So after reconfiguring the server, run the following two commands (the first should fail, and the second should succeed):

openssl s_client -ign_eof -connect target:port -cipher RC4-MD5

openssl s_client -ign_eof -connect target:port -cipher DHE-RSA-AES256-SHA

(You should replace target:port with something like www.example.com:443)

Safari Issues

2011-02-04T08:53:00.001-06:00

I learned a couple of things about Safari yesterday. When using the @import syntax for CSS, make sure you remember the semi-colon after the URL (outside the quotes):


<style type="text/css" media="screen">@import "styles.css";</style>

Firefox and Internet Explorer are forgiving about a missing semi-colon, but Safari won't load the stylesheet without it.

And by default Safari has only limited support for tabbing through Web pages (something that's probably pretty important to keyboard users). The default setting will allow you to tab from form field to form field, but you can't focus on links by tabbing. You can enable this behavior (which is behavior I've come to expect from using Firefox and Internet Explorer) by going to the Advanced tab of the Preferences menu and clicking the checkbox that says something like "Press Tab to highlight..."

added READONLY option to password wallet

2010-03-14T18:51:00.003-05:00

Made an update to my password wallet. You can now have the READONLY attribute in your .walletrc file: this disables updates to the wallet (w/ the -e option). I keep my wallet in two places (work and home), and a cron job copies from work to home daily. So I need to make sure that I only update the wallet at work. I once updated it at home, and the next run of that cron job overwrote the update (a new password).

panopticlick

2010-01-29T13:15:00.010-06:00

I've seen several posts about the panopticlick project in the last few days. If you go to the panopticlick Web page and click the "test me" button, it'll tell you how identifiable your Web browser is. The idea is that it might be possible for someone to track your Web browsing based solely on certain characteristics of your Web browser (without using cookies or even IP addresses).

So I hit the "test me" page with several different kinds of browsers to see what kind of results I would get. The results are given below (all Firefox browsers below have the NoScript extension). In terms of security, these are like golf scores: you want low numbers in the second (BII="bits of identifying information") and third (NIF="number of identical fingerprints") columns. And in terms of security, being unique is bad (it makes it easy to identify you).

browser/platform	BII	NIF
MSIE7 on XP	17.64	unique in 204,788
Firefox 3.6 on XP	8.62	one in 392
Firefox 3.6 on Ubuntu	12.64	one in 6,364
MSIE6 via wine on Ubuntu	17.66	unique in 207,713
lynx on Ubuntu	14.67	one in 26,001
elinks on Ubuntu	17.67	unique in 208,111
wget on Ubuntu	9.57	one in 761
curl on CEntOS	17.67	unique in 208,688

Firefox 3.6 on XP did pretty well, so I captured the HTTP request headers from that browser:


GET / HTTP/1.1
Host: vmware:8000
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

Then I installed the Modify Headers extension to Firefox on Ubuntu and set the User-Agent header to the value from the request headers above. After doing that, Firefox 3.6 on Ubuntu got panopticlick scores like Firefox 3.6 on XP.

An interesting side effect of this is that the Firefox Add-Ons site uses the User-Agent header. So if you do this and want to add extensions later, you will probably need to disable the header. And I've just done this today, so I don't yet know what effect this will have on updating extensions.

pager in wallet program

2009-11-03T21:48:00.002-06:00

I recently got an email from someone who has been using the password wallet program. The reader asked about the possibility of using a different pager when viewing the password file (the "less" pager is hard-coded into the program).

I thought this was a good idea, so I've changed the wallet program to allow the user to specify the pager using the WALLET_PAGER environment variable (which defaults to "less"). You can also put this in the .walletrc file. The reader wants to use w3m, so this should now work in .walletrc:

WALLET_PAGER="w3m -o bg_color=blue"

I've updated the program in the google code repository.

Zendcon 2009

2009-10-24T10:23:00.004-05:00

Got home last night from Zendcon 2009. Good conference.

Here are a few of the main things I'm taking away from it:

I'm a fool not to be using APC (and maybe memcache)
Zendconners really like twitter (I got sucked in: @carl_welch)
I need to learn more about dependency injection and better OOP methods
I need to give git a try (had a good visit with the guy at the github booth)

Update (Monday 26 October): I took some pictures, and I've posted them to flickr.

Barnswallows' return

2009-05-16T12:55:00.001-05:00

The barnswallows are back. Considering the placement of the nest, I assume that it has to be the same ones as last year. I've been taking a few pictures.

belated Earth Day

2009-04-26T12:02:00.002-05:00

Here are a few interesting articles I found this past week:

The Next Generation of Biofuels (Scientific American) and California Takes on King Corn (The Daily Climate) talk about alternatives to corn-based ethanol
How to Fix a Climate Emergency (Newsweek) is a pretty interesting look at some radical ideas about slowing down global climate change (and it makes a good point about how this shouldn't be a replacement for cutting emissions)
and Wil Wheaton found a cool video of Earth rising over the moon's horizon (must have been taken near new moon)

bad news for iron fertilization

2009-03-29T10:46:00.002-05:00

I follow a few environmental blogs, and for a while I was occasionally seeing posts about the possibility of using iron fertilization for carbon sequestration. The idea (as I understand it) is that scientists would dissolve a bunch of iron near the ocean surface, phytoplankton would consume the iron (causing the phytoplankton to flourish), the phytoplankton would inhale a bunch of carbon dioxide, and the phytoplankton would sink to the bottom of the ocean, taking the CO2 with it, forever.

So they tried it.

They dumped a bunch of iron in the ocean, and the phytoplankton dutifully multiplied (and presumably inhaled a lot of CO2). But before the phytoplankton could sink, it ended up at the bottom of the food chain of a series of increasingly large sea creatures that live near the surface.

Nice try.

Batman logos

2009-03-25T11:20:00.002-05:00

There's a post on /Film highlighting a youtube video showing various incarnations of the Batman logo. The video includes logos from various comic book titles, TV series, and films. It's not exhaustive, but it's a cool presentation of a good sampling.

saving space in firefox

2009-03-18T07:30:00.000-05:00

I found a cool Firefox extension a day or two ago. It's called Menu Mod, and it's good for saving some space on the Firefox window (particularly if you have a small screen, like on a netbook). It can collapse all the standard menu items into a single menu item (after installing/restarting, do Tools->Add-ons, click Menu Mod, click Preferences, select "Place all menus inside another"). This isn't all that helpful on its own, but try also doing the following:

do Menus->View->Toolbars->Customize
drag all the stuff from the navigation bar (Back/Forward/Refresh/Stop/Home buttons, address bar, etc.) up next to the newly-collapsed menu
get rid of the search field by dragging it to the "Customize Toolbar" window
do Menus->View->Toolbars and uncheck the Navigation toolbar

If you do this and start to miss the search toolbar, try this:

go to www.google.com (or whatever your favorite search engine is)
right-click in the search field and select "Add a keyword for this search..."
add something descriptive for the Name field (like "search" or "google")
add something short for the Keyword field (I used "g")
next time you want to do a search, open a new tab (Ctrl-T is as easy as Ctrl-K), then type the keyword ("g" for me) followed by a space and your search term(s)

If you use the Web Developer extension, do Menus->View->Toolbars->Customize and drag the "Web Developer" item so that it's to the left of the URL bar. Clicking this new item is a quick way to hide/display the Web Developer Toolbar.

xampp

2009-03-17T07:30:00.000-05:00

At times I've wanted to try doing some development work on my eeepc, but the default distribution doesn't come with a LAMP stack (and so far I've been too chicken to try installing something else).

Today I tried installing xampp, and that seems to work pretty well. So far my only complaint is that it doesn't seem to come with any version control tools (like svn), and I don't see an easy way to add/compile them (the eeepc doesn't have gcc).

ESC key alternative in vim

2009-03-16T07:30:00.000-05:00

I've been using vim for a couple of years now, and I really like it. But one thing that's always been a nuisance to me is reaching for the escape key. I often hit the wrong key (like the tilde or F1), and/or I have to glance at the keyboard to find it.

A recent post by Matthew Weier O'Phinney suggested binding the 'jj' sequence to <ESC>. I've been trying that for the last day or so, and I'm finding that to be a pretty good trick. Here's what I added to ~/.vimrc to make it work:


:map! jj <ESC>

Star Trek Old School

2009-02-01T09:41:00.002-06:00

Funny stuff.

Uhuru is my favorite.

Belize: Day Off, Return

2008-12-19T07:30:00.000-06:00

(This is part 6 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

We didn't plan anything for Thursday, so we slept in. After a leisurely breakfast, we headed north into the shopping areas of San Pedro. We visited several shops looking for souvenirs and gifts. I found that most of the offerings seemed to be overpriced tourist junk, but I did splurge on a couple of Belikin Beer T-shirts. This shopping trip was also a pub crawl: we hit four or five bars, having lunch in one of them. There are lots of dogs in San Pedro. One would adopt us for a while as we walked along, and another would pick us up as we left a shop or bar. We finished out our last full day of the trip with a delicious dinner at the restaurant of a nearby coastal resort.

We took it easy again Friday morning. I partook of some wireless Internet by the Xanadu pool (my friends were impressed that I'd held out for nearly a week), L and KL swam a bit, and H and K did a little more shopping. Then we packed up and took a cab back to the San Pedro airport. Another Tropic Air flight with more breathtaking views of the Caribbean took us directly to the Belize City International Airport. Other than K having a bit of trouble with immigration/customs in Houston, we had an uneventful trip home. The temperature change was pretty startling: from somewhere around 85F to 33F. Ouch. Back to reality. *shrug*

It was a fabulous trip. I'd do it again.

Belize: Caye Caulker and Snorkling

2008-12-18T07:30:00.000-06:00

(This is part 5 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

Wednesday morning started with another speedboat pickup from Searious Tours. They took us and several other tourists back to the Searious pier where we piled onto a catamaran. There were ten of us on the tour with two crewmembers. We headed out toward a popular snorkling spot just inside the barrier reef. I'd never been snorkling before, so I didn't know what to expect, but this turned out to be my favorite part of the whole trip. The water was only twenty or thirty feet deep, and it was teeming with fish. We even saw a few stingrays and a couple of moray eels. The fish would swim almost right up to me: I guess they get lots of practice sharing the water with snorklers. We probably got to spend the better part of an hour in the water at this spot.

After another short run on the catamaran, we found ourselves at what the crew called "Shark Ray Alley." As the name suggests, it's an area frequented by predators. One of the crew (Daniel) jumped in and caught a nurse shark. Daniel said that the animals are used to him, and they just swim right up to him. The shark was about four feet long, and it just sat patiently in Daniel's arms while we touched it. Its skin was courser than I would have guessed. After we'd all checked out the shark, Daniel released it and grabbed a stingray, which had a much smoother skin. Anyway, the underwater petting zoo was pretty cool.

Back on the catamaran, we sailed south to the island of Caye Caulker, with plenty of Bob Marley, Belikin, and rum punch along the way. The crewmembers jokingly described Caye Caulker as a drinking village with a fishing problem. We had a delicious lunch of ceviche and fish burritos, followed by a little shopping.

The return trip was straight into the wind (and seemed to narrowly avoid some bad weather), so the crew had to rely on the two outboard motors. Back at Xanadu, we made sandwiches for dinner and again fell into bed pretty early, most of us nursing sunburns.

Belize: Altun Ha

2008-12-17T07:30:00.000-06:00

(This is part 4 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

We got up early Tuesday morning and were picked up from the Xanadu pier by a speedboat from Searious Tours. There were already several other tourists on board (along with the three crewmembers), and we picked up a few more at other resorts along the coast. Then we headed out over the open waters toward the mainland.

The fellow from Searious who drove the boat (a two-engine job, about 40 feet long) and served as our tour guide as we left San Pedro was named Willie. He was very knowledgeable about the local flora and fauna, and he was fun to listen to: his speech was sort of a toned-down version of the frequently-overblown Caribbean stereotype (I'm thinking Predator 2 here). On the way to the mainland, we got to see a couple of bottle-nosed dolphins break the surface pretty close to the boat.

Once we reached the coast, we went up the Belize River a bit. We saw an iguana lounging about in one of the trees. We stopped at a dock and transferred to a van which took us to Altun Ha. The ruins there are pretty spectacular--I'll let the photos speak for themselves. We stayed for an hour or so. We got to climb to the top of one of the structures, and that was a real kick. There were no guardrails or anything to prevent a careless tourist from falling over the side--one of the many differences with tourist attractions in the litigation-happy US.

After Altun Ha we spent a couple of hours at the Maruba Spa. They apparently offer massages, mud treatments, and several other odd things. We enjoyed a nice lunch and some time by the pool. Then we rode back to the dock (with one of the tour guides acting as bartender in the back of the van: Belikin and rum punch) and took the boat back to Ambergris Caye (the ride back offered a pretty spectacular sunset). That evening we walked up the beach to the Blue Water grill for some fantastic seafood (I had some snapper), and then we headed back to Xanadu and fell into bed.

Belize: San Pedro

2008-12-16T07:30:00.000-06:00

(This is part 3 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

We had pretty luxurious accommodations in San Pedro, which is on the island of Ambergris Caye. We were in a three-level dome-topped structure, and we had the top two levels. Our downstairs had a well-equipped kitchen, a dining area, a common area (TV and couches), and a bedroom (L and KL took that one). There were two more bedrooms upstairs: I took one, and H and K took the other. Each bedroom had its own bathroom. There was a wonderful wooden deck/balcony off of our downstairs, and it looked out over the water. It was really quite fancy.

The beach wasn't quite what I expected, because I hadn't read about the barrier reef. Ocean waves strike the reef, rather than the coast, which is a big part of why the water here is so clear. But that means that we didn't see or hear waves, which is one of my favorite ocean things. So that was a very minor disappointment, but it was still very cool being by the water. The reef is not that far out, so we could see waves breaking out on the reef just below the horizon, and that was pretty awesome to watch. The beach itself is very clean white sand, and it was fun walking around.

That first afternoon in San Pedro we didn't do much more than have a good meal and settle in to Xanadu. We turned in early, because we knew we had an early start the next morning: the Mayan ruins at Altun Ha.

Belize: Pook's Hill

2008-12-15T07:30:00.000-06:00

(This is part 2 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

David introduced us to his co-manager (and wife) Kat and the owner (Ray) and took our bags to our cabanas (I'd never seen a thatched roof up close before). We took it easy that afternoon, and it got dark around 6PM. After the amazing sunsets, we mostly hung out at the main cabana, which has hammocks, chairs, a well-stocked bar, and a few sugar-water dispensers that were very popular with the local hummingbirds. This gave us an opportunity to get acquainted with some of the other guests: at one point I got to have a fun visit with a self-described "petrol head" from Britain, and we talked about Steve McQueen movies. After a few drinks, dinner was served downstairs, and we were treated to a delicious buffet-style meal. After some after-dinner coffee and tea (and maybe a few more cocktails), we retired to our cabanas for the night. I found that I really enjoyed falling asleep to the sounds of the jungle.

The next morning (Saturday), my companions went on the Actun Tunichil Muknal (ATM) adventure tour. I picked up a charming sinus infection around the time we began this trip, so I stayed at Pook's. My friends said that it was a great experience, in which they hiked, explored some caverns, and visited Mayan ruins. The hike to the ATM cave requires four river crossings each way, and there are no bridges: you swim across. So, although they said it was lots of fun, my friends told me that I'd made a good decision to skip it. So I had a quiet morning at Pook's, and by afternoon I felt perked up enough to do part of one of the hiking trails. By the time I got back to the lodge, my friends had returned from the ATM trip, and we enjoyed another evening at the main cabana.

Sunday morning we finished out the hiking trail I'd started the previous afternoon. That route took us across a large meadow and along several well-kept jungle trails. That afternoon we had a real treat: we went inner-tubing down the Roaring River. It was surprisingly fun and relaxing. The water was cool but not cold, and it was amazingly clear. There was a great swimming hole in a bend of the river, and we had a high time hanging around there for about an hour. We saw some sleeping bats hanging from a tree, some fresh footprints (probably a tapir) on the riverbank, and we got a kick out of watching the smaller fish nibbling at the skin of our feet (that tickled a bit).

Sunday evening's pre-dinner drinking was on the roof of the owner's house, which is up at the top of the hill and afforded a breathtaking view of the valley. We saw several egret flocks fly to their nighttime nesting areas, and we were up high enough to see the hills.

Monday morning we spent a little time on one of the other hiking trails near Pook's, this one through the jungle above the owner's house. At one point we all heard something moving around to our left, but we never saw what it was. And then we took the monstrously-bumpy road back to Teakettle Village, the Western Highway back to Belize City and its municipal airport, and a Tropic Air prop to San Pedro on Ambergris Caye. That was a really cool flight out over the water. It offered a great view of the clear waters of the Carribean and the barrier reef. A short cab ride got us to our home for the next four days: Xanadu Resort.

Belize: Arrival

2008-12-14T07:30:00.000-06:00

(This is part 1 of a 6-part description of a trip I took to Belize with friends just after Thanksgiving 2008. I put my pictures a flickr.)

Two friends of mine (L and KL) and I flew to Houston on Thanksgiving where we were met by two other friends (K and H). We spent the night there and then got up the next morning and took a Continental jet to the Belize City International Airport. After going through immigration and customs, we stepped outside and were met by David, one of the managers at Pook's Hill Lodge. Pook's is a great place in the jungle of the Cayo District, far away from any population centers.

David packed us and our stuff into a van, and we headed westward on the Western Highway. After about an hour, we stopped at a restaurant called Amigos and had a delicious lunch of stewed chicken, rice and beans, and Belikin beer. Due to import restrictions, Belikin is about the only beer you can get in Belize--fortunately it's very good.

After lunch we went to the Belize Zoo, which features howler monkeys, spider monkeys, owls, tapirs (which were quite a bit bigger than I expected), otters, coatis, a puma (also larger than I expected), a pair of HUGE crocodiles, a couple of jaguars, and some really foul-smelling wild pigs called peccaries. I didn't get many good pictures, but I got a short movie of one of the jaguars (he came right up to the fence).

Another hour on the Western Highway brought us to Teakettle Village. We took a monstrously bumpy dirt road for about a half an hour, and then we arrived at Pook's Hill Lodge, where we spent the next three days.

Thursday at ZendCon

2008-09-18T18:32:00.001-05:00

Today is the final day of ZendCon, and it's a half day. It started with sessions, rather than a keynote (the keynote is at the end). I was having trouble figuring out which session to attend, but then I looked at the presenter names, and that made it easy to pick "Scaling Mozilla's websites with PHP" with Laura Thomson. I've heard her speak at OSCON, and she always gives a good talk. She didn't disappoint today, as she told us about how she helped Mozilla get ready for the Firefox 3 "Download Day" (or, as she called it, D-Day). It was a fascinating case study of query/code optimizations, caching solutions, MySQL replication tricks, and other goodness. A couple of fun facts are that mozilla.com uses drupal, and D-Day saw saw 14Gb/s of downloads and 2Gb/s of web traffic.

Next Stefan Priebsch gave a good discussion and demonstration of Selenium. Several people have talked about Selenium at this conference, and it really looks like a great resource.

The closing keynote is by David J. Neff from the American Cancer Society. He told us about sharinghope.tv, a site with user-generated content from people affected by cancer. Pretty cool.

Here's a picture from the closing keynote. That's Cal Evans (ZendCon program chair) on the stage, and the (backs of the) heads of Laura Thomson and Paul Reinheimer. Sebastian Bergmann was also milling about (which would have put my three favorite speakers in the shot), but he wouldn't hold still long enough.

Wednesday at ZendCon

2008-09-17T21:39:00.003-05:00

ZendCon started with a really interesting keynote today (I'm usually not big on keynotes). The first speaker was a Zend Framework developer named Wil Sinclair, and he talked about how PHP applications have evolved over time. He introduced the CEO and CTO of Varien, and then talked about their company's development of Magento. Magento looks really cool. It's an open-source e-commerce built on Zend Framework. It appears to be as full-featured as big commercial e-commerce sites like amazon.com. They apparently wrote the whole thing in a matter of months. Impressive. I'll definitely try it if I ever need to make an online store.

Then I checked out "Architecting for PHP5..." with Elizabeth Smith. She covered some of the features new to PHP5 and again encouraged us to use extensions whenever possible ("C is faster than PHP"). Looks like I need to read more about the SPL and the filter extension.

Stefan Esser gave a really good talk called "Lesser Known Security Problems in PHP Applications." Some of it was kind of scary. We even got to hear him announce a 0-day vulnerability with the ZipArchive extension (along with a more obscure problem with HTTP response splitting affecting users of older Netscape proxies).

After lunch was another keynote: "The State of AJAX" with Ben Galbraith. Not a lot of technical information, so not too interesting to me. It was mostly a survey of lots of shiny-looking, bleeding-edge stuff (which may or may not be around in six months). He speculated that HTML5 and (google) gears will be important to the future of AJAX. I was hoping he'd tell me which AJAX framework to use, and he did address this point. He said that it's sort of a toss-up between Dojo, Prototype/script.aculo.us, and jQuery, because they're all small, powerful, extensible (with community support) frameworks. So pick one. *sigh* Thanks.

In his "Phar Scape" talk, Marcus Boerger showed us some neat tricks to do with phar, a deployment tool modeled after Java's JAR.

I went to another talk by Sebastian Bergmann, this one called "phpUnderControl: A Quick Start to Continuous Integration." I'm pretty much the only PHP programmer where I work, so I don't really have to integrate my work with a team. But phpUnderControl looks cool enough that I'd like to try it. Besides, it makes nice pictures that could distract managers. (And Sebastian says that he likes doxygen more than phpDocumentor, so I'll give that a try, too.)

I finished out the day with an UnCon session called "Subversion Tips and Tricks" with Lorna Mitchell and Matthew Weier O'Phinney. It turned out to be mostly introductory in nature, but I still picked up a few things. It was very informal, and it was fun.

ScribeFire

2008-09-17T21:39:00.001-05:00

I've been playing with ScribeFire (a Firefox extension) today, and I'm finding it to be a pretty good HTML editor. It runs right in the browser (one of the configuration items lets you run it in its own tab, which is cool). It'll save drafts locally, which is good for offline writing. And if I put a URL in the copy-and-paste buffer, when I highlight some text in ScribeFire and click the URL button, the URL in the buffer automagically appears in the URL dialog box.

Tuesday at ZendCon

2008-09-16T21:20:00.002-05:00

Kind of a slow morning at ZendCon (to me, anyway). Started off with the keynote by Harold Goldberg, Zend Technologies CEO. Mostly business-speak, so not too exciting (I'm a nuts-and-bolts sort, I guess).

Then I went to "Of Haystacks and Needles" by Derrick Rethans. This looked interesting to me because of my php|arch article. One of the people who wrote about my article seemed to advocate storing records as documents, like maybe XML documents. I think that's a pretty interesting idea, because storing it like that sidesteps the whole issue of different records having different sets of fields. And I could just store the XML string in a text column or something. But I didn't know how I'd do searches--if I want to find a record submitted by someone whose last_name is Smith, it seems like I'd have to run a DB query to get the XML string for every record, pull it out of the DB and into application memory, parse each XML string, and look for any that match. So I was hoping that this would give me some ideas of how to do this (although lately I've been thinking about stored procedures). Anyway, the talk gave me several things to look at more closely later:

Apache Lucene

Zend Lucene (PHP port of Adobe Lucene, lacking some of the former's features)

Apache Solr (an extension of Apache Lucene w/ a Web services API)

marjory (like Solr but written in PHP, supports other backends like sphinx and xapian)

Lunch was a catered affair again, but no celebrities this time (not that I realized, anyway).

Things picked up after lunch, starting with "PECL Picks..." with Elizabeth Smith. This was a whirlwind survey of some PECL projects that Elizabeth deems "cool." Here are some of the ones that look interesting to me:

uploadprogress (useful in AJAX applications)

Haru (for PDF manipulation)

ssh2

sphinx and clucene

Next was "Knight Rider Methodology to Software Develoment" in which Eli White covered a lot of development tools and techniques. The theme was how Michael Knight got lots done on (the 80s TV show) "Knight Rider" by using the tools at his disposal (well, tool: the car, KITT). The talk was punctuated by clips from the show (one of my favorites as a kid, and it's far cheesier than I remembered--wow). Here are some fun quotes from Eli's talk:

"hardware is cheaper than people"

"use someone else's time as your own" (use libraries rather than re-inventing the wheel)

"nothing is right the first time: even 'hello, world!' needs internationalization" (debuggers)

After his talk, I'm looking forward to trying out some subversion GUIs like subcommander and rapidsvn.

Paul Reinheimer gave a great talk about how Web 2.0 breaks the browser's Back button, and he talked about a really interesting solution using the yahoo user interface (YUI). He also talked about how to deal with AJAX responses coming back in an order different from that in which they were sent. I think that'll take a few reads for it to sink in for me, but I'm looking forward to trying it out. Paul does PHP training, and he's a really good speaker.

Finally, Eddo Rotman gave a good presentation about PHP errors and exceptions. His talk has inspired me to write a cron job which knows a list of PHP application error logs and emails me the entries made in the last 24 hours: maybe it'll append a marker to each log file and email the entries written since the previous marker.

Monday at ZendCon

2008-09-15T21:25:00.002-05:00

Today at ZendCon I attended two tutorials, and I enjoyed them both. In both cases, there was a lot of review, but I also learned new things in both. The morning session was "PHP Developer Best Practices" with Matthew Weier O'Phinney and Mike Naberenzy. They covered a pretty broad set of topics:

They spent quite a bit of time on source control. They talked mostly about subversion, but they also discussed some git's advantages, particuarly for offline development (like on a laptop on a plane). Some of the other things that were interesting to me were the ability to link one SVN repository to another with the svn:internals feature, using post-commit hooks to send emails (to other developers) or to rebuild documentation (e.g., via phpdoc), and using branches for maintaining older product lines (the example that occurred to me is that the Apache developers might have a branch for the 1.3.x line).

They talked a lot about coding standards, and then advocated the PEAR standard. I think that's the default standard which is enforced by PHP_CodeSniffer, which is one of the coding tools they discussed (which I started using a few weeks ago).

They spent some time on testing, and they pointed out that when coupled with xdebug, PHPUnit can do coverage analysis. I didn't know that, and I think that's pretty cool. I've never been able to get xdebug to work for me, but that's a good reason to try again. They also made PHPUndercontrol look interesting enough to play with.

They talked about phpDocumentor, which is something I've been using and enjoying lately. They also touched on DocBook, which evidently is just fairly straightforward XML. I'll have to give that a try.

They concluded with a few remarks about deployment issues. I'd hoped they'd talk about phing or phar, and they might have, but they sort of ran out of time.

Lunch was catered box lunches, served in a large room with lots of big tables. So I had lunch with strangers, but one of them turned out to be Jay Pipes. I'd heard him speak at OSCON previously, and he had some interesting insights about Sun's MySQL acquisition (he said that Sun had so far mostly left MySQL alone). Jay was wearing a cool T-shirt with the Decepticon logo. And Paul Reinheimer was sitting behind me. I don't know his face, but I recognized his voice. Sounded like he was keeping his tablemates well entertained.

The afternoon session was "Quality Assurance in PHP Projects" with Sebastian Bergmann. I've been fiddling with PHPUnit for a little while, and the talk gave me several things I want to research a bit more when I have time:

the --testdox option

the @group phpdoc tag

xUnit Test Patterns, a language-agnostic book about software testing

the DbUnit feature

using sqlite for testing DB stuff

using the dataProvider feature for throwing a large stack of specific test data at the code

Sebastian also talked a lot about mocks and stubs and such, but that's still a bit over my head. But we got to see the --ansi feature of the shiny new v3.3.0 (which he just released this morning).

The eee pc had good moments and bad. This convention center did a pretty poor job of providing power outlets (people were sitting up front so that they could plug into surge suppressors for the sound systems, and others even pried some metal plates off the floor to get at electrical outlets), so I was on battery all morning (I scored an outlet in the afternoon). The eee pc battery held, but perhaps only because I dimmed the screen and turned off the wireless. But I'm still happy with it--it's light enough that I don't feel tired or sore at the end of the day. And although I make more mistakes than usual on the little keyboard, it's plenty good enough for note-taking.

Sunday at/before ZendCon

2008-09-15T21:19:00.002-05:00

I'm at ZendCon this week. I flew in to San Jose airport yesterday and got the hotel shuttle to the hotel (which is in Santa Clara). I got in pretty early (around 10AM local time), but my room was already ready, so I got to go straight in.

A bit later I took the hotel shuttle to the Santa Clara Convention Center, which is where the conference is being held. Conference check-in only took a few minutes (I gave them my name, and they gave me my conference packet), so I had the rest of the afternoon play.

I had the hotel shuttle take me to the local CalTrain station, and I took that into San Francisco. I was wanting to go to Pier 39 (a touristy shopping area with Bay cruises and an aquarium), but I had a terrible time finding the right bus. The nice woman who answered the Pier 39 phone number told me to take the 9x bus. As far as I can tell, that particular bus runs approximately once every two weeks. I only ever saw one 9x bus, and it was going the wrong way. I almost gave up a couple of times and just took the train back early.

I eventually got to Pier 39 (I caught the 10 bus, which runs fairly regularly, and which got me to within a block of the pier), but I didn't have much time there (I needed to get back to the train station by 7PM for the return to Santa Clara). But the pier offers a nice view of the Bay, and I took several pictures. I could see Alcatraz Island, and there was a neat view of the Golden Gate Bridge in the distance. Some of the other shorelines were wrapped in a neat fog, and seeing the sea lions was cool.

I got back to the hotel and had some dinner in the hotel restaurant. By then I was pretty tired (I didn't sleep much the night before, and the time change added an extra two hours to the day), so I turned in a bit early.

Robocop vs. Terminator

2008-09-08T07:00:00.000-05:00

Topless Robot had a post a couple of days ago about a fan mashup on youtube called Robocop vs. Terminator. Mindless fun.

eee pc

2008-09-07T18:41:00.003-05:00

I got an Asus eee pc (model 900) the other day (I ordered it through buy.com). I'm going to a conference next week (zendcon), and I didn't want to lug around my laptop (it gets pretty heavy after a few hours). I didn't need much--something with a Web browser, an ssh client, something to pull images off of my camera (a Kodak Easyshare v1003), and a text editor for taking notes. The eee pc fits that nicely, and it only weighs about 2.5 pounds.

It's got an 8" screen which I'm finding to be perfectly readable. The keyboard is pretty small, but I'm getting used to it (I'm posting this from the eee pc).

It has an SD/MMC card reader, 3 USB 2.0 ports, and built-in wireless (802.11 g/b). It has 1GB of RAM and a 20GB solid-state hard drive (the thing boots to the login prompt in about 30 seconds). It even has an integrated 1.3Mpixel Web cam.

I'm finding the eeeuser wiki to be very helpful (especially a post about getting gwenview to import photos from my camera).

One little wrinkle I experienced was that the wireless adapter was inadvertently disabled, and it took me a little while to figure out what had happened. The eee pc typically recovers well from going to standby mode, but once when I tried to resume, the screen looked like static and I couldn't get it to do anything. I had to hold down the power button and reboot. When it came back, it refused to join my wireless network. I finally figured out (with the help of the diagnostic tools) that the wireless adapter had been disabled (dunno if I accidentally did that, or if it was a fluke). Anyway, holding down the special function key ("Fn" in the lower left) and hitting F2 toggles the adapter, and I was back in business.

feedback to php|arch article

2008-08-30T15:05:00.005-05:00

I noticed a couple of blog posts written in response to my (somewhat) recent php|arch article:

Reading these was initially discouraging, as both authors are critical of the concept of my article. Although I don't necessarily agree with them, they both make good points in their posts, and I encourage you to read them both if you are interested in the topic. I particularly appreciate the point about table-level locking in MyISAM tables, and how that might affect performance in the frequently-updated value tables.

Although this is not a very useful rebuttal, about all I can say is that the EAV method has worked well for me. As with anything, your mileage may vary. I'm not running reddit or facebook, and the systems I've built on EAV don't have thousands of simultaneous users. So I really can't say how well it would perform in a large-scale deployment.

After I sort of got over being defensive about the whole thing, I'm just glad that people found the article interesting enough to talk about it.

LAMP pconnect

2008-08-23T09:06:00.002-05:00

I had a bad experience a few years ago using pconnect() in a PHP program running in/on/under Apache on Linux to talk to a MySQL database. My memory is somewhat vague, but we had to restart the MySQL service (and switch to non-persistent connections). Ever since then, I've had an irrational fear of pconnect() and have never used it.

Looks like I'm not the only one who doesn't trust pconnect().

HTTPS in Apache in Ubuntu

2008-08-16T14:54:00.003-05:00

If there's an easy way to make Apache in Ubuntu (v7.10, gutsy) do HTTPS, I can't find it. So I played around with it this morning and got it working.

First you need to generate an SSL certificate. I just went with self-signed certificates:


openssl genrsa -out apache.key 1024
openssl req -new -key apache.key -x509 -out apache.crt \
    -days 365 -set_serial `date +%s`

I saved these two files as /etc/ssl/certs/apache.crt and
/etc/ssl/private/apache.key.

And then I saved the following as
/etc/apache2/sites-available/default-ssl:


NameVirtualHost *:443
<VirtualHost *:443>
    DocumentRoot "/var/www"
    ServerName www.example.com:443
    ErrorLog /var/log/apache2/ssl_error.log
    TransferLog /var/log/apache2/ssl_access.log
    LogLevel warn
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/apache.crt
    SSLCertificateKeyFile /etc/ssl/private/apache.key
</VirtualHost>

Then after enabling the new site (a2ensite default-ssl) and restarting Apache (/etc/init.d/apache2 reload), I was able to connect to https://localhost/. FireFox3 complained bitterly about the self-signed certificate, but adding the exception straightened that out.

barn swallows: alive and well

2008-07-27T16:56:00.002-05:00

Today I saw the four fledgelings perched on a nearby railing. Their parents still bring them food.

When I got home last night, two of them were perched on a door frame near where the nest used to be.

barn swallows: moving on

2008-07-24T22:32:00.002-05:00

When I left for work this morning, the nest appeared to be empty--I didn't even see Stoopy lurking in it. I guess they were all off doing...well, whatever barn swallows do (eat insects and make poop, I suppose).

When I got home from work, I saw that the painters had taken down the nest so that they could paint the entryway. Lame, but at least they waited until the hatchlings had become fledgelings. If that was a deliberate decision, it was a nice one.

This evening as I left for a bike ride, the entire crew swooped past me single file through the entryway, as if to say "hello" (or perhaps "oh god it's a human fly away as fast as you can"--it's a subtle difference). And when I came back, one of the fledgelings was perched on the doorframe close to where the nest used to be.

So I guess they'll be OK. It was nice having them as neighbors for a while.

fledgeling barn swallows

2008-07-23T17:48:00.003-05:00

Maybe they hatched earlier than I thought, because a couple of them were flying a bit today.

When I came home from work, one of them was perched on a rail about 30 feet away from the nest.

Another one was fluttering around a bit near my doorway. He didn't seem comfortable going too far, but he was able to hover and then land on the nest. (That was pretty cool to see.)

A third one was staying in the nest. That one holds his (her?) wings a bit funny--up higher closer to his head. It almost makes him look like an old man with a stoop. I'm wondering if that one is healthy.

When one of the parents came to bring food, Stoopy was the only one I saw stick his head out of the nest. So I can't account for one of the hatchlings. I looked around a bit but didn't find the fourth anywhere nearby on the ground.

Update: I just stepped outside to have a look, and all four hatchlings are back in the nest. They're big enough now that it's pretty crowded.

barn swallows; bigger and bolder

2008-07-22T17:56:00.002-05:00

They're painting my building, so each day I fear that I'll come home to find that the painters have "evicted" the hatchlings (which they probably wouldn't survive). But they were still there again today.

It amazes me how much they've grown in just over a week. wikipedia says that barn swallows fledge (I believe that more-or-less means "leave the nest") after about 18-23 days, so they've got another week or two.

php|arch article

2008-07-17T07:30:00.000-05:00

I got another article published. In fact, it looks like I made the cover of the June 2008 issue of php|architect. The article is titled "EAV Modeling" and talks about a database design I've used in a couple of recent projects.

Working with the editor on this assignment was a good experience. She made me feel a lot more involved in the process than I did with the Linux Journal article. *shrug*

barn swallows

2008-07-16T07:30:00.001-05:00

About a month ago I started noticing a bird's nest attached to the wall near the door to my apartment. I'd occasionally see a couple of small, orange-and-black birds coming and going. Because of something that happened a couple of days ago, I wanted to find out what kind of birds they were.

A Web search directed me to whatbird.com. This site has a pretty cool search feature allowing you to enter certain characteristics of a bird (size, color, tail shape, etc.), and it'll help you figure out what kind of bird it is. Turns out that my neighbors are barn swallows.

The thing that happened earlier in the week is that their eggs hatched. So now I have about four other new neighbors. I took a few pictures and posted some of the better ones to my flickr account:

PHP frameworks: performance

2008-07-12T15:08:00.003-05:00

For some time now I've been trying to figure out what to do about PHP frameworks. Most notably I've been wondering which one would be best for my needs and whether or not it's worth my time learning one. The problem is that there are so many. Zend, Cake, and Symfony appear to be pretty popular (at least, they are frequently mentioned in PHP blogs).

developertutorials.com has a post which highlights a recent performance analysis of Zend, Cake, and CogeIgniter. The concluding sentence is a good summation:

...if you’re building small applications, CakePHP will clearly save you time in development, CodeIgniter will offer massive performance benefits, and Zend will give you a reasonable middle ground.

Still not sure which one I want to try, but I lean a bit toward Zend (although it has received some recent criticism regarding its coding conventions and documentation). I like it that you can use it as a full-blown framework or just import the features you need for your application.

When I get some time, I guess *shrug*

mod_security

2008-07-07T07:30:00.005-05:00

mod_security is an open source Web application firewall which operates as an Apache module. mod_security inspects incoming requests (and, I believe, can also inspect outgoing responses) and take certain actions if a request (or response) matches a pattern. These actions can include logging and/or blocking the request. mod_security works sort of like anti-virus software, in that it comes with a ruleset which can identify common malicious activity (like cross-site scripting and SQL injection attempts). Like anti-virus software, it's necessary to update the ruleset from time to time.

I installed mod_security on a couple of production RHEL5 Web servers lately, and here are a few of my observations.

Installing mod_security is pretty easy and is documented in the mod_security download. I found that I needed to install the following packages to meet some dependencies and to build mod_security:

apr-devel
gcc-c++
httpd-devel
pcre and pcre-devel
libxml2-devel

I had the support of my managers to put mod_security in full blocking mode, so after copying the rules directory to /etc/httpd/modsecurity.d, I saved the following in /etc/httpd/conf.d/modsecurity.conf:


LoadFile /usr/lib/libxml2.so.2

LoadModule security2_module modules/mod_security2.so
LoadModule unique_id_module modules/mod_unique_id.so

<IfModule mod_security2.c>
Include modsecurity.d/*.conf
Include modsecurity.d/optional_rules/*.conf
</Ifmodule>

The Web servers run a variety of custom Web applications as well as some canned software like Webcalendar and Wordpress. I didn't experience any problems with the custom applications or Webcalendar, but mod_security took issue when someone tried to edit an existing blog post in Wordpress (curiously, there wasn't any trouble when submitting a new post). So I put the following in /etc/httpd/modsecurity.d/modsecurity_crs_15_customrules.conf:


<Directory /path/to/wordpress/wp-admin>
SecRuleEngine Off
</Directory>

I'm in the fortunate (and perhaps unusual) situation of being able to restrict access to the wp-admin directory by IP address, so I don't have the entire Internet hammering at the thing. Looks like blogsecurity.net has a custom mod_security configuration for Wordpress which I just haven't had time to try yet.

Another wrinkle I had was that some command-line Perl programs I run would be blocked because they weren't providing "accept" and "user-agent" request headers. One of these programs looked something like this:


#!/usr/bin/perl -w

use strict;
use HTTP::Request::Common;
use LWP::UserAgent;

my $ua = LWP::UserAgent->new();
my $uri = shift @ARGV;
my $res = $ua->request( GET $uri );
print $res->content();

I had to make the following two changes/addition:


$ua->agent('whinerack');
my $res = $ua->request( GET $uri, accept => 'text/html' );

(Looks like just about any non-blank user-agent will do.)

Another trick I've learned is that instead of using SecRuleEngine Off (like I did for the Wordpress wp-admin directory, which makes mod_security totally ignore that directory), you can use SecRuleEngine DetectionOnly, which makes mod_security log what it would do without actually blocking requests. This can be good for debugging.

And although I haven't needed it, the mod_security documentation suggests a way to whitelist requests from a specific host:


SecRule REMOTE_ADDR "^192\.168\.1\.100$" nolog,phase:1,allow

All in all, installing mod_security has been a fairly easy transition, and it's nice having another layer of protection.

xephem in Ubuntu

2008-07-06T09:00:00.000-05:00

I was out with friends last night (4th of July fireworks), and they asked me to identify a bright object in the sky (I used to be an astronomer). I'm really out of practice at that kind of thing, so I speculated that it was Sirius (there was some light cloud cover, and I couldn't see whether or not this object was southeast of Orion, but it was pretty bright). Turns out I was wrong.

There's a really cool desktop ephemeris program called Xephem from the Clear Sky Institute. So I installed that on my Ubuntu desktop this morning to find what that thing was last night. I had to fulfill a few dependencies to compile xephem. Here's what I had to install first (I just explicitly installed the ones in bold--apt-get installed the packages in parentheses as dependencies):

libxt-dev (libsm-dev, libice-dev)
x11proto-print-dev
libxp-dev
libxext-dev (x11proto-xext-dev)
libxmu-headers (?)
libxmu-dev

(I'm not sure I needed libxmu-headers.)

After that I mostly just followed the directions in the INSTALL file from the xephem download. I copied the data directories (auxil, catalogs, etc.) to /usr/share/xephem (a directory I created) and put the following in ~/.xephem/XEphem (xephem didn't seem to want to read /usr/X11R6/lib/X11/app-defaults/XEphem as the INSTALL file suggested):


XEphem.ShareDir: /usr/share/xephem

I also gziped the man page (xephem.1) before copying it to /usr/share/man/man1/xephem.1.gz. And I created /usr/share/doc/xephem-3.7.3/ and copied in the Copyright, INSTALL, and README files.

By the way, that object turned out to be Jupiter. shrug

apt-get: "kept back"

2008-07-05T10:57:00.002-05:00

I have the following (executable) file in /etc/cron.daily on my Ubuntu desktop:


#!/bin/bash

apt-get update
apt-get -s upgrade

This lets me know when updates are available: the -s option lists available updates without running them unattended.

Occasionally I'll get a list saying that some updates have been "kept back." I always have trouble remembering what to do in this case. It's typically just some dependency problem. This issue is addressed in the APT HOWTO on the Debian Web site. In my (limited) experience, this has always been overcome by doing apt-get instal pgkname, where pkgname is the offending package which is being "kept back."

n800 maemo updates

2008-06-29T17:57:00.002-05:00

I got a Nokia n800 Internet tablet a few months ago and installed the Maemo os2008 software platform. I put the n800 in red pill mode to install some packages, and I just left it that way and forgot all about red/blue pill mode.

It didn't take long for me to find that updates just didn't work, but I never put the two things (red pill mode and broken updates) together. Looks like this is a well-known problem (see the bottom of the red pill mode wiki page linked above).

So if you put your n800 in red pill mode and updates don't work (mine complained that it needed to resolve libglade dependencies: it seemed to want to update to a version which was already installed), put it back in blue pill mode and try running updates. That worked for me.

mcrypt randomness in PHP

2008-06-22T08:00:00.000-05:00

The other day I was trying to debug a PHP program which was being really slow. I'm not bright enough to use proper debugging tools (like xdebug), so I just sprinkled in a bucketload of error_log() calls until I figured out what was gumming up the works.

It turned out to be an mcrypt_create_iv() call. Sometimes that call would run in a fraction of a second, and sometimes it would take over a minute, with no discernible pattern. I had pretty much done a copy-and-paste from the mcrypt_module_open() manual page, which shows using the MCRYPT_DEV_RANDOM constant as the second argument to mcrypt_create_iv(). It finally occurred to me to try using the MCRYPT_DEV_URANDOM constant (note the "U"), instead, and the encryptions immediately became consistently fast.

This was happening on a VMWare ESX guest running RHEL4. A Web search or two found a good comparison of /dev/random v. /dev/urandom, and my problem turned out to be a good illustration of /dev/random blocking the caller until sufficient entropy is attained.

HTML form attack

2008-06-21T08:00:00.000-05:00

The other day I came across a post about the HTML form attack.

I don't think I'd seen this before, and I'm not well versed in JavaScript attacks (authors of the planet-websecurity.org blogs would probably point, laugh, and yell "NOOB!"). But when I sort of figured out what it was talking about, it occurred to me that a form on a page which is vulnerable to cross-site scripting could be made to POST to an arbitrary location. Try the following in a JavaScript-enabled browser, and see where it ends up taking you when you click the submit button:


<html>
<body>
<form id="gakkk" action="/good.html">
<input type="submit" />
</form>
<script type="text/javascript">
// <![CDATA[
document.getElementById('gakkk').action = '/bad.html';
// ]]>
</script>
</body>
</html>

GPG wallet in cygwin

2008-06-20T18:46:00.003-05:00

The other day it occurred to me try my password wallet in cygwin. The wallet requires dialog, but cygwin doesn't seem to have a dialog package. So I figured I'd try building it.

dialog requires ncurses, which meant that I needed to install the ncurses-devel cygwin package (using the cygwin setup tool). Then I downloaded the dialog source and did configure && make && make install, and that "just worked" to get dialog in cygwin. And then the wallet "just worked," too.

So if you're running Windows and want to try the password wallet, install cygwin and give a wallet a try.

AdoDB, PHP, MySQL, SSL

2008-06-19T07:30:00.000-05:00

(I'm practicing for an "Unreadable blog post title" contest.)

Here are a few hints on how to use SSL certificates when connecting to MySQL from a PHP program using the AdoDB database abstraction layer. (You may want to see my previous post on setting up SSL certificates for MySQL connections.)

The trick is to use a DSN in the NewADOConnection() call (rather than authenticating with a Connect() call) and to use the mysqli driver (looks like the mysql driver won't work for this). The DSN syntax allows you to supply client flags, and there's a mysqli flag for using SSL certificates.

After creating a CA certificate (we'll say it's at /path/to/ca-cert.pem), make sure that the following item is in the [client] stanza of /etc/my.cnf or the connecting user's ~/.my.cnf on the client host:


ssl-ca=/path/to/ca-cert.pem

Then try the following PHP program:


// these are part of the AdoDB library
require '/path/to/adodb-exceptions.inc.php';
require '/path/to/adodb.inc.php';

/*
* I got the '2048' from running
* printf( "%d\n", MYSQLI_CLIENT_SSL )
* in a PHP program (w/ the mysqli extention installed)
*/
$dsn = 'mysqli://ssluser:sslpass@dbhost/test?clientflags=2048';

$dbh = NewADOConnection($dsn);

$sql = "show status like 'ssl_cipher'";
$res =& $dbh->Execute($sql);
print_r( $res->fields );
$res->Close();
$dbh->Close();

This should generate output similar to like this:


Array
(
  [0] => Ssl_cipher
  [Variable_name] => Ssl_cipher
  [1] => DHE-RSA-AES256-SHA
  [Value] => DHE-RSA-AES256-SHA
)

SSL in MySQL connections

2008-06-17T07:30:00.001-05:00

Last week I wanted to figure out how to use SSL certificates in MySQL connections. This is well-documented on the MySQL Web site, but here are a few wrinkles I experienced while figuring out how to get this working (this was with MySQL5 on CentOS5 and RHEL5).

After creating the certificate authority (CA) certificate/keyfile pair, you can specify them in the mysqld section of /etc/my.cnf:

ssl-ca=/etc/pki/CA/ca-cert.pem
ssl-cert=/etc/pki/tls/certs/mysql-server-cert.pem
ssl-key=/etc/pki/tls/private/mysql-server-key.pem

When making certificates for a client connecting locally (e.g., ssluser@localhost), it's important to supply localhost as the "common name" when prompted by openssl. (Yes, it's probably pretty silly to use SSL for a connection over the loopback interface, but you might be in this situation if you were testing.)

If you want to specify the CA (whose signature must appear in client certificates) when setting up a MySQL user (as you might when using the require x509 syntax), the fields should be separated by backslashes ('/'):

grant usage on *.* to ssluser@localhost require issuer '/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd/CN=www.example.com/emailAddress=webmaster@example.com';

The following command will more-or-less correctly format the issuer for the grant statement:


openssl x509 -text -in /path/to/ca-cert.pem | grep Issuer \
| cut -d':' -f2 | sed -e 's/, /\//g'

Using issuer and subject items imply x509, and it's an error to try using x509 and issuer.

Depending on the require clause in the grant statement, you can use one or more of the following to connect to the SSL-enabled server:

mysql -u ssluser -p

mysql -u ssluser --ssl-ca=ca-cert.pem -p

mysql -u ssluser --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -p

If you use require none or omit the require clause, you can use any of the three connection commands. If you use require ssl, you can use #2 or #3. And if you use require x509, you have to use #3 (note that #3 includes the --ssl-ca option). After connecting, type status (or just \s) and make sure that the SSL item says something encryptiony (mine says Cipher in use is DHE-RSA-AES256-SHA).

Unless client certificates are really necessary (extra client-level authentication), it's probably adequate just to use require ssl and to have the client provide the CA certificate (this appears to provide as high a level of encryption as the client certificate does). But note that you still need to generate the server certificate and key, even if you're not using client certificates.

MIME-decoding email attachments

2008-06-15T18:31:00.003-05:00

Occasionally a friend will forward a message to my gmail account, and the forwarded message ends up as a plain-text attachment in the message I receive. If the original message had an attachment, that attachment appears as a MIME-encoded section of the attachment.

If this happens to you, you could try the following. Save the attachment as a text file, and open that file in a text editor. Delete all the lines except the lines which represent the encoded attachment (don't keep the attachment headers, just the lines of text which are 76 characters wide [the last line may be shorter--keep that one, too]). Don't forget to get rid of the lines after the attachment. Save the file as encoded.txt.

Save the following to an executable file called mime_decode somewhere in your $PATH:


#!/usr/bin/perl -w

use strict;
use diagnostics;

use Carp;
use MIME::Base64;

my $usage = "$0 infile outfile";
if ( @ARGV != 2 ) {
    die "usage: $usage\n";
}
my ( $infile, $outfile ) = @ARGV;

open my $fh, '<', $infile or croak "cannot read $infile";
my $encoded = join '', <$fh>;
close $fh;

my $decoded = decode_base64($encoded);
open $fh, '>', $outfile or croak "cannot write $outfile";
print {$fh} $decoded;
close $fh;

Then run the following command:


mime_decode encoded.txt decoded

decoded should be the original attachment.

If you know of a standard utility which does this (especially if it doesn't require the user to prune the email message), please leave a comment.

Gump

2008-06-13T23:04:00.003-05:00

As a big Transformers fan and someone who, well, goes to the bathroom, I thought this was pretty cool.

Fallen Tree

2008-06-01T20:24:00.003-05:00

There was a ferocious wind-and-rain storm here a week ago, and it knocked over some trees. I took some pictures of one of the more impressive casualties. I think it was an elm tree, and (judging by the rings) it appears to have been around forty years old. They cut it up to cart it off, and they made a cut just above the roots. It was probably around two feet in diameter at the base.

Here are a couple of the pictures...

Burning Universal Studios

2008-06-01T14:37:00.003-05:00

A couple of years ago I visited L.A. with friends, and we checked out Universal Studios. We took the tour, which included the cheesy-but-fun King Kong attraction.

That part of the tour was destroyed by fire this morning. The same fire damaged the town hall clocktower from the Back to the Future set, and damaged over 40,000 reels of film (fortunately, there are duplicates in another location--someone was awake during the "Make Backups" lecture at film school).

Tourist attractions have had a hard time of it lately.

RPMs on a tight filesystem

2008-05-24T13:04:00.003-05:00

I've ended up managing a couple of CentOS servers which don't have much free space left on their root (/) filesystems. I was looking through their lists of installed packages, and I discovered a useful trick. The following command will give the size (in bytes) of the original RPM of an installed package:

rpm -q --qf '%{archivesize}\n' pkgname

So if you needed a report indicating roughly how much filesystem space each installed package on an RPM-based distribution was consuming, you could try this:

rpm -qa --qf '%{archivesize} %{name}\n' | sort -rn

When I did this on a CentOS4 box with a full install, I was rather unsurprised to find that the top offender is the OpenOffice.org internationalization package openoffice.org-i18n.

Hard Time

2008-05-21T21:26:00.002-05:00

From the AP news wire:

Lou Pearlman, the man who created the Backstreet Boys and 'N Sync, was sentenced Wednesday to 25 years in federal prison for engineering a decades-long scam that bilked thousands of investors out of their life savings.

Well, at least he's going to jail, even if it may be for the wrong reason.

And I willfully acknowledge the irony of tagging this post with the 'music' label.

root ssh access trick

2008-05-19T07:00:00.001-05:00

Free Software Daily had an interesting post the other day about securing SSH services (that post points to a Tux Training article). This particular tutorial included a configuration item I hadn't seen before. It's a configuration value for the PermitRootLogin field.

If I'm running an SSH service which is visible to the Internet (or even a large intranet), I tend to disable PermitRootLogin (PermitRootLogin no), because the script kiddies can be reasonably sure that an SSH service will have a user called root, and if they try hard enough, they might get lucky with the password.

(I'm also a big fan of the AllowUsers option, which allows you to provide a list of users allowed to log in via ssh. If a valid user not on that list tries to log on, ssh acts as though the user has provided the wrong password.)

The new (new to me, anyway) trick in this tutorial is setting PermitRootLogin without-password. This allows root to log in with a key, but not with a password. This is a really good compromise if you have a server where you need root to be able to log in over ssh. Backups over rsync are a good example of this: to preserve file ownership and permissions, it's sometimes necessary to have rsync run as root.

Bletchley Park financial problems

2008-05-18T11:50:00.004-05:00

A recent Slashdot post talks about financial problems at Bletchley Park. Bletchley Park was home and workplace to Allied cryptographers in WWII. Some say that their success at deciphering German Enigma messages was responsible for the Allied victory against the Nazis. At the very least, their efforts probably significantly shorted the war (in the European theatre, anyway).

It's sad to me to see such an important historical site threatened. They'd probably turn it into condos and shopping centers.

lunchpails

2008-05-16T19:49:00.003-05:00

The other day Film School Rejects (great blog, with a great podcast) has a post about a flickr set of lunchpails. Reminded me of a Hong Kong Phooey lunchpail I used to have.

problem w/ PHPUnit reports on CentOS5/RHEL5

2008-05-10T15:30:00.004-05:00

Yesterday I was trying PHPDocumentor and was going through its Quickstart guide. After I ran phpdoc on the sample code, I threw the reports in my CentOS5 Apache document root so that I could look at the output. Several of the pages wouldn't load. After a quick look at the Apache error log, I saw that those pages were generating PHP errors (the T_STRING gripe), even though the files were named something like sample.php.html.

(CentOS5 and RHEL5 have Apace v2.2.x.)

It took me a while to figure it out, but it's due to an odd feature of Apache which honors multiple extensions in filename. RHEL5 does an AddHandler php5-script .php which tells Apache to run all files with a .php extension through the PHP5 interpreter. I didn't know this, but it even does this for files with names like sample.php.html, where .php isn't at the end of the filename. So even though the phpdoc output files should just render as HTML, they were being interpretted as PHP and were throwing errors.

So I created a directory called /var/www/html/phpdoc and added the following to /etc/httpd/conf.d/php.conf in a Directory container (and restarted Apache): RemoveHandler .php

That convinced Apache not to run any files in that directory through the PHP5 interpreter. Incidentally, I had previously tried SetHandler default-handler for that directory, and it disabled PHP5, but it also disabled nice things like autoindexing (which broke URLs like http://localhost/phpdoc/sample/: Apache would refuse to serve a directory).

By the way, this doesn't seem to affect CentOS4/RHEL4 (Apache 2.0.x and PHP4), because Apache sets up PHP a little differently: it does an AddType, so there's no conflict of having both a text/html content type and a PHP5 handler.

Batdance

2008-05-08T07:00:00.001-05:00

Today digg had a story highlighting a topless robot post offering
The 11 Best Songs from Geek-Movie Soundtracks. Most of the 11 songs didn't really do it for me, but one of them was Prince's Batdance from Batman. I probably hadn't seen that in fifteen years, and it was fun watching it again.

Satellite imagery of post-cyclone Myanmar

2008-05-07T19:00:00.002-05:00

Estimates of the death toll in Myanmar have gone up and up over the last few days, and a Dot Earth post showing satellite images before and after the cyclone illustrate why.

"Star Trek: The Experience" maybe closing

2008-05-06T07:00:00.000-05:00

I went to Las Vegas with friends a few years ago, and one of the things we did was to check out Star Trek: The Experience at the Vegas Hilton. It's expensive, but you can walk through a museum which has props from the shows and a timeline of the Star Trek universe, there's a bar modeled after Quark's in DS9, and there are two rides: The Borg Invation 4D and Klingon Encounter. I actually didn't much care for the Borg show, the the Klingon ride was pretty cool. Walking through the museum was fun, and Quark's was a kick. There's also a good gift shop that'll be happy to overcharge you for souvenirs.

Looks like they may be shutting the thing down. So if you're in Vegas before September, and if you like Star Trek (and are OK with throwing away some cash), go check it out while you still can.

MySQL query optimization from Jay Pipes

2008-05-05T18:00:00.000-05:00

Jay Pipes has posted slides from a recent presentation in which he discussed query optimization in MySQL. Pretty good pointers, worth a look.

RSS day

2008-05-01T12:02:00.001-05:00

As a proponent of RSS, here's a shout out to RSS day.

updated WordPress security whitepaper

2008-04-26T08:55:00.001-05:00

blogsecurity.net has released version 1.2 of their "How to secure WordPress" whitepaper. Looks like they've added some v2.5-specific details along with updated information about security-related plugins.

Wil Wheaton and Radio Free Burrito

2008-04-25T20:03:00.003-05:00

I've recently started reading Wil Wheaton's blog, and I've really enjoyed it. He's a very good writer with a lot to say.

Perhaps like many viewers, I felt that Wesley was one of the dimmer lights in Star Trek: The Next Generation. I think Wil might reply to that kind of comment with something along the lines of "I was a kid. I did what they told me to do." Look me in the eye and tell me you'd have done any differently. Thought so. And me neither.

(Besides, he got to make out with Ashley Judd. Look me in the eye and tell me you'd have done any differently. Thought so. And me neither.)

Anyway, this week he posted a couple of episodes of his Creative Commons podcast called Radio Free Burrito, on which he plays some music from podsafe. It's totally awesome and you're totally a hoser for not listening. So get over there and start listening.

BSG

2008-04-18T07:30:00.001-05:00

Battlestar Galactica is finally back, and I'm really enjoying it. The other day I found the Battlestar Wiki and thought it was pretty cool. I'm pretty eager to find out who the twelfth Cylon is. My money is on Tom Zarek. Or maybe Dualla.

Prompt for new firefix window

2008-04-16T07:30:00.000-05:00

I tend to run my window manager (fluxbox) with four desktops, and I typically have firefox windows open in two of them. Occasionally I have to open a firefox window on the third or fourth desktop, and it's a nuisance to go to one of the first two desktops, open a new window (Ctrl-N), and move the new window to the other desktop (and I acknowledge the irony of considering that a "nuisance").

I recently discovered the -new-window command-line option to firefox. It takes a URL as an argument, and it opens that URL in a new window. So I wrote a shell script that prompts me for a URL and then opens that page in a new browser window. If you want to try this, save the following to a file (I saved it to ~/bin/ffwin), and remember to make the file executable:


#!/bin/bash

URL=$( dialog --stdout \
  --backtitle ffwin \
  --title 'new Firefox window' \
  --inputbox 'URL:' 8 40 )
if [ ! -z "$URL" ]; then
  exec firefox -new-window $URL
fi

When you run this, a new xterm window will open, and dialog will prompt you for the URL. Preceding the firefox call with exec means that the xterm will go away after you enter the URL.

As a further refinement, make it so that you can run this from a menu-click. I added the following entry to ~/.fluxbox/menu, so that I just have to right-click on the desktop and select "ffwin":


[exec] (ffwin) {xterm -e ~/bin/ffwin}

Other window managers would likely allow you to create a custom application launcher from a toolbar or menu or widget or something.

XML in PHP5: the weather

2008-04-14T07:30:00.000-05:00

My favorite weather-related Web site is the weather underground, but their pages can be a bit heavy. Usually I just want a quick summary of current conditions and a forecast for the next day or two. Thankfully, wunderground provides this in XML format. Here's the example for Portland, Oregon: HTML, XML.

I thought it would be fun to write a quick PHP program to download the XML file, parse it, and present it in an easy-to-read format. I decided to use the SimpleXML extension for PHP5, because my XML-parsing needs are pretty modest for this project. And I'll use the curl extension to fetch the XML file.


$url = 'http://rss.wunderground.com/auto/rss_full'
  . '/OR/Portland.xml?units=both';

$ch = curl_init($url);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
$xmlstr = curl_exec($ch);
$res_info = curl_getinfo($ch);
curl_close($ch);
if ( $res_info['http_code'] != 200 ) {
  header( 'content-type: text/plain' );
  die("couldn't open $url");
}

$xml = new SimpleXMLElement($xmlstr);
$epoch = strtotime( $xml->channel->pubDate );
$date = date( 'H:i:s l j F Y', $epoch );
$report_uri = htmlentities(
  $xml->channel->item[0]->link );
$content = '';
$forecast_items = array();
foreach ( $xml->channel->item as $item ) {
$desc = strip_tags( $item->description );
$forecast_items[] = array(
  'guid' => $item->guid,
  'desc' => htmlentities( html_entity_decode($desc) ),
);
}

echo '<html><body><h1>Weather Underground Report</h1>',
  '<h2>Portland, Oregon: ', $date, '</h2>';
foreach ( $forecast_items as $item ) {
  $id = '';
  if ( !empty($item['guid']) ) {
      $id = ' id="' . $item['guid'] . '"';
  }
  echo "<p$id>", $item['desc'], '</p>';
}
echo '<p><a href="', $report_uri, '">Full report</a></p>',
  '</body></html>';

There's some magic in the first foreach loop. Just as you should never trust anything typed into a Web form, you should also be skeptical of content from a foreign XML document, hence the strip_tags() and htmlentities() calls. But some of the characters in the wunderground XML are already HTML-encoded (like the degree symbol), so it's useful to call html_entity_decode() first (otherwise the temperature might look like "75°F", rather than "75°F").

The code is otherwise straightforward. If you look at the raw XML, you'll find that the entire report is wrapped in a <channel> container, inside which the report date is wrapped in a <pubDate> container, etc. As its name implies, SimpleXML makes parsing XML pretty easy, and it's a great choice for small projects like this.

fopen($url) v. curl in PHP

2008-04-08T08:20:00.000-05:00

Occasionally you'll see PHP code which uses require() or include() or fopen() or file_get_contents() to import code from a remote location (the argument to those functions can be a URL). This sort of thing is generally considered to be a bad security practice, especially if you don't control the code at the remote location (it could unexpectedly change in such a way as to do something destructive to your application).

Many PHP security experts tend to recommend disabling the allow_url_fopen option in php.ini. Disabling this feature can even serve to prevent inadvertent code injection. Imagine an application which calls require($file) where $file is dynamically determined. If your application has some sort of problem which allows an attacker to set the value of $file, the attacker can inject the code of his/her choosing into your application.

So I feel that disabling allow_url_fopen is a good idea, but sometimes you need to initiate HTTP requests in your PHP code. The curl extension provides a good way of doing this. The following snippet will put the contents of the Web page at $url into the $page variable:


$ch = curl_init($url);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
$page = curl_exec($ch);
curl_close($ch);

The previous example is a GET request, but you can also do POST:


$postdata = 'var1=value1&var2=value2';
$ch = curl_init($url);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
curl_setopt( $ch, CURLOPT_POSTFIELDS, $postdata );
$page = curl_exec($ch);
curl_close($ch);

undeclared attributes in PHP classes

2008-04-07T08:30:00.001-05:00

I was recently surprised to discover that a PHP object can have attributes (variables) not declared in the class. The following works in PHP4 and PHP5 (it prints 'ick' and then 'yark'):


class Gakkk {}

$gakkk = new Gakkk();
$gakkk->blech = 'ick';
echo $gakkk->blech, "\n";
$gakkk->blech = 'yark';
echo $gakkk->blech, "\n";

At best, this strikes me as a very poor programming practice. Who knows when this sort of thing will stop working (in a future version of PHP)? And what kind of code readability is this?

I really like PHP, but this is just weird to me.

PHP4 in RHEL4

2008-04-06T08:30:00.000-05:00

Since last year's announcement that PHP4 will reach end-of-life this summer, I've been wondering what will become of PHP in the versions of Red Hat's Enterprise Linux distribution which shipped with PHP4. Looks like Red Hat will continue to provide bugfix and security updates for PHP4 throughout the lifetime of its PHP4-relevant distributions.

Falkirk Wheel

2008-04-05T12:36:00.004-05:00

Friends of mine like roller coasters. Screw that. I wanna ride the Falkirk Wheel:

I've long been fascinated by locks and canals (I walked over the Erie Canal twice a day my first year of grad school), and this is one of the cooler mechanisms I've seen. It's even quite energy efficient: because the two caissons (the 'chairs' of this two-chair merry-go-round) always weigh the same, it takes very little energy to run the thing.

If I'm ever in Scotland, I'm totally checking this out.

rate-limiting in iptables

2008-03-24T09:00:00.000-05:00

I recently learned about a useful feature in iptables which might help prevent denial of service (DOS) attacks. The iptables "recent" extension dynamically creates a list of source addresses against which your ruleset can match, for example, to block someone who is making too many connection attempts in a given time interval. The Debian Administration blog has a good example of using this to block DOS attacks against an ssh server.

iterating through an array in bash

2008-03-23T01:32:00.003-05:00

Every now and then I need to iterate through an array of items in a bash script, and I can never remember the syntax--I always have to look it up. So here's a quick example...


#!/bin/bash

things=( first second third )

for i in ${things[@]}
do
  echo $i
done

If the number of array elements is large, it can be useful to have one element per line:


things=( \
first \
second \
third \
)

another Highlander sequel

2008-03-16T20:40:00.003-05:00

The other day I rented Highlander: the Source, and I watched it this evening. Although the original film is one of my favorites, I didn't have very high hopes for this one: all of the sequels have been disappointments (although I seem to remember thinking that the fourth film wasn't horrible).

But I got a bit of a surprise. There's more to say about this movie than I would have imagined. I was surprised because this newest installment is actually worse than Highlander II, which I did not think was humanly possible. Highlander II at least had a fun villain. This film stars Adrian Paul as Duncan MacLeod from the Highlander TV show, and in the film Paul is surrounded by a handful of characters who are even less interesting than he is.

So if you're in the video store and you see a copy of Highlander: the Source, keep walking, and rent something better, like Ishtar, Plan 9 From Outer Space, or Highlander II.

relativistic economics

2008-03-15T14:15:00.003-05:00

There was an interesting Slashdot article the other day about a satirical speculative analysis of the economics of interstellar trade. The idea is that if you're shipping something to another star system, you've made a significant financial investment in the goods you are shipping, and the duration of the voyage will be long enough that there should be an interest rate applied to your investment.

The interesting wrinkle appears when you consider that for interstellar trade to be worthwhile, the cargo vessels will need to travel at relativistic speeds. Special relativity describes the effect of time dilation, the phenomenon of a measurable discrepancy in the voyage duration as measured by the ship's crew versus that of a stationary observer (like the investor).

So whose measurement of time do you use to compute the interest?

To extend this nonsense to other predictions of special relativity, the ship's mass and length will also be affected, which might complicate matters for the interstellar equivalents of weigh stations.

Class::Accessor constructors

2008-03-09T17:33:00.002-05:00

I'm a pretty big fan of Class::Accessor. It's great for those occasions when you need to write a Perl module which has lots of attributes. You tell your module to inherit from Class::Accessor, provide a list of attributes, and your module automatically has accessors and mutators for all of those attributes. Class::Accessor even takes care of creating your module's constructor.

That last point was actually giving me some trouble the other day. I was writing a Perl module, and it turned out to have several attributes (counters that needed to be incremented while parsing a file), so I decided to have my module inherit from Class::Accessor. But one of the attributes was going to be an instance of another class (I wanted to use composition, rather than multiple inheritance), and I wanted to instantiate this object when my object is instantiated. But since Class::Accessor creates my constructor automatically, it wasn't clear to me how I'd do this.

With a little fiddling, I was able to override the Class::Accessor constructor in such a way that it still created my accessors and mutators, but also allowed me to do other object initialization tasks:


package Gakkk;

use strict;
use diagnostics;
use warnings;

use base qw/ Class::Accessor /;
Gakkk->mk_accessors(
   qw/
        flamningle
        line_number
        num_parse_errors
        num_zortbiptons
        /
);

use Some::Other::Class;

sub new {
   my $class = shift @_;

   my $self = $class->SUPER::new(@_);
   $self->flamningle( Some::Other::Class->new() );
   $self->line_number(0);
   $self->num_parse_errors(0);
   $self->num_zortbiptons(0);

   return $self;
}

# other methods, ...

1;

The call to $class->SUPER::new(@_) gives what's left of the argument list (@_) to the constructor of the parent class (Class::Accessor) and returns an instance of my class. I'm then able to initialize my object attributes without requiring that the calling code do it explicitly. Without overriding the constructor, the caller would have to do something like this:


my $gakkk = Gakkk->new(
    {
        flamningle       => Some::Other::Class->new(),
        line_number      => 0,
        num_parse_errors => 0,
        num_zortbiptons  => 0,
    }
);

Having overridden the constructor, the caller can instantiate the class like this:


my $gakkk = Gakkk->new();

IntranetAddress PHP class

2008-03-01T14:46:00.002-06:00

I've added another Google code project. This one is called IntranetAddress, and it's a PHP class which you can use to determine whether or not an IPv4 address belongs to a set of network ranges (specified in CIDR notation in a configuration file). The class requires the Net::IPv4 PEAR package, and a PHPUnit test suite in included.

password wallet in google code

2008-02-19T07:00:00.000-06:00

I put my password wallet in a google code project.

overnight at the lake

2008-02-18T09:12:00.003-06:00

I'm writing this from my friends' lakehouse. I've been here since yesterday afternoon, and it's been a nice break from routine. I took a few pictures which I think came out pretty well.

There was a brief snowstorm yesterday afternoon with wonderfully large snowflakes:

This morning I took a picture from a similar angle. The lake was so still this morning--like looking at glass:

password wallet update

2008-02-16T21:37:00.003-06:00

Yesterday I discovered an interesting (and somewhat alarming) problem with my password wallet.

I use vim for my text editor (I have export VISUAL="/usr/bin/vim" in my ~/.bashrc). Yesterday I used the wallet script to update my password list, and then later I was using vim to edit a totally unrelated text file. I fat-fingered what I was doing and typed some magical set of keystrokes (still not sure just how I did that), and suddenly I was looking at several lines from my password file. I recognized those lines as lines that I had highlighted, deleted, and then pasted to a new location when editing the password file when I was using wallet. I then had a forehead-slapping moment when I realized that such edits are saved for posterity in the ~/.viminfo file.

Oops. That's a potential information leakage vulnerability.

But it is easily remedied by adding the following line to ~/.walletrc:

VISUAL="/usr/bin/vim -i NONE"

The -i option tells vim to use some file other than ~/.viminfo for its state information. In this case, it tells vim not to store state information at all. The trick of putting it in ~/.walletrc (rather than in ~/.bashrc) means that vim only skips storing state information when running wallet--vim will keep state information in ~.viminfo any other time you run vim.

So if you're using wallet with vim, I urge you to make the above change to your ~/.walletrc file.

securing WordPress with blogsecurity.net

2008-02-06T19:26:00.000-06:00

I needed to set up a WordPress blog at work this week, and I decided to try following the WordPress Security Whitepaper at blogsecurity.net. It was pretty easy, and (hopefully) has made that WordPress installation a bit more secure.

blogsecurity.net is a blog about security issues relating to blogging. It's pretty interesting and has lots of good information and resources.

Python 3.0 To Be Backwards Incompatible

2008-02-02T07:55:00.000-06:00

According to a Slashdot post, just about all python code will require at least some changes when python 3.0 comes out in early 2008. I've never learned python, and news like this makes me glad that I've never bothered. (Besides, a syntax predicated on whitespace just seems weird to me.)

I wonder how Red Hat feels about this, considering that a lot of the RHEL system scripts are in python. They'll probably have a lot of rewriting to do for RHEL6.

I suppose that similar criticism could be leveled at Perl6 v. Perl5 (although there is talk of some sort of compatibility mode as well as a Perl5-to-Perl6 translater). But it's probably a moot point: as far as I can tell, Perl6 will never, ever be released.

Microsoft buying Yahoo?

2008-02-01T17:03:00.000-06:00

So I started going through my RSS feeds this morning, and I saw that a big news item was Microsoft's $44.6 billion offer to buy Yahoo.

I'm not sure how I feel about this. If the purchase goes through, I hope MS won't screw up flickr.

I think Yahoo uses open source technology for a lot of their services. I'd hate to see that change, too.

Someone posted an interesting comment at Linux Journal. The commenter pointed out that Yahoo owns Zimbra, a potential Exchange competitor. I wonder how much that contributed to Microsoft's offer.

syntax highlighting in vim in Ubuntu

2008-01-27T19:21:00.000-06:00

Today I finally noticed that syntax highlighting wasn't working in vim in Ubuntu. Installing vim-full and adding syntax on to ~/.vimrc did the trick.

google code, trac-backup

2008-01-18T12:07:00.000-06:00

In the current episode (season 5, episode 9) of LugRadio, Stuart Langridge says that his new year resolution is to start releasing some of the little scripts and programs he writes. He says that he writes lots of these things, but tends not to release them, because he thinks that they're not very user-friendly. I really identified with him when he said that, and it's inspired me to try doing the same.

So I created a project in Google Code for the trac backup script I described in a previous post. Creating the Google Code project was pretty easy (although someone unfamiliar with subversion might have a hard time). I've updated the script according to a comment on the previous post about a problem with a new version of trac. If you are interested, please have a look at trac-backup.

I'll probably add more projects in the coming weeks:

a versioned backup system based on subversion, which is pretty good for backing up configuration data
maybe some other backup programs I've written
the password wallet I wrote about in the January issue of Linux Journal

WPA2 Enterprise on the Nokia N800

2008-01-06T16:35:00.000-06:00

I got a Nokia N800 as a holiday gift, and I took it to work the other day. The N800 is an "Internet Tablet" which is a bit larger than a cell phone and much smaller than a laptop. It's a WiFi device which runs Linux, and it's a pretty neat toy. If you get one, definitely go the software available at maemo.org.

Anyway, I had a bit of trouble getting the N800 to talk to the wireless network at work, which is WPA2-Enterprise authenticating against an Active Directory domain. But a google search found a page describing how to configure a connection, and that worked right away. The following is a direct copy-and-paste of that post:


page 1: Connection type = WLAN
page 2: Network mode = Infrastructure; Security method = WPA with EAP
page 3: EAP type = PEAP
page 4: Select certificate = None; EAP method = EAP MSCHAPv2
page 5: You can enter your login information if you don't want to log in manually each time
page 6: Click "Advanced" button
Other tab: Enable "WPA2-only mode"
EAP tab: Enable "Use manual user name"; enter your "Manual user name"; Disable "Require client authentication" (I thought I had this one enabled initially, but it will now only work if disabled)

I set it not to remember my password (in case the N800 is lost or stolen).

No Country For Old Men

2008-01-05T21:46:00.000-06:00

I saw the Coen brothers' No Country For Old Men with a friend last night. It's probably the best film I've seen in a long time. It's pretty violent, but it's well worth seeing. It's more of a character study (like Heat or A River Runs Through It) than a narrative, and it definitely doesn't have a traditional Hollywood ending (in fact, the movie ends rather abruptly). But I thought it was seven shades of awesome. Javier Bardem was a fantastic villain, and Tommy Lee Jones also gave a great performance. Guess I'll be adding Cormac McCarthy (the author of the book on which the movie is based) to my reading list.

Ubuntu asking for the CD to install software

2007-12-31T09:02:00.000-06:00

Sometimes I ask apt-get or synaptic to install something, and it asks for the CD. Turns out that this is an easily-remedied nuisance. A fosswire post (which I found by way of fsdaily) gives a GUI-based solution. An equivalent solution is to comment out the line in /etc/apt/sources.list which starts w/ 'deb cdrom:' (that's probably line 1).

Ubuntu firewall

2007-12-30T12:15:00.000-06:00

This post offers a way of telling your Ubuntu system to set up a simple firewall at boot time. It assumes that you have a single network adapter called eth0.

I saved my firewall rules (in iptables-save format) to /etc/network/fwrules. My firewall rules are fairly specific to my setup, but the following might serve as a good starting point if you want to try this:


*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
COMMIT

And then I just saved the following to /etc/network/if-pre-up.d/fw:


#!/bin/bash

iptables-restore < /etc/network/fwrules

(Be sure to make this file executable: sudo chmod 755 /etc/network/if-pre-up.d/fw).

This loads the firewall rules prior to bringing up the network interface, so that the firewall is in place by the time the network connection is active.

udev in Ubuntu

2007-12-28T10:25:00.000-06:00

This post will be a recipe for configuring udev in Ubuntu so that if you plug in a USB storage device (like a flash drive, an MP3 player, etc.), it will get a consistent and predictable device name which you can attache as a non-root user to a fixed mount point. I'll be using my new Verbatim thumb drive as an example.

Plug in the flash drive, wait a few seconds, and type 'dmesg | tail'. The last few lines should show the USB system detecting the device and giving it the first available device name. In my case, the flash drive got /dev/sdd. Next, ask udevinfo for details about the device:

udevinfo -a -p $( udevinfo -q path -n /dev/sdd ) | less

Page through the output looking for the device's values for idVendor and idProduct. The udevinfo output for my thumb drive contained the following lines:


   ATTRS{idProduct}=="1e23"
   ATTRS{idVendor}=="13fe"

Next thing is to tell udev about the device. Create a udev rule file (I used /etc/udev/rules.d/99-thumb.rules) with something like the following:


SUBSYSTEMS=="usb", SYSFS{idVendor}=="13fe", SYSFS{idProduct}=="1e23", NAME="thumb", MODE="0660" OWNER="mbrisby" GROUP="mbrisby"

(Naturally, replace mbrisby with your username and group name.) You may need to run udevcontrol reload_rules to tell udev to read the new addition into its in-memory ruleset.

Now you can make a mount point:


$ sudo mkdir /media/thumb
$ sudo chown mbrisby.mbrisby /media/thumb

Finally, add the mount point to /etc/fstab:


/dev/thumb /media/thumb vfat user,noauto 0 0

And from now on, you should be able to plug in the thumb drive, wait a couple of seconds, type mount /media/thumb, and start accessing the files at /media/thumb.

fetchmail in Ubuntu

2007-12-27T11:36:00.000-06:00

I recently wrote about using fetchmail for gmail. In the meantime I've switched my main desktop (at home) from CentOS to Ubuntu. Ubuntu's fetchmail build is a bit more picky about SSL certificates than the CentOS build, so this post will describe some of the changes I had to make to my ~/.fetchmailrc file.

(By the way, fetchmail should work OK without these changes, it'll just whine about the certificates.)

First I needed to install the ca-certificates package from the Ubuntu repositories, and then I needed to change the gmail line of my ~/.fetchmailrc file from

poll imap.gmail.com protocol IMAP user "my_gmail_username@gmail.com" there with password "my_password" nofetchall keep ssl

poll imap.gmail.com protocol IMAP user "my_gmail_username@gmail.com" there with password "my_password" nofetchall keep ssl sslcertck sslcertpath /etc/ssl/certs

This tells fetchmail where to find the public certificate it needs to verify the SSL connection to the gmail server.

I also use fetchmail to check some IMAP accounts on a server using self-signed certificates, certificates which don't appear in /etc/ssl/certs. One way of doing this is to compute the IMAP certificate's fingerprint and telling that to fetchmail. If the IMAP server is imap.example.com and it's running on the standard port (993), you can use openssl to grab the certificate like this:


openssl s_client -ign_eof -connect imap.example.com:993 > imap.cert

(You may need to Contol-C to get back to the command prompt.)
Then use openssl to find the MD5 fingerprint:


openssl x509 -fingerprint -md5 -in imap.cert

The output of this latter command should contain a line starting with MD5 Fingerprint. Add the fingerprint to your ~/.fetchmailrc file with something like this:


poll mail.example.com via imap.example.com protocol IMAP user mbrisby there with password "my_password" nofetchall nokeep ssl sslfingerprint "4C:69:E2:E6:F9:6B:6C:4E:E9:8B:E1:C8:2B:B9:4F:B9"

And then just run fetchmail in cron every now and then.

desktop Ubuntu

2007-12-25T06:29:00.000-06:00

I recently converted my laptop from CentOS 5 to Ubuntu 7.10 and liked the change. So I did the same to my main desktop at home this weekend. Naturally, there were a few bumps in the road. Over the next several days I'll be posting about some of them.

But first, a couple of annoyances.

Ubuntu likes to beep. It rings the system bell a lot more than CentOS seemed to do: tab completion at the bash prompt, unsuccessful page text searches in Firefox, trying to go past the end of the file in vim, etc. It really enjoyed beeping at me, and putting set bell-style none in ~/.inputrc didn't help much.

It turns out to be a kernel module. A post in Dell's Linux desktop forums suggested modprobe -r pcspkr, and that worked right away. The post also suggests putting blacklist pcspkr in a file in /etc/modprobe.d to make the change permanent (I haven't rebooted yet, but I figure that oughtta do it.)

The other annoyance is that Ubuntu's grep isn't compiled with libpcre support (that's the Perl-compatible regular expression library). One of the bash scripts I use for backups has a grep -P in it. The -P options tells grep to regard the search pattern as a Perl-style regex. This gives the following charming error message:


The -P option is not supported

Someone else noticed this and filed a bug report. Looks like the Ubuntu developers aren't interested in fixing it in this version. Someone suggested installing the pcregrep package, but this has a few problems:

the binary is installed as /usr/bin/pcregrep
pcregrep doesn't have the same performance or options as grep
oddly, pcregrep doesn't accept the -P option (you'd think it would just ignore it)

So pcregrep is hardly a drop-in replacement for grep, even if you rename the binary to /bin/grep.

As it happens, I got lucky. My the regex in my bash script is dull enough that I was able to replace grep -P with egrep. But if you use something more sophisticated, you'll have a harder time of it.

But all in all, I'm enjoying my shiny new Ubuntu installation. I'll be back later to yammer on about using udev, fetchmail, iptables, and maybe some other stuff in Ubuntu.

Inspekt PHP library

2007-12-11T22:18:00.000-06:00

A recent post on the Planet-Websecurity.org blog got me interested in Inspekt. It's a secure input validation library for PHP. It reminds me a bit of Perl's taint switch, in that Inspekt prevents you from directly using $_POST, $_GET, and their ilk.

Looks like it hasn't really hit release status yet, but I think it's going to be worth watching.

Ubuntu

2007-12-06T07:00:00.000-06:00

I finally gave Ubuntu a try recently. I'd previously tried it as a VMWare Server guest and hated it. But that probably wasn't a fair shake, so I installed it on my laptop last week. I was really impressed by how easy it was to get everything set up. It only took a few hours to get it installed and pretty highly customized with some of my favorite packages, including gtkpod, grip, easytag, mplayer, fluxbox, VMWare Server, gkrellm (and a few of its plugins), and grisbi.

About the only thing that really took a while was getting fluxbox to work, and that's because Ubuntu does it rather differently than CentOS (what I'm used to). It took me a little while to realize that I needed to be using ~/.fluxbox/startup rather than ~/.Xclients, and it took me forever to cotton on to the fact that the ~/.fluxbox/keys syntax had changed between v0.9.x and v1.0.x. I'd never had the following three lines in my keys file before, but they're pretty important (you can't easily get to the fluxbox menu without them):


OnDesktop Mouse1 :HideMenus
OnDesktop Mouse2 :Workspacemenu
OnDesktop Mouse3 :RootMenu

About the only thing I couldn't do was install native drivers for one of my wireless cards. I have two cards: a Linksys WPC11v4 802.11b card and a Netgear 802.11g card. The Linksys card has open-source drivers which support monitor mode (so that I can run kismet), while the Netgear card only has Windows drivers. It was very easy getting ndiswrapper and wpa_supplicant set up for the Netgear card, but I never got the Linksys drivers working. Looks like other people have had the same trouble, and the solution may be to try a different kernel. Oh, well.

Anyway, it was all pretty easy, and I may start using Ubuntu on all my desktops. And O'Reilly's Ubuntu Hacks was pretty helpful.

fetchmail for gmail

2007-12-05T22:00:00.000-06:00

If you have lots of email accounts, it can be a real pain checking all of them. But if you're running a mail server on a Linux box somewhere (like postfix on your workstation at home, for example), you can use fetchmail to download the messages from your IMAP and POP3 mail accounts. That way, all your mail is in one place (and you only have to go to one place to read it).

gmail recently added IMAP support (it's one of the tabs under Settings). Once you enable IMAP support in your gmail account, you could add something like the following to your ~/.fetchmailrc file:


poll imap.gmail.com protocol IMAP user "my_gmail_username@gmail.com" there with password "my_password" nofetchall keep ssl

nofetchall just gets the new messages, keep prevents fetchmail from deleting the messages off your gmail account (so that you can still read them by logging on the gmail), and ssl keeps your password encrypted when fetchmail connects to gmail. Then just run fetchmail -s in cron every now and then.

Something to keep in mind is that although this won't delete your messages from gmail, it'll mark them as read. So if you log in to gmail, new messages won't look new, they'll look read (because fetchmail has read them).

Bats in the belfry

2007-11-23T22:08:00.000-06:00

The other day I read that DC Comics is planning to 'promote' Bruce Wayne to the ranks of the New Gods. Despite the departure of Bruce Wayne, there will still be a Batman to watch over Gotham City. The role will be filled by Jason Todd, the second Robin.

Jason Todd was murdered by the Joker (beaten to death with a crowbar, if memory serves).

If the last couple of paragraphs don't make any sense to you, then you and I are of like mind.

This sounds like a publicity stunt to me, like when DC briefly killed Superman in the early 90s.

Guess they're running out of ideas over there.

Lame OpenDocument Foundation Blathering

2007-11-19T06:46:00.000-06:00

I recently wrote about some strange announcements from the OpenDocument Foundation (which has since totally dissolved), and I said I didn't know what that meant for the OpenDocument format (ODF).

Not much, it seems. An Antic Disposition post has clarified the matter somewhat:

The adoption of the ODF standard is promoted by several organizations, most prominently the ODF Alliance (with over 400 organizational members in 52 countries), the OpenDocument Fellowship (around 100 individual members) and the OpenDoc Society (a new group with a Northern European focus, with around 50 organizational members). To put this in perspective, the OpenDocument Foundation, before it changed its mission and dissolved, had only 3 members.

Origin of Kryptonite

2007-11-17T06:27:00.000-06:00

According to Wikipedia, Kryptonite (a fictional mineral, the green variety of which is toxic to Superman) was originally introduced in 1943 (about five years after Superman's first appearance in comic books) in the radio show. It was a plot device used to allow the actor portraying Superman the opportunity to take some vacation time.

Wacky.

trac: backups, Gantt plugin, concluding remarks

2007-11-13T07:00:00.000-06:00

This is the third installment of a series on trac, Web-based pr0ject management software. The previous segments talked about installing and using trac.

trac comes with a command-line utility called trac-admin, which can (among other things) perform backups of individual trac projects. The following is a shell script you could put in /etc/cron.daily to back up all your trac projects each night:


#!/bin/bash

TRAC_ROOT=/var/www/trac/tracroot
TRAC_BAC_ROOT=/var/trac_bac

TODAY=$( date +%Y%m%d%H%M%S )
mkdir -p $TRAC_BAC_ROOT/$TODAY
for i in $TRAC_ROOT/*
do
 DEST=$TRAC_BAC_ROOT/$TODAY/$( basename $i )
 DEST_TARGZ=${DEST}.tar.gz
 /usr/bin/trac-admin $i hotcopy $DEST
 tar czf $DEST_TARGZ $DEST
 rm -rf $DEST
done

This uses the trac-admin hotcopy feature to make a compressed archive of each individual project (putting them in time/date-labeled directories in /var/trac_bac).

This series discussed the WebAdmin plugin. I also tried the TracGantt plugin, which makes Gantt charts of your project. I found that I didn't much care for this plugin. You have to enter an extra four data fields for each ticket, one of which is a list of ticket dependencies (e.g., completion of this ticket is dependent on completion of that ticket). The Gantt charts don't clearly display these ticket dependencies, so it seems like a wasted effort. And for a large project, the chart becomes too big for useful printouts, and the plugin doesn't offer exports in other formats. So TracGantt didn't really do it for me. shrug

In closing, I really like trac, and it's been very helpful to me in my work. Clearly, trac is designed to manage software development projects. But with a little imagination, I think it could be used quite effectively to manage just about any kind of project, even something as simple as a running 'to-do' list.