GNU screen w/ ssh-agent

I maintain a lot of Linux servers, and I find it useful to keep an ssh session open to each one. But I don't want a terminal window open for each server, so GNU screen has been really helpful to me. I've used screen for years and I thought I knew most of its features, but I recently saw a post on polishlinux.org which has some really neat screen tricks which were new to me.

One screen trick I've used a lot in the past is to run screen inside of an ssh-agent session, with each screen window being an ssh session to one of my servers. So if I generate a password-protected ssh key and share it to all my servers, I can do the following:

$ screen -S wrapper -c .screenrc_escP
$ ssh-agent /bin/bash
$ ssh-add # supply ssh key password
$ screen -S ssh

The first call to screen sets up a 'wrapper' session, so that the ssh-agent will work for adding new windows to the inner screen session, even if I re-attach from another terminal. The .screenrc_escP configuration file contains escape ^Pp so that the two nested screen sessions have different escape sequences.

Then within the inner screen session, I can ssh to my servers without passwords (because I've already given the ssh key password).

The tedious part of doing this was manually opening all those ssh sessions and naming the screen windows. But now (thanks to the polishlinux.org post) I see that I can save something like the following to a file called .screenrc_ssh:

screen -t host1 ssh host1
screen -t host2 ssh host2
screen -t host3 ssh host3
screen -t host4 ssh host4

And then I can instead do this:

$ screen -S wrapper -c .screenrc_escP
$ ssh-agent /bin/bash
$ ssh-add # supply ssh key password
$ screen -S ssh -c .screenrc_ssh

And all my ssh sessions open like magic.

Another interesting part of the polishlinux.org post is the discussion of regions. This feature lets you split a screen window into regions. I've done this several times by accident, and I always just found it annoying, because I'd have to look in the man page to see how to close a region. I never knew how to use the feature. But you could have an ssh session to two servers in the two regions of the same window--allowing you to run some long-running process on one server and keep an eye on it while you're working on another server in the other region.

Screen rocks.

xscreensaver in CentOS 5

xscreensaver landed in the CentOS 5 'extras' repository a couple of days ago (I'd previously bemoaned the absence of xscreensaver in CentOS 5).

Nuclear materials for the asking

The New York Times is reporting that the General Accounting Office (GAO) set up a fake construction company and requested a license from the Nuclear Regulatory Commission (NRC) to purchase nuclear materials. The GAO did this in order to audit the NRC's security protocols. The fake GAO company had no physical location, no Web site, no clients, no construction equipment, and no personnel--just a mailbox.

The NRC quite promptly (less than a month) sent the fake company the requested license. In fact, the GAO was able to alter the document so as to be able to purchase more nuclear material than the original license allowed. The GAO was then able to acquire enough americium-241 and cesium-137 (substances which are legitimately purchased by construction companies) to have been able to construct a dirty bomb (the GAO called off the order prior to delivery and never actually constructed a bomb).

So, next time you think the NRC's got your back, think again.

gpg-based password wallet

I've been using the following script for a while to store passwords in an encrypted file. As you can see from the comments, it's based on a script from a linux.com article, but I've added several features which make it more agreeable to me. To use, save it as an executable file somewhere in your path (I've saved it as ~/bin/wallet).

You'll need to specify the location of the encrypted wallet file. You can do that in one of three ways:

1. with the PASSWD_LIST environment variable
2. having something like 'PASSWD_LIST=/path/to/wallet.gpg' in ~/.walletrc
3. on the command line: wallet -c /path/to/wallet.gpg
   

Then just type wallet to view your password wallet in less, or type wallet -e to edit your wallet (set your VISUAL environment variable to your favorite editor, or wallet will default to vi).

And here's the script...

#!/bin/bash

# alteration of script described at
# http://www.linux.com/article.pl?sid=07/03/06/1640216
# changes from original:
# 1. use of VISUAL envariable for editor
# 2. storage of password in variable, rather than file
# 3. view-only mode (rather than always opening in text editor)
# 4. symmetric encryption
# 5. saving backup copy of encrypted password file prior to editing
# 6. creates password wallet if it doesn't exist
# 7. encrypted file can be specified by -c option, by PASSWD_LIST
#    envariable, or in ~/.walletrc

if [ -f ~/.walletrc ]; then
. ~/.walletrc
fi

if [ -z ${VISUAL} ]; then
VISUAL=vi
fi

EDIT_PWFILE=0
while getopts 'ec:' OPTION
do
case $OPTION in
e) EDIT_PWFILE=1;;
c) PASSWD_LIST="$OPTARG";;
?) printf "usage: %s [ -e ] [ -c encrypted file ]\n" $( basename $0 ) >&2
 exit 2
 ;;
esac
done
shift $(($OPTIND - 1))

if [ -z "${PASSWD_LIST}" ]; then
echo "need the encrypted file specified by PASSWD_LIST (in ~/.walletrc"
echo "or the envariable) or with the -c option"
exit 2
fi

if [ ! -f $PASSWD_LIST ]; then
echo "$PASSWD_LIST doesn't exist--attempting to create..."
echo "(you'll need to give gpg a master password in a moment)"
mkdir -p $( dirname ${PASSWD_LIST} )
TEMPFILE=$( mktemp /tmp/wallet.XXXXXX )
gpg -c -o ${PASSWD_LIST} ${TEMPFILE}
rm -f ${TEMPFILE}
EDIT_PWFILE=1
fi

# prompt the user for the password
PASSWORD=$( dialog --stdout --backtitle "Password Locker" \
--title "Master Password" --clear --passwordbox \
"Enter the Password Locker master password." 10 51 )
RETVAL=$?

case $RETVAL in
1)
  echo "Authentication Required!"
  exit 1;;
255)
  echo "Authentication Required!"
  exit 1;;
esac

# if we're not editing the file, just display it and quit
if [ $EDIT_PWFILE -eq 0 ]; then
echo $PASSWORD | gpg --decrypt --passphrase-fd 0 $PASSWD_LIST | less
clear
exit
fi

TMPDIR=$( mktemp -d /tmp/wallet.XXXXXX )
chmod 700 ${TMPDIR}
PASSWD_LIST_UNENCRYPTED=${TMPDIR}/wallet
# decrypt the password list
echo $PASSWORD | gpg -o $PASSWD_LIST_UNENCRYPTED --passphrase-fd 0 \
$PASSWD_LIST &> /dev/null
RETVAL=$?

# if decryption succeeded, open the password list in the editor
# and then re-encrypt it after the editor closes
case $RETVAL in
0)
  mv $PASSWD_LIST ${PASSWD_LIST}.bak
  ${VISUAL} $PASSWD_LIST_UNENCRYPTED 2> /dev/null;
  echo $PASSWORD | gpg -c -o $PASSWD_LIST --passphrase-fd 0 \
      $PASSWD_LIST_UNENCRYPTED &> /dev/null
  CRYPT_RETVAL=$?
  if [ $CRYPT_RETVAL -eq 0 ]; then
      rm -rf ${TMPDIR}
      clear
  else
      echo -n "gpg failed to encrypt your password file! "
      echo "Please fix the problem manually!"
      echo "unencrypted file at $PASSWD_LIST_UNENCRYPTED"
      exit 1
  fi;;
?)
  echo "error condition detected (invalid password?)"
  rm -rf ${TMPDIR}
  exit 1;;
esac

No more oil: try jatropha and miscanthus

A recent post on the Neutral Existence blog reports that the International Energy Agency says we'll run into serious oil supply problems in only five years. The post says that there will be a significantly increased demand from the booming industrialization of India and China, and that it's becoming increasingly critical to find alternatives to oil.

Along those lines, the Energy Blog had posts for a couple of exotic-sounding alternative fuel possibilities that I hadn't read about before. One is a cellulosic ethanol energy crop called miscanthus, whose output exceeds that of switchgrass:

In the 2004 trials, miscanthus out-performed switchgrass by more than double and in the 2005 trials more than triple.

(Don't know if that means the amount of crop produced, or the amount of energy produced.) And the other is jatropha, a biodiesel crop which grows well in undeveloped land:

Although not suitable for temperate climates, jatropha promises to be less expensive and less competitive for land than food based oil seeds that are used as feedstock for biodiesel.

Correspondent Inference Theory

Bruce Schneier has an interesting post about correspondent inference theory (the post discusses a recent paper which applies correspondent inference theory to terrorism). Schneier describes correspondent inference theory as the following:

People tend to infer the motives -- and also the disposition -- of someone who performs an action based on the effects of his actions, and not on external or situational factors.

This is relevant to terrorism in the context of the assertion that terrorism is typically not very successful at helping terrorists attain their goals, because victims tend to assume that the terrorists' goal is to hurt them, rather than effecting some political change.

For example, many people probably believe that the 9/11 attacks were carried out because Al-Qaeda wants to destroy the Americal way of life. But the way I understand it, bin Laden's feelings toward America go back to the early 1990s, when Saudi Arabia allowed Western military forces to be stationed in Saudi Arabia, the home of Islam's two holiest cities, Mecca and Medina. The Schneier post lists four other motivations behind bin Laden's actions. Bin Laden doesn't necessarily want to kill Americans for the sake of killing Americans, but rather to change America's Middle Eastern policy. But many people (understandably) have trouble seeing further than Ground Zero, the Pentagon, and a field in Pennsylvania.

This brings me to a very interesting book I recently read: Religious Literacy by Stephen Prothero. The book details how little the typical American knows about Christianity, let alone the world's other major religions. I learned about this book when the author was interviewed on Comedy Central's The Daily Show. Prothero told an anecdote about a government official (someone influential in U.S. foreign policy) who was unable to correctly answer the question "Is Al-Qaeda a Shi'a or Sunni organization?" Prothero's book makes a pretty convincing argument that university and/or high school curriculum programs should include mandatory courses in basic religious literacy, and that understanding religion helps us to be better citizens, better able to make decisions. If you disagree with that thesis, ask yourself a few questions. Do you know what the terms Sunni and Shi'a mean? Do you know why Mecca and Medina are holy to Muslims? Can you name the world's five major religions? To what story was George W. Bush referring when he mentioned the Jericho Road in his inaugural address?

Google Earth finds new Chinese submarine

I thought this was pretty cool. If you download and install Google Earth (there's now even a version for Linux), you can see China's new Jin-class ballistic missile submarine. The coordinates are 38°49'4.40"N, 121°29'39.82"E.

PHP4 end of life

I maintain a lot of legacy PHP code on some CentOS 4 servers, and CentOS 4 comes with PHP4 (I only recently became aware of the PHP5 packages in the centosplus repository). I've long resisted trying to move to PHP5 due to (probably overblown) fears of broken code.

PHP recently announced the PHP4 end of life at the end of 2007 (with some security updates through 8 August 2008). So it looks like I've just about run out of excuses.

Makes me wonder what Red Hat will do about their RHEL3 and RHEL4 distributions.

Screw the iPhone

I'm so sick of hearing about the iPhone. For those of you who have an iPhone, congratulations. And for those of you who've had service or hardware problems, condolences. And for members of the press who can't seem to talk about anything else, you suck.

It's an expensive phone. So go call your accountant. Or get a real hobby. Or something.

Looks like someone's already pwned the damn thing, anyway (yes, that's right, pwned).

Photos from Antarctica

Some photos (not mine) from Antarctica hit digg.com yesterday. The post says it's a flash-frozen tsunami. Lame, but the pictures are very cool.

the end of sysadmin

I've been a subscriber of Sys Admin for several years. So I was surprised and disappointed to read this in the 'syslog' (letter from the editor) of the newest issue:

This is the last issue of Sys Admin magazine that you will receive. The magazine is ceasing publication as of this issue.

No warning, no fanfare, they're just done.

There's nothing else anywhere in the issue to indicate the end of the run, and I don't see anything on the Web site, either. Must have been a very abrupt decision.

Sys Admin appears to have been part of CMP media, which owns several other Web sites and publications. I wonder if they'll send me a few issues of something else to finish out my current subscription.

new 7 wonders

A new seven wonders of the world have been selected. There's a pretty good wikipedia page with pictures and links for the 21 finalists. Apparently the voting is somewhat suspect, and it seems that Egypt was pretty annoyed by the whole thing (the pyramids of Giza are the only surviving monuments from the original seven wonders, and Egyptian officials didn't think the pyrimids needed to compete again).

And here's the wikipedia page for the ('original') seven wonders of the ancient world. Looks like earthquakes are pretty rough on these things.

Cosmologically illogical

I don't get into astronomy much any more, but I thought this Ars Technica article was pretty interesting. The article talks about a paper to be published in the journal General Relativity and Gravitation. The paper claims that in 100 billion years the universe's cosmological evidence will have disappeared. The cosmic microwave background will be buried in interstellar plasma, and light from other galaxies will have been redshifted (from Hubble expansion) too much to be detectable.

Reminds me of that Simpsons episode: "Let's burn down the observatory so that this can never happen again!" (If I only had a dime for every time I've thought those very words.)

July 4 sunset

Spent July 4th with friends and took some photos of the sunset. I especially liked this one (I fiddled with the colors a bit):

GPLv3

You can't swing a dead cat over your head lately without hitting a blog post which mentions version 3 of the GNU Public License (an appropriately cynical reader would correctly point out that this would require swinging a dead cat at a fairly narrowly-focused RSS reader). I don't really know a lot about the GPL, but here are a couple of resources which look useful:

1. a post on Luis Villa's blog (some poor bastard in law school)
2. the GPL FAQ on the GNU Web site
3. a critical view of GPLv3
4. speculation about Microsoft's reaction
   

e-voting source code disclosures

Efforts by Microsoft and a few vendors of e-voting technology recently failed to amend New York state legislation in a way that would have weakened source code escrow provisions.

New York state passed legislation in 2005 requiring that e-voting software source code be placed in escrow for examination. Microsoft (whose Windows operating system is used by some e-voting products) lobbied to amend that legislation. This amendment would have exempted code not specifically designed for voting technology. I suppose this would have made it easier for Microsoft and the e-voting vendors to claim that most or all of their code is to generalized to be considered voting-specific, and would therefor be exempt from examination.

California has similar source code disclosure provisions regarding e-voting technology. One e-voting vendor (Election Systems & Software) had been holding out for months, but recently (and grudgingly) turned over their source code to the California Secretary of State.

Looks like event Presidential candidate John Edwards is getting into the act.

Restrictions on photography in NYC

The New York City Mayor's office is considering new rules which would require a person to obtain a permit and an insurance policy as a prerequisite to certain kinds of public photography in NYC.

The rule would apply to two or more people taking pictures in one location for more that 30 minutes, and also to someone using a tripod for more that ten minutes (that timeframe includes setting up and dismantling the tripod).

So what about someone taking pictures at the Macy's Thanksgiving Day Parade? That's more than a half-hour, and typically more than one person.

The Mayor's office says that this is not intended to affect tourists and amateur photographers. In fact, the article doesn't say what these rules are intended to accomplish (the article says that the rules are coming from the Mayor’s Office of Film, Theater and Broadcasting). But I imagine that city officials will try to justify this as an improvement in city security, based on stories of terrorists taking pictures of their intended targets for planning purposes.

Bruce Schneier talks about this kind of thing a lot in his blog. He calls it security theater: doing something which has the appearance of improving security but which actually doesn't accomplish anything except inconvenience the innocent (like having someone make a cursory visual inspection of your car's trunk when you enter an airport--they're paid a wage not to look through your suitcases, just to look at your suitcases).

Refuse to be terrorized.

Dallas World Acquarium

Friends and I went to Dallas recently to see The Police in concert (great show). We also checked out the Dallas World Acquarium. I took several pictures, most of which didn't come out very well. But here are a couple of pretty good ones.

This first one may be hard to understand out of context. There's a large pool with rays and a shark, and there's a plexiglass tunnel along the floor of this pool. You can walk through the tunnel and see the shark and rays (although the distortion is pretty bad). You can also (from an upper level) look down into the pool and see the tunnel. This picture is looking down into the pool while the shark is swimming over the tunnel:



And here's a penguin, because penguins are awesome:



The DWA also has a black jaguar. Beautiful animal. So if you've got a couple of hours to kill in Dallas, hit the DWA.

CentOS 5 follow-up II

I was able to build gtkpod on CentOS 5 today. Wasn't all that hard, really. Leave a comment if you'd like the SRPM. (For some context, you may want to see my previous posts on gtkpod and CentOS 5.)

And yesterday when I ran yum, I found out why there's no xpdf in CentOS 5: it's been obsoleted by a package called poppler-utils. poppler is an xpdf fork, and the poppler-utils package includes the extra utilities like pdftotext and pdfimages. Apparently evince uses the poppler libraries. And if you prefer xpdf to evince (like I do), just compile xpdf (using the --with-freetype2-includes=/usr/include/freetype2 option to 'configure') and copy it into your path.

stupid bash tricks

Saw this on digg or something last week (and a friend also sent it to me via del.icio.us):

10 Linux Shell Tricks You Don’t Already Know. Really, we swear

I usually don't find these posts very useful, but this one had a couple of nice surprises. I'd never heard of ssh-copy-id, but it sure looks a lot easier than adding pubkeys manually. And the trick of recovering from an NFS mount gone haywire might work for a Samba mount (that happened to me the other day).

Recent energy-related developments

The San Francisco Chronicle has an article about how the idiots we elected to Congress are bickering about energy standards. Sometimes I'm amazed Congress ever gets anything done at all.

In happier news, the Energy Blog has a post about a new CO2 sequestration technique developed by Global Research Technologies (GRT). CO2 sequestration is the process of putting CO2 into storage (typically underground), instead of releasing it into the atmosphere: for example, future coal-burning power plants would point their smokestacks down, rather than up (that is a gross oversimplification).

But this GRT technique is a little different: instead of grabbing CO2 as it is produced (which I suppose can only level off greenhouse gas emissions), this method would be able to pull CO2 out of thin air (which could potentially reduce atmospheric greenhouse gases).

There is mention of the GRT technique on the wikipedia page for the Virgin Earth Challenge, Richard Branson's $25 million prize for atmospheric scrubbing of greenhouse gases.

The customer is always right

A fun post found its way to the digg homepage the other day. Although it was written by a Web designer, it's a pretty accurate indictment of the sort of thing I put up with, too:

If Architects Had To Work Like Web Designers

In a similar vein, StumbleUpon (installed it a few days ago--pretty cool) gave me this little bit of wisdom:

http://www.linuxkungfu.org/images/fun/geek/project.jpg

ODF v. OOXML

ONLamp has a pretty good article about the differences between ODF and OOXML. ODF (Open Document Format) and OOXML (Office Open XML) are both XML-based file formats which can be used to store word-processing documents, spreadsheets, etc. There is fierce competition for adoption between these two formats, notably in the arena of long-term government document storage. This competition is controversial for a number of reasons, including the fact that OOXML is a Microsoft product.

A google search for 'OOXML "men in black"' turns up quite a few hits regarding allegations of Microsoft lobbyists and lawyers trying to sway state legistatures (like Florida) toward OOXML.

Microsoft Protection Rackets

There's an interesting linuxtoday.com article about some of the recent patent indemnification deals Microsoft has signed (Novell, Xandros, Linspire, and LG). Actually, it's more about the companies who've gone on record saying they'll have no part of it (Red Hat, Canonical [Ubuntu], and Mandriva).

easytag

On a recent episode (#51) of The Linux Action Show (a weekly podcast about Linux), one of the hosts (Chris) was responding to a listener question about editing ID3 tags (that's the metadata attached to media files, like MP3 and OGG files).

This is interesting to me, because I've had sort of mixed results in editing ID3 tags (I've yammered about this before). I've tried the ID3-editing feature in gtkpod, but it consistently crashes gtkpod (ick). So I've been using the command-line utilities from id3lib. That works, but it's a command-line interface, and it's typically a file-at-a-time kind of thing.

Chris suggested easytag, and it's really cool. It's a graphical interface, and it makes it easy to edit the ID3 tags of multiple media files. There are RPMs for CentOS (v4 and v5) on the extras site. Good stuff. Thanks, Chris.

Shoutout to PJ

In support of PJ, I'm including the following inaccurate statements from a TechNewsWorld article by Kimberly Hill. Perhaps this will draw a few search engine hits. If you are reading this, please read PJ's side of the story, in which she (PJ) makes it clear that she had no part in the OSRM study about patents supposedly infringed by Linux: this is in direct contradiction to comments made by Laura Didio of the Yankee Group.

Here are some of the statements PJ refutes:

Back in 2004, said DiDio, then-fledging insurance firm Open Source Risk Management commissioned a study to determine just how many patients Linux may infringe upon. At that time, the number was pinned at 280 or so, most of them owned by IBM (NYSE: IBM) Latest News about IBM, with about 30 held by Microsoft.

The now-infamous study was performed by Pamela Jones of Groklaw, and its methods and conflicts have seen much comment since then. Still, DiDio asserted, the open source community itself was the first to raise the issue of how much Linux actually overlapped, in terms of intellectual property, with proprietary software.

zap2it closing

In December I bemoaned the revolting changes to yahoo's TV listings, and I switched to zap2it. Well, the other day I read that zap2it will be discontinuing its free TV listings on 1 September.

So it was looking like I'd have to find another source of online TV listings. But I just had a pleasant surprise. It looks like yahoo actually listened to (at least some of) the negative feedback from late last year, and their online TV listings don't suck nearly as much as the last time I wrote about them. At the time, I had three major gripes about the changes to yahoo TV:

1. painfully slow incremental loading--it doesn't do that any more
2. really annoying 3-hour browsing blocks--they're back to 1-hour increments (and they fixed the problem of not being able to see listings of shows starting prior to the current block)
3. amnesia about my display preferences: I signed in, set my preferences, signed out, deleted my cookies, signed back in, and it remembered to show just my favorite channels.

So, screw you, zap2it. And yahoo, you get another chance.

xpdf

Yesterday at work I got stuck retyping a handful of PDF files. They were nothing too fancy: black text in a garden-variety font on a white background, with a logo (image) in the upper-right corner. Nothing I couldn't do in a word processor, but I didn't want to retype all that junk (I have no idea what became of the original documents--I just had the PDFs).

xpdf was a big help to me. xpdf is an open-source PDF viewer, and it comes with several command-line programs. Yesterday I was able to use two of these programs to help me recreate the documents: pdfimages extracted the logo image (in ppm format) from one of the PDFs, and pdftotext converted each PDF file to text. So I was able to use oowriter (the word processor of openoffice.org) to create the new documents, and I could just copy-and-paste from the text files generated by pdftotext. Still tedious and annoying, but better than typing from scratch (less error-prone, too).

CentOS 5 doesn't have xpdf. This experience highlighted to me how important that package is to me (I use xpdf to view PDFs all the time). So I spent some time this morning building xpdf on CentOS 5 from source, and I came up with an SRPM. I sent it to the CentOS Extras site--maybe they'll add it to their package list. If you want the spec file, leave a comment.

Tiki Bar

If you find yourself with some free time, try out Tiki Bar. Very funny, and a good excuse to drink. (They also have an RSS feed.)

Middle-click on a laptop

Lately I've been using my laptop without a mouse (actually on my lap, rather than on a table where there's room for a mouse). My laptop has a touchpad with two buttons. I've enabled Emulate3Buttons in X11 so that I can click both buttons at the same time to simulate a middle-click. This is useful to me, because I use middle-click a lot for pasting (highlighting some text is an implicit 'copy', and a middle-click pastes at the cursor location).

The problem is that I find it difficult to click both buttons at the same time. I usually end up clicking one or the other, which typically throws off the focus and undoes the 'copy' (so the stuff I want to paste is no longer in the X11 clipboard).

(Yes, this is exactly the sort of thing that drives me insane.)

The other day while I was working on a desktop computer, I ran some google searches trying to find a solution, and I found out that if you do shift-numlock and then a 5 on the number pad, that amounts to a middle-click (then you have to do shift-numlock again to resume normal use of the number pad).

(Have you seen the problem with this solution yet?)

I was eager to get home to try this on my laptop, only to feel a crushing humiliation to realize that my laptop does not in fact have a dedicated number pad. (There's a special function key which can convert about a dozen keys on the keyboard into a number pad, but the trick doesn't work on my laptop.)

But then I realized that I could use xmodmap along with the key-handling feature of my window manager. The xmodmap 'pointer' command lets you remap your mouse keys in real time (a left-handed person can use this to make his/her mouse work correctly). If I tell my window manager that control-alt-9 means xmodmap -e 'pointer = 1 3 2' and that control-alt-0 means xmodmap -e 'pointer = 1 2 3', then I can highlight some text (to copy), do control-alt-9, and do a hard-to-screw-up right-click to paste (and then control-alt-0 to resume normal right-click operation).

To do this in fluxbox, just add these two lines to ~/.fluxbox/keys:

Control Mod1 9 :ExecCommand xmodmap -e 'pointer = 1 3 2'
Control Mod1 0 :ExecCommand xmodmap -e 'pointer = 1 2 3'

Xnest

This is basically a distillation of a recent Linux Magazine article ("Using Xnest" by Roderick W. Smith, p. 46 of the March 2007 issue, available at http://www.linux-mag.com/id/3431/ with free registration).

Let's say you're running gnome in Linux. You've installed some other window manager (like XFCE or fluxbox), and you want to try it but don't want to close all your applications and log out (to log in to the other window manager). You can run the other window manager in Xnest. Xnest is like running another X11 instance inside an application window. Try running the following (for fluxbox):

Xnest -ac :1 &
DISPLAY=:1 fluxbox &

This should run fluxbox in a new window. You get all the features of a window manager (wallpaper, multiple desktops, etc.) inside an application window.

I've yet to come up with a particularly compelling use for this. It's mostly (to me) just a stupid human trick. But it may intrigue some of your more easily-impressed friends.

Wireless transfer of electricity

The Energy Blog has an interesting post about transferring power without cables. This technology (being developed by MIT researchers) works sort of like magnetic induction, in which two physically-separated coils transfer power using magnetic fields. But the technique described in the Energy Blog post uses resonant coupling, which works over greater distances with little or no interaction with the surroundings (furniture, people, etc.). So someday this might allow us to run our laptops and cell phones without power cables or batteries.

rtl8180 chipset

If you happen to have a wireless card based on the RealTek rtl8180 chipset and want to use it in Linux without using ndiswrapper (there are probably about 4 people on Earth like this), you may find this interesting/useful.

I have a Linksys WPC11v4 PCMCIA wireless card. There's an open-source driver for it at http://sourceforge.net/projects/rtl8180-sa2400, and the driver lets you run it in monitor mode. Monitor mode is what lets you run wireless network detectors like kismet. (ndiswrapper, which lets you run wireless cards in Linux using Windows drivers, doesn't support monitor mode, even for cards which which do). The released versions doesn't work for me (in CentOS 5), but the CVS version does. You can get the CVS code by running the following:

cvs -d:pserver:anonymous@rtl8180-sa2400.cvs.sourceforge.net:/cvsroot/rtl8180-sa2400 login
cvs -z3 -d:pserver:anonymous@rtl8180-sa2400.cvs.sourceforge.net:/cvsroot/rtl8180-sa2400 co -P rtl8180-sa2400-dev

Then you'll need to edit a couple of files. In
rtl8180-sa2400-dev/r8180_core.c, comment out the lines beginning with MODULE_PARM and MODULE_PARM_DESC (there are four of each, found on lines 137-147 of the file). And in rtl8180-sa2400-dev/Makefile, remove the text MODVERDIR=$(PWD) from line 62. (I have a patch file with both of those edits--leave a comment if you'd like me to send a copy).

Then just run 'make', and then you can run the following commands to insert the kernel modules (the order is important):

/sbin/insmod ieee80211_crypt-r8180.ko
/sbin/insmod ieee80211_crypt_wep-r8180.ko
/sbin/insmod ieee80211-r8180.ko
/sbin/insmod r8180.ko

CentOS 5 follow-up

I've had a week to play more with CentOS 5 on my laptop, and I've overcome a few of the shortcomings that were bothering me last time. It eventually occurred to me that I could use gnome-panel and its pager. That worked out pretty well, but actually I find that I like fbpanel even better. fbpanel is a lot like gnome-panel, but is a little more configurable. And the pager shows scaled-down versions of my wallpaper--not a big deal, but cool.

I was able to build grisbi from source, but I couldn't get OFX support to work. The libofx/openjade/opensp dependency hell was too annoying, so I just turned off that feature. OFX is a file format for financial records. Some financial institutions might be able to deliver your financial records in OFX format, and then you could import them into grisbi (if OFX support is built in). So my build might not be very useful for some people. It's not a feature that I've ever used, so I don't really miss it. I'm just glad to have grisbi working in CentOS 5. Leave a comment if you'd like the spec file.

CentOS 5

I finally got around to trying out CentOS 5 yesterday (if you're not familiar with CentOS, it's a Linux distribution which is generally binary-compatible with Red Hat Enterprise Linux [RHEL]). Here are a few of my first impressions.

I installed CentOS 5 on my laptop. The laptop is about two years old, and it was nothing really special to begin with (1.67 GHz Athlon Mobile, 1 GB of RAM, video hardware which is probably way too lame for beryl/compiz).

The installation is different, in that you can no longer select 'full installation' or 'minimal installation' in the package selection screen. I really liked those features, and I'm sorry to see them go. Packages are now arranged in groups and subgroups, and you can select which groups/subgroups will be installed (but you can't select individual packages--at least, I didn't see how to). One of the subgroups probably more-or-less corresponds to the minimal install ('base system' or something, I think), and I suppose you can select all the subgroups for a full install. But it was nice having those as selection items in CentOS 4.

One of the big new features of RHEL/CentOS 5 is virtualization (they are using xen). I thought I'd try it out, so I selected the virtualization group in the installation process. This installs a xen-enabled kernel, and it's the default kernel (in fact, it didn't install any non-xen kernels). My laptop is rather noisy anyway, but the CPU fan typically ran two levels higher (faster, louder) than usual with the xen kernel, even when the laptop was idle. That was too noisy, so I installed a non-xen kernel package, and the CPU fan is now running at its normal less-noisy rate. So make sure that your computer has good cooling if you try xen.

There are lots of packages missing. This isn't an issue with a non-full installation: the packages just don't seem to be available at all. Not even in the CentOS extras or in DAG's RPMs. Here are a few examples:

1. no xpdf and no gpdf (well, DAG has gpdf, but there's no EL5 build), just evince
2. no xscreensaver (!): there's xlock, which isn't as cool, and DAG has an SRPM for xautolock (I had to remove the BuildRequires from the specfile), but I miss xscreensaver
3. there's no EL5 build for audacity
4. no grisbi (ouch)
   

And I had some trouble building some stuff I like. I use fluxbox, but I can't seem to build fluxter or fbpager, so I'm stuck with no decent pager program.

wpa_supplicant was installed as part of my package selection, but I couldn't make it work. I had to compile a newer version from source.

On the brigher side, it's got more current (than CentOS 4) versions of several packages: OpenOffice 2.0, PHP 5.1, MySQL 5.0, Apache 2.2 (which has mod_proxy_balancer: there was an interesting HowToForge article about mod_proxy_balancer recently).

But all in all, I'm disappointed in losing some of my favorite packages. Guess I need to quit whining and try to contribute specfiles.

Theater e-Ushers

Saw this today and was mildly intrigued:

High-Tech Tattle-Tale Device Hits NYC Theaters

It's an article about how some NYC Regal cinemas are giving certain patrons the ability to page the management. So if you're one of these patrons and there's something wrong with the movie (sound, focus, etc.), you can page the management to send someone to the projection booth.

This can also be used to rat on unruly patrons, and this is the part that interests me. This is why I rarely go see a film in the theater anymore. It's not because theater admission prices are too high (they are), and it's not because Hollywood churns out utter crap in two-hour installments (it does). It's because I invariably end up sitting in front of some rotten bastard who thinks he's sitting in his living room, who can't keep his feet off my chair and can't keep his big mouth shut.

They just need to take this notion a bit further. If I'm watching a film and the guy behind me is talking back to the movie and kicking my seat, I want to push a button which does one of the following:

• injects a harmless but potent tranquilizer into the noisy patron
• closes a high-voltage electrical circuit connected to the noisy patron's chair
• opens a trapdoor which sends the noisy patron down a metal slide and into a StarWars-like garbage masher, complete with a dianoga

The third option could be further enhanced if the movie could be briefly suspended while live footage from the garbage masher was projected on the movie screen. This would be especially effective in an IMAX theater.

Firewalling NFS, testing SMTP

Yesterday I found a useful Web page explaining how to use Linux iptables to firewall an NFS server. Firewalling NFS is complicated, because NFS picks random listener ports when it starts up. But by following the instructions on this page, you can edit a few files to tell NFS which ports to use:

http://www.lowth.com/LinWiz/nfs_help.html

If you are using Red Hat (or something similar, like CentOS), you only have to edit /etc/modprobe.conf, /etc/sysconfig/nfs, and /etc/services. The only thing I'd add to this tutorial is that you can just put something like 'STATD_PORT=4000' in /etc/sysconfig/nfs, rather than hardcoding the rpc.statd port number in the nfslock startup file. Then you can use iptables to control access to the following ports (tcp and udp for each port): 111, 2049, 4000, 4001, 4002, and 4003. I actually had to reboot to get nfslock to start up on port 4001. Oh, well.

Another useful Web page shows how to run an SMTP session using telnet (you could also use netcat):

http://www.yuki-onna.co.uk/email/smtp.html

One useful application of this technique is testing the access rules of an SMTP server (for example, making sure you're not inadvertently relaying for certain hosts).

20070521 thunderstorm

Took a few pictures during a thunderstorm the other night, and here are a couple of my favorites:

More photos (cool clouds)

I took some pictures the other day. It was a day with my favorite kind of weather: it was cloudy and cool, but not rainy. There were some horses in a nearby field, some wildflowers, and some pretty cool-looking clouds. The local topology really worked for me--very flat horizons made the photo contrast image-editing technique very effective.

Here are a few of my favorites.

Storm clouds

Have had some thunderstorms in the last few days. A few nights ago, I heard thunder, and was surprised to see clear skies when I looked out the window. When I stepped outside for another look, I found that the storm was sneaking up over my roof. Took a couple of pictures, which don't quite do it justice.

grip, gtkpod, id3lib, grisbi

This is a post about some useful GNU/Linux programs I've recently discovered. I use CentOS, and RPMs for these packages are available from karan and/or DAG.

I bought a Sandisk Sansa MP3 player in late 2005. I don't know how I got through the workday before I did that. I've bought two more since then (a larger storage capacity each time). Sansas basically work like external USB hard drives, making them Linux-friendly: you can just drag-and-drop MP3 files onto them. The Sansa's firmware then reads the files' ID3 tags to display a list of available music (ID3 tags are bits of data in an MP3 file which give the artist name, album name, track title, etc.).

Sansas are not compatible with iTunes, and I haven't tried any of the other online music services--I just rip my own CDs to MP3 files. I use grip to rip the CDs. grip is basically a nice, feature-rich graphical interface to cdparanoia and LAME. It'll connect to a CDDB site (like freedb.org) to download album and artist names and track titles, rip the CD tracks to WAV files, then encode the WAV files as MP3s.

Although I can then just plug in my Sansa and start moving files around, it's nicer to have something to keep my music more organized. I use gtkpod for this. I keep all my music files on my PC, and then periodically change what I've got on the Sansa (the Sansa is 4GB, not large enough to hold my entire library). gtkpod is a nice program for displaying what's on my PC, what's on my Sansa, and changing out files on the MP3 player.

Although grip is pretty good about setting the ID3 tags on the MP3 files, it's not foolproof. The ID3 tags will occasionally have errors or be missing altogether. gtkpod has a feature for changing ID3 tags, but I haven't had much luck with this--it sometimes even causes gtkpod to crash. So I usually just use the command-line utilities in the id3lib package. id3info lists a file's ID3 tags, and id3tag and id3cp can be used to change them.

The last software package I want to mention has nothing to do with music. It's called grisbi, and it's a pretty good personal finance program. Although I've never tried Quicken or Microsoft Money, grisbi is probably pretty comparable. I use it to track my checking account. grisbi lets me define a list of transaction categories, and I can tag a transaction when I enter it. grisbi keeps up with my account balance and has features for bank statement reconciliation. It can also run reports, handle scheduled transactions (for things like automated drafts and deposits), and track multiple accounts. I've found it to be a convenient way of balancing my checkbook (much less error-prone than scribbling in the check register).

e-Voting Update, DST Lameness

This is mostly an update to last week's e-voting rant. The Diebold suit against Massachusetts is still in litigation, but it was dealt three significant setbacks this week:

1. execution of Massachusetts' contract with Diebold's competitor will not be blocked
2. Diebold will not be granted an accelerated discovery process
3. and Massachusetts will be able to view Diebold internal documents

An enlightened judge. How refreshing.

Also, HR 811 is making its way through US Congress. HR 811 is an e-voting reform bill which, among other things, requires a paper trail to be an integral part of any e-voting solution. It also forbids e-voting machines to have wired or wireless Internet connections, and it requires that e-voting software source code be made publicly available. Signs of enlightenment in Congress--also refreshing.

And, to no one's surprise, it looks like the change in Daylight Savings Time accomplished very little other than to annoy computer system administrators. Like me. So much for Congressional enlightenment.

Alternative Energy Sources

In the past few weeks, I've started reading about the environment and alternative energy sources. I'm starting to see that this is a very complicated issue with potentially far-reaching consequences.

An article came out yesterday which gives a very interesting summary of the current state biofuel production. It's a pretty long article, but I would recommend it to anyone who is interested. It paints a rather grim picture.

According to the article, a significant portion of US government funding into alternative energy is directed at the production of ethanol from corn. Although I'm pleased to see the US government taking an interest in alternative energy, corn-based ethanol is arguably not the best solution. There's probably not enough cropland on Earth to grow enough corn to rival the energy produced by burning fossil fuels. More importantly, using so much corn to generate ethanol takes away (and drives up the price of) an important source of food: this may begin to deprive many people in poor nations of a staple of their diet. I was especially appalled to read this in the article: "...filling the 25-gallon tank of an SUV
with pure ethanol requires over 450 pounds of corn -- which contains enough calories to feed one person for a year."

There is also evidence that using corn-based ethanol has only a small benefit over fossil fuels in the creation of greenhouse gases: "The full cycle of the production and use of corn-based ethanol releases less greenhouse gases than does that of gasoline, but only by 12 to 26 percent."

But the US government seems somewhat fixated on corn-based ethanol, due in part to the lobbying efforts of companies like the Archer Daniels Midland Company (adm). I don't like criticizing adm, because they're a big supporter of public television. But they make a lot of money turning corn into ethanol, and they carry a lot of clout in Washington.

The environment has gotten a lot of press lately, and I'm glad that awareness of these issues is increasing. But I'm starting to think that it's just not happening fast enough. I think we should all try to find ways to conserve resources and to help our governments find ways to better prepare for the future. I think the US and Chinese governments should start pouring money into researching and developing solar power, wind energy, and cellulosic biofuels (which is made from wood chips, trash, and other stuff no one wants).

This has turned into more of a rant than I intended, so I'll end with the addresses of a few interesting Web sites I've recently discovered (they all have RSS feeds):

• Ecoworld
• Grist
• The Energy Blog
  

Hopeless RSS Addiction

I have become hopelessly addicted to RSS.

RSS (really simple syndication) is a special data format (called XML) used to provide an alternate way of reading Web site content. Most blogs have RSS feeds, and the blog you're reading now is no exception:

http://mbrisby.blogspot.com/feeds/posts/default

RSS feeds aren't really readable on their own, but they're very powerful if used in an RSS reader. You 'subscribe' to a Web site's feed in your RSS reader, and whenever new content appears on that Web site, it shows up in your RSS reader. The advantage of this is that if you follow a large number of sites with feeds, you can see the updated content of all of them in your RSS reader, rather than having to visit all the sites individually: it's one-stop shopping for all your Web-reading needs.

This is a huge help to me, as I need to monitor lots of Web sites which post information about software updates. Without RSS I'd need to spend a significant portion of each day checking all those Web sites individually for updates. But if I subscribe to their feeds, the announcements just show up in my RSS reader.

This is also useful for keeping track of news Web sites (most of which have RSS feeds).

There are lots of different RSS readers, but they all work more-or-less the same way. You subscribe to a list of feeds in the reader, and the reader periodically checks each feed for new content. When a new item shows up in a feed, the reader displays the new item. If it's a new item on a news Web site, for example, you'll typically see the story's title and an excerpt from the story. The title is likely a link, and clicking the title takes you to the full version of that story on the original Web site. Once you're done looking at the new item, you tell the reader to discard it, and the reader doesn't show you that item any more (just new items). However, many readers allow you to somehow save interesting items, so that you can look at them later.

I've tried several RSS readers over the last year or two. First I tried the Sage Firefox extension. It's pretty cool, but because it's part of your browser configuration, it's only effective on your computer. If you're at a friend's house, even if your friend has Firefox with the Sage extension installed on her computer, her Firefox won't know about your feeds. And even if you subscribe to your feeds on your friend's computer (which may or may not thrill your friend), her computer will display a bunch of items which you've already seen (because her computer doesn't know which ones you've previously read).

The RSS reader in Thunderbird is OK, but it has the same set of problems as Sage: it's configuration and history are stored locally on your computer. So Sage and Thunderbird are fine, as long as you only read RSS feeds on one computer.

In an effort to learn more about RSS (and AJAX), I even wrote my own Web-based RSS reader (I wrote it in Perl w/ CGI::Application, and I used script.aculo.us for the AJAX), and I used that for several months. It ran on my home computer, to which I have a VPN connection from work. So I was able to read my feeds from work or home. While that was a big improvement, it didn't work if I was somewhere other than home or work.

So I recently started using Google Reader, and I think it's a great solution. It's full-featured, in that it lets you categorize your feeds and save items for later (you can 'star' an item), and it's accessible from any computer with an Internet connection. You just point a browser (Firefox, MSIE, whatever) at http://www.google.com/reader/view/, log in, and start reading.

If you need or want to keep track of a large number of Web sites (as long as they have RSS feeds, which unfortunately not all do), I highly recommend using Google Reader. As of this writing, I am using it to keep tabs on 58 Web sites.

Trees

Took some pictures at work the other day. Trees are in bloom, and the colors were pretty impressive. My favorite picture in the set has purple-, brown-, and green-leaf trees in front of a deep blue sky:

1 April Mayhem

I really hate April Fool's day. Until I remembered the date, I briefly believed a Slastdot post asserting that Mozilla is suing Microsoft for $1.4 billion over tabbed browsing, and I honestly can't decide whether or not to believe a post on The Energy Blog about cars that run on air.

*sigh* It'll be like this all day. Christmas for geeks.

Recent e-Voting Developments

There were a couple of interesting e-voting-related items in the news this week.

The state of Massachusetts decided to purchase a large number of e-voting machines, and they solicited bids in order to select a vendor. They ended up choosing AutoMARK, a competitor of Diebold. Diebold, annoyed at losing a $9 million contract, is suing the state of Massachusetts. The term 'sore losers 'comes to mind.

The state of California is looking at imposing a very strict set of requirements for e-voting machines. These requirements are in fact so strict that no e-voting vendor may be able to meet them in time for the presidential primary in February 2008 (which is about four months earlier than in previous elections), which might mean that the election will be conducted with paper ballots.

The articles state that both decisions (Massachusetts' AutoMARK selection and California's interest in tougher standards) were motivated at least in part by legislation requiring voting facilities for voters with certain types of disabilities.

In a somewhat related story, the New York Review of Books published an article which contains some interesting speculation about the outcome of the 2000 presidential election had Florida prisoners been allowed to vote. This is a fairly long article, but it's one of the most thought-provoking things I've read in a while.

Batman on Film

Last night I rented Batman Forever (1995, 'BF' hereafter, w/ Val Kilmer as Batman) and Batman & Robin (1997, 'BnR' hereafter, w/ George Clooney as Batman). I don't think I'd seen either (not in their entirety) since each came out. I vaguely remembered that neither was a particularly good film.

Turns out that my memory was quite accurate, if somewhat understated. Ewwww.

However, each had a couple of nice surprises that I didn't remember. BF has a pair of pretty good songs by U2 and Seal, although you have to slog through to the end credits to hear them. And Drew Barrymore and Debi Mazar make for pretty sexy window dressing as Sugar and Spice in BF. BnR has fun (albeit brief) performances by Vivica A. Fox and John Glover (he's Lionel Luthor in "Smallville"). And Uma Thurman is a very provacative Poison Ivy.

Otherwise, they're both pretty grim, and they don't hold a candle to Batman Begins (2006, w/ Christian Bale as Batman). I'm really looking forward to The Dark Knight (supposedly 2008, w/ Bale again).

Recent Reading

I've recently finished reading a couple of pretty good books. I just (a few minutes ago) finished The KILL BILL Diary: The Making of a Tarantino Classic as Seen Through the Eyes of a Screen Legend by David Carradine. Carradine turns out to be a pretty good writer. If you enjoyed the movies, you'll like this book. It has some interesting observations into the making of the films (which were evidently originally intended to be released as a single film).

And a few days ago I finished Weapons of Choice by John Birmingham. The premise is that a multinational naval armada from 2021 is zapped back in time to June 1942. This disrupts the battle of Midway, and the multinational fleet's presence begins to alter history. This is the first part of a trilogy. I liked it so much that I bought the other two books even before I finished reading the first (which ends with a pretty cool cliffhanger).

More on passports and e-voting

A recent article from The Register describes some passport-cloning research (these are UK passports). These people were able to read and clone the RFID data while the passport was being mailed to the owner, before he/she even had the chance to take possession of it.

And it looks like Diebold is thinking of getting out of the e-voting business. I guess they think that all the bad press about security problems in their electronic voting machines has damaged their image. So rather than trying to improve the technology, they'd rather just dump the whole thing. So scads of expensive e-voting machines would remain in service (because municipalities blew their budgets buying them in the first place, and may not be able to replace them for a while), with a big question mark over the prospect of future support and updates. Classy.

Tiny RFID tags

The BBC has an article about recent innovations in the miniaturization of RFID technology. The image at the top of the article is particularly astounding: these RFID chips are smaller than the width of a human hair. The very image suggests the possibilty of putting RFID tags in someone's hair gel and using the tags to track that person. That statement no doubt sounds paranoid, and maybe it is. But the fact that these things are getting so small means that surreptitiously distributing these devices is getting easier.

better-than-wholesale e-voting machines

Wired has an article describing a method one computer science researcher is using to acquire e-voting machines for security analysis: he bought them cheap off eBay. No background check, no non-disclosure agreement, nothing. And by cheap I mean he paid $82 for $25,000 worth of Sequoia e-voting equipment (that's a 99.672% markdown).

Although the Wired article claims that the research finds these machines to be more secure than products from competing companies, the researcher's Web page about his evaluation paints a dimmer picture.

Media collection software

linux.com has had articles about a couple of media collection programs called gcstar and data crow. They're similar in concept: both are databases for your CDs, DVDs, books and such. Each allows you to enter your collections with searches of amazon.com, imdb.com, etc. So if you have a copy of X2 on DVD, you can type 'X2' in the search field and it'll retrieve the cast list, cover art, plot summary, and other stuff.

gcstar is built on Perl and gtk2, and data crow is built on Java. So both are more-or-less cross-platform (they run on Linux, Windows, and probably OS X).

Both also allow the user to add loaning information to records. If you loan your copy of X2 to someone, you can make a notation of that as part of the X2 record. And both let you import and export your data (gcstar seems more flexible in this regard, in that it supports a fairly wide variety of formats).

I've tried both, and I'm finding gcstar to be more reliable. data crow is pretty crashy, and I gave up on it.

Some drawbacks to gcstar are that you can only select one item from the results of a search. If you have several Star Trek DVDs and you run a search for 'star trek', you can only select one of the search results to add it to your collection (you have to run a separate search for each Star Trek DVD you own). It would be nice if you could do Ctrl-click to pick Wrath of Khan and The Undiscovered Country if they both show up in the search results (data crow actually lets you do this).

And gcstar also has gtk tooltips which pop up when you mouse over the items in your search results. These tooltips sometimes make it hard to click on the search result that you want.

And it seems that the current version of gcstar (v1.1.1) is less than completely compatible with the version of the Gtk2 Perl module currently available in CPAN (v1.142, 21 January 2007). To make it work, you have to comment out the set_row_separator_func() and set_focus_on_click() calls in a couple of gcstar modules. Lame.

I actually prefer the data crow interface, but it kept hitting out-of-memory errors. I had to restart the application pretty frequently. That was beyond annoying. So for now I'm using gcstar.

RFID passport

My new passport arrived in the mail today, and it's got an RFID tag in it.

Crap.

(Here's my previous whining about passports.)

Huge hole in the water

This is one of the coolest things I've seen in a while. You know that hole near the top of your bathroom sink which keeps it from overflowing? They put those in some reservoirs. I would love to see one of these in person.

ssh security features

ssh offers ssh keys as a nice alternative to password authentication, and putty is a pretty cool ssh client for Windows. There's a good tutorial on howtoforge which discusses many of the features of the putty suite including key generation (puttygen) and putty's ssh-agent (pagent).

And as the above article mentions, the PasswordAuthentication option in sshd_config can be cleared to force the use of ssh keys (password authentication will be disabled).

AllowUsers is another good sshd_config option. It can be used to provide a list of users who can connect via ssh. Any user not in this list can't connect by ssh. It's good for defeating ssh scans which try a few passwords against common account names (like root, guest, etc.). Another trick that might help dodge ssh scans is to run ssh on a port other than 22. The ListenAddress sshd_config option can be used to run ssh on some other (non-standard) port.

A nice trick for your ~/.ssh/authorized_keys file is to specify source hosts from which you can connect using certain keys. If you have the following in your authorized_keys file, then the key in question can only be used for connections from the hosts listed in the from list:

from="this_host,that_host" ssh-dss ...key data... USER@HOST

(This is discussed in the 'AUTHORIZED_KEYS FILE FORMAT' section of the sshd man page.)

Finally, the denyhosts project claims to be able to do dynamic edit to the tcpwrappers files (/etc/hosts.deny) when dictionary attacks are detected. It would probably be really useful for a server with lots of ssh users that need to log in from anywhere/everywhere.

Checksum verification of large downloads

When you download software, the vendor often provides a checksum or a digital signature. If you download the software and then compute the checksum (or verify the signature), you're reading through the download twice. If the download is large (like a Linux kernel source archive or an ISO image), it can take a long time. Here's a way to do both at once.

If the vendor provides an MD5 checksum, try this:

wget -O - http://www.example.com/large_file.tar.bz2 |\
    tee huge.tar.bz2 | md5sum

The -O - option tells wget to write the download to standard output, rather than to a file. Piping that to tee writes the download to a local file (huge.tar.bz2) and to standard output, and this is piped to md5sum: the checksum is printed to the screen.

You can do the same trick for an SHA-1 checksum (or any other digest supported by openssl):

wget -O - http://www.example.com/large_file.tar.bz2 |\
    tee huge.tar.bz2 | openssl dgst -sha1

If the vendor provides a detached signature, you can do a similar trick. As an example, let's use the bzip'ed 2.6.0 patch file for the Linux kernel and the corresponding signature file. First grab the signature file, then the patch file:

wget http://www.kernel.org/pub/linux/kernel/v2.6/patch-2.6.0.bz2.sign

wget -O - http://www.kernel.org/pub/linux/kernel/v2.6/patch-2.6.0.bz2 |\
    tee patch-2.6.0.bz2 |\
    gpg --keyserver pgp.mit.edu \
      --keyserver-options auto-key-retrieve \
      --verify patch-2.6.0.bz2.sign -

In this case, you're piping the download into gpg, telling it to verify the data coming in on standard input (the '-' at the end) against the detached signature file. The --keyserver and --keyserver-options items tell gpg to fetch and import the key if necessary (this example uses pgp.mit.edu as the keyserver, but there are lots: type 'keyserver' into a search engine).

Norah Jones' new album

If you get a chance, go pick up a copy of Not Too Late by Norah Jones. As much as I like her first two studio albums, I think I like this one even more.

destroying democracy the easy way

A recent slashdot post caught my eye. It involves two of my favorite topics: e-voting and lockpicking. According to the slashdot article, Diebold (a company which makes e-voting machines) recently posted, on their own freaking Web site, high-quality images of the key which can be used to unlock the access panels on their e-voting machines. The images were apparently good enough that it was possible for someone to make a quick trip to Home Depot, buy a metal file and a few blanks of the right kind of key, file the keys to the correct shape, and start unlocking Diebold machines.

Word to the wise: next time you feel like photographing your keys (and let's face it, who doesn't love photographing their keys?), put the pictures in a scrapbook on your bookshelf, not the Internet.

flickr: more 'screw the users!' from yahoo

Yesterday photo-sharing Web site Flickr (owned by yahoo) announced some changes which have angered lots of their users. Each flickr user will have to start signing in with his/her yahoo account username/password (lots of users currently log in with a flickr username/password, so they'll have to change), and there are some new limits being imposed on flickr data (there will soon be a limit of 3000 contacts and a limit of 75 tags per image).

I only recenty started using flickr, and have used my yahoo account for all of that time. And the new limits don't affect me. So this isn't too big a deal for me personally. But it's another example of arbitrary changes imposed with little or no warning or user involvment, much like the recent utter ruination of yahoo TV. Not everything they do is horrible: I like the new yahoo mail (beta). But if they keep alienating their users, they may find that their shiny new upgrades aren't that good for business.

Image inputs in MSIE7 -- revisited

My previous post was a whinefest about image inputs in MSIE 7. This problem turns out to be worse than I thought. In that post, I said that the problem could be circumvented by taking either of two measures, one of which was changing to a submit-type input element. Today I found out that this solution is inadequate, because the name/value pair are still not sent in the POST data if you hit return rather than clicking the submit button.

<* input type="submit" name="ick" value="gakkk" />

If you actually click the submit button in a form (in MSIE 7) containing the above code, then the ick/gakkk pair will be included in the POST data. But if you just hit the return key in the form (which is how I typically submit forms), the ick/gakkk pair won't be sent.

So, I'll have to stick with the other corrective measure and put the ick/gakkk pair in a hidden input, replacing the above HTML with this:

<* input type="hidden" name="ick" value="gakkk" />
<* input type="submit" value="MSIE 7 blows" />

Crap.

Image inputs in MSIE7

I saw a post in the last couple of days saying that <* input type="image"> doesn't work in MSIE7. I've recently been working on a project which happens to have one of these elements. I tested it in MSIE7 today, and sure enough, it doesn't work. But it's broken in a very subtle way.

The element in my project looks like this...

<* input type="image" name="ick" value="gakkk" src="button.jpg" />

...and the interface to which this form POSTs looks for the ick field. Looks to me like MSIE7 just doesn't send any name/value data in one of these elements when the form is submitted. All the other form fields make it into the POST data, just not the ick/gakkk pair.

Either of the following seemed to make it work as expected:

1. turning the input element into a normal type="submit"
2. moving the ick/gakkk name/value pair into a hidden input element in the form

I don't know if this is a bug in MSIE7 or if it is intentional behavior. The W3C HTML4.01 recommendation for the input element lists the name and value attributes, with no obvious (to me) exception for image-type input elements.

*sigh* Just one more stupid thing I have to remember when designing Web applications.

Ice storm aftermath

Pictures taken after an ice storm in Versoix, Switzerland. The icicles on the trees are pretty amazing.

This was posted on digg.com, where several of the commentors said that since the ice blew in off Lake Geneva, it's not really an ice storm. Whatever. It's a lot of ice.

Brrrrr.

superhero/supervillain quiz

There's a pretty cool quiz at http://www.thesuperheroquiz.com/ which tells you which superhero you most resemble. I turned out to be the Hulk (70% likeness). This puzzled me until I remembered answering "all the way YES" to "do you anger quickly/easily?".

After you take that quiz, there's a link to find out which supervillain you most resemble. Looks like I have an 86% correspondence to Dr. Doom: "Blessed with smarts and power but burdened by vanity." (That latter part might sting if it were less accurate.)

gmail backup

Today there was a report of some data loss for 60 gmail users. They lost all their mail, their address books, etc. Lame.

This prompted me to look into methods of backing up my gmail account. Looks like it's a simple as changing a gmail setting (enabling POP3) and setting up a POP3 account in your favorite mailer (Thunderbird, Outlook, ...). It's a straightforward procedure. It takes a while to download all your mail the first time, and thereafter it just downloads new messages. It probably wouldn't allow a user to restore a mangled gmail account, but it would at least provide an external backup of all the messages. Unfortunately, it doesn't look like this process preserves message labels.

And it looks like you can export your address book, too: click 'contacts' (left-hand panel) and then click 'export' in the upper-right.

vmmouse for Linux VMWare guest

I decided to give Ubuntu a try to see what all the fuss is about. But I wasn't ready to install it on my laptop (I'm in the middle of a project in which I rely quite a bit on the laptop), so I decided to try Ubuntu in VMWare server on my desktop. Ubuntu installed OK, but the mouse didn't work well: I had to click in the VMWare window to make the mouse work in Ubuntu, and then I had to press Ctrl-Alt for VMWare to release the mouse (to use it anywhere outside the VMWare window). It was doing this even after I installed VMWare-tools.

That's a real drag, all the more so since that doesn't happen when running Windows XP in VMWare (the mouse 'just works': you can just roll the cursor in and out of the VMWare window and it works as it should).

The trick is to install the 'vmmouse' driver (which comes with VMWare-tools) in X.org in the Linux guest. (This solution comes mostly from a post by 'zaroff' on the Ubuntu Forums.)

After installing Linux in VMWare server, click VM->Install VMWare Tools... on the VMWare menu. This makes Linux think you've just mounted a CD with a couple of files on it (the 'CD' will probably show up on the desktop). Unpack the .tar.gz file, cd into the vmware-tools-distrib directory, and run the vmware-install.pl installer.

When I did this, I found that when the installer re-wrote /etc/X11/xorg.conf, it didn't put in a DefaultDepth directive in the "Screen" section, and I had to add a DefaultDepth 24 line to that section.

Next you need to install the vmmouse driver. A good start is to run the following inside the vmware-tools-distrib directory:

find . -type f -name 'vmmouse*'

You need to copy the correct vmmouse driver (depending on what version of X.org your Linux guest is running) into the X.org input modules directory. For an Ubuntu 6.10 Linux guest, I needed to copy the XOrg/7.0/vmmouse_drv.so to /usr/lib/xorg/modules/input. (A friend was having the same trouble running a CentOS 4.4 guest: he needed to copy XOrg/6.8.x/vmmouse_drv.o to /usr/X11R6/lib/modules/input/.)

Next you need to make 2 changes to /etc/X11/xorg.conf:

1. add Load "vmmouse" to the "Module" section
2. change Driver "mouse" to Driver "vmmouse" in the "InputDevice" section

Then restart X (or reboot).

Fedora Legacy Project Closing

I maintain several front-line servers (exposed to the Internet) which have run Fedora Core 3 (FC3) for a couple of years, and I have relied on the Fedora Legacy Project to provide security updates for those servers. The Fedora Legacy Project is a community project providing security updates to versions of Fedora and Red Hat which are no longer supported by Red Hat.

The project has gone above and beyond, and I'm grateful for their efforts.

Last Tuesday (12 December 2006) they quietly announced that they will no longer be providing updates for FC3, FC4, or any other damn thing. I say 'quietly', because I didn't hear about for nearly a week. I don't think it made digg, Slashdot, or any of the other technology-related Web sites that actually have RSS feeds. I'm not upset that they ended support--I'm happy that I was able to run that Linux distribution (especially one as volatile as Fedora) for as long as I did. But for the support to dry up with no warning (at least, I didn't see it coming), and for me to get that news less than a week before the holiday break at my work, really sucks out loud. Now I have to bust my hump to install a operating system with some measure of support on all those servers before Friday.

Thanks for all the advance notice! Happy freakin' holidays!!!!!

Downloading YouTube ...

Saw this yesterday and thought it was cool. The All-In-One Video Bookmarklet lets you download videos from YouTube, Google Video, and a number of other Web sites. You save the bookmarklet (go to the above link, and then on that page right-click on the All-In-One Video Bookmarklet link and pick the bookmarking option), go to the Web page of a YouTube/Google/whatever video you want to save, and then hit the bookmark. You'll get a page which allows you to download the movie in one or more formats.

If you want to try this out, here's a link to a short and funny video about a cat with depth perception problems (remember that you'll have to go save the bookmarklet first). That video makes me laugh out loud every single time (I think it's the sound that really does it for me).

ePassports

For months I've been reading about these new passports. And for months I've been meaning to go get a passport, in hopes of getting the old kind. I'm probably already too late.

The new passports have RFID chips in them. RFID stands for radio frequency identifier. An RFID chip is a small device which transmits short-range signals which uniquely identify the transmitter. This sort of thing has been used for years for stuff like electronic toll collection systems. You have an RFID transmitter in your car so that you can roll through the toll booth without stopping to pay. The toll booth electronically records your passage, and you get billed later.

Unfortunately, RFID raises all kinds of security and privacy concerns. RFID tags are useful, because they can be read so easily. No physical connection (like swiping a credit card or ID badge) is required: proximity is sufficient for an information exchange. But this means the information can be collected by someone other than the intended recipient. It's been shown over and over again that information stored in RFID tags can be read surrepticiously with inexpensive, off-the-shelf equipment. A recent example involves RFID chips in sneakers.

And now they're putting these things in passports, and the same kinds of remote information retrieval have been demonstrated. Government agencies implementing these technologies say that it's safe. But what else are they going to say? They've invested a lot of money in these systems, so they're not necessarily objective or fothcoming.

One of the things in my job that really annoys me is the "Ooooh, shiny!" mentality: people see something new, and they want it just because they thing it's cool, not necessarily because it's a good idea. This is the feeling I get about RFID in passports. I think people are jumping on a bandwagon without taking the time and effort to do reasonable risk analysis.

A number of interesting RFID countermeasures have surfaced:

• an RFID personal firewall, which aims to restrict RFID communications within a certain distance
• special wallets which block RFID transmissions (it's a Faraday cage in your pocket)
• some people even recommend throwing your new passport in the microwave for a few minutes to fry the chip

Bruce Schneier has a good write-up about the new passports.

Maritime movies: eating and crashing

A couple of interesting posts made it to digg.com homepage overnight. One concerns a company which makes tables for boats. These 'capstan' tables are expandable, like a rectangular table which can be enlarged by adding leaves. But these tables are round, and they get bigger or smaller just by rotating them. Check out the movie clips. (Here's the digg post w/ comments.)

The second clip shows an accident in which a boat crashes into a bridge (apparently no one was hurt). This is a moving bridge--I saw one of these at OSCON in Portland. This one isn't a drawbridge, but a 'lift' bridge: the motorway lifts straight up using cables and pulleys, leaving room for the ship to pass underneath. When watching the video, pay close attention to the bridge at the beginning of the clip. (Here's the digg post w/ comments.)

interesting pictures

I took a couple of weird pictures recently.

The other day I was about to leave my apartment for work, and I saw this just outside my door. The faucet was dripping, and it made a cool-looking ice stalagmite:


And the other night I was throwing away a beer bottle (yes, I'm destroying the environment--talk to my state legislature), and it made a funny sound when it landed. When I looked at the trash can, I saw that the bottle had landed on the edge, and the bottle's tip had come to rest on the table. I thought about computing the odds against this, but then decided just to go get another beer.

I'm in Dilbert

A co-worker referred me to the 22 November 2006 Dilbert cartoon, and I thought it was pretty funny.

Yahoo TV Completely Ruined

I've used Yahoo TV listings for years. They changed it the other day, and the new version is utter crap. It used to be simple and fast. Here are a few of my more vitriolic gripes:

1. the page loads a little bit at a time as the user scrolls down the page: so browser searches don't work, and it's very slow
2. you can only browse in 3-hour increments: if a show starts prior to the current 3-hour block, you can see that something is showing, but you can't see what it is
3. it doesn't remember that I only want to see my favorite channels: it defaults to showing every channel offered by my cable provider

Two digg posts about this have made it to the front page, and there's a post on Yahoo's blog about the change. The comments on all three of these are overwhelmingly critical:

• http://digg.com/design/Redesigned_Yahoo_TV_Gets_A_New_Do
• http://digg.com/tech_news/Yahoo_Gets_Trashed_By_Users
• http://yodel.yahoo.com/2006/11/28/anything-good-on-tonight/

I'm really hoping they'll change it back (or at least make it suck less). I admit to being generally inflexible: I typically don't like change under the best of circumstances. But this is pretty disappointing. There are several other sites offering online TV listings. Guess I'll switch to whichever one pisses me off the least.

Lockpicking Guide

Locksport International (LSI) has created a pretty interesting guide to lockpicking. It talks about the techniques of picking locks and how to make the tools:

LSI Lockpicking Guide (HTML)

LSI Lockpicking Guide (PDF)

There's also lockpicking101.com, a set of forums about lockpicking.

248 ways to annoy people

I thought this was pretty funny:

http://www.dbooth.net/internerd/annoy.cfm

#216 is my favorite, with #185 a close second.

Interview w/ Slackware's Patrick Volkerding

I used the Slackware distribution of GNU/Linux for several years. It was my first distribution, and I think it's a really interesting project. That distribution's creator, Patrick Volkerding, recently sat for a 90-minute interview with the Linux Link Tech Show (direct MP3 download). I'd never heard his voice before. It's a good way to waste an hour-and-a-half.

Griffith Observatory Reopens

Looks like the Griffith Observatory reopened today after a $93 million four-year renovation and expansion project. It was closed during my visit to LA a few months ago, which was disappointing. Oh, well. Maybe next time.

Perils of e-Democracy

The following article details some of the hazards of electronic voting. It's somewhat long, but it's very interesting (and a bit frightening):

How to steal an election by hacking the vote

I especially like the default password of '1111' on the voting machines, and the fact that this is probably still the password on a large number of these machines. And the fact that the same key (the same little chunk of metal) will access the memory card on every single machine.

20 Worst Video Games of All Time

The following article lists what the author things are the 20 worst video games ever...

http://seanbaby.com/nes/egm.htm

And the reason I think this is blogworthy? I had a copy of the #1 game as a kid. Yeah, it sucked.

Season 3 premiere of Lost

I watched the season 3 premiere of Lost tonight.

I bought season 1 on DVD a little over a year ago having never before watched the show. I was hooked after about 2 episodes. But by the time I finished watching season 1, season 2 had already started. I didn't want to come into the season partway, so I just didn't watch season 2 until I bought that on DVD about a month ago.

So tonight was the first time I'd watched Lost in prime time. I gained two pieces of insight from the experience:

1. Lost rocks
2. commercials suck

I'm just hoping that season 3 of Lost is better than season 3 of Alias.