xephem in Ubuntu

I was out with friends last night (4th of July fireworks), and they asked me to identify a bright object in the sky (I used to be an astronomer). I'm really out of practice at that kind of thing, so I speculated that it was Sirius (there was some light cloud cover, and I couldn't see whether or not this object was southeast of Orion, but it was pretty bright). Turns out I was wrong.

There's a really cool desktop ephemeris program called Xephem from the Clear Sky Institute. So I installed that on my Ubuntu desktop this morning to find what that thing was last night. I had to fulfill a few dependencies to compile xephem. Here's what I had to install first (I just explicitly installed the ones in bold--apt-get installed the packages in parentheses as dependencies):

• libxt-dev (libsm-dev, libice-dev)
• x11proto-print-dev
• libxp-dev
• libxext-dev (x11proto-xext-dev)
• libxmu-headers (?)
• libxmu-dev
  

(I'm not sure I needed libxmu-headers.)

After that I mostly just followed the directions in the INSTALL file from the xephem download. I copied the data directories (auxil, catalogs, etc.) to /usr/share/xephem (a directory I created) and put the following in ~/.xephem/XEphem (xephem didn't seem to want to read /usr/X11R6/lib/X11/app-defaults/XEphem as the INSTALL file suggested):

XEphem.ShareDir: /usr/share/xephem

I also gziped the man page (xephem.1) before copying it to /usr/share/man/man1/xephem.1.gz. And I created /usr/share/doc/xephem-3.7.3/ and copied in the Copyright, INSTALL, and README files.

By the way, that object turned out to be Jupiter. shrug

apt-get: "kept back"

I have the following (executable) file in /etc/cron.daily on my Ubuntu desktop:

#!/bin/bash

apt-get update
apt-get -s upgrade

This lets me know when updates are available: the -s option lists available updates without running them unattended.

Occasionally I'll get a list saying that some updates have been "kept back." I always have trouble remembering what to do in this case. It's typically just some dependency problem. This issue is addressed in the APT HOWTO on the Debian Web site. In my (limited) experience, this has always been overcome by doing apt-get instal pgkname, where pkgname is the offending package which is being "kept back."

n800 maemo updates

I got a Nokia n800 Internet tablet a few months ago and installed the Maemo os2008 software platform. I put the n800 in red pill mode to install some packages, and I just left it that way and forgot all about red/blue pill mode.

It didn't take long for me to find that updates just didn't work, but I never put the two things (red pill mode and broken updates) together. Looks like this is a well-known problem (see the bottom of the red pill mode wiki page linked above).

So if you put your n800 in red pill mode and updates don't work (mine complained that it needed to resolve libglade dependencies: it seemed to want to update to a version which was already installed), put it back in blue pill mode and try running updates. That worked for me.

mcrypt randomness in PHP

The other day I was trying to debug a PHP program which was being really slow. I'm not bright enough to use proper debugging tools (like xdebug), so I just sprinkled in a bucketload of error_log() calls until I figured out what was gumming up the works.

It turned out to be an mcrypt_create_iv() call. Sometimes that call would run in a fraction of a second, and sometimes it would take over a minute, with no discernible pattern. I had pretty much done a copy-and-paste from the mcrypt_module_open() manual page, which shows using the MCRYPT_DEV_RANDOM constant as the second argument to mcrypt_create_iv(). It finally occurred to me to try using the MCRYPT_DEV_URANDOM constant (note the "U"), instead, and the encryptions immediately became consistently fast.

This was happening on a VMWare ESX guest running RHEL4. A Web search or two found a good comparison of /dev/random v. /dev/urandom, and my problem turned out to be a good illustration of /dev/random blocking the caller until sufficient entropy is attained.

HTML form attack

The other day I came across a post about the HTML form attack.

I don't think I'd seen this before, and I'm not well versed in JavaScript attacks (authors of the planet-websecurity.org blogs would probably point, laugh, and yell "NOOB!"). But when I sort of figured out what it was talking about, it occurred to me that a form on a page which is vulnerable to cross-site scripting could be made to POST to an arbitrary location. Try the following in a JavaScript-enabled browser, and see where it ends up taking you when you click the submit button:

<html>
<body>
<form id="gakkk" action="/good.html">
<input type="submit" />
</form>
<script type="text/javascript">
// <![CDATA[
document.getElementById('gakkk').action = '/bad.html';
// ]]>
</script>
</body>
</html>

GPG wallet in cygwin

The other day it occurred to me try my password wallet in cygwin. The wallet requires dialog, but cygwin doesn't seem to have a dialog package. So I figured I'd try building it.

dialog requires ncurses, which meant that I needed to install the ncurses-devel cygwin package (using the cygwin setup tool). Then I downloaded the dialog source and did configure && make && make install, and that "just worked" to get dialog in cygwin. And then the wallet "just worked," too.

So if you're running Windows and want to try the password wallet, install cygwin and give a wallet a try.

AdoDB, PHP, MySQL, SSL

(I'm practicing for an "Unreadable blog post title" contest.)

Here are a few hints on how to use SSL certificates when connecting to MySQL from a PHP program using the AdoDB database abstraction layer. (You may want to see my previous post on setting up SSL certificates for MySQL connections.)

The trick is to use a DSN in the NewADOConnection() call (rather than authenticating with a Connect() call) and to use the mysqli driver (looks like the mysql driver won't work for this). The DSN syntax allows you to supply client flags, and there's a mysqli flag for using SSL certificates.

After creating a CA certificate (we'll say it's at /path/to/ca-cert.pem), make sure that the following item is in the [client] stanza of /etc/my.cnf or the connecting user's ~/.my.cnf on the client host:

ssl-ca=/path/to/ca-cert.pem

Then try the following PHP program:

// these are part of the AdoDB library
require '/path/to/adodb-exceptions.inc.php';
require '/path/to/adodb.inc.php';

/*
* I got the '2048' from running
* printf( "%d\n", MYSQLI_CLIENT_SSL )
* in a PHP program (w/ the mysqli extention installed)
*/
$dsn = 'mysqli://ssluser:sslpass@dbhost/test?clientflags=2048';

$dbh = NewADOConnection($dsn);

$sql = "show status like 'ssl_cipher'";
$res =& $dbh->Execute($sql);
print_r( $res->fields );
$res->Close();
$dbh->Close();

This should generate output similar to like this:

Array
(
  [0] => Ssl_cipher
  [Variable_name] => Ssl_cipher
  [1] => DHE-RSA-AES256-SHA
  [Value] => DHE-RSA-AES256-SHA
)

SSL in MySQL connections

Last week I wanted to figure out how to use SSL certificates in MySQL connections. This is well-documented on the MySQL Web site, but here are a few wrinkles I experienced while figuring out how to get this working (this was with MySQL5 on CentOS5 and RHEL5).

After creating the certificate authority (CA) certificate/keyfile pair, you can specify them in the mysqld section of /etc/my.cnf:

ssl-ca=/etc/pki/CA/ca-cert.pem
ssl-cert=/etc/pki/tls/certs/mysql-server-cert.pem
ssl-key=/etc/pki/tls/private/mysql-server-key.pem

When making certificates for a client connecting locally (e.g., ssluser@localhost), it's important to supply localhost as the "common name" when prompted by openssl. (Yes, it's probably pretty silly to use SSL for a connection over the loopback interface, but you might be in this situation if you were testing.)

If you want to specify the CA (whose signature must appear in client certificates) when setting up a MySQL user (as you might when using the require x509 syntax), the fields should be separated by backslashes ('/'): grant usage on *.* to ssluser@localhost require issuer '/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd/CN=www.example.com/emailAddress=webmaster@example.com';
The following command will more-or-less correctly format the issuer for the grant statement:

openssl x509 -text -in /path/to/ca-cert.pem | grep Issuer \
| cut -d':' -f2 | sed -e 's/, /\//g'

Using issuer and subject items imply x509, and it's an error to try using x509 and issuer.

Depending on the require clause in the grant statement, you can use one or more of the following to connect to the SSL-enabled server:

1. mysql -u ssluser -p


2. mysql -u ssluser --ssl-ca=ca-cert.pem -p


3. mysql -u ssluser --ssl-ca=ca-cert.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem -p

If you use require none or omit the require clause, you can use any of the three connection commands. If you use require ssl, you can use #2 or #3. And if you use require x509, you have to use #3 (note that #3 includes the --ssl-ca option). After connecting, type status (or just \s) and make sure that the SSL item says something encryptiony (mine says Cipher in use is DHE-RSA-AES256-SHA).

Unless client certificates are really necessary (extra client-level authentication), it's probably adequate just to use require ssl and to have the client provide the CA certificate (this appears to provide as high a level of encryption as the client certificate does). But note that you still need to generate the server certificate and key, even if you're not using client certificates.

MIME-decoding email attachments

Occasionally a friend will forward a message to my gmail account, and the forwarded message ends up as a plain-text attachment in the message I receive. If the original message had an attachment, that attachment appears as a MIME-encoded section of the attachment.

If this happens to you, you could try the following. Save the attachment as a text file, and open that file in a text editor. Delete all the lines except the lines which represent the encoded attachment (don't keep the attachment headers, just the lines of text which are 76 characters wide [the last line may be shorter--keep that one, too]). Don't forget to get rid of the lines after the attachment. Save the file as encoded.txt.

Save the following to an executable file called mime_decode somewhere in your $PATH:

#!/usr/bin/perl -w

use strict;
use diagnostics;

use Carp;
use MIME::Base64;

my $usage = "$0 infile outfile";
if ( @ARGV != 2 ) {
    die "usage: $usage\n";
}
my ( $infile, $outfile ) = @ARGV;

open my $fh, '<', $infile or croak "cannot read $infile";
my $encoded = join '', <$fh>;
close $fh;

my $decoded = decode_base64($encoded);
open $fh, '>', $outfile or croak "cannot write $outfile";
print {$fh} $decoded;
close $fh;

Then run the following command:

mime_decode encoded.txt decoded

decoded should be the original attachment.

If you know of a standard utility which does this (especially if it doesn't require the user to prune the email message), please leave a comment.

Gump

As a big Transformers fan and someone who, well, goes to the bathroom, I thought this was pretty cool.

Fallen Tree

There was a ferocious wind-and-rain storm here a week ago, and it knocked over some trees. I took some pictures of one of the more impressive casualties. I think it was an elm tree, and (judging by the rings) it appears to have been around forty years old. They cut it up to cart it off, and they made a cut just above the roots. It was probably around two feet in diameter at the base.

Here are a couple of the pictures...

Burning Universal Studios

A couple of years ago I visited L.A. with friends, and we checked out Universal Studios. We took the tour, which included the cheesy-but-fun King Kong attraction.

That part of the tour was destroyed by fire this morning. The same fire damaged the town hall clocktower from the Back to the Future set, and damaged over 40,000 reels of film (fortunately, there are duplicates in another location--someone was awake during the "Make Backups" lecture at film school).

Tourist attractions have had a hard time of it lately.

RPMs on a tight filesystem

I've ended up managing a couple of CentOS servers which don't have much free space left on their root (/) filesystems. I was looking through their lists of installed packages, and I discovered a useful trick. The following command will give the size (in bytes) of the original RPM of an installed package:

rpm -q --qf '%{archivesize}\n' pkgname

So if you needed a report indicating roughly how much filesystem space each installed package on an RPM-based distribution was consuming, you could try this:

rpm -qa --qf '%{archivesize} %{name}\n' | sort -rn

When I did this on a CentOS4 box with a full install, I was rather unsurprised to find that the top offender is the OpenOffice.org internationalization package openoffice.org-i18n.

Hard Time

From the AP news wire:

Lou Pearlman, the man who created the Backstreet Boys and 'N Sync, was sentenced Wednesday to 25 years in federal prison for engineering a decades-long scam that bilked thousands of investors out of their life savings.

Well, at least he's going to jail, even if it may be for the wrong reason.

And I willfully acknowledge the irony of tagging this post with the 'music' label.

root ssh access trick

Free Software Daily had an interesting post the other day about securing SSH services (that post points to a Tux Training article). This particular tutorial included a configuration item I hadn't seen before. It's a configuration value for the PermitRootLogin field.

If I'm running an SSH service which is visible to the Internet (or even a large intranet), I tend to disable PermitRootLogin (PermitRootLogin no), because the script kiddies can be reasonably sure that an SSH service will have a user called root, and if they try hard enough, they might get lucky with the password.

(I'm also a big fan of the AllowUsers option, which allows you to provide a list of users allowed to log in via ssh. If a valid user not on that list tries to log on, ssh acts as though the user has provided the wrong password.)

The new (new to me, anyway) trick in this tutorial is setting PermitRootLogin without-password. This allows root to log in with a key, but not with a password. This is a really good compromise if you have a server where you need root to be able to log in over ssh. Backups over rsync are a good example of this: to preserve file ownership and permissions, it's sometimes necessary to have rsync run as root.

Bletchley Park financial problems

A recent Slashdot post talks about financial problems at Bletchley Park. Bletchley Park was home and workplace to Allied cryptographers in WWII. Some say that their success at deciphering German Enigma messages was responsible for the Allied victory against the Nazis. At the very least, their efforts probably significantly shorted the war (in the European theatre, anyway).

It's sad to me to see such an important historical site threatened. They'd probably turn it into condos and shopping centers.

lunchpails

The other day Film School Rejects (great blog, with a great podcast) has a post about a flickr set of lunchpails. Reminded me of a Hong Kong Phooey lunchpail I used to have.

problem w/ PHPUnit reports on CentOS5/RHEL5

Yesterday I was trying PHPDocumentor and was going through its Quickstart guide. After I ran phpdoc on the sample code, I threw the reports in my CentOS5 Apache document root so that I could look at the output. Several of the pages wouldn't load. After a quick look at the Apache error log, I saw that those pages were generating PHP errors (the T_STRING gripe), even though the files were named something like sample.php.html.

(CentOS5 and RHEL5 have Apace v2.2.x.)

It took me a while to figure it out, but it's due to an odd feature of Apache which honors multiple extensions in filename. RHEL5 does an AddHandler php5-script .php which tells Apache to run all files with a .php extension through the PHP5 interpreter. I didn't know this, but it even does this for files with names like sample.php.html, where .php isn't at the end of the filename. So even though the phpdoc output files should just render as HTML, they were being interpretted as PHP and were throwing errors.

So I created a directory called /var/www/html/phpdoc and added the following to /etc/httpd/conf.d/php.conf in a Directory container (and restarted Apache): RemoveHandler .php

That convinced Apache not to run any files in that directory through the PHP5 interpreter. Incidentally, I had previously tried SetHandler default-handler for that directory, and it disabled PHP5, but it also disabled nice things like autoindexing (which broke URLs like http://localhost/phpdoc/sample/: Apache would refuse to serve a directory).

By the way, this doesn't seem to affect CentOS4/RHEL4 (Apache 2.0.x and PHP4), because Apache sets up PHP a little differently: it does an AddType, so there's no conflict of having both a text/html content type and a PHP5 handler.

Batdance

Today digg had a story highlighting a topless robot post offering
The 11 Best Songs from Geek-Movie Soundtracks. Most of the 11 songs didn't really do it for me, but one of them was Prince's Batdance from Batman. I probably hadn't seen that in fifteen years, and it was fun watching it again.

Satellite imagery of post-cyclone Myanmar

Estimates of the death toll in Myanmar have gone up and up over the last few days, and a Dot Earth post showing satellite images before and after the cyclone illustrate why.

"Star Trek: The Experience" maybe closing

I went to Las Vegas with friends a few years ago, and one of the things we did was to check out Star Trek: The Experience at the Vegas Hilton. It's expensive, but you can walk through a museum which has props from the shows and a timeline of the Star Trek universe, there's a bar modeled after Quark's in DS9, and there are two rides: The Borg Invation 4D and Klingon Encounter. I actually didn't much care for the Borg show, the the Klingon ride was pretty cool. Walking through the museum was fun, and Quark's was a kick. There's also a good gift shop that'll be happy to overcharge you for souvenirs.

Looks like they may be shutting the thing down. So if you're in Vegas before September, and if you like Star Trek (and are OK with throwing away some cash), go check it out while you still can.

MySQL query optimization from Jay Pipes

Jay Pipes has posted slides from a recent presentation in which he discussed query optimization in MySQL. Pretty good pointers, worth a look.

RSS day

As a proponent of RSS, here's a shout out to RSS day.

updated WordPress security whitepaper

blogsecurity.net has released version 1.2 of their "How to secure WordPress" whitepaper. Looks like they've added some v2.5-specific details along with updated information about security-related plugins.

Wil Wheaton and Radio Free Burrito

I've recently started reading Wil Wheaton's blog, and I've really enjoyed it. He's a very good writer with a lot to say.

Perhaps like many viewers, I felt that Wesley was one of the dimmer lights in Star Trek: The Next Generation. I think Wil might reply to that kind of comment with something along the lines of "I was a kid. I did what they told me to do." Look me in the eye and tell me you'd have done any differently. Thought so. And me neither.

(Besides, he got to make out with Ashley Judd. Look me in the eye and tell me you'd have done any differently. Thought so. And me neither.)

Anyway, this week he posted a couple of episodes of his Creative Commons podcast called Radio Free Burrito, on which he plays some music from podsafe. It's totally awesome and you're totally a hoser for not listening. So get over there and start listening.

BSG

Battlestar Galactica is finally back, and I'm really enjoying it. The other day I found the Battlestar Wiki and thought it was pretty cool. I'm pretty eager to find out who the twelfth Cylon is. My money is on Tom Zarek. Or maybe Dualla.

Prompt for new firefix window

I tend to run my window manager (fluxbox) with four desktops, and I typically have firefox windows open in two of them. Occasionally I have to open a firefox window on the third or fourth desktop, and it's a nuisance to go to one of the first two desktops, open a new window (Ctrl-N), and move the new window to the other desktop (and I acknowledge the irony of considering that a "nuisance").

I recently discovered the -new-window command-line option to firefox. It takes a URL as an argument, and it opens that URL in a new window. So I wrote a shell script that prompts me for a URL and then opens that page in a new browser window. If you want to try this, save the following to a file (I saved it to ~/bin/ffwin), and remember to make the file executable:

#!/bin/bash

URL=$( dialog --stdout \
  --backtitle ffwin \
  --title 'new Firefox window' \
  --inputbox 'URL:' 8 40 )
if [ ! -z "$URL" ]; then
  exec firefox -new-window $URL
fi

When you run this, a new xterm window will open, and dialog will prompt you for the URL. Preceding the firefox call with exec means that the xterm will go away after you enter the URL.

As a further refinement, make it so that you can run this from a menu-click. I added the following entry to ~/.fluxbox/menu, so that I just have to right-click on the desktop and select "ffwin":

[exec] (ffwin) {xterm -e ~/bin/ffwin}

Other window managers would likely allow you to create a custom application launcher from a toolbar or menu or widget or something.

XML in PHP5: the weather

My favorite weather-related Web site is the weather underground, but their pages can be a bit heavy. Usually I just want a quick summary of current conditions and a forecast for the next day or two. Thankfully, wunderground provides this in XML format. Here's the example for Portland, Oregon: HTML, XML.

I thought it would be fun to write a quick PHP program to download the XML file, parse it, and present it in an easy-to-read format. I decided to use the SimpleXML extension for PHP5, because my XML-parsing needs are pretty modest for this project. And I'll use the curl extension to fetch the XML file.

$url = 'http://rss.wunderground.com/auto/rss_full'
  . '/OR/Portland.xml?units=both';

$ch = curl_init($url);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
$xmlstr = curl_exec($ch);
$res_info = curl_getinfo($ch);
curl_close($ch);
if ( $res_info['http_code'] != 200 ) {
  header( 'content-type: text/plain' );
  die("couldn't open $url");
}

$xml = new SimpleXMLElement($xmlstr);
$epoch = strtotime( $xml->channel->pubDate );
$date = date( 'H:i:s l j F Y', $epoch );
$report_uri = htmlentities(
  $xml->channel->item[0]->link );
$content = '';
$forecast_items = array();
foreach ( $xml->channel->item as $item ) {
$desc = strip_tags( $item->description );
$forecast_items[] = array(
  'guid' => $item->guid,
  'desc' => htmlentities( html_entity_decode($desc) ),
);
}

echo '<html><body><h1>Weather Underground Report</h1>',
  '<h2>Portland, Oregon: ', $date, '</h2>';
foreach ( $forecast_items as $item ) {
  $id = '';
  if ( !empty($item['guid']) ) {
      $id = ' id="' . $item['guid'] . '"';
  }
  echo "<p$id>", $item['desc'], '</p>';
}
echo '<p><a href="', $report_uri, '">Full report</a></p>',
  '</body></html>';

There's some magic in the first foreach loop. Just as you should never trust anything typed into a Web form, you should also be skeptical of content from a foreign XML document, hence the strip_tags() and htmlentities() calls. But some of the characters in the wunderground XML are already HTML-encoded (like the degree symbol), so it's useful to call html_entity_decode() first (otherwise the temperature might look like "75°F", rather than "75°F").

The code is otherwise straightforward. If you look at the raw XML, you'll find that the entire report is wrapped in a <channel> container, inside which the report date is wrapped in a <pubDate> container, etc. As its name implies, SimpleXML makes parsing XML pretty easy, and it's a great choice for small projects like this.

fopen($url) v. curl in PHP

Occasionally you'll see PHP code which uses require() or include() or fopen() or file_get_contents() to import code from a remote location (the argument to those functions can be a URL). This sort of thing is generally considered to be a bad security practice, especially if you don't control the code at the remote location (it could unexpectedly change in such a way as to do something destructive to your application).

Many PHP security experts tend to recommend disabling the allow_url_fopen option in php.ini. Disabling this feature can even serve to prevent inadvertent code injection. Imagine an application which calls require($file) where $file is dynamically determined. If your application has some sort of problem which allows an attacker to set the value of $file, the attacker can inject the code of his/her choosing into your application.

So I feel that disabling allow_url_fopen is a good idea, but sometimes you need to initiate HTTP requests in your PHP code. The curl extension provides a good way of doing this. The following snippet will put the contents of the Web page at $url into the $page variable:

$ch = curl_init($url);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
$page = curl_exec($ch);
curl_close($ch);

The previous example is a GET request, but you can also do POST:

$postdata = 'var1=value1&var2=value2';
$ch = curl_init($url);
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1 );
curl_setopt( $ch, CURLOPT_HEADER, 0 );
curl_setopt( $ch, CURLOPT_POSTFIELDS, $postdata );
$page = curl_exec($ch);
curl_close($ch);

undeclared attributes in PHP classes

I was recently surprised to discover that a PHP object can have attributes (variables) not declared in the class. The following works in PHP4 and PHP5 (it prints 'ick' and then 'yark'):

class Gakkk {}

$gakkk = new Gakkk();
$gakkk->blech = 'ick';
echo $gakkk->blech, "\n";
$gakkk->blech = 'yark';
echo $gakkk->blech, "\n";

At best, this strikes me as a very poor programming practice. Who knows when this sort of thing will stop working (in a future version of PHP)? And what kind of code readability is this?

I really like PHP, but this is just weird to me.

PHP4 in RHEL4

Since last year's announcement that PHP4 will reach end-of-life this summer, I've been wondering what will become of PHP in the versions of Red Hat's Enterprise Linux distribution which shipped with PHP4. Looks like Red Hat will continue to provide bugfix and security updates for PHP4 throughout the lifetime of its PHP4-relevant distributions.

Falkirk Wheel

Friends of mine like roller coasters. Screw that. I wanna ride the Falkirk Wheel:

• wikipedia entry
  
• youtube video
• metacafe video

I've long been fascinated by locks and canals (I walked over the Erie Canal twice a day my first year of grad school), and this is one of the cooler mechanisms I've seen. It's even quite energy efficient: because the two caissons (the 'chairs' of this two-chair merry-go-round) always weigh the same, it takes very little energy to run the thing.

If I'm ever in Scotland, I'm totally checking this out.

rate-limiting in iptables

I recently learned about a useful feature in iptables which might help prevent denial of service (DOS) attacks. The iptables "recent" extension dynamically creates a list of source addresses against which your ruleset can match, for example, to block someone who is making too many connection attempts in a given time interval. The Debian Administration blog has a good example of using this to block DOS attacks against an ssh server.

iterating through an array in bash

Every now and then I need to iterate through an array of items in a bash script, and I can never remember the syntax--I always have to look it up. So here's a quick example...

#!/bin/bash

things=( first second third )

for i in ${things[@]}
do
  echo $i
done

If the number of array elements is large, it can be useful to have one element per line:

things=( \
first \
second \
third \
)

another Highlander sequel

The other day I rented Highlander: the Source, and I watched it this evening. Although the original film is one of my favorites, I didn't have very high hopes for this one: all of the sequels have been disappointments (although I seem to remember thinking that the fourth film wasn't horrible).

But I got a bit of a surprise. There's more to say about this movie than I would have imagined. I was surprised because this newest installment is actually worse than Highlander II, which I did not think was humanly possible. Highlander II at least had a fun villain. This film stars Adrian Paul as Duncan MacLeod from the Highlander TV show, and in the film Paul is surrounded by a handful of characters who are even less interesting than he is.

So if you're in the video store and you see a copy of Highlander: the Source, keep walking, and rent something better, like Ishtar, Plan 9 From Outer Space, or Highlander II.

relativistic economics

There was an interesting Slashdot article the other day about a satirical speculative analysis of the economics of interstellar trade. The idea is that if you're shipping something to another star system, you've made a significant financial investment in the goods you are shipping, and the duration of the voyage will be long enough that there should be an interest rate applied to your investment.

The interesting wrinkle appears when you consider that for interstellar trade to be worthwhile, the cargo vessels will need to travel at relativistic speeds. Special relativity describes the effect of time dilation, the phenomenon of a measurable discrepancy in the voyage duration as measured by the ship's crew versus that of a stationary observer (like the investor).

So whose measurement of time do you use to compute the interest?

To extend this nonsense to other predictions of special relativity, the ship's mass and length will also be affected, which might complicate matters for the interstellar equivalents of weigh stations.

Class::Accessor constructors

I'm a pretty big fan of Class::Accessor. It's great for those occasions when you need to write a Perl module which has lots of attributes. You tell your module to inherit from Class::Accessor, provide a list of attributes, and your module automatically has accessors and mutators for all of those attributes. Class::Accessor even takes care of creating your module's constructor.

That last point was actually giving me some trouble the other day. I was writing a Perl module, and it turned out to have several attributes (counters that needed to be incremented while parsing a file), so I decided to have my module inherit from Class::Accessor. But one of the attributes was going to be an instance of another class (I wanted to use composition, rather than multiple inheritance), and I wanted to instantiate this object when my object is instantiated. But since Class::Accessor creates my constructor automatically, it wasn't clear to me how I'd do this.

With a little fiddling, I was able to override the Class::Accessor constructor in such a way that it still created my accessors and mutators, but also allowed me to do other object initialization tasks:

package Gakkk;

use strict;
use diagnostics;
use warnings;

use base qw/ Class::Accessor /;
Gakkk->mk_accessors(
   qw/
        flamningle
        line_number
        num_parse_errors
        num_zortbiptons
        /
);

use Some::Other::Class;

sub new {
   my $class = shift @_;

   my $self = $class->SUPER::new(@_);
   $self->flamningle( Some::Other::Class->new() );
   $self->line_number(0);
   $self->num_parse_errors(0);
   $self->num_zortbiptons(0);

   return $self;
}

# other methods, ...

1;

The call to $class->SUPER::new(@_) gives what's left of the argument list (@_) to the constructor of the parent class (Class::Accessor) and returns an instance of my class. I'm then able to initialize my object attributes without requiring that the calling code do it explicitly. Without overriding the constructor, the caller would have to do something like this:

my $gakkk = Gakkk->new(
    {
        flamningle       => Some::Other::Class->new(),
        line_number      => 0,
        num_parse_errors => 0,
        num_zortbiptons  => 0,
    }
);

Having overridden the constructor, the caller can instantiate the class like this:

my $gakkk = Gakkk->new();

IntranetAddress PHP class

I've added another Google code project. This one is called IntranetAddress, and it's a PHP class which you can use to determine whether or not an IPv4 address belongs to a set of network ranges (specified in CIDR notation in a configuration file). The class requires the Net::IPv4 PEAR package, and a PHPUnit test suite in included.

password wallet in google code

I put my password wallet in a google code project.

overnight at the lake

I'm writing this from my friends' lakehouse. I've been here since yesterday afternoon, and it's been a nice break from routine. I took a few pictures which I think came out pretty well.

There was a brief snowstorm yesterday afternoon with wonderfully large snowflakes:



This morning I took a picture from a similar angle. The lake was so still this morning--like looking at glass:

password wallet update

Yesterday I discovered an interesting (and somewhat alarming) problem with my password wallet.

I use vim for my text editor (I have export VISUAL="/usr/bin/vim" in my ~/.bashrc). Yesterday I used the wallet script to update my password list, and then later I was using vim to edit a totally unrelated text file. I fat-fingered what I was doing and typed some magical set of keystrokes (still not sure just how I did that), and suddenly I was looking at several lines from my password file. I recognized those lines as lines that I had highlighted, deleted, and then pasted to a new location when editing the password file when I was using wallet. I then had a forehead-slapping moment when I realized that such edits are saved for posterity in the ~/.viminfo file.

Oops. That's a potential information leakage vulnerability.

But it is easily remedied by adding the following line to ~/.walletrc:

VISUAL="/usr/bin/vim -i NONE"

The -i option tells vim to use some file other than ~/.viminfo for its state information. In this case, it tells vim not to store state information at all. The trick of putting it in ~/.walletrc (rather than in ~/.bashrc) means that vim only skips storing state information when running wallet--vim will keep state information in ~.viminfo any other time you run vim.

So if you're using wallet with vim, I urge you to make the above change to your ~/.walletrc file.

securing WordPress with blogsecurity.net

I needed to set up a WordPress blog at work this week, and I decided to try following the WordPress Security Whitepaper at blogsecurity.net. It was pretty easy, and (hopefully) has made that WordPress installation a bit more secure.

blogsecurity.net is a blog about security issues relating to blogging. It's pretty interesting and has lots of good information and resources.

Python 3.0 To Be Backwards Incompatible

According to a Slashdot post, just about all python code will require at least some changes when python 3.0 comes out in early 2008. I've never learned python, and news like this makes me glad that I've never bothered. (Besides, a syntax predicated on whitespace just seems weird to me.)

I wonder how Red Hat feels about this, considering that a lot of the RHEL system scripts are in python. They'll probably have a lot of rewriting to do for RHEL6.

I suppose that similar criticism could be leveled at Perl6 v. Perl5 (although there is talk of some sort of compatibility mode as well as a Perl5-to-Perl6 translater). But it's probably a moot point: as far as I can tell, Perl6 will never, ever be released.

Microsoft buying Yahoo?

So I started going through my RSS feeds this morning, and I saw that a big news item was Microsoft's $44.6 billion offer to buy Yahoo.

I'm not sure how I feel about this. If the purchase goes through, I hope MS won't screw up flickr.

I think Yahoo uses open source technology for a lot of their services. I'd hate to see that change, too.

Someone posted an interesting comment at Linux Journal. The commenter pointed out that Yahoo owns Zimbra, a potential Exchange competitor. I wonder how much that contributed to Microsoft's offer.

syntax highlighting in vim in Ubuntu

Today I finally noticed that syntax highlighting wasn't working in vim in Ubuntu. Installing vim-full and adding syntax on to ~/.vimrc did the trick.

google code, trac-backup

In the current episode (season 5, episode 9) of LugRadio, Stuart Langridge says that his new year resolution is to start releasing some of the little scripts and programs he writes. He says that he writes lots of these things, but tends not to release them, because he thinks that they're not very user-friendly. I really identified with him when he said that, and it's inspired me to try doing the same.

So I created a project in Google Code for the trac backup script I described in a previous post. Creating the Google Code project was pretty easy (although someone unfamiliar with subversion might have a hard time). I've updated the script according to a comment on the previous post about a problem with a new version of trac. If you are interested, please have a look at trac-backup.

I'll probably add more projects in the coming weeks:

• a versioned backup system based on subversion, which is pretty good for backing up configuration data
• maybe some other backup programs I've written
• the password wallet I wrote about in the January issue of Linux Journal
  

WPA2 Enterprise on the Nokia N800

I got a Nokia N800 as a holiday gift, and I took it to work the other day. The N800 is an "Internet Tablet" which is a bit larger than a cell phone and much smaller than a laptop. It's a WiFi device which runs Linux, and it's a pretty neat toy. If you get one, definitely go the software available at maemo.org.

Anyway, I had a bit of trouble getting the N800 to talk to the wireless network at work, which is WPA2-Enterprise authenticating against an Active Directory domain. But a google search found a page describing how to configure a connection, and that worked right away. The following is a direct copy-and-paste of that post:

page 1: Connection type = WLAN
page 2: Network mode = Infrastructure; Security method = WPA with EAP
page 3: EAP type = PEAP
page 4: Select certificate = None; EAP method = EAP MSCHAPv2
page 5: You can enter your login information if you don't want to log in manually each time
page 6: Click "Advanced" button
Other tab: Enable "WPA2-only mode"
EAP tab: Enable "Use manual user name"; enter your "Manual user name"; Disable "Require client authentication" (I thought I had this one enabled initially, but it will now only work if disabled)

I set it not to remember my password (in case the N800 is lost or stolen).

No Country For Old Men

I saw the Coen brothers' No Country For Old Men with a friend last night. It's probably the best film I've seen in a long time. It's pretty violent, but it's well worth seeing. It's more of a character study (like Heat or A River Runs Through It) than a narrative, and it definitely doesn't have a traditional Hollywood ending (in fact, the movie ends rather abruptly). But I thought it was seven shades of awesome. Javier Bardem was a fantastic villain, and Tommy Lee Jones also gave a great performance. Guess I'll be adding Cormac McCarthy (the author of the book on which the movie is based) to my reading list.

Ubuntu asking for the CD to install software

Sometimes I ask apt-get or synaptic to install something, and it asks for the CD. Turns out that this is an easily-remedied nuisance. A fosswire post (which I found by way of fsdaily) gives a GUI-based solution. An equivalent solution is to comment out the line in /etc/apt/sources.list which starts w/ 'deb cdrom:' (that's probably line 1).

Ubuntu firewall

This post offers a way of telling your Ubuntu system to set up a simple firewall at boot time. It assumes that you have a single network adapter called eth0.

I saved my firewall rules (in iptables-save format) to /etc/network/fwrules. My firewall rules are fairly specific to my setup, but the following might serve as a good starting point if you want to try this:

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i lo -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
COMMIT

And then I just saved the following to /etc/network/if-pre-up.d/fw:

#!/bin/bash

iptables-restore < /etc/network/fwrules

(Be sure to make this file executable: sudo chmod 755 /etc/network/if-pre-up.d/fw).

This loads the firewall rules prior to bringing up the network interface, so that the firewall is in place by the time the network connection is active.

udev in Ubuntu

This post will be a recipe for configuring udev in Ubuntu so that if you plug in a USB storage device (like a flash drive, an MP3 player, etc.), it will get a consistent and predictable device name which you can attache as a non-root user to a fixed mount point. I'll be using my new Verbatim thumb drive as an example.

Plug in the flash drive, wait a few seconds, and type 'dmesg | tail'. The last few lines should show the USB system detecting the device and giving it the first available device name. In my case, the flash drive got /dev/sdd. Next, ask udevinfo for details about the device:

udevinfo -a -p $( udevinfo -q path -n /dev/sdd ) | less

Page through the output looking for the device's values for idVendor and idProduct. The udevinfo output for my thumb drive contained the following lines:

   ATTRS{idProduct}=="1e23"
   ATTRS{idVendor}=="13fe"

Next thing is to tell udev about the device. Create a udev rule file (I used /etc/udev/rules.d/99-thumb.rules) with something like the following:

SUBSYSTEMS=="usb", SYSFS{idVendor}=="13fe", SYSFS{idProduct}=="1e23", NAME="thumb", MODE="0660" OWNER="mbrisby" GROUP="mbrisby"

(Naturally, replace mbrisby with your username and group name.) You may need to run udevcontrol reload_rules to tell udev to read the new addition into its in-memory ruleset.

Now you can make a mount point:

$ sudo mkdir /media/thumb
$ sudo chown mbrisby.mbrisby /media/thumb

Finally, add the mount point to /etc/fstab:

/dev/thumb /media/thumb vfat user,noauto 0 0

And from now on, you should be able to plug in the thumb drive, wait a couple of seconds, type mount /media/thumb, and start accessing the files at /media/thumb.

fetchmail in Ubuntu

I recently wrote about using fetchmail for gmail. In the meantime I've switched my main desktop (at home) from CentOS to Ubuntu. Ubuntu's fetchmail build is a bit more picky about SSL certificates than the CentOS build, so this post will describe some of the changes I had to make to my ~/.fetchmailrc file.

(By the way, fetchmail should work OK without these changes, it'll just whine about the certificates.)

First I needed to install the ca-certificates package from the Ubuntu repositories, and then I needed to change the gmail line of my ~/.fetchmailrc file from

poll imap.gmail.com protocol IMAP user "my_gmail_username@gmail.com" there with password "my_password" nofetchall keep ssl

to

poll imap.gmail.com protocol IMAP user "my_gmail_username@gmail.com" there with password "my_password" nofetchall keep ssl sslcertck sslcertpath /etc/ssl/certs

This tells fetchmail where to find the public certificate it needs to verify the SSL connection to the gmail server.

I also use fetchmail to check some IMAP accounts on a server using self-signed certificates, certificates which don't appear in /etc/ssl/certs. One way of doing this is to compute the IMAP certificate's fingerprint and telling that to fetchmail. If the IMAP server is imap.example.com and it's running on the standard port (993), you can use openssl to grab the certificate like this:

openssl s_client -ign_eof -connect imap.example.com:993 > imap.cert

(You may need to Contol-C to get back to the command prompt.)
Then use openssl to find the MD5 fingerprint:

openssl x509 -fingerprint -md5 -in imap.cert

The output of this latter command should contain a line starting with MD5 Fingerprint. Add the fingerprint to your ~/.fetchmailrc file with something like this:

poll mail.example.com via imap.example.com protocol IMAP user mbrisby there with password "my_password" nofetchall nokeep ssl sslfingerprint "4C:69:E2:E6:F9:6B:6C:4E:E9:8B:E1:C8:2B:B9:4F:B9"

And then just run fetchmail in cron every now and then.

desktop Ubuntu

I recently converted my laptop from CentOS 5 to Ubuntu 7.10 and liked the change. So I did the same to my main desktop at home this weekend. Naturally, there were a few bumps in the road. Over the next several days I'll be posting about some of them.

But first, a couple of annoyances.

Ubuntu likes to beep. It rings the system bell a lot more than CentOS seemed to do: tab completion at the bash prompt, unsuccessful page text searches in Firefox, trying to go past the end of the file in vim, etc. It really enjoyed beeping at me, and putting set bell-style none in ~/.inputrc didn't help much.

It turns out to be a kernel module. A post in Dell's Linux desktop forums suggested modprobe -r pcspkr, and that worked right away. The post also suggests putting blacklist pcspkr in a file in /etc/modprobe.d to make the change permanent (I haven't rebooted yet, but I figure that oughtta do it.)

The other annoyance is that Ubuntu's grep isn't compiled with libpcre support (that's the Perl-compatible regular expression library). One of the bash scripts I use for backups has a grep -P in it. The -P options tells grep to regard the search pattern as a Perl-style regex. This gives the following charming error message:

The -P option is not supported

Someone else noticed this and filed a bug report. Looks like the Ubuntu developers aren't interested in fixing it in this version. Someone suggested installing the pcregrep package, but this has a few problems:

1. the binary is installed as /usr/bin/pcregrep
2. pcregrep doesn't have the same performance or options as grep
3. oddly, pcregrep doesn't accept the -P option (you'd think it would just ignore it)

So pcregrep is hardly a drop-in replacement for grep, even if you rename the binary to /bin/grep.

As it happens, I got lucky. My the regex in my bash script is dull enough that I was able to replace grep -P with egrep. But if you use something more sophisticated, you'll have a harder time of it.

But all in all, I'm enjoying my shiny new Ubuntu installation. I'll be back later to yammer on about using udev, fetchmail, iptables, and maybe some other stuff in Ubuntu.

Inspekt PHP library

A recent post on the Planet-Websecurity.org blog got me interested in Inspekt. It's a secure input validation library for PHP. It reminds me a bit of Perl's taint switch, in that Inspekt prevents you from directly using $_POST, $_GET, and their ilk.

Looks like it hasn't really hit release status yet, but I think it's going to be worth watching.

Ubuntu

I finally gave Ubuntu a try recently. I'd previously tried it as a VMWare Server guest and hated it. But that probably wasn't a fair shake, so I installed it on my laptop last week. I was really impressed by how easy it was to get everything set up. It only took a few hours to get it installed and pretty highly customized with some of my favorite packages, including gtkpod, grip, easytag, mplayer, fluxbox, VMWare Server, gkrellm (and a few of its plugins), and grisbi.

About the only thing that really took a while was getting fluxbox to work, and that's because Ubuntu does it rather differently than CentOS (what I'm used to). It took me a little while to realize that I needed to be using ~/.fluxbox/startup rather than ~/.Xclients, and it took me forever to cotton on to the fact that the ~/.fluxbox/keys syntax had changed between v0.9.x and v1.0.x. I'd never had the following three lines in my keys file before, but they're pretty important (you can't easily get to the fluxbox menu without them):

OnDesktop Mouse1 :HideMenus
OnDesktop Mouse2 :Workspacemenu
OnDesktop Mouse3 :RootMenu

About the only thing I couldn't do was install native drivers for one of my wireless cards. I have two cards: a Linksys WPC11v4 802.11b card and a Netgear 802.11g card. The Linksys card has open-source drivers which support monitor mode (so that I can run kismet), while the Netgear card only has Windows drivers. It was very easy getting ndiswrapper and wpa_supplicant set up for the Netgear card, but I never got the Linksys drivers working. Looks like other people have had the same trouble, and the solution may be to try a different kernel. Oh, well.

Anyway, it was all pretty easy, and I may start using Ubuntu on all my desktops. And O'Reilly's Ubuntu Hacks was pretty helpful.

fetchmail for gmail

If you have lots of email accounts, it can be a real pain checking all of them. But if you're running a mail server on a Linux box somewhere (like postfix on your workstation at home, for example), you can use fetchmail to download the messages from your IMAP and POP3 mail accounts. That way, all your mail is in one place (and you only have to go to one place to read it).

gmail recently added IMAP support (it's one of the tabs under Settings). Once you enable IMAP support in your gmail account, you could add something like the following to your ~/.fetchmailrc file:

poll imap.gmail.com protocol IMAP user "my_gmail_username@gmail.com" there with password "my_password" nofetchall keep ssl

nofetchall just gets the new messages, keep prevents fetchmail from deleting the messages off your gmail account (so that you can still read them by logging on the gmail), and ssl keeps your password encrypted when fetchmail connects to gmail. Then just run fetchmail -s in cron every now and then.

Something to keep in mind is that although this won't delete your messages from gmail, it'll mark them as read. So if you log in to gmail, new messages won't look new, they'll look read (because fetchmail has read them).

Bats in the belfry

The other day I read that DC Comics is planning to 'promote' Bruce Wayne to the ranks of the New Gods. Despite the departure of Bruce Wayne, there will still be a Batman to watch over Gotham City. The role will be filled by Jason Todd, the second Robin.

Jason Todd was murdered by the Joker (beaten to death with a crowbar, if memory serves).

If the last couple of paragraphs don't make any sense to you, then you and I are of like mind.

This sounds like a publicity stunt to me, like when DC briefly killed Superman in the early 90s.

Guess they're running out of ideas over there.

Lame OpenDocument Foundation Blathering

I recently wrote about some strange announcements from the OpenDocument Foundation (which has since totally dissolved), and I said I didn't know what that meant for the OpenDocument format (ODF).

Not much, it seems. An Antic Disposition post has clarified the matter somewhat:

The adoption of the ODF standard is promoted by several organizations, most prominently the ODF Alliance (with over 400 organizational members in 52 countries), the OpenDocument Fellowship (around 100 individual members) and the OpenDoc Society (a new group with a Northern European focus, with around 50 organizational members). To put this in perspective, the OpenDocument Foundation, before it changed its mission and dissolved, had only 3 members.

Origin of Kryptonite

According to Wikipedia, Kryptonite (a fictional mineral, the green variety of which is toxic to Superman) was originally introduced in 1943 (about five years after Superman's first appearance in comic books) in the radio show. It was a plot device used to allow the actor portraying Superman the opportunity to take some vacation time.

Wacky.

trac: backups, Gantt plugin, concluding remarks

This is the third installment of a series on trac, Web-based pr0ject management software. The previous segments talked about installing and using trac.

trac comes with a command-line utility called trac-admin, which can (among other things) perform backups of individual trac projects. The following is a shell script you could put in /etc/cron.daily to back up all your trac projects each night:

#!/bin/bash

TRAC_ROOT=/var/www/trac/tracroot
TRAC_BAC_ROOT=/var/trac_bac

TODAY=$( date +%Y%m%d%H%M%S )
mkdir -p $TRAC_BAC_ROOT/$TODAY
for i in $TRAC_ROOT/*
do
 DEST=$TRAC_BAC_ROOT/$TODAY/$( basename $i )
 DEST_TARGZ=${DEST}.tar.gz
 /usr/bin/trac-admin $i hotcopy $DEST
 tar czf $DEST_TARGZ $DEST
 rm -rf $DEST
done

This uses the trac-admin hotcopy feature to make a compressed archive of each individual project (putting them in time/date-labeled directories in /var/trac_bac).

This series discussed the WebAdmin plugin. I also tried the TracGantt plugin, which makes Gantt charts of your project. I found that I didn't much care for this plugin. You have to enter an extra four data fields for each ticket, one of which is a list of ticket dependencies (e.g., completion of this ticket is dependent on completion of that ticket). The Gantt charts don't clearly display these ticket dependencies, so it seems like a wasted effort. And for a large project, the chart becomes too big for useful printouts, and the plugin doesn't offer exports in other formats. So TracGantt didn't really do it for me. shrug

In closing, I really like trac, and it's been very helpful to me in my work. Clearly, trac is designed to manage software development projects. But with a little imagination, I think it could be used quite effectively to manage just about any kind of project, even something as simple as a running 'to-do' list.

Using trac

In a previous post, I described installing trac, a Web-based project management system.

Now you can go to http://myserver.org/trac/ (substituting your server's hostname, of course), and you should see a link for your project. Clicking the link takes you to that project's homepage, which is a wiki. You can use this to provide as much or as little documentation as you like for your project.

One of the first things you'll want to do is to click the Admin link (upper-right, which would not be present without the WebAdmin plugin). The main admin page lets you set the name, URL, and description of your project. Clicking the Permissions link (left-hand side) lets you change who has what permissions to the project. By default, anonymous users have just about every right--you will probably want to revoke these rights, and then just dole them out on a per-user as-needed basis (for example, you may want to give people testing your project permission to create tickets). The WebAdmin plugin also lets you manage components, versions, milestones, and other items through the Web interface (you'd otherwise have to use the trac-admin command-line tool for all that).

The Browse Source link lets you poke around in your repository, even looking at the different revisions.

But my favorite feature is the ability to create and manage tickets. Clicking the New Ticket link lets you create a new ticket, in which you can enter a description of a problem with your project, the affected version, the relevant component, etc. (most of these fields are optional). And the View Tickets link lets you run pre-configured queries to display your tickets (you can also create your own custom ticket queries, but I've found the default set perfectly adequate).

Installing trac

I started using trac a few weeks ago, and now I don't know what I did without it. It's great for project management. trac is a multi-user Web-based ticket-tracking system which has a built-in wiki, integrates with Subversion, and offers a wide array of plugins.

It's written in python. Oh, well. Nothing is perfect.

Here I'll be describing how to install trac v0.10 with the WebAdmin plugin on CentOS 5. We'll pretend to be installing it at http://myserver.org/trac/ (upcoming posts will talk about using and maintaining trac).

Start by installing the trac and python-clearsilver RPMs from the EPEL repositories. This will add the /etc/httpd/conf.d/trac.conf file to your Apache configuration. I suggest replacing the default contents of that file with the following:

<LocationMatch /trac>
SetHandler mod_python
PythonInterpreter main_interpreter
PythonHandler trac.web.modpython_frontend
PythonOption TracEnvParentDir /var/www/trac/tracroot
PythonOption TracUriRoot /trac
SetEnv PYTHON_EGG_CACHE /var/www/trac/egg_cache
AuthType Basic
AuthName trac
AuthUserFile /var/www/trac/htpasswd
Require valid-user
</LocationMatch>

(Don't forget to restart Apache to make the new configuration take effect.)

I'll be putting all the trac files in /var/www/trac (outside the Apache docroot at /var/www/html). Each trac project will have its own directory in /var/www/trac/tracroot, and the subversion repository will be at /var/www/trac/svn.

The 'egg cache' (I guess that's some wierd Python drivel) will be at /var/www/trac/egg_cache. The egg cache is for plugins. It's actually not necessary for the WebAdmin plugin, but you may as well set it up, anyway, in case you want to add other plugins. It needs to be Apache-writeable: chown -R apache.apache /var/www/trac/egg_cache.

You'll notice that I've set up Basic Apache authentication. Use the command-line htpasswd command (part of the httpd package) to create and maintain the /var/www/trac/htpasswd. In my case, I created a user called carl: htpasswd -c /var/www/trac/htpasswd carl

If you want to use the Subversion integration, put your repository at /var/www/trac/svn (either drop in a hotcopy or use svnadmin load /var/www/trac/svn). Remember to make it Apache-writeable: chown -R apache.apache /var/www/trac/svn.

To install the WebAdmin plugin, you'll need setuptools. Download ez_setup.py and run
python ez_setup.py (this is all described on the TracPlugins node of the trac wiki). This installs the easy_install utility. Running easy_install http://svn.edgewall.com/repos/trac/sandbox/webadmin should install the plugin (verify the URL on the WebAdmin wiki node). Now you'll need to enable the plugin by adding the following text to /usr/share/trac/conf/trac.ini (this file probably doesn't exist yet, so you'll be creating it):

[components]
webadmin.* = enabled

You'll probably need another Apache restart at this point (editing /usr/share/trac/conf/trac.ini seems to require an Apache restart).

And now we can actually create a trac project. We'll call it foo, for laughs:

trac-admin /var/www/trac/tracroot/foo initenv

This will ask you a few questions (I'm assuming that your Subversion repository is set up such that there's a foo item just under the repository root, and that it corresponds to this trac project):

• project name: keep this short but descriptive
• DB connection string: just use the default (SQLite)
• repository type: use the default if you're doing the Subversion integration
• repository path: /var/www/trac/svn/foo
• templates: use the default

Your answers are used to create a project configuration file at /var/www/trac/tracroot/foo/conf/trac.ini. You can later edit this file by hand, but if you change the repository location (the repository_dir item), you'll need to run the following command:

trac-admin /var/www/trac/tracroot/foo resync

Now give yourself administrative rights to the project (using the same username you used with the htpasswd command, above):

trac-admin /var/www/trac/tracroot/foo permission add carl TRAC_ADMIN

Well, this has already run pretty long, so I'll break for now. In the next exciting episode, I'll talk a bit about actually using trac.

OpenDocument Foundation reversal

At times on this blog I've discussed the open document format (ODF), an XML-based file format intended to be used in office productivity software (word processors, spreadsheets, and the like). This file format would be a completely open standard, and would compete with proprietary file format like those used in Microsoft Office.

A major proponent of this format, the OpenDocument Foundation, has evidently recently decided to dump ODF in favor of an obscure alternative called the Compound Document Format, developed by the World Wide Web Consortium. So now I really don't know what to think. I wonder if the foundation will change its name.

Microsoft (with their OOXML format) must be having a good laugh about this.

perl breakage

I run a bunch of CentOS 4 boxes at work, and recent yum updates to perl caused me a lot of problems. If I tried doing just about anything in cpan, I'd get errors like this:

Use of uninitialized value in concatenation (.) or string at
/path/to/Scalar/Util.pm line 30.

and this

Undefined subroutine &Compress::Zlib::gzopen ...

After several Web searches, I found a Google Groups posting which recommended manually installing Scalar::List::Utils.

I have no idea what Scalar::List::Utils has to do with anything, but it seemed
to work. Thank you, Peter Scott.

If you try this, and the Compress::Zlib::gzopen errors persist, you could try the following (admittedly drastic) measure. It was successful for me in one case where just installing Scalar::List::Utils wasn't enough (for whatever reason). Try running the following search against your perl libraries (might be in a different directory on a non-RedHat-like distribution):

find /usr/lib/perl5/ -type f -path '*Compress/Zlib.pm'

Delete or rename the Zlib.pm files found, and then try 'install Compress::Zlib' in cpan (you may need to 'force install Compress::Zlib').

identity theft

Bruce Schneier has posted about a report giving some interesting statistics about identity theft.

lock pick gun

Here's an interesting video showing someone defeating 8 locks in less than 80 seconds. The person in the video is using a lock pick gun. I'd only seen these in movies and TV before this. I don't really understand how the thing works, but it may be similar to bumping. Note the use of the torsion wrench in the video.

Nuke Anything Enhanced Firefox Extension

One of my favorite Firefox extensions is Nuke Anything Enhanced. After installing this extension, right-clicking on something on a Web page gives a menu including an item called 'Remove this object'. Picking that item makes the object disappear.

This is useful sites like The Energy Blog. That's a great site, but there's always a really annoying vertical animated gif banner on the right-hand side. This extensions makes it easy to do away with such things.

mailinator

Every now and then I want to access content or a service on a Web site which requires registration with an email address (for example, live365.com started requiring registration a couple of days ago, and many online newspaper Web sites do this). I used to always give a fake address, for fear that the site will sell my address to spammers, or that the site will send me a bunch of promotional junk I don't want. But that doesn't always work. Sometimes the site requires a valid address so that they can send me something that I need to complete the registration. In this case, mailinator.com is a good way around this problem.

If you go to mailinator.com, it auto-generates an email address for you in the form of something@mailinator.com (you can also make up your own), and you can give that address when registering for the newspaper (or whatever) Web site. Then just go to mailinator.com and check for mail sent to that address. There's no username and password, so you wouldn't want to use it as an actual email account or for anything confidential (anyone who knows your mailinator address can read your mail). But it's a good throwaway email account, so that you don't have to give your real address.

(In fairness to live365, they don't appear to have sent me any mail at all after registering.)

Power Generation with Solar Towers

The Energy Blog has an interesting post about solar towers, a method of solar power generation. The tower is surrounded by mirrors which reflect sunlight onto a receiver at the top of the tower (the mirrors move to track the sun). Fluids are pumped through pipes in the receiver for heat exchange, and the fluids are then used in steam generators.

The post contains a link to a previous post with more details about the types of fluids used for heat exchange: it's a salt mixture which is able to retain heat for power generation at night or in cloudy weather.

The process is said to be over 40% effective in converting thermal energy into electricity.

Batman v. Alien v. Predator

When I read the descripti0n of this amateur film, I thought it would be pretty lame. But it's actually really cool. Very high production value, and very comic book-y.

2007 Halloween pumpking carving

Hung out with friends today. We have a tradition of carving jack-o-lanterns for Halloween, and my part of the tradition is not to carve a jack-o-lantern. *shrug* It's way too messy for my delicate sensibilities. Ewwww.

This time, one of my friends convinced me to join in the fun. So here's my jack-o-lantern...



One of my other friends found these really nifty little watch-battery-powered LED candles, and that's what's inside.

And here it is in the light... So, not too messy, after all.

And here's the lot. The friend who found the LED candles (she's the X-Men fan) carved the '07 Jack to mark the occasion. She's clever, that one. My favorite is the Frank Castle Jack.

Anyway, had a good time seeing friends. We listened to a really cool CD I bought this afternoon: Raising Sand by Robert Plant and Alison Krauss.

USB hilarity

Here are a couple of amusing items that rolled through my RSS feeds this past week.

Next time the week seems to be dragging on a bit too long, try 'It Only Tuesday' [sic] from the Onion.

And here are some fun USB toys. I've got my eye on the fishtank.

noscript

I've been using the flashblock Firefox extension for a long time. There's nothing more annoying (to me) than going to a Web site littered with a bunch of flash movies which slow the page load, distract me from the important content, or crash my browser. The flashblock extension replaces each flash movie with a link you can click to enable that flash movie, allowing you to enable only the individual movies you want to view.

The noscript Firefox extension disables all JavaScript in your browser. You can temporarily or permanently whitelist Web sites in noscript, allowing JavaScript from the sites you trust. This is a good idea: just start reading some of the stuff at Planet Websecurity if you need convincing.

Unfortunately, the two extensions are incompatible, because flashblock uses JavaScript to replace the movies (and noscript disables JavaScript). Until this week, I'd chosen flashblock over noscript, because my annoyance with flash exceeded my fear of JavaScript. I really can't defend that decision. shrug

But this week I took another look at noscript and discovered that noscript can disable flash in the same way that flashblock does. Looks like the developer(s) added that feature in version 1.1.0 (August 2005). Guess it's been that long since I'd tried noscript (or else I didn't look at the feature list very well). Anyway, I've switched to noscript.

dailylit.com

A recent issue of Wired clued me in to dailylit.com. dailylit.com has a bunch of public domain publications (mostly classical literature) which they have carved up into bite-size chunks deliverable via RSS feed. So you can go to dailylit.com, pick a book, and subscribe to it in your RSS reader. You get a post every day (or 3 times a week, or every weekday) which you can read in a couple of minutes. It's pretty cool. I'm reading Sir Arthur Conan Doyle's A Study in Scarlet (the first Sherlock Holmes story).

There's also the feature that each post comes with a link to tell dailylit.com to release the next post (rather than waiting until the next day). This feature has a caveat if you're using an online RSS reader like Google Reader: although dailylit.com immediately puts the next post in your feed, the post won't show up in your reader until the RSS service checks the feed again (which might take hours).

Be warned that the catalog at dailylit.com isn't nearly as extensive as something like Project Gutenberg. But the selection isn't bad, and it's a neat way to read a book.

Sirens of Song (Internet radio)

I'd never tried Internet radio, but became interested when I read a recent polishlinux post about how to listen to Internet radio. The post didn't say much about how to find content, so a quick google search yielded www.live365.com. live365 has lots of stations of all kinds of music. I've been enjoying Sirens of Song (which has its own site at www.sirensofsong.com).

OOXML Monkey in the Wrench

I've been meaning to write about the OOXML nonsense, but just haven't had time. Microsoft failed in its recent (but probably not final) attempt to have OOXML listed as an ISO standard file format. Groklaw has the details of the vote.

The Groklaw article also discusses Microsoft's version of the results--Microsoft tried to spin it as a success. When I first skimmed Microsoft's press release (which I saw on Google News before reading any intelligent analysis), I was fooled into thinking that OOXML had passed.

There has been a lot of criticism of the ISO process, accusations that Microsoft has effectively purchased the votes that they did get. Hopefully ISO can reform some of their processes before the next vote on OOXML (which I think happens in early 2008).

DIY Laser Microphone

At times (can't think of specific examples) I've seen movies (or watched TV shows, or read novels or comic books) in which someone eavesdrops on somebody else by pointing a laser at a glass window separating the speaker and the eavesdropper: the idea is that the speaker's voice vibrates the glass in a way that the laser can detect. I figured that was science fiction, but a recent LifeHacker post suggests that it's possible, easy, and inexpensive. Pretty cool.

clock drift in Linux VMWare guest

Today I installed CentOS 5 as a VMWare guest (VMWare server, CentOS 4 host) and had a few problems. The first problem was that when it came time to partition the drive, CentOS didn't think I had any storage. A helpful post on the CentOS forums pointed out that I needed to select LSI (not BusLogic) for the SCSI controller.

And then I found that the clock drift was really bad, and NTP wasn't working for some reason.

http://kbase.redhat.com/faq/FAQ_43_9259.shtm suggested adding the following line to the .vmx file:

tools.syncTime = "TRUE"

This (by itself, anyway) didn't work for me.

http://www.djax.co.uk/kb/linux/vmware_clock_drift.html suggested appending the following items to the kernel command line (in lilo.conf or grub.conf):

nosmp noapic nolapic

That worked like a charm. That article also suggested appending 'clock=pit' if the guest clock runs fast (mine was running slow).

AVP2

IGN has downloadable trailers for Aliens vs. Predator: Requiem. Gory, but cool. I liked the previous film--not a great movie (can't touch Alien, Aliens, or Predator), but fun. And this one looks even better. Can't wait.

Dark Side of the Rainbow

Last week Leo Laporte on the This Week in Tech podcast (episode 109) mentioned something called the Dark Side of the Rainbow, which I'd never heard of before. The idea is that if you play Pink Floyd's Dark Side of the Moon while watching The Wizard of Oz, you'll see and hear a degree of synchronicity: moments where the music and the film seem to intersect.

I've got a copy of that CD, and last night I picked up a copy of the movie on DVD to try it out. All in all, pretty lame. Maybe it's more interesting if you're not sober.

Another worthless Internet rumor propagated by people with too much time on their hands (although it seems like I had enough time on my hands to try it myself *shrug*).

But last night I noticed something interesting about Toto: I don't know how that dog managed to keep so calm with all the histrionics going on around him/her while they were filming that movie.

Crashing e-passport readers

An RFID expert named Lukas Grunwald presented some interesting research at the recent DefCon. Grunwald was able to read the data from the RFID tag in a US passport, clone it on a writable RFID chip, and replace the image data (the e-passport RFID tag data includes a JPEG2000-format version of the passport's owner). The new image data contained a buffer overflow exploit which Grunwald demonstrated was able to crash two RFID readers. Grunwald's point is that if the readers can be crashed by altering RFID data, the readers could probably also be exploited to do things like approving an expired passport or altering what a customs official would see on his/her screen after scanning the passport.

'Customize Google' Firefox extension

I just discovered the Customize Google Firefox extension. It has a large number of user preferences which affect your use of Google services. Many of the preferences are privacy-related, including some anonimization features. It can also remove ads in some contexts, and add links to other search engines in some Google search results.

But this extension is interesting to me because it can force HTTPS traffic for Gmail and Google reader, which is especially beneficial for a laptop on a coffee shop wireless network, for example. A recent blog post on dmiessler.com makes a good argument (with packet-sniffing evidence) for encrypting your Gmail traffic. (One of the comments on that post is what directed me to the extension.)

EPEL repository

A new 'extras'-type repository recently opened for Red Hat Enterprise Linux and CentOS: Extra Packages for Enterprise Linux (EPEL). It has packages for versions 4 and 5. This can supplement the extras at CentOS extras and DAG's RPMs.

DNSUnpinning review process

I got email late today saying that my Firefox extension is being retained in the sandbox (staying in development) pending user reviews. So if you are so inclined, I encourage you to post a user review. As an incentive, by downloading the extension, you'll be able to view the source code for a simple Firefox extention (it's got an .xpi extension, but it's really just a zip file). So if you ever had the urge to write an extension, this might be a good place to start.

If you'd like to post a review, you can either sign up for a developer account and post the review that way (here are a few notes about that), or you can write an external review (I assume that comments to this blog would work for that). If you sign up for a developer account, you'll be able to see the extension's sandbox page. Or you can visit the project home page.

To review the extension, go to about:config and search for the network.dnsCacheEntries item. You should be able to see this item's value change between 0 and 1 when toggling the extension menu item. If you run your own DNS or aren't afraid to fiddle with your hosts file, you might be able to observe the browser caching (or not caching) IP addresses.

I don't have access to a Mac, so a review of the extension by a Mac user might be useful. And the more details your review provides, the more likely it is to have an impact on the evaluation process.

DNSUnpinning Firefox extension

I wrote a Firefox extension yesterday. Nothing very exciting--it just toggles a user preference. It's called DNSUnpinning, and can disable/enable IP address caching in Firefox. This has consequences for the same-origin policy in Web browsers: some phishing-related attacks take advantage of the fact that browsers tend to cache IP addresses for 60 seconds.

I created a developer account at the Firefox Add-ons site according to the MozillaZine page about sharing extensions. If you'd like to check out the extension, it's currently available on my DNSUnpinning page. The extensions now goes into a review process, and if it's accepted, it'll start showing up on the list of official Firefox extensions.

Light bulb comparison

Yesterday Neutral Existence published an interesting comparison of incandescent, compact florescent (CFL), and LED light bulbs. Looks like CFLs come out on top, with incandescent in last place. The blog post also points out that LED bulbs have less mercury in them than CFLs, and that LED bulbs may get cheaper over time.

I've never tried LED light bulbs (and only recently bought my first CFLs), but I have an LED flashlight, and I like it. It doesn't seem to focus light as well as a traditional (incandescent) flashlight, but it's pretty bright, and I never have to worry about replacing the bulb. And the batteries seem to last a long time.

Link goatsed

A co-worker just pointed out that a link in my OSCON 2007: Thursday post went to a ghastly gay male porn site. I think it was the correct link at the time (or I may have copied it down wrong), or else something happened to that domain. Anyway, my apologies to anyone who followed that link (slides for the vim talk) and was appalled.