Search Results: "spa"

26 November 2009

Tore S. Bekkedal: Wardialling for the 21st century

The story behind it My SPA2102 Recently, I decided to set up a subscription with a VoIP provider, Phonzo, here in Norway. On their webpage, Phonzo advertised a VoIP service which actually gave you the SIP information and allowed the user to connect their own equipment to this service. That s really cool , I thought. I can play with Asterisk on the PSTN now! . They also advertised an offer with rent of a Linksys SPA2102 included, at a very affordable rate. Now, I suspected that the box might be locked as I d heard they were with some providers so I searched all over their webpage for any hint that it might be. None was to be found and since they included the specific model designation of the adapter rather than mentioning a generic Analogue Telephone Adapter , I basically assumed it wouldn t be crippled. But when it did arrive (impeccable delivery time, and telephony worked out of the box, btw), I found to my dismay that the box was indeed locked. So I sent a polite email to customer service, saying basically that I know this is a matter mostly interesting to enthusiasts, but they ve advertised an SPA2102 , and what I have receieved is a crippled SPA2102 . They basically replied It says rent , so it belongs to us. I replied Renting does not exempt you from marketing laws; you ve sold me something else than what I paid for . I got the reply: We can t open it, it contains sensitive information and it s not crippled, it s optimized for Phonzo service[sic] (!). Yeah, that s really what they said. A few more emails back and forth, and nothing of value came forth. When I received a letter from customer service saying Stop your nonsense, we re providing you a service and the adapter is a part of it I realized I wasn t getting anywhere there. I ve sent an email to the address in the SSL certificate (who also seems to be one of the founders) hoping I d get in touch with someone of relevance, but I don t have great hopes. (There s a copy of the correspondance in Norwegian, if you re interested.) So over to my plan B. The Linksys SPA2102 has two interfaces for an administrator: The first is the HTTP interface bog-standard, with an admin password. The second is the Interactive Voice Response menu you know the kind, Press 1 for x, 2 for y, . Now, this menu has several different options, including one to enable HTTP access on the WAN port . By default, this option is set to False, and changing it requires an administrator password. But how do you enter an alphanumeric password on a DTMF dialpad? Aha the admin passnumber is derived from the admin password! The mapping is 1=1, [2ABCabc] = 2, [3DEFdef] = 3, , (everything else) = 0. This reduces the keyspace quite dramatically! So basically, what I ve done is kludged together a shell script which tries the different combinations and sounds them out using a software DTMF tone generator, with earphones serving as acoustic couplers. (For now, I ve skipped numbers containing a 1 . The number 1 only represents itself, and thus its value is quite low.) It then tries port 80 on its WAN IP every 100 attempts to see if a passnumber has succeeded. The shellscript is accessible here: http://simula.gunkies.org/~toresbe/dtmfbruteforce.bash. The phone adapter has two lines, but the second one is locked by Phonzo however, it is not possible to disable the IVR menu on this thing, so I have full use of the box while this is happening. (It nearly goes without saying that I ve spoofed the DNS so it connects to my Asterisk box. :) ) I m now averaging about one passkey per second. According to my calculations of each passkey representing the number of symbols per digit raised to the power of the number of digits, I am trying 16807 passwords per second and will be trying 117649 passwords per second when I get to six digits. I have a quite technical readership so please do correct me in the comments if I ve made an error in either the calculations or anywhere else. If there are any Phonzo users out there with an SPA2102, I would very much appreciate it if you contacted me brute force works a whole lot better when it s parallelized. I am currently at #302362. I have not yet been contacted by anyone in the same situation.

Josselin Mouette: The new faces of Europe

This is it. We know the faces of people who will count in Europe during the 2009-2014 period. And we can count on them to make the EU weigh even less than it did until now. Jos Manuel Dur o Barroso, president of the European Commission. For 5 years, this ultra-liberal brought in his fanatic views of the free market, leading to unprecedented removals of regulations and legislations that could prevent large corporations to extort money from citizens. He holds a non-negligible responsibility on the (still unsolved) bank crisis of 2007. Yet, citizens voted en masse earlier this year for the EPP all across Europe, leading to his renewal. You get the commission you deserve. Herman Van Rompuy, president of the European Council. This is no secret that this transparent non-leader was the choice of Sarkozy after Tony Blair turned out to be an unsustainable choice. Yet, none of the 26 other members of the Council dared to raise a single finger against this choice. Sarkozy has completely lost his credit in France, but that doesn t prevent this council of cowards from trusting him, apparently. It s not as if there weren t good candidates, like Jean-Claude Juncker or Vaira V e-Freiberga. But having a competent, Europe-friendly president who actually knows his files and speaks many languages would have cast shadows on those who don t (see below). Catherine Ashton, foreign ministry of the EU. If there was any worse possible choice, I don t know which. This was the only position supposed to be affected to a socialist. And since the Labour party is still member of the PASD, despite their insane liberal economic policy and their full-scale paranoia leading to unprecedented freedom hunting in the UK, the position was given to someone from this party. And among them, they chose a person with a reputation of sloppiness and incompetence, who doesn t speak correctly a single foreign language. It is probable that, just like Van Rompuy s going to be Sarkozy s puppet, she s going to be the UK Foreign Office s servant. And we continentals all love the Foreign Office s policy, which is often in complete opposition to what the rest of Europe feels like. Jerzy Buzek, president of the European Parliament. You don t know him? Neither do I. A weak parliament goes with a weak parliament president. This way, the European Council has its hands free for behind-the-curtains arrangements, rather than letting the citizens representatives take action. Martin Schultz, president of the PASD group at the European Parliament. In order to ensure his place as president of the Parliament for the second half of the period, he betrayed his own people, and accepted any rotten compromise the EPP would propose for the key positions. Socialists have never been so weak in Brussels, and the total absence of leadership has something to do with it. Makes you proud to be European, heh? And of course you already know the real faces of Europe for the next years. Sarkozy, Merkel, Berlusconi, Brown. The main leaders from Western Europe, with their rotten governments who swore to slay any of the remaining personal freedoms in each of their countries. What a great image for EU in the world. What a great example to set. But again, you get the leaders you deserve. That s the whole point of democracy.

MJ Ray: Who wikis Who in British Librarianship

It s great to discover this experimental wikified version of W. A. Munford s Who was Who in British Librarianship 1800-1985 (1987). As a statistician who has strayed into serving libraries, I don t know many of the famous names and a lot of the online materials are from the US. This looks like a useful guide (and CC-BY-SA-3.0 which is OK, although the current site has an unfriendly Choice of Law and Forum) and I hope that any UK-based Librarians who read my site will take a look and see if they can help it.

25 November 2009

Erich Schubert: Identifying Link Spammers via nofollow links

I wonder if it's possible to identify link spammers (you know, these bots that mass-submit a link into as many blogs/etc they can find in order to boost their page rank) by the simple measure of how many of the links to their site are marked 'nofollow'.Say, a regular page should have less than 5% (and less than 20) nofollow links; a site that goes significantly above this value probably employs some spam bot.The only really hard thing is how to avoid attacks on a site using this ... say, I write a bot that spams links to Microsoft on as many sites as it can find that DO use 'nofollow', in order to get that site above the limit, and have google penalize it.So in general I don't think Google would automatically penalize such things, still it could be used to e.g. have a human check the destination site for useful content, and then only blacklist when it doesn't seem to be useful.P.S. Which BTW is a reason why some of the SEO "do nots" are bullshit: it would be too easy to deliberately use these to blacken a competitor. So a 'link farm' will at most do nothing to raise your ranking; but Google must not allow you to actually lower a competitors ranking by setting up a link farm to him!)P.P.S. On another side note: Who guarantees that Google actually ignores "nofollow" links? They could also just be assigned a lower weight or a penalty, so that a "nofollow" link from a strong site such as Wikipedia would still be worth a lot, while the average blog comments page link goes down to 0. Say a "nofollow" link from a PR 6 site is as much worth as a regular link from a PR 4 site, and PR 2 becomes PR 0. Would already do much of the trick in discouraging the use of blog spam bots. Because after all, ignoring the links on Wikipedia for page rank would be quite stupid. In German Wikipedia, the page contents are even "sighted" (aka: peer reviewed); this is a rather trustworthy source, especially when you take time effects into account. A link being constantly in Wikipedia on a popular page for more than a month very likely is good.

Russell Coker: Seatbelts and Transporting Computers

I ve just read an interesting post at Making Light about seat-belts [1]. In Australia seat-belt use is mandatory, you can be fined for failing to wear one and the police (who help clean up the mess when someone dies on the road) are apparently quite aggressive about enforcement. Even aside from the legal requirement the use of seat-belts is fairly ingrained in Australian culture, people tend to use them even when they won t get caught. One of the things I like to do in my spare time is to take unused computer gear from IT companies (which they regard as rubbish) and give it to home users for recreational and educational use. Due to that and my work for some smaller IT companies I ve helped many people load computer gear into their private cars and observed that most people will not take adequate care unless I coerce them. A CRT monitor tends to be large and heavy, you wouldn t want to get hit in the back of the head with one at 60Km/h. With some combinations of monitor and car you can fit a monitor in the front passenger foot-well, but usually the only place a monitor will fit is the back seat. The correct thing to do is to use the seat-belt to strap the monitor in place. It s most likely that the monitor stand (the only part that allows a seat-belt to be attached) would snap off in the event of a serious crash but this would at least slow the monitor down. Also don t put the monitor directly behind your seat if you can avoid it, put it behind the passenger seat. In a collision monitor might be able to push through your seat and cause you a back injury. Between 1992 and 2006 there were 78,000 acute computer-related injuries treated in US hospital emergency rooms [2]. The number of injuries caused by monitors peaked at 37% of the total in 2003 this was largely due to monitors falling on people. Even without the speed of a car a monitor can be a dangerous projectile. Hard drives have a lot of potential to cause damage, they are dense, hard, and the corners often aren t rounded. Storing them above the back seat behind the driver s head (as a friend once tried to do) is a really bad idea. Mythbusters showed that a box of tissues isn t going to kill you in a crash, but a hard drive is much more dangerous. The typical car glove box can store a few drives. If you need to transport a box full then the front passenger foot well is a reasonable place. If your car rolls then that would suck, but it seems that people usually die when they roll their car anyway so just try not to do that. A serious server (EG 2RU or bigger rack-mount) typically weighs 30Kg or more and is solidly constructed. The size and mass of such a machine makes it extremely difficult to safely store inside a car. The ideal place is the boot, but if that isn t an option then behind the passenger seat is the next best option. One final issue that I ve been wondering about is the safest option for laptops that are in use in a moving car. A 3Kg Thinkpad would have to hurt if it hit you in the back of the head at 60Km/h. The child-seat attachments are solid anchor points that can be used for other things. I wonder if a laptop security cable could be attached to one of the child seat points. According to an exhibit at a science museum I can throw a tennis ball at 115Km/h, so I presume that laptop security cables are designed not to break when someone swings the laptop at that speed. Therefore if a car was driving at a legal speed in Australia before crashing then a laptop security cable should be able to stop the laptop. Preventing the cable from injuring the passenger on the way would be the difficult part.

Gunnar Wolf: Source format 3.0 (quilt) for teh win!

My Debian QA page shows what I consider to be a huge amount of packages I am currently uploader for 207 packages. Why so many? There are many factors The main one is group maintenance (I'm directly responsible only for 19; of course, this should not mean I disregard the rest of them), the second one is regularity. By far, most of my source packages (177) match lib.*perl, followed by lib.*ruby with 20. Anyway A strong factor that allows the pkg-perl group to be successful in maintaining 1411 packages is the regularity of the task: Packaging Perl modules is usually as easy as running dh-make-perl on them (of course, not taking away the merit of packaging the few strange corner cases In Ruby-land, the landscape is quite different. The developer community is quite anchored in agile worldviews, which go beyond coding practices and all the way over to confronting the way most Free Software projects distribute their work. I have previously ranted presented informed and opinionated blog posts on this topic Ruby culture dictates the distribution via Ruby Gems, which are for many reasons not Debian friendly. Besides Gems, most projects have adopted Git for development tracking and are hosted under Github That's why I came up with Githubredir, which basically presents an uscan-friendly listing of tags for a given project. But if you develop in Git, you might want to split a project in its constituent parts for easier organization, without meaning that each subproject should be an independent project by itself, right? After all, that's what Git submodules are for. That's what happened with a great PDF generating library for Ruby, Prawn. Thing is, the three parts of the main project are required for the project to be built. Anyway, that was a great reason to move the package over to the new dpkg 3.0 (quilt) source format. And, yes, it is a straightforward move! If you have not yet done so, take a look at Raphael Hertzog' explanation+FAQ wiki page. It just works, and makes many things way easier. There are still some wrinkles in my packaging, like where I'm getting the orig tarballs from As the submodules are not presently tagged in any way, I was only able to download a snapshot of their respective current master branches. This is suboptimal, I know, but I have talked to the upstream author, and he confirms that for the next major version (which should not be long in coming) the tags will be synchronized, and things will be even cleaner. PS- I love Hpricot. To get the numbers for my QA page, I just had to get three dirty but useful arrays:
  1. require 'hpricot'
  2. require 'open-uri'
  3. url = 'http://qa.debian.org/developer.php?login=gwolf&comaint=yes'
  4. doc = Hpricot(open(url))
  5. tot = ( (doc / 'table' )[1]/'tr').map row
  6. (row%'td' % 'a').inner_html rescue nil .select i i
  7. team = ( (doc / 'table' )[1]/'tr').map row
  8. (row%'td' % 'span.uploader' % 'a').inner_html rescue nil .
  9. select i i
  10. mine = ( (doc / 'table' )[1]/'tr').map row
  11. (row%'td' % 'span:not(.uploader)' % 'a').inner_html rescue nil .
  12. select i i

And work from the three very simple lists there i.e. tot.select pkg pkg =~ /lib.*perl/ .size gives me 177.

Erich Schubert: Google Wave rolling out?

When I got my Google Wave account, it took the invitation about a week to arrive. A few days ago, I got my first own invites, and invited some colleagues (in an attempt to actually find a use for Google Wave beyond "rich media live messaging"). Within a few minutes they were "in". Now I just got my second set of invites. So is Google Wave now getting ready for mass opening, rocketing user numbers?As you might have already guessed, I'm not convinced by Google Wave. It's technically interesting and well-done. The demos are all nice. It's just that the UI in the browser is a bit fragile and cumbersome, and the big question so far is:
What does Google Wave allow you to do that you couldn't do before?
To me, there has been little actual use so far. Wave can do everything, but isn't optimal in any of them: Yes, I'm aware that you should differentiate between the protocol and the ui. Still pretty much everything is currently designed for the web browser with full JavaScript and Flash capabilities.Of course this isn't the end yet, Google Wave will evolve. Maybe into something cool, maybe it will remain just a niche thing. Maybe some cool apps will just use Wave as protocol. But I figure, I'll mostly wait for these things to happen first before I become a frequent user of Wave.The biggest thing I see is the "spam" (this especially includes 'Quiz', Mafia Wars and similar Scamville type of 'apps' that surely will show up in no time, once Wave is open to the public). What will Wave provide to me to handle this flood of worthless information that I'm getting more and more?P.S. Please don't bother to ask for invitations to Wave.P.P.S. here's how to replace the odd scrollbars with the regular OS scrollbars with a really simple user style (CSS).

Biella Coleman: Ninja Mind Tactics

Over the years far too many years I have occasionally chronicled the slow death of my mother, a death of mind, personality, really person that comes with Alzheimers. She has officially had the illness for 7 years now but had symptoms prior to this time, in the form of perceptual disturbances that are the defining feature of the rare type of Alzheimers she has, Benson s syndrome. As her illness progressed and we saw her doctors they would always ask: what other illnesses or health problems does Vera have? And I would answer none. Without fail and almost immediately, the inquiring doctor would respond back none? often with a slightly raised eyebrow, the one word uttered not to challenge the veracity of my answer, but used instead to convey another meaning, often bathed in some mixture of compassion and pity. It was an acknowledgement of the future that awaited us, basically stating with no other illness, this is going to be on heck of long and difficult haul of a life experience, which has indeed been the case. However, after nearly two years of being bed bound in a nursing home, physical health problems are now creeping in and my mother is descending into different type of hell, especially since she can no longer communicate the physical pain she might be in. The words she knows are few: no and a few other words (she likes to tell people they are loco and indeed I can only imagine how true this accusation of crazy is given that we are keeping her alive against her wishes). Her consistent and persistent wailing, agitation and crying do of course communicate the depth of suffering this being the hardest thing to bear witness to. She does have periods of calm, coaxed in part by the drugs she is given but these are not enough to override the pain she and we feel. About two months ago, her body started to give, the first problem being a fracture that led to significant internal bleeding and required a blood transfusion and a brace she is still wearing. A few weeks ago when I was visiting her, she basically developed these black and red welts on the bottom of her feet in a manner of two days, so instead of boarding a plane to NYC, I took her to the emergency room and stayed a full week while she was pumped with intravenous antibiotics. At first, doctors thought it might be gangrene, which was mortifying mostly because of all the associations that come with it. The doctors determined that it was not in fact gangrene but that she has a bone infection technically called osteomyelitis a tricky condition to treat that requires at minimum 45 days of IV antibiotics. The hospital/doctors who had originally determined she would stay there for her treatment, changed their mind unexpectedly and announced their intention to ship her to a long-term care facility, which in theory we were not opposed to, except for the fact that it is very far from where my sister lives, and also it is a facility we had not verified for ourselves. On top of it, we knew she had a legal right stay in the hospital (though some doctors informed us otherwise). We preferred the hospital because it is so close to our house, we would be able to hire someone to visit her when my sister is at work, and we suspect that she will have additional complications from 45 days of IV abx so why not stick around and receive treatment and care from the same internist who had been nothing but a great doctor. The story took a turn toward the surreal when the infectious disease doctor decided to release her to her nursing home with a treatment of oral antibiotics, even though every single doctor we saw from the emergency room doctor to the weekend internist who subs for her regular doctor, repeatedly informed us the only treatment is IV antibiotics for at least 45 days, possibly more (which is the normal treatment protocol).
Since so many people don t know how to maneuver complaints and take action in hospitals, doctors and other staff can exploit this to make medically dogdy decisions (which happened in fact when a feeding tube was put into my mom, but that is another long story I don t think I ever wrote about here). I am sure also that some doctor s are less willing to take questionable action with certain patients depending on the class and background of their family members but I bet the first impression I give off to doctors, to invoke Erving Goffman s work on self-presentation, is not someone willing to take swift action. In the hospital, I have the sense that most doctors don t take me all that seriously, probably thinking that I am 5 foot slacker/artistic type that I admittedly do look like as I dress in jeans, a hoodie and a winter cap because the hospitals are so effing, ridiculously cold in PR (and I can t help my height nor the fact that I look 24 or so). So it usually comes as a surprise when I bring out my mind ninja tactics developed over years of being and thinking like an academic, whose craft is research, whose passion is arguing, and for some of us who are politically inclined, who love the challenge of righting wrongs. So when this happened I contacted lawyer-friends, talked to the social worker and promptly complained to the head of client services/ombudsperson and made a stink but of a very particular sort: it was packaged in massive tact. I was very deferential (especially since those folks have nothing to do with the mess, they are there to help and are your allies), repeatedly pointed out how the doctor s decision amounts to medical negligence, and made it clear that I was willing to take action, leave my work if need be and get my ass down there, and casually mention how in the 5 hours between their decision and my phone calls, I have already taken action (how I have contacted lawyers on the island, etc). Needless to say, the hospital decided that my mom is staying put in the hospital and I am relieved. But this solace is only of the tiniest sort. I am still reeling from the absurdity of her condition and her suffering. She is only alive because of a feeding tube that I am opposed to, her state of being a modern day zombie that in reality, or at least from my perspective perpetuates her suffering. For this reason, truth be told and at one level relieved that her body is finally failing, that there is a chance, a light at the end of this lonely, now horrific tunnel that her life will end sooner than later. This, however, makes it no easier emotionally nor ethically as it is my mother who must journey alone through significant pain and suffering as her body now goes elsewhere a journey we can watch in person yet are powerless in its face.

Biella Coleman: Ninja Mind Tactics

Over the years far too many years I have occasionally chronicled the slow death of my mother, a death of mind, personality, really person that comes with Alzheimers. She has officially had the illness for 7 years now but had symptoms prior to this time, in the form of perceptual disturbances that are the defining feature of the rare type of Alzheimers she has, Benson s syndrome. As her illness progressed and we saw her doctors they would always ask: what other illnesses or health problems does Vera have? And I would answer none. Without fail and almost immediately, the inquiring doctor would respond back none? often with a slightly raised eyebrow, the one word uttered not to challenge the veracity of my answer, but used instead to convey another meaning, often bathed in some mixture of compassion and pity. It was an acknowledgement of the future that awaited us, basically stating with no other illness, this is going to be on heck of long and difficult haul of a life experience, which has indeed been the case. However, after nearly two years of being bed bound in a nursing home, physical health problems are now creeping in and my mother is descending into different type of hell, especially since she can no longer communicate the physical pain she might be in. The words she knows are few: no and a few other words (she likes to tell people they are loco and indeed I can only imagine how true this accusation of crazy is given that we are keeping her alive against her wishes). Her consistent and persistent wailing, agitation and crying do of course communicate the depth of suffering this being the hardest thing to bear witness to. She does have periods of calm, coaxed in part by the drugs she is given but these are not enough to override the pain she and we feel. About two months ago, her body started to give, the first problem being a fracture that led to significant internal bleeding and required a blood transfusion and a brace she is still wearing. A few weeks ago when I was visiting her, she basically developed these black and red welts on the bottom of her feet in a manner of two days, so instead of boarding a plane to NYC, I took her to the emergency room and stayed a full week while she was pumped with intravenous antibiotics. At first, doctors thought it might be gangrene, which was mortifying mostly because of all the associations that come with it. The doctors determined that it was not in fact gangrene but that she has a bone infection technically called osteomyelitis a tricky condition to treat that requires at minimum 45 days of IV antibiotics. The hospital/doctors who had originally determined she would stay there for her treatment, changed their mind unexpectedly and announced their intention to ship her to a long-term care facility, which in theory we were not opposed to, except for the fact that it is very far from where my sister lives, and also it is a facility we had not verified for ourselves. On top of it, we knew she had a legal right stay in the hospital (though some doctors informed us otherwise). We preferred the hospital because it is so close to our house, we would be able to hire someone to visit her when my sister is at work, and we suspect that she will have additional complications from 45 days of IV abx so why not stick around and receive treatment and care from the same internist who had been nothing but a great doctor. The story took a turn toward the surreal when the infectious disease doctor decided to release her to her nursing home with a treatment of oral antibiotics, even though every single doctor we saw from the emergency room doctor to the weekend internist who subs for her regular doctor, repeatedly informed us the only treatment is IV antibiotics for at least 45 days, possibly more (which is the normal treatment protocol).
Since so many people don t know how to maneuver complaints and take action in hospitals, doctors and other staff can exploit this to make medically dogdy decisions (which happened in fact when a feeding tube was put into my mom, but that is another long story I don t think I ever wrote about here). I am sure also that some doctor s are less willing to take questionable action with certain patients depending on the class and background of their family members but I bet the first impression I give off to doctors, to invoke Erving Goffman s work on self-presentation, is not someone willing to take swift action. In the hospital, I have the sense that most doctors don t take me all that seriously, probably thinking that I am 5 foot slacker/artistic type that I admittedly do look like as I dress in jeans, a hoodie and a winter cap because the hospitals are so effing, ridiculously cold in PR (and I can t help my height nor the fact that I look 24 or so). So it usually comes as a surprise when I bring out my mind ninja tactics developed over years of being and thinking like an academic, whose craft is research, whose passion is arguing, and for some of us who are politically inclined, who love the challenge of righting wrongs. So when this happened I contacted lawyer-friends, talked to the social worker and promptly complained to the head of client services/ombudsperson and made a stink but of a very particular sort: it was packaged in massive tact. I was very deferential (especially since those folks have nothing to do with the mess, they are there to help and are your allies), repeatedly pointed out how the doctor s decision amounts to medical negligence, and made it clear that I was willing to take action, leave my work if need be and get my ass down there, and casually mention how in the 5 hours between their decision and my phone calls, I have already taken action (how I have contacted lawyers on the island, etc). Needless to say, the hospital decided that my mom is staying put in the hospital and I am relieved. But this solace is only of the tiniest sort. I am still reeling from the absurdity of her condition and her suffering. She is only alive because of a feeding tube that I am opposed to, her state of being a modern day zombie that in reality, or at least from my perspective perpetuates her suffering. For this reason, truth be told and at one level relieved that her body is finally failing, that there is a chance, a light at the end of this lonely, now horrific tunnel that her life will end sooner than later. This, however, makes it no easier emotionally nor ethically as it is my mother who must journey alone through significant pain and suffering as her body now goes elsewhere a journey we can watch in person yet are powerless in its face.

Russell Coker: Computer Security and Political Censorship

I ve just been disappointed to read about the DNI (Defence in the National Interest) web site closing down [1]. The final blog post says In the meantime, I ll leave everything up unless we start having more security problems , but unfortunately they have had a number of security problems in the past. I doubt the ability of a Wordpress installation to remain unscathed on the Internet if it s not upgraded regularly. So I think it s only a matter of time before a new bad Wordpress bug is discovered and DNI goes offline for good. In the past I did idly consider volunteering to help them run their site, but apart from a lack of spare time there is the issue that a number of their policy positions are things that I strongly disagree with. I can agree with paleo-cons on a number of issues, but there are also significant areas of disagreement. So it seems that the combination of a lack of skilled system administrators and a lack of good security in their software is reducing their ability to spread their message. While the site content is going to be mirrored on other sites the URLs will break and Google will give it a lower rank. In many ways losing Google ranking is a way of being silenced. I wonder whether the apparent lack of moderate-right political expression on the Internet is partly due to that demographic having less IT skills than the groups who have centrist to left-wing political views and those who have extreme-right views. Naturally anyone can pay to have someone run their web site, but having to pay raises the barrier to entry and eliminates some of the potential contributors. I think it s a bad thing for democracy if the only people who get their voices heard are those who have significant amounts of money or technical skill. One of my hopes for the SE Linux project was that it would increase the longevity of servers while also decreasing the amount of money required to run them. But of course if you have buggy PHP code then there s not much SE Linux can do to help you.

24 November 2009

Luciano Bello: removing your facebook photo tags automagically

Este post tambi n est escrito en espa ol aqu . Privacy at Facebook is heavy-duty. As a big fan of the Worlds Collide Theory I hate be tagged compulsively. I would like to select in which photos appear in my profile and feed. Since I couldn t find that option in the setting menu, I looked for the answer in my favorite scripting language: Python. This 60-lines-long script removes your tag from the latests photos where you has been labeled. You can download it from here. You may run it hourly (or every 15 minutes, or every 5 minutes, depends how paranoid you are) via cron or whatever. Any improvement is welcome. It probably runs on Windows too. If you managed to do it, leave a comment for the others.

Jaldhar Vyas: The Mind of Mnencia

I am pleased to announce that Marco Nenciarini has joined the Dovecot maintainer team. One of his first contributions was converting the package to the 3.0 (quilt) source format which all the cool kids are doing these days. One ongoing problem we have is that Dovecot does not (yet) have a stable ABI for plugins. This affects dovecot-antispam as described in bug #544588 The short term solution is binNMUs but obviously a better long term solution is needed. One idea I've had is to include dovecot-antispam as an additional tarball within the dovecot source package now that 3.0 (quilt) gives us that capability. This way, dovecot-antispam will be rebuilt (with the right dependencies) whenever dovecot is. I have previously experimented with multiple tarballs and it works although at the moment all the debian build tools (devscripts, *-buildpackage etc.) don't fully support it. I expect that will be rectified soon enough but there is a philosophical issue as well. dovecot and dovecot-antispam though related, are two seperate upstream projects with seperate versioning, maintainers etc. Does it make sense to lump them together? I say yes; conceptually they belong together. (dovecot-antispam is useless except as a dovecot plugin.) In fact we have many source packages like this, that only exist as workarounds for a flaw the lack of source dependencies in the packaging system. However when I brought this up on IRC, there was some disagreement. So I put it to this august assembly, should source packages combine related but distinct upstream sources or not?

23 November 2009

Jon Dowland: sid fail

Every now and then I have a demoralising experience with the quality of Debian packages in sid. That's to be expected, sid is a development distribution, but it still sometimes gets on my nerves. I've decided to write about some of my experiences. Some rules: I may not rant without Earlier in the week I was interested in doing some very simple video editing. A bit of searching and I come across the name of a potentially useful program: 'pitivi'. As luck would have it, there's a Debian package! However, the program within won't run. I also discovered more or less immediately that the package (provided a useless, whitespace only README file)[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=556850]. Today I was looking at tracing stuffs, and I discovered etrace. The very first action I tried after installing it was to look in /usr/share/doc/etrace -- which was devoid of documentation. (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=514083)

Russell Coker: Laptop Reliability

Update: TumbleDry has a good analysis of the Square Trade report [0]. It seems that there are significant statistical problems in Square Trade s analysis and a possible conflict of interest. Square Trade did a survey of laptop reliability and wrote an interesting article about the results [1]. One thing to keep in mind when reading them is that the usage patterns vary greatly by type of product (netbook vs laptop) and probably by brand. Their statistics indicate that netbooks are less reliable than laptops, but I think that my actions in taking my EeePC to places such as the beach are probably not uncommon a netbook is ideal when you might need access to a computer at a moment s notice. I expect that the reliability of my laptop has increased because I bought a netbook! Their statistics show that Lenovo is far from the most reliable brand, I wonder what the usage scenarios for such machines are. I ve been using Thinkpads happily for over 11 years. I have had many warranty repair jobs, I lost count long ago. But I don t think that this indicates a problem with Thinkpads, my use is very demanding, I have done a lot of traveling, and done coding in planes, trains, trams, and taxis in many countries. So instead of criticising IBM/Lenovo for having their machines break, I praise them for repeatedly repairing them no matter how they wear out in my use. The speed and quality of the repair work is very impressive. Based on this I have been strongly recommending Thinkpads to everyone I know who seems likely to wear laptops out through basically doing everything that a laptop is designed to do all day every day! Among people I know the incidence of laptop warranty repairs is probably about 100% as the number of systems that are never repaired are outweighed by the systems that are repaired multiple times. Generally Thinkpads seem fairly well built to me, I ve been surprised at how many times they didn t break when I expected them to. When articles like the one from Square Trade are discussed people usually cite personal anecdotes. My above anecdote covers just over 11 years of intensive use of four different Thinkpads. Of course it doesn t prove much about the inherent reliability of Thinkpads (I could have received through random selection either four Thinkpads that were significantly more or less reliable than average). But having dealt with the IBM/Lenovo service in a few countries I can confirm the quality of their repair work. Every time they have returned my machine rapidly, they never complained about my policy of giving them a system with the hard drive removed, and in all but one case they completely solved the problem on the first try. One time they forgot to replace a broken rubber foot and to make up for this they sent me a complete set of spare parts by courier they had repaired the other two faults without problem. Now comparing the reliability of rack-mount servers would be a lot easier. The vast majority of such systems are stored safely in racks all the time and tend not to be mishandled. My experience with servers from Dell, HP, IBM, and Sun is that apart from routine hard drive failures they all run well if you keep them cool enough. But of course as I haven t run more than a few dozen of any of those brands at one time I don t have anything near a statistically significant sample.

Martín Ferrari: Movies

Just wanted to share comments on some movies I've watched recently. Tags: Planet Lugfi, Planet Debian

Benjamin Mako Hill: The Computer (Still) in My Pocket

The Computer in My Pocket -- which I intended mostly as a one-off blog-post -- ended up having some legs. First, Carolina Flores Hine translated the essay into Spanish. More recently the FSF published a slightly patched-up version in the Fall 2009 bulletin, sent to all members, along with a bunch of more interesting writing by other free software folks. Certainly, there is growing recognition in our communities that phones are a critical battleground in the fight for software freedom. More exciting for me though, my post elicited a bunch of comments from folks pointing to promising projects (Replicant was just one often cited example) making real progress toward freedom for all the computers in our pockets. I knew about most of them, but growing knowledge and excitement about problems and potential solutions was striking. There is an enormous amount to do, but there are reasons to believe that all is not lost.

22 November 2009

Julien Valroff: Converted my packages to 3.0 (quilt) source format

I have now finished converted most of the packages I maintain (part of the official archive or not) to the new 3.0 (quilt) source format. I first had to switch from dpatch or cdbs simple-patchsys to quilt, which was easy thanks to Romain Francoise s old blog post. Also note this quick adaptation for cdbs:
for i in $(ls debian/patches/*.patch); do \
    I=$(basename $i   sed 's/.patch$//'); \
    quilt import -P $I.diff $i; \
done
The rest was much easier than what I thought, thanks to the related page on the wiki. I have already tried uploading a package to my personal repository, and reprepro just worked as expected.

Russell Coker: Planning Servers for Failure

Sometimes computers fail. If you run enough computers then you encounter failures regularly. If the computers are important then you need to plan for the failure. An ideal situation is to have redundant servers. Misconfigured clusters can cause more downtime than they can prevent and it requires more expensive hardware to properly implement a cluster (you need at least two servers and hardware to allow a good node to kill a bad node) as well as more time (from people who may charge higher rates). Most companies don t have redundant servers. So if you have some non-redundant servers there seem to be two reasonable options. The first one is to use more expensive hardware on a support contract. If a server is really important to you then get a 24*7 support contract it only takes an extra mouse click (and a couple of thousand dollars) when ordering a Dell server. I am not going to debate the relative merits of Dell vs IBM vs HP at this time, but I think that most people will agree that Dell offers significant advantages over a white-box server, both in terms of quality (the low incidence of failure) and support (including 24*7 part replacement). The second option is to have a cheap server that can be easily replaced. This IS appropriate for some tasks. For example I have installed many cheap desktop systems with two IDE disks in a RAID-1 array that run as Internet gateway systems for small businesses. The requirements were that they be quiet, use little power (due to poorly ventilated server rooms / cupboards), be relatively reliable, and be reasonably cheap. If one of those systems suddenly fails and no replacement hardware is available then someone s desktop PC can be taken as a replacement, having one person unable to work due to a lack of a PC is better than having everyone s work impeded by lack of Internet access! This ability to swap hardware is dependent on the new hardware being reasonably similar. Finding a desktop PC in an office today which can support two IDE disks and which has an Ethernet port on the motherboard and a spare PCI slot is not too difficult. I expect that in the near future such machines will start to disappear which will be an incentive for using systems with SATA disks and USB keyboards as routers. This evening I had to advise someone who was dealing with a broken server. The system in question is mission critical, was based on white-box hardware, and had four SATA disks in a LVM volume group for the root filesystem. This gave a 600G filesystem with less than 10G in use. If the person who installed it had chosen to use only a single disk (or even better two disks in a RAID-1 array) then there would have been a wide range of systems that could take the disks and be used to keep the company running for business tomorrow. But finding a computer that can handle four SATA disks is a little more tricky. Of course running a mission critical server that doesn t use RAID is obviously very wrong. But using four disks in an LVM volume group both increases the probability of a data destroying disk failure and makes it more difficult to replace the computer itself. Some server installations are fractally wrong.

Raphael Geissert: it's time...



Vote Earth!



Why vote?


World leaders are set to discuss new ways to deal with climate change at the UN Climate Change Conference in Copenhagen, 7-18 December 2009. This new deal will replace the Kyoto Protocol and set new standards for reducing harmful emissions and global warming.

21 November 2009

Sandro Tosi: Goodbye MIA team

I can't simply put up any longer with all the shit thrown on the face being unable to do punish such bad behavior. There are just so many other things that increase my anger (like, for example, "WTH is python2.6 still not in unstable?!") that I don't need another one.

For sure, I don't advocate or encourage anyone to join the MIA team, and I'm speaking with a lot of experience... There is a proposal, from zack, to restructure how MIA works (another bright example of collaboration...): when will it be implemented? nobody knows. will it help? I don't think so (much).

My work (MIA work in general) was almost invisible, like invisible were all the harsh and aggressive replies I got. The nice part is that those replies came from people with the worst situation. Something like:
and several other non-sense replies doesn't leave anything but a huge frustration in you.

And when you got really pissed off, and want to see some sort of reaction on such bad and unmotivated attacks and ask the "People with Powers", what do you got? "sorry, we can't do anything to help you, it's your problem". Something should be done to protect people from fuckheads, make them behave, or else kick them out of the project as far away as we can. But what we got is nothing (and nothing seems to be changing on this side).

Well, now it's not my problem anymore, it's someone else: in perfect Debian-style.

Next.

Previous.