77020 packets transmitted, 18029 received, 76% packet loss, time 77049435ms
rtt min/avg/max/mdev = 20.026/130.848/2245.752/287.550 ms, pipe 3 Above are the ping results from pinging my server (hosted on a business DSL connection). Telstra stuffed up and appear to have entirely disconnected DSL for a few suburbs (based on reports from a client who has several clients in that region that all went offline simultaneously). It’s affected at least two ISPs (every DSL service uses Telstra’s backbone). The above ping results show almost 17 hours of outage, but it was really more like 18 (I didn’t start pinging until I realised it was down). Telstra’s response to the problem reports (which my client raised via two ISPs) was that it would take until the end of the next business day. The problem was reported at 10AM, so Telstra was apparently happy with two entire business days of outage. I think that the root cause of such problems is the terrible performance of Sol Trujillo [1] (or “Telstra’s Sole True Hero” as suggested in Crikey [2]). Under Sol’s leadership Telstra stock has not performed well (it’s a monopoly - it’s supposed to reap money), it’s lost market share in every area where competition is permitted and it hasn’t made it’s customers happy. Sol is taking an approach to business that works well for some big companies in the US (and for the mining and automative industries in Australia). He has been trying to force the government to extend the Telstra monopoly with the Fibre To The Node (FTTN) plan [3]. His idea was to have small Telstra boxes (nodes) spread around the suburbs with short copper runs to each home, each node would have absolutely no spare space for other ISP equipment and therefore the other ISPs would not be able to provide a service. The claim was that FTTN was needed for decent performance but ADSL2+ has been shown to work well in the areas where FTTN was proposed. Telstra even sent out brochures to stock-holders encouraging them to lobby members of Parliament on behalf of Telstra’s rent seeking [4]. However Australia is not like the US and this didn’t work, they couldn’t even get Telstra stock holders to support such plans. Speaking for myself, my interests as a Telstra stock-holder (and I own more Telstra shares than the median stock holder) are vastly outweighed by my interests as a consumer of telecommunications services. I would like to see the government nationalise the local loop and the exchange buildings and then provide fair and equal access to all telephone companies and ISPs (including Telstra). Then we can have true competition in this market and the companies that provide the best services will win. Currently Telstra resembles one of those inefficient Soviet monopolies. We need some capitalism in the telco industry!

• [1] http://en.wikipedia.org/wiki/Sol_Trujillo


• [2] http://www.crikey.com.au/


• [3] http://www.zdnet.com.au/news/communications/soa/Optus-threatens-war-over-Telstra-s-fibre-plans/0,130061791,139225166,00.htm


• [4] http://en.wikipedia.org/wiki/Rent_seeking

Share This

Thanks to the Virtuzzo developers for forward porting the OpenVZ patch to 2.6.26. It uses a lot of the already merged namespace features (For interested peoples linux-next carries interesting sysfs patches). The openvz upstream merge statistic is impressive. The namespace solution allows low overhead, while still running multiple Linux distributions in individual containers on the same box. Control over the network vitalisation is gained as a resource management for CPU power, I/O bandwidth and disk space. Live migration including snapshotting is possible too. The Debian 2.6.26 Linux images will feature not only better Xen vitalisation support, kvm port to new archs, but also an opvenvz flavour. Please don't forget to install proper vzctl userspace support as the correct dependencies have not yet been added. Supported archs will start with both x86 and the ia64 archs. Tomorrows linux-2.6 Debian trunk snapshots will already build openvz. Thanks for your feedback. P.S.: 2.6.26 is the targeted kernel for Lenny, we hope to convince Debian installer people to pick it up soonest - 2.6.25 is a not so bad backup plan as release hasn't fully approved 2.6.26 before extensive unstable testing.

Finally the pwnie award nominations are out, a bit late though.

Of course we also got our nomination for the infamous openssl issue in the Most Epic FAIL category as well as one nomination for Luciano for the discovery of this in the Mass0wnage section :/

I nominated Wonderware (I wrote about that before) in the Lamest vendor response category, looks like it has been accepted.

wordpress also got its place in the Mass0wnage category:

An unbelievable number of WordPress vulnerabilities (CVE-2008-*)

Discovered by: everybody who cared to look

It seems like hardly a week goes by without a new vulnerability in WordPress or one of its many plugins. Many of them are actively being exploited to own popular WordPress blogs and use them to serve spam or client-side exploits to unsuspecting visitors. The popularity of WordPress combined with the abysmal security practices of WordPress plugin developers places the entire Internet at risk and is worty of a nomination.

138 reported vulnerabilities since 2004 referring to MITRE, shocking!

I have just bought a EeePC 701 [1], I chose the old model because it’s significantly smaller than the 90x series and a bit lighter too and it had Linux pre-loaded. Also it was going cheap, while I am not paying for it I give the same attention to saving my clients’ money as to saving my own. I ruled out everything that was heavier or larger than an EeePC 901 and everything that cost more than $700. That left only the Linux version of the EeePC 901 (which I couldn’t find on sale) and the EeePC 701 as my options. I also excluded the EeePC 900 because it is bigger and heavier than the 701 but has the same CPU (and therefore can’t run Xen). In terms of it’s prime purpose (a SSH client) 96*22 characters is the size of a konsole screen with the default (medium) font size when the window is maximised, that is 5% more characters than the standard terminal size of 80*25 but the smaller number of lines is a problem. When using the small font I can get 129*29 which I find quite comfortable to read (it would be impossible for me to read withut glasses - which means having almost average vision for someone in their 30’s). Then I can get 129*31 if I dismiss the tool bar at the bottom of the screen and could probably get another couple of rows if I removed the tabs that Konsole uses to switch between sessions. That would only be viable if using screen extensively as a single session without the ability to switch between programs is not particularly useful (I don’t think that ALT-TAB is adequate for switching between terminal sessions). When running Debian I can get 130*32 with the same font due to smaller window controls, but I’ll write more about converting to Debian in another post. Note that while the OS that ships with the Linux based EeePC machines is based on Debian, it is heavily customised and has some notable differences from a typical Debian install. It has some proprietary software, and uses unionfs for the root and /home filesystems. The first issue is that Console (the KDE terminal program) can only be accessed from the file manager (via the tools menu or ^t), the machine clearly doesn’t have defaults for someone like me. In principle it’s a multi-user system that can be fully customised, but in practice it’s configured as a single-user machine. Once you have a Console window open you can run “su -” and the root password is the password for the “user” account. I wonder whether I could get more than 42 rows or more than 140 columns of text that is readable. If so then I could have two console windows fully displayed on screen. The screen is bright and clear, this is essential as the number of pixels per character is going to be low for any reasonable amount of text to be displayed on screen. The password that you set when you first use the machine also works for “su -” (in fact that is the only real use as I expect that almost everyone will choose the automatic login option). The display comprises a significant portion of the weight, if the screen is fully open (about 150 degrees) then it will tip over. Even when the screen is not as far open it will tip due to bumps if resting on your lap on a tram. It’s a pity that the screen is connected at the very back of the base, if the attachment point was a bit closer then it would balance better and also be easy to hold with one hand. The depth of the machine combined with the angle at the back makes it impossible for me to get a good one-handed grip from the base, so typing while standing on a moving tram or bus will be extremely difficult (unlike my iPaQ which I can use at full speed on any form of public transport). Inidentally it would be good if there was an attachment point for a wrist-strap, every camera and most mobile phones have them so it would be good to have the same safety feature in a laptop to facilitate use on public transport. Another reason for not using it as a PDA is the fact that it takes about 7 seconds to resume after hibernating (when the lid is closed). The PSU is almost as small as that of a mobile phone! This is a major benefit as in the past I have often stored a Thinkpad PSU at a client site for 9-5 jobs as it is heavy enough that I didn’t want to carry it on public transport. The EeePC PSU is light enough that it won’t be unpleasant to carry, and small enough to fit easily into a jacket pocket. The OS installation is very well done for the basics. It’s easy to launch applications and there is a good selection of educational programs (including the periodic table, planetarium, typing, letters, and hangman, drawing, and a link to www.skoool.com). It’s a pity that they organised the folders according to the area rather than the age, but generally the OS is very well done. Most of the reviews focus on the speed of the CPU, the RAM expansion options, etc, but miss the fact that it is a really nice machine for using as-is. It is a much better machine for teaching children than any of the machines I’ve seen which are sold specifically for children (see my previous post about an awful computer for kids [2]). I believe that you could give an EeePC to any 3yo and have them doing something useful in a matter of minutes! The ability to freely install new software should not be overlooked when considering a computer for children to use. Someone who buys one now could use it for a few years as an ssh client and then reinstall the original OS and give it to a child as an educational toy. It has a program to create OGG video files from it’s built-in camera and mic, at this moment it’s the only device I own that can create OGG files (this is a good thing). OGG compression takes a really long time, the Atom CPU in the 901 and 1000x series would be good for this. It’s a pity that the microphone is directly below the mouse buttons, it clearly records the mouse click used to finish recording. The version of mplayer which is installed to play OGG files can also play FLV files downloaded from youtube with youtube-dl (althrough the file association is not set). When I tried to play a MP4 file from ted.com it only gave audio (the video works on a full Debian/Etch installation). There is a full set of office software, OpenOffice.org, Thunderbird email client, and all the other stuff you might expect. I find that the biggest problem for using it is the size of the keyboard, I don’t think I’ll ever be able to touch-type properly on it. Not only are the keys small but the positions of non-alphabetical keys are slightly different from most keyboards. Another problem is that the space-bar needs to be pressed near the centre, I usually like to press near the end but that doesn’t work. Those issues are all trade-offs of the small size. My T series Thinkpad is reasonably portable and has a great keyboard so I have the serious typing while travelling angle covered. One real mistake in the keyboard design is the lack of a LED to indicate whether caps-lock is enabled (there are four status LEDs, adding number five couldn’t be that expensive), this is a real problem when using the vi editor (which uses letters as editor commands and is case-sensitive). It will also occasionally cause problems when entering passwords. There is a caps-lock indicator on screen, but that is in the toolbar at the bottom of the scren (which I like to dismiss to gain an extra two lines of text). It would be good if I could display the status of the caps and num lock keys in the right side of the title-bar of the active window (the only bit of unused space on the screen). The cooling fan makes an annoying buzz. It’s significantly louder than Thinkpads which dissipate a lot more heat. The other problems are all software, which is OK as I plan to reinstall it. Firstly it is using Debian and shipped with the broken openssl library. There is a GUI for installing upgrades, but it recommends rebooting after installing each one! Naturally I didn’t choose to reboot, I installed the security update #1. Then I clicked on the button to install a BIOS update. It told me that it had to reboot to apply the update and gave only one button (OK), I tried closing the window but it rebooted anyway (fortunately the vi swap file allowed me to recover this post - which I am entirely writing on the EeePC). Aftere booting up again I discovered that the libssl bug still wasn’t fixed and that there was a second udate to apply! Why can’t they have a “apply all updates” button and also have it not automatically reboot? This must be the only Debian-based distribution that forces Windows-style reboots. But that said, while they made some mistakes in their software it generally provides a good user experience

• [1] http://en.wikipedia.org/wiki/Eeepc


• [2] http://etbe.coker.com.au/2008/07/07/awful-computers-for-kids/

Share This

I recently had to setup netconsole in order to diagnose some grsecurity-related suspend/resume problems. The idea is to have the broken machine send its kernel messages to a remote machine via the network.
As a prerequisite, the local machine (the one sending the console messages) must have the following kernel options turned on:

• CONFIGFS_FS
• NETCONSOLE
• NETCONSOLE_DYNAMIC

(The first and last ones are required in order to be able to configure netconsole after boot, through the configfs interface.)The remote machine should be told (using netcat) to listen on a specific UDP port (64001 in this example):

netcat -l -p 64001 -u -s 192.168.1.1 2>&1 tee /root/netconsole.log

Then, running this script on the local machine will turn netconsole on (don't forget to customize the appropriate parameters for your environment):

#!/bin/sh
modprobe configfs
umount /sys/kernel/config 2> /dev/null
mount -t configfs none /sys/kernel/config
modprobe netconsole
mkdir  /sys/kernel/config/netconsole/hostname
echo "xx:xx:xx:xx:xx:xx" >  /sys/kernel/config/netconsole/hostname/remote_mac
echo 192.168.1.1 >  /sys/kernel/config/netconsole/hostname/remote_ip
echo 64001 >  /sys/kernel/config/netconsole/hostname/remote_port
echo 192.168.1.2 >  /sys/kernel/config/netconsole/hostname/local_ip
echo 64001 >  /sys/kernel/config/netconsole/hostname/local_port
echo eth1 >  /sys/kernel/config/netconsole/hostname/dev_name
echo 1 >  /sys/kernel/config/netconsole/hostname/enabled
dmesg -n 8

That's all you need to start seeing messages on the remote machine's screen.
Interested readers may want to look at other ways to configure and use netconsole.

( I love acronyms :-D )

At this point, all of you should know and see how the H D Moore s toys work. Those toys attack SSH public-key authentication using clone keys and online brute force.

Furthermore, many of you know that there are other effects produced by a biased PRNG besides this one.

Strangely, I could not find more of those toys exploiting these aspects. So, I would like to show you a Wireshark patch which attacks Perfect Forward Secrecy (PFS) provided by Ephemeral Diffie Hellman (EDH).
Introduction to EDHLet s put it in plain words (if you know what we are talking about, ignore this and jump to the next heading):
In an insecure communications channel the parties agree a common key to cipher their dialog. This is what happens in SSL (in most of the cases, depending on the cipher suite):

• The server selects a random prime p and a generator g of the field Z*_p (Let s ignore the mathematical properties of these values). So, the components p and g are public.
  
• The server picks a secret random number X_s and calculates Y_s=g^X_s mod p. Y_s is public and is sent to the client (just like p and g).
  
• The client does something similar, selecting a secret random number X_c and calculating Y_c=g^X_c mod p too. The client makes Y_c public by sending it to the server.
  
• The shared secret s is the public key of the other part to the exponential of the own private number, all in p modulus. That is, for the client s=Y_s^X_cmod p and for the server s=Y_c^X_smod p.
  
• With this shared secret the parties can encrypt all the following messages in a secure way.
  
• In the Ephemeral Diffie Hellman (EDH), the private numbers are ruled out, so s is mathematically secure and nobody can obtain it even having access to one of the parties after the aforementioned handshake.
  

The exploit If an eavesdropper can explore the complete private key space (the all possible numbers for X_c or X_s), he/she will be able to get access to the shared secret. With it all the communication can be deciphered. That s what this patch can do.

A Wireshark with this patch and a list of possible private keys will try to brute force the share secret. If one of the parties is using the vulnerable OpenSSL package the communication is totally insecure and will be decrypted.

• The patch for Wireshark 1.0.2 can be downloaded from here.
  
• Debian packages with the patch applied can be found here.
  
• This is a list of all 2¹⁵ possible 64 and 128 bit DH private keys in systems vulnerable to the predictable OpenSSL PRNG described by DSA-1571.
  
• An example of a pcap file can be found here (it was built with a vulnerable client and one of the Moore toys, a hacked getpid by running $ MAGICPID=101 LD_PRELOAD= getpid.so ./vulnerable-openssl/apps/openssl s_client -connect db.debian.org:443 )

The patch was submitted in order to be committed on the Wireshark trunk. There you can find the patch against the on-develop source revision 25765.
Issues that can be improvedWe (the other developers and myself) detected few things to be improved. But we will do nothing for them. So, if you want to contribute with some code, start from these items and submit the patches to the Wireshark s bugzilla:

• When the packets are out-of-order the decipher with stop itself.
  
• The brute force attack should run in a background process (and with a progress bar)
  
• Check the length of the keys before trying to brute force them.
  
• The patch also implements the display of public DH parameters in the packet tree. It s incomplete.

CreditsPaolo Abeni <paolo.abeni at email.it>
Luciano Bello <luciano at debian.org>
Maximiliano Bertacchini <mbertacchini at citefa.gov.ar>

This work was partially supported by Si6 Labs at CITEFA, Argentina.

UPDATE Jul. 21st: See more and updated info here, especially this.

( I love acronyms :-D )

At this point, all of you should know and see how the H D Moore s toys work. Those toys attack SSH public-key authentication using clone keys and online brute force.

Furthermore, many of you know that there are other effects produced by a biased PRNG besides this one.

Strangely, I could not find more of those toys exploiting these aspects. So, I would like to show you a Wireshark patch which attacks Perfect Forward Secrecy (PFS) provided by Ephemeral Diffie Hellman (EDH).
Introduction to EDHLet s put it in plain words (if you know what we are talking about, ignore this and jump to the next tittle):
In an insecure communications channel the parties agree a common key to cipher their dialog. This is what happens in SSL (in most of the cases, depending on the cipher suite):

• The server selects a random prime p and a generator g of the field Z*_p (Let s ignore the mathematical properties of these values). So, the components p and g are public.
  
• The server picks a secret random number X_s and calculates Y_s=g^X_s mod p. Y_s is public and is sent to the client (just like p and g).
  
• The client does something similar, selecting a secret random number X_c and calculating Y_c=g^X_c mod p too. The clients makes Y_c public by sending it to the server.
  
• The share secret s is the public key of the other part to the exponential of the own private number, all in p modulus. That is, for the client s=Y_s^X_cmod p and for the server s=Y_c^X_smod p.
  
• With this share secret the parties can encrypt all the following messages in a secure way.
  
• In the Ephemeral Diffie Hellman (EDH), the private numbers are ruled out, so s is mathematicaly secure and nobody can obtain it even having access to one of the parties after the aforementioned handshake.
  

The exploit If an eavesdropper can explore the complete private key space (the all possible numbers for X_c or X_s), he/she will be able to get access to the share secret. With it all the communication can be deciphered. That s what this patch can do.

A Wireshark with this patch and a list of possible private keys will try to brute force the share secret. If one of the parties is using the vulnerable OpenSSL package the communication is totally insecure and will be decrypted.

• The patch can be downloaded from here.
  
• Debian packages with the patch applied can be found here.
  
• This is a list of all 2¹⁵ possible 64 and 128 bit DH private keys in systems vulnerable to the predictable OpenSSL PRNG described by DSA-1571.
  
• An example of a pcap file can be found here (it was built with a vulnerable client and one of the Moore toys, a hacked getpid by running $ MAGICPID=101 LD_PRELOAD= getpid.so ./vulnerable-openssl/apps/openssl s_client -connect db.debian.org:443 )

The patch was submitted in order to be committed on the Wireshark trunk. There you can find the patch against the on-develop source revision 25765.
Issues that can be improvedWe (the other developers and myself) detected few things to be improved. But we will do nothing for them. So, If you want to contribute with some code, start from these items and submit the patches to the Wireshark s bugzilla:

• When the packets are out-of-order the decypher with stop itselft.
  
• The brute force attack should run in a background process (and with a progression bar)
  
• Check the length of the keys before trying to brute force them.
  
• The patch also implements the display of public DH parameters in the packet tree. It s incomplete.

CreditsPaolo Abeni <paolo.abeni at email.it>
Luciano Bello <luciano at debian.org>
Maximiliano Bertacchini <mbertacchini at citefa.gov.ar>

This work was partially supported by Si6 Labs at CITEFA, Argentina.

One of the most exciting things about the computer industry these days is the ease with which can get started. Decent computers can be had for well south of $1000, hosting is cheap, services like Amazon EC2 make it ever easier to scale rapidly should the need arise, and the only other things you need are an internet connection and a place to sit. This is leading to more people, like 37 Signals to question the need for investment entirely and others, like YCombinator to successfully make very small investments (thousands of dollars, rather than millions). Sometimes, however, I wonder - is it just a passing moment in time, a window of opportunity, or is it a long term trend? Historically, to set up something like a factory required a great deal of money, putting it beyond the reach of anyone unable to obtain financing. Even in this day and age, there are plenty of endeavors that require large amounts of capital, and a lot of time, prior to seeing returns: that's how things work in my wife's field, biotech. Some fields have even become more expensive with time. High end computer games are very expensive propositions in this day and age, compared to the low budget stuff typical of, say, the Commodore 64 era, although it's also true that the market has also grown a lot, and that there is still space for smaller-budget operations. How does all this look historically? Have there been industries in the past where it was so easy to get started? Anything that was able to scale? By which I mean: it might have been relatively easy to start some kind of small business, but it would most likely always stay small, whereas things like Craigslist or 37Signals have the means to grow a great deal without adding lots of people. Will things change in the future so that one or a few programmers can't compete with a big team? Or perhaps things will go in the other direction and more industries will become like computing is today and it will be possible to a biotech startup in your home office?

There is a lot of interest in making organisations “green” nowadays. One issue is how to make the IT industry green. People are talking about buying “offsets” for CO2 production, but the concern is that some of the offset schemes are fraudulent. Of course the best thing to do is to minimise the use of dirty power as much as possible. Of course the first thing to do is to pay for “green power” (if available) and if possible install solar PV systems on building roofs. While the roof space of a modern server room would only supply a small amount of the electricity needed (maybe less than needed to power the cooling) every little bit helps. The roof space of an office building can supply a significant portion of the electricity needs, two years ago Google started work on instralling Solar PV panels on the roof of the “Googleplex” [1] with the aim of supplying 30% of the building’s power needs. For desktop machines a significant amount of power can be saved if they are turned off overnight. For typical office work the desktop machines should be idle most of the time, so if the machine is turned off outside business hours then it will use something close to 45/168 of the power that it might otherwise use. Of course this requires that the OS support hibernation (which isn’t supported well enough in Linux for me to want to use it) or that applications can be easily stopped and restarted so that the system can be booted every morning. One particular corner case is that instant-messaging systems need to be server based with an architecture that supports storing messages on the server (as Jabber does [2]) rather than requiring that users stay connected (as IRC does). Of course there are a variety of programs to proxy the IRC protocol and using screen on a server to maintain a persistent IRC presence is popular among technical users (for a while I used that at a client site so that I could hibernate the PowerMac I had on my desktop when I left the office). It seems that most recent machines have BIOS support for booting at a pre-set time. This would allow the sys-admin to configure the desktop machines to boot at 8:00AM on every day that the office is open. That way most employees will arrive at work to find that their computer is already booted up and waiting for them. We have to keep in mind the fact that when comparing the minimum pay (about $13 per hour in Australia) with the typical electricity costs ($0.14 per KWh - which means that a desktop computer might use $0.14 of electricity per day) there is no chance of saving money if employee time is wasted. While companies are prepared to lose some money in the process of going green, they want to minimise that loss as much as possible. The LessWatts.org project dedicated to saving energy on Linux systems reports that Gigabit Ethernet uses about 2W more power than 100baseT on the same adapter [3]. It seems most likely that similar savings can be achieved from other operating systems and also from other network hardware. So I expect that using 100baseT speed would not only save about 2W at the desktop end, but it would also save about 2W at the switch in the server-room and maybe 1W in cooling as well. If you have a 1RU switch with 24 Gig-E ports then that could save 48W if the entire switch ran at 100baseT speed, compared to a modern 1RU server which might take a minimum of 200W that isn’t very significant. The choice of server is going to be quite critical to power use, it seems that all vendors are producing machines that consume less power (if only so that they can get more servers installed without adding more air-conditioning), so some effort in assessing power use before purchase could produce some good savings. When it comes time to decommission old servers it is a good idea to measure the power use and decommission the most power hungry ones first whenever convenient. I am not running any P4 systems 24*7 but have a bunch of P3 systems running as servers, this saves me about 40W per machine. It’s usually the case that the idle power is a significant portion of the maximum power use. In the small amount of testing I’ve done I’ve never been able to find a case where idle power was less than 50% of the maximum power - of course if I spun-down a large number of disks when idling this might not be the case. So if you can use one virtual server that’s mostly busy instead of a number of mostly idle servers then you can save significant amounts of power. Before I started using Xen I had quite a number of test and development machines and often left some running idle for weeks (if I was interrupted in the middle of a debugging session it might take some time to get back to it). Now if one of my Xen DomU’s doesn’t get used for a few weeks it uses little electricity that wouldn’t otherwise be used. It is also possible to suspend Xen DomU’s to disk when they are not being used, but I haven’t tried going that far. Xen has a reputation for preventing the use of power saving features in hardware. For a workstation this may be a problem, but for a server that is actually getting used most of the time it should not be an issue. KVM development is apparently making good progress, and KVM does not suffer from any such problems. Of course the down-side to KVM is that it requires an AMD64 (or Intel clone) system with hardware virtualisation, and such systems often aren’t the most energy efficient. A P3 system running Xen will use significantly less power than a Pentium-D running KVM - server consolidation on a P3 server really saves power! I am unsure of the energy benefits of thin-client computing. I suspect that thin clients can save some energy as the clients take ~30W instead of ~100W so even if a server for a dozen users takes 400W there will still be a net benefit. One of my clients does a lot of thin-client work so I’ll have to measure the electricity use of their systems. Disks take a significant amount of power. For a desktop system they can be hibernated at times (an office machine can be configured such that the disks can spin-down during a lunch break). This can save 7W per disk (the exact amount depends on the type of disk and the efficiency of the PSU - (see the Compaq SFF P3 results and the HP/Compaq Celeron 2.4GHz on my computer power use page [4]). Network booting of diskless workstations could save 7W for the disk (and also reduce the noise which makes the users happy) but would drive the need for Gigabit Ethernet which then wastes 4W per machine (2W at each end of the Ethernet cable). Recently I’ve been reading about the NetApp devices [5]. By all accounts the advanced features of the NetApp devices (which includes their algorithms for the use of NVRAM as write-back cache and the filesystem journaling which allows most writes to be full stripes of the RAID) allow them to deliver performance that is significantly greater than a basic RAID array with a typical filesystem. It seems to me that there is the possibility of using a small number of disks in a NetApp device to replace a larger number of disks that are directly connected to hosts. Therefore use of NetApp devices could save electricity. Tele-commuting has the potential to save significant amounts of energy in employee travel. A good instant-messaging system such as Jabber could assist tele-commuters (it seems that a Jabber server is required for saving energy in a modern corporate environment). Have I missed any ways that sys-admins can be involved in saving energy use in a corporation? Update: Albert pointed out that SSD (Solid State Disks) can save some power. They also reduce the noise of the machine both by removing one moving part and by reducing heat (and therefore operation of the cooling fan). They are smaller than hard disks, but are large enough for an OS to boot from (some companies deliberately only use a small portion of the hard drives in desktop machines to save space on backup tapes). It’s strange that I forgot to mention this as I’m about to buy a laptop with SSD.

• [1] http://www.boston.com/news/science/articles/2006/10/16/google_to_convert_hq_to_solar_power/


• [2] http://en.wikipedia.org/wiki/Jabber


• [3] http://www.lesswatts.org/tips/ethernet.php


• [4] http://doc.coker.com.au/environment/computer-power-use/


• [5] http://en.wikipedia.org/wiki/Netapp

Share This

Recently my Nikon D70s, when using a new Sigma lens, displayed the following error in the aperture display: fEE. As it took me some time to find out the cause and fix it, I'll explain it here perhaps for the benefit of others. What does it mean? Some lenses require that the aperture is set to smallest when they are connected to the body (the largest f-number; this is usually coloured orange). fEE is indicated when the lens is connected wrongly and the camera refuses to operate until the lens is reconnected. If like me you still get the fEE even though you've connected the lens correctly, then obviously something is broken. The camera "knows" whether the aperture ring is set to the right value due to a notch on the lens (rightmost picture) and a switch on the body ("EE Servo Coupling Post", left picture). In my case the switch on the body had broken off. You can of course send your camera in for repair, but for me it was easily repaired by sticking a hairpin in the switch. A little piece of plastic and some superglue could work as well.

A little while ago I completely rewrote the #debian-devel-changes IRC bot so it was actually maintainable. At the same time I added some commands suitable for developers, but I didn’t really advertise them anywhere. Here goes.

!bug <bug-number>

Print a one-line synopsis of the specified bug. The parser is fuzzy and will find the bug number embedded in URLs, etc.

!madison <source-package>

Print a colourful rmadison output for the specified package.

!qa <source-package>
!overview <source-package>

Prints the URL of the Debian PTS entry for the specified package.

!changelog <source-package>

Prints a URL containing the most recent debian/changelog file for the specified package.

!copyright <source-package>

Prints a URL containing the most recent debian/copyright file for the specified package.

!bug_graph <source-package>
!buggraph <source-package>

Prints the URL of the bug graph for the specified package.

!buildd <source-package>

Prints the URL of the non-experimental buildd status of the specified package.

!popcon <source-package>

Prints the URL which contains the popularity-contest data for the specified package.

!dehs <source-package>

Prints the URL which contains the Debian External Health Status of the specified package.

Some notes:

• Using these commands is easy: “/msg BTS <command>” on irc.debian.org or simply “<command>” on a channel that the bot is lurking on.
• Please don’t spam channels with data from the bot – use a private message. This particularly applies to #debian-devel-changes.
• If you are communicating with the bot in a private message, the leading exclamation mark is optional.
• If you would like the bot to lurk on other channels, please ping me on IRC after gaining a consensus on the channel in question.

As always, patches and suggestions welcome. (Source).

revamping w3-recs: new specs, misc improvements After quite a lot from my initial adoption, I've spent some time to update w3-recs. Beside the long overdue update of shipped recommendations (quite a few new specification was released, mostly related to SPARQL, but a few more have been edited, including CSS 1 and 2), I've also uploaded some pending improvements. A couple of bug fixes were about dangling links and registration of recommendations with the GNOME devhelp stuff. Additionally, I've also moved all the documents registered with doc-base under the new Help/Standards section of doc-base, which seems to be fit for W3C Recommendations. Apparently we have finally managed to have a proper section tree for doc-base, the decoupling of that tree from the Debian menu one will not be missed (at least not by me). During the process I've also discovered a (recent?) change in debhelper semantics. Thus far I used to have broken doc-base document IDs in w3-recs, as they contained uppercase letters, which are prohibited according to /usr/share/doc/doc-base/doc-base.txt.gz. My fault, I concur, but in the past the documents got installed anyhow without any problem. On the contrary, with the latest debhelper all documents got written to the very same file, apparently stripping away the part of their names which do not match the used lowercase regular expression. Well, not too bad, I fixed one more bug, but with a warning fixing that would have been quicker. Also, /me wonders, if everything (but package build ) worked properly with uppercase document IDs, why the heck one should forbid them in the doc-base specification?

I’ve been considering the possibility of using Xen on an ASUS EeePC as a mobile test platform for an Internet service. While the real service uses some heavy hardware it seems that a small laptop could simulate it when running with a small data set (only a few dozen accounts) and everything tuned for small amounts of RAM (small buffers for database servers etc). According to the wikipedia page about the EeePC [1] the 70x and 900 versions of the EeePC use a Celeron-M CPU. According to Wikipedia that is based on the Pentium-M (which lacks PAE support and therefore can’t run Xen). The Fedora Tutorial about the EeePC has a copy of the /proc/cpuinfo data from an EeePC [2] which shows that the model in question (which is not specified) lacks PAE. Are there any 70x or 90x variants that have PAE? Intel sometimes dramatically varies the features within a range of CPUs… The 901 version and the 1000 series use an Intel “Atom” CPU. According to discussion on the Gentoo Forums some Atom CPUs have the “lm” flag (64bit) but no “vmx” flag for virtualisation [3] (which means that they can run Xen paravirtualised but no KVM or hardware virtualisation for Xen), it also has PAE. This is more than adequate. According to the Wikipedia page the Atom comes in both 32bit and 64bit variants [4]. Hopefully the 901 version and the 1000 series EeePC will have the 64bit version. The 90x versions have support for up to 4G of RAM but the 1000 series is only listed as supporting 2G, hopefully that will be 4G or more (although I wouldn’t be surprised if Intel had a chipset supporting only 4G of address space and PCI reservations limiting the machine to 3G). But even 3G will be enough for a mobile test/development platform which should make it easier to debug some problems remotely. The 901 is available in Australia for just under $700. It’s a little more expensive than previous EeePC variants ($500 is a magic number below which things can be purchased with significantly less consideration), but it still might be something that one of my clients will pay for. The prime aim is to be a mobile sys-admin platform that can be carried anywhere, running a Xen simulation of the target network is an added bonus. Any suggestions for other laptops that should be considered will be welcome. It needs to be light (1.14Kg for a 901 EeePC is more than I desire), small (a reduced display size is not a problem), and not overly expensive ($700 is more than desired). Update: JB HiFi is selling the 1000H model [5]. The 1000H has an 80G hard disk and weighs 1.45Kg. The extra 210g and slightly larger size are a down-side, as is the extra ~$50 in price. A comment was made that OpenVZ could be used. If that avoids the need for PAE then a 702 series would do the job (with some USB flash devices as extras). The 702 is a mere 920g. Update: This ZDNET review shows that the 901 can only handle 2G of RAM and has an Atom CPU that is only 32bit [6].

• [1] http://en.wikipedia.org/wiki/ASUS_Eee_PC


• [2] http://fedoratutorials.com/tag/eeepc/


• [3] http://forums.gentoo.org/viewtopic-t-696142.html


• [4] http://en.wikipedia.org/wiki/Intel_atom


• [5] http://www.jbhifi.com.au/computers/


• [6] http://www.zdnet.com.au/reviews/hardware/laptops/soa/Asus-EeePC-901/0,2000065761,339290002,00.htm

Share This

Lenny general freeze is approaching, so I'm walking thru my packages bugs and I found this one reported against fdupes.

I got 4Gb of memory, so how to reproduce an OoM? Let's start with a rather large file base, but I need a script to generate it. With 4 cores and a fast Raptor hd, I want something to stess them while learning something: Python + ParallelPython was the answer!

I wrote a small script that takes 3 parameters: the destination directory, the number of dirs to create and the number of files (with random contents) to created inside each of the created dirs. I ran it with 1000 dirs and 1000 files, so it generated 1M files set to work on.

But even with so many files, fdupes ran fine... At that point I realized that ulimit could be my friend, and the "-v" option would have saved me some time, but without the fun to write the script :)

If you don't know pp, here is a little explanation of the main part of the script (I forgot to comment the script well enough):

• job_server = pp.Server() is the pp job server: with no parameter, it allocates execution slots for the number of cores/CPUs on your system (you can force more/less)
  
• jobs.append(job_server.submit(gen_dir_set, (dirname+'/'+str(i),fileno), (), ('random',))) appends to jobs list the function returned by job_server.submit: this command takes the function to execute, the parameters tuple, the functions called by the first one (here empty) and the tuple of needed modules for the called function (here random).
• for job in jobs: job() execute each item in jobs: they are functions that return the results for every jobs (here they are discarded, but you could aggregate them to obtain the final result)
• job_server.print_stats() prints some stats about jobs executions (I love stats :D )

ParallelPython is more powerful than this: for examples, it allows to send your jobs to job nodes, machine dedicated to execute tasks (while you keep your own machine as the administration one), and more! Give it a try ;)

Recently, I've been doing a lot of thinking -- and a bit of talking -- about what software freedom means in the context of network services. I gave a talk on this subject at the most recent FSF members meeting and at Sun's Community One. In a few days, I'll be giving another at Wikimania in Alexandria, Egypt. A few months ago, I worked with the FSF to organize a meeting of free software hackers and scholars to talk about the issues. Today, that group is announcing the first two concrete results of that project. The first is a blog and a wiki called autonomo.us. The project aims to provide a space to continue, expand, and open up the work that was done at the FSF in March. Our aim is to explore the implications and responses to network services in relation to software. We're going to do that by continuing to take notes in the wiki and by publishing articles, essays, and documents that help inform the discussion about software freedom and network policies. We will be working independently from, but closely with, the Free Software Foundation, and with others in the free and open source software communities. Our goal is not to set policy, but to explore the space and inform the discussion about autonomy and user freedom in cloud computing and software as a service. The second announcement is the first concrete product of autonomo.us's work: a statement we're calling the Franklin Street Statement on Freedom and Network Services. It lays out our initial consensus on positive steps that developers, service providers, and users can take. If you want to follow our work, please subscribe to the autonomo.us blog and check out some of our work so far. If you've got thoughts and things to contribute, you can mail or get to work in our wiki. You can read our about page for more information about us and our goals. In a coordinated move, the Open Knowledge Foundation (which I help advise) is launching the 1.0 version of their Open Software Service Definition. There is a whole lot we need to learn, think through, and do before we have reasonable answers to the problems to freedom posed by network services. Today marks the beginning of several wonderful steps toward some of these answers.

Yesterday I was forced to test my backup system in anger, on a large scale, for the first time in months. A broken package upgrade meant that my anti-spam system lost the contents of all its MySQL databases. That was a little traumatic, to say the least. But happily I have a good scheme of backups in place, and only a single MX machine was affected. So, whilst there was approximately an hour of downtime on the primary MX the service as a whole continued to run, and the secondary (+ trial tertiary) MX machines managed to handle the load between them. I'm almost pleased I had to suffer this downtime, because it did convince me that my split-architecture is stable - and that the loss of the primary MX machine isn't a catastrophic failure. The main reason for panicing was that I was late for a night in the pub. Thankfully the people I were due to meet believe in flexible approaches to start times - something I personally don't really believe in. Anyway the mail service is running well, and I've setup "instant activation now", combined with a full month of free service which is helping attract more users. Apart from that I've continued my plan of migrating away from Xen, and toward KVM. That is going well. I've got a few guests up and running, and I'm impressed at how stable, fast, and simple the whole process is. :) ObQuote: Brief Encounter (That is a great film; and a true classic. Recommended.)

Looking through mail logs. After 7 days or so of spamassassin churning, I've managed to process about 20 days of e-mail and caught up to email since 5 days ago. Looking at some bugs to see if something is urgent.

'churro' is the name of the Debian i18n server (i18n.debian.net), hosted by the Extremadura region in Merida (IIRC). That server was setup back in september 2006, during the first Extremadura i18n meeting. Since then, a lot of hidden work happened on it, mostly moving all scripts that build statistics pages from Debian localization data, for instance the Central Debian translation statistics. Thomas Huriaux, then Nicolas Fran ois, have been the people building all this, with the help of Felipe Augusto van de Wiel for the system administration. Churro for instance has neat statistics pages, built by Nicolas Fran ois. These would just need to be packaged with nice web pages to give a great website for stats junkies(See that example showing how Swedish decreased over time, then revived recently....or that other one showing German reaching the 100% Grail). The DDTP also uses churro as server which is an important brick for having translated package descriptions (which is now an achieved lenny release goal). And now, since this week-end, I think we can say that Pootle is partly in production. The Pootle server is now hooked directly to the VCS of some parts of Debian-Installer related packages (including the core D-I itself) and, since last night, I am not the only one using it...:-) That small bit:

Author: pootle-guest
Date: Sun Jul 13 20:48:15 2008
New Revision: 54294
Log:
Commit from Debian/Pootle l10n server by user pi. 413 of 413 messages translated (0 fuzzy).
Modified:
   trunk/packages/po/sublevel3/eu.po

... indeed shows that Piarres Beobide Ega a, the Basque team coordinator, just committed an update to D-I SVN, through Pootle. We're still working on organizing all that scattered stuff, to finally turn churro into the central point for Debian localization and internationalization work but I think that the i18n team can really be proud of the achieved work, already. PS: as churro turned out to be hard to pronounce for German mouths, please note that it is also called 'spaetzle' :-)

Rumour has it that Kaminsky’s vulnerability is that it is possible to hijack the NS records for a TLD registry’s root servers, by spoofing the response from a hostile machine and guessing the transaction id. Obviously transaction spoofing is nothing new. Anyway, here’s a way how it works:

• Query a public nameserver for domain.tld where you own domain.tld.
• The nameserver will connect to your nameserver.
• Reply with additional records about how to find the authoritative servers for .tld.
• The server will now query your nameserver for lookups in the entirety of .tld due to caching, and any other nameservers which query that one will too.
• Repeat until you control .tld from enough nameservers to make a considerable impact.

Other methods on how to do this, including spoofing transaction IDs and UDP packets are left up to the reader. The problem in this case is that:

• Usually the port that the machine connects outwards on and the transaction ID are the same.
• There’s a small pool of transaction IDs, as it’s a 16 bit value.

So, that’s the vulnerability. Now, the important question I propose is, “can someone use this same concept to hijack a DNSBL?”. The answer is yes. By adjusting the values for the attack, one can still poison the cache for a specific domain if seen as desirable. This is a problem because spammers will now likely try to poison cache for DNSBLs in order to buy more time for their botnets… But maybe I am missing something. Luckily caching times out eventually so even if it’s poisoned, it won’t stay that way forever.