Sam's place

Routing for multiple uplinks/providers

2006-01-25T17:02:00.000-08:00

I've been researching the topic in the subject line for a little while now. My plan is to use my old desktop box to route for my home LAN. I have DSL and Cable at home (large house, lots of roommates), so I will be (finally) hammering out a way to use a single box to provide DHCP and other LAN services as well as provide outbound routing for BOTH ISP's.

This should be fun!

Anyways, I have here a couple links that address this:
Routing for multiple uplinks/providers
Multiple Connections to the Internet

They seem a bit stale, but I will try to post back with my progress.

I've already tried out pfSense, but found it to dislike my hardware as well as having a very sluggish web interface. The multi-WAN features of pfSense also turned out to be very unpolished and a bit confusing. So I figured that if I was going to be confused anyways, I may as well teach myself something useful.

I will probably begin by using gentoo, since it is what I have on my laptop, though I may go back to a more streamlined distro once I have things "figgered". Gentoo is also appealing as some of the baselayout changes in the latest version are designed to help out multi-homed hosts (particularly laptops, but I figure I can take advantage for my own goals).

A few extra goals I have beyond simply load-balacing/aggregating over both ISP connections will be to make it fairly easy to direct specific traffic across one ISP or the other (provided that ISP is up, of course). I also want my DHCP server to provide DNS servers from BOTH ISP connections (which are both DHCP... *g*). So a little bit of scripting beyond just setting up a multipath route.

I guess an alternative DNS approach would be to get a DNS server running on my router box itself, and provide special DNS routing rules that would prevent lookups from going out on the wrong interface.

I'll try to keep things updated -- my intended starting time for this project is this weekend. Any additional information that might be of use is, of course, appreciated.

Opinion: New Linux study suggests fundamental Microsoft creditability problems

2005-11-17T23:17:00.000-08:00

Wait, this isn't news, is it???

http://www.linux-watch.com/news/NS6557933549.html

[edit]

I've gone and read some of the study in question now. Not too impressive.

First is all the commentary about "Out of support" packages on SLES 8, while SLES 9 is available (and with those packages that are out of support in SLES 8!!!). Hmm! Maybe the applications that required those out of support packages were written towards distributions of SLES 9's vintage. Rather than upgrade 1-2 packages "out of support", I would expect a competent administrator to upgrade to SLES 9 or find an application compatible with SLES 8.

Rather, 3rd party extensions/products were chosen that operated both on Linux and Windows. Though of course, the specific application isn't disclosed, nor were the versions of those 3rd party products discussed.

Second, again with the "Out of support" packages. The report indicates that two of three of the SLES (*ahem*) administrators completely broke their servers while trying to upgrade glibc. I have to question the competence of the admins they selected. No backups? No knowledge of how to deal with this type of issue at all? Why were "third party extensions" to their "custom" ecommerce platform selected that weren't compatible with the existing platform?

The footnote at the bottom of page 3 is telling in this regard. Tallying non-version-specific "Windows" experience vs. non-version-specific "Linux" experience and having some version-specific requirements as well doesn't quite add up. What would the Windows administrators be getting experience in if not Windows 2000 or 2003?

Third, there is a mention of one of the Microsoft admins calling "Third party product support". Didn't the SLES administrators have similar options available?

Fourth, the number of patches installed, and the conveniently "monthly" patch cycle. Convenient, as Microsoft has a monthly patch release cycle. And the "number" of patches is questionable, as every patch not rated "optional" was installed. This entirely ignores whether the patch was to a component actually in use. SLES has all services disabled by default, and needn't automatically launch GUI software either.

SLES's patches included upgrades and patches to things like Acrobat Reader, which, given the methodology, would not have been patched on MS's enterprise solutions. The number of patches was higher for SLES because the vendor supports virtually all of the software on the machine.

Given the way modern linux distributions handle patch management, this isn't much of a burden. Requiring that _all_ patches be applied, presumably even to packages that were only installed to need patching, isn't a sensible approach. If it isn't needed, don't install it. If it isn't installed, don't patch it.

Some interesting charts, from Secunia:

SLES 8:
http://secunia.com/product/1171/
SLES 9:
http://secunia.com/product/4118/

Windows 2000:
http://secunia.com/product/20/
Windows 2003:
http://secunia.com/product/1174/

Pffft.

Sony's DRM rootkit

2005-11-01T08:57:00.000-08:00

If you use some of Sony's new copy-protected CD's on your computer, you get a nice present. You get some "stealth" processes and services, putatively designed to implement DRM. This doesn't sound like fun.

Mark's Sysinternals Blog: Sony, Rootkits and Digital Rights Management Gone Too Far

Microsoft's "monkeys" find first zero-day exploit

2005-08-14T11:08:00.000-07:00

Microsoft's "monkeys" find first zero-day exploit
Robert Lemos, SecurityFocus 2005-08-08

Microsoft 's experimental Honeymonkey project has found almost 750 Web pages that attempt to load malicious code onto visitors' computers and detected an attack using a vulnerability that had not been publicly disclosed, the software giant said in a paper released this month.

More:
Microsoft's "monkeys" find first zero-day exploit

Google Translator: The Universal Language

2005-05-26T17:26:00.000-07:00

Here is some really interesting machine learning. Google took all of the UN's translated documents and fed it to a statistical engine of some sort. Now that engine can translate between all of the UN languages with fairly high accuracy.

Google Translator: The Universal Language

I am curious about how this would handle colloquial use of language. My guess is not terribly well, without enough input data to chew on. I can imagine this type of database being grown organically though, with people translating the occasional document or snippet in their spare time, or as needed. What sort of statistical strength piecemeal (and potentially low-quality) translations would have is debatable, though. It may be that a rigorous and repeated approach such as what the UN needs to take with all of their documents would be needed.

ransom-ware

2005-05-25T08:52:00.000-07:00

Proof that people will find a way to abuse any technology given half a chance.

Computer users anxious about viruses and identity theft have a new reason to worry: hackers have found a way to lock up the electronic documents on your computer and then demand a ransom for their return.

Hacker holds computer files hostage

It always helps if the damn thing is plugged in.

2005-05-24T05:49:00.000-07:00

Yeah. It might seem obvious, but time and again, I find myself banging my head because I didn't think to check that first.

Never too young for a copyright lesson

2005-05-23T23:04:00.000-07:00

Good fun. 6th graders getting lectured about file-sharing.

Never too young for a copyright lesson | CNET News.com

'Geek speak' confuses net users

2005-04-07T06:15:00.000-07:00

BBC NEWS | Technology | 'Geek speak' confuses net users

SANS - Internet Storm Center - March 2005 DNS Poisoning Summary

2005-04-05T18:02:00.000-07:00

This is really interesting. DNS cache poisoning is and has been leveraged to redirect surfers to malicious websites that attempt to install malware.

This has been going around a bit in security mailing lists, but SANS has thoroughly written it up. At least as thoroughly as possible, as not everything is resolved and/or mitigated yet.

SANS - Internet Storm Center - March 2005 DNS Poisoning Summary

The future of blogging | CNET News.com

2005-04-05T15:14:00.000-07:00

The future of blogging | CNET News.com

Trackbacks courtesy of haloscan

2005-03-22T08:33:00.000-08:00

Trackbacks are now possible on blogger.com, using haloscan.com's trackback service.

A tiny bit of tinkering was required to enable haloscan's trackback and not their comment service, and unfortunately I couldn't find any haloscan icons that didn't say "Comments by". So no icon.

A bit of code to paste to enable auto-discovery, but nothing too hard.

Anyways, here's hoping I get some fun trackbacks!

Metalicensing

2005-03-19T04:40:00.000-08:00

An interesting take on the 'problem' of the proliferation of OSS licenses. It isn't terribly groundbreaking as things like the Mozilla Public License already includes text in it's template a block allowing alternate licenses to be given as an option.

But the idea of heirarchical meta-licenses seems intriguing.

NewsForge | Metalicensing

POPFile wins Jolt Productivity Award

2005-03-16T21:21:00.000-08:00

So here I am, sitting in the coffee bar at the Westin Santa Clara, sipping a mocha, listening to the live music at the "VIP pass only" St. Patrick's Eve SD West party. I got in anyways, and they seem to have stopped checking passes too.

Anyways, POPFile won a Jolt "Productivity Award" -- so I guess we are all award winning developers now. Cool. It's not the big award of the night, as there were 3 productivity awards in each category, but I am still thrilled. We were in the security category, so it's not surprising that at a software development conference we (a peripheral utility, perhaps part of the IS infrastructure) would loose out to a source-code analysis platform.

What little I saw of the conference was fun. I enjoyed talking to a lady at the sourceforge booth, and briefly discussed some of POPFile's problems with the service. Apparently some big changes are coming. Sourceforge will also be under a new director soon, as Pat is leaving (Bye Pat! I'll miss your emails). I also briefly chatted with a guy at the intel booth, but what they were doing didn't seem too thrilling.

I recorded the entire Jolt ceremony on my webcam, so I will be putting together a montage at least. For now, all I have is a shot of the award.

Woops, I got distracted for a couple hours there by some guys from Schwan's. Cool guys. We talked software and politics for a couple hours. They seemed fairly interested in open source.

Anyways, here's a picture of the award.

POPFile is a Jolt award finalist

2005-03-16T05:17:00.000-08:00

So I'm off to Santa Clara/San Jose for the award ceremony later today. A big thanks goes to John Graham-Cumming (who couldn't attend) and all who have donated to POPFile for making it possible for me to fly down there.

We're competing against mostly closed source commercial software, including Microsoft's ISA Server 2004. May the best software win, I guess.

I'm fairly ready to feel completely out of place, however.

I'll be wandering around at SD West for a few hours before the award ceremony, and then apparently there will be an after-party. I'll try to make some notes, and maybe get my webcam running to record the ceremony.

Good luck to us!

Schneier on Security: SHA-1 Broken

2005-02-17T17:20:00.000-08:00

Schneier on Security: SHA-1 Broken

Yikes. It'll be a short while before the paper is publicly available, but it doesn't look good. Are there any hash functions out there still unbroken?

Visiting SFU tonight

2005-02-11T01:52:00.000-08:00

So I'm up at SFU tonight. Wow, memories. I used to spend professional days up here with my dad, mostly doing stupid things to computers that an 8-13 year-old shouldn't be doing, meeting his co-workers (some of whom still remember me, at least according to them at the dinner many of us shared while my dad was in town) and eating lunch in the staff room at the cafeteria.

Sarah, a friend of my roommate's who seems to tolerate my existence ( ;-) ) is editor for the arts section at SFU's student paper. Sarah is up here all night and needs to fill her section, so Natasha and I are up here hanging out with her. We brought bubble tea and a buritto.

The one idea we (ie, they) had for filling space that involved me was a critique of a movie Natasha and I saw recently. That sounded too much like a book report, so I am doing my usual geeky stuff. My offer to write something geeky wasn't enthusiastically received. They, not being as uncontrollably geeky are doing arts editor stuff, and writing some other stuff.

Hooray for stuff.

And boo to politics and drama impeding good things.

Challenge/response filtering systems DO get false negatives

2005-02-06T06:50:00.000-08:00

This is what you get if you use challenge/response that flails about and
hits a non-existent account on one of the domains I administer. As a side note, it seems wrong for an anti-spam vendor to function using affiliate advertising. These guys don't have a good reputation, anyways. So... Enjoy your spam, "Mark". Please don't ask me to "filter" it for you again.

Thank you for verifying your email address with Spam Arrest!

Your email has been forwarded to Mark's inbox. All of your
future emails to Mark will also be delivered directly into
their inbox.

You can protect your own email account using Spam Arrest.

Please visit our website to learn more, and signup for a
completely free account!

http://spamarrest.com/affl?foo/

Spam Arrest - Take control of your inbox!

------------------------------------------------------------

Webmasters help stop spam and make 50%.
http://spamarrest.com/affl?foo/affiliates/index.jsp

------------------------------------------------------------

2005-02-06T05:35:00.000-08:00

This is a test post for "gaim-blogger". Blogging via IM (or close, anyways!) Interesting.

Hair? What hair?

2005-02-06T05:27:00.000-08:00

Yep, shaved my head. No more mop for a little while. Damn, but shaving your head goes through the razor blades.

I'll see how I like the bald look. Mixed reports so far, but I think there's only really one opinion that counts.

bleeeeeeeaaaaaaaaaaaaaahhh

2005-01-31T04:51:00.000-08:00

I feel unclean. So much loathing.

Geeking out, 802.11b SDIO card, mongolian grill, oh my.

2005-01-11T22:55:00.000-08:00

Today I slept in till 9 (!!!), then caught up with my Dad at the office. He was busy geeking out on his project, so I popped on my headphones and finished setting up my laptop to be useful for POPFile development. Mostly I was solving issues with having aborted the initial Linux install part way through, such as not having perl-devel and a bunch of other things installed. I also caught a bit of a nap in the office, since I was up far too late last night.

Long story short I now have email working using my training database from my desktop. I considered and discarded the possibility of forwarding email for classification via SSH to my desktop POPFile's XMLRPC interface. Running it locally makes more sense. I can copy the database back over when I get home.

After all that fun at the office we went for a drive up to the CompUSA in the next town over as the local one didn't have my Dad's coveted 802.11b SDIO card for his palm in stock. When we got home we checked his email on the hotel's wireless via IMAP. How neat!

On the way home we stopped at a very yummy mongolian grill and had a nice long chat with our waitress. Good fun.

Tomorrow... CVS commits should be happening. I feel content.

I'm in Michigan, and I have a laptop!

2005-01-10T22:22:00.000-08:00

My dad's visit to Vancouver was a precursor to a two-week long business trip to Ann Arbot, in Michigan, to do some close collaboration with the developers of the software used in my Dad's current project. Apparently 'the project' is hitting a bit of trouble which may be fatal, and my Dad is 'the man' to troubleshoot it.

At any rate, my Dad is largely confined to a wheelchair or a walker, due to the effects of mid-stage MS. In order for him to be able to get this vital trouble-shooting done, arrangements were supposed to be made for him to have access to on-call nursing care. Unfortunately, after he arrived in Vancouver, the arrangements that were supposed to be in place fell apart.

In order for things to proceed my Dad still needed someone to tend to him in the case of any non-emergency complications. So here I am.

Right now I'm in bed in our room blogging with my brand new laptop onto which I have shoehorned Mandrake. How cool is that.

I hope to use the rest of the next week and a half here to get some solid work done on POPFile. I seem to have ironed enough of the kinks in my new linux install to be able to focus on some improvements. I've also arranged to have SSH access to my home desktop so nothing I need there is inaccessible.

More later, of course.

my dad is in town!

2005-01-05T13:04:00.000-08:00

Yay. My dad is visiting from Australia for a week, and then we're both of to Michigan for two weeks. We're super busy visiting with all of his local friends until then, but are finding plenty of time to do all kinds of geeky things.

We tried using my linux desktop as a PPP gateway for his bluetooth PDA (close, but not quite), tried booting several computers from a linux distro on my USB flash-drive watch (yes, a watch!). We've also slurped all of my telephone contacts out of my cell-phone, which I didn't know could be done via IRda. Cool!

More later.

Most Hated Advertising Techniques

2004-12-06T14:00:00.000-08:00

Jakob Nielsen, of the Neilsen Norman Group, a group that specializes in helping companies design more usable product interfaces, recently wrote about a presentation at Neilsen Norman's "User Experience 2004" conference.

Two researchers, John Boyd from Yahoo! and Christian Rohrer from eBay presented information about negative user experience attributed to advertisements. About time.

Most Hated Advertising Techniques (Jakob Nielsen's Alertbox)

I wasn't able to find a free link to a paper by the researchers, though the ACM does seem to have something related by the same authors, which I wasn't able to access for free.

The rise of intrusive online advertising and the response of user experience research at Yahoo! (subscription download)

I also found a cached introduction to the 'tutorial' at the conference. I'm not sure how long that will work for. The uncached URL now redirects to The alertbox article linked above.

If spam is looked at from a user experience point of view, many companies would think twice about engaging in practices that encourage spamming on their behalf.

I know first-aid!

2004-12-04T23:48:00.000-08:00

My new second job decided they wanted to train me in first-aid. So I went up the mountain this Wednesday for a full-day course. I got paid too. Cool!

So I am now the proud holder of a brand new OFA Level 1 certificate. Yay me.

Introducing the anti-spam snake-oil club: Screensaver tackles spam websites

2004-11-30T23:09:00.000-08:00

Here's another anti-spam solution that completely misses the point. Things like this will do more harm to the internet in general than they will to spammers. 'Attack' tools are also easily mis-targetted.

BBC NEWS | Technology | Screensaver tackles spam websites

Speedy Glass is the best!

2004-11-20T06:38:00.000-08:00

Well, I did finally get my sunroof replaced earlier this week. I just wanted to give the nice folks who did the repair a little plug.

The service was excellent, and the repair was completed two hours early.

Auto Glass Repair and Replacement from Speedy Glass

I'm not sure exactly how much it cost since ICBC was paying everything but the $300 deductible, but if you want quality work done, and want it handled professionally, I'd recommend these guys.

Yahoo deploys DomainKeys, hopes for the best

2004-11-17T01:43:00.000-08:00

Let the MARID implementation wars begin!

Yahoo deploys DomainKeys, hopes for the best

still awake

2004-11-13T06:41:00.000-08:00

I forgot to mention, I'm still awake. 30hrs awake isn't really that long for me, but it has been a while since I've really pushed at staying awake.

I find it harder to do now that I drive regularly. Something about a comfortable seat and the drone of the road, as well as the high speeds and safety of others makes me want to get at least 4 hours of sleep before throwing myself into a hurtling death missle. 30 hours awake only feels bad when I drive, and since I plan to continue to drive, I plan to sleep.

It'd be interesting to try to find a long weekend and some suitably geeky or bored friends to try to push past my personal best. And no, I'm not telling unless you do.

E-Mail Authentication Will Not End Spam

2004-11-13T06:29:00.000-08:00

Y'Know, this isn't a surprise to anyone who has been following this technology. The idea isn't to eliminate spam via authentication. The idea is to ensure that only email that is legitimately associated with a source makes it's way onto networks that wish to enforce this distinction.

From there, spammer 'sources' (which are now legitimately associated with their spam) can be blocked or ignored with minimal fuss. Basically, SPF and all of it's ilk are designed solely to allow the re-introduction of domain blocking. Really this is the only type of blocking some of the *ahem* weaker email clients out there can perform.

Anyways, the article is here. Nothing new if you're following the issue. The article does introduce some non-spam related security issues which should serve put a good fright into anyone reading. That seems a bit sensationalistic to me. Ah well.

E-Mail Authentication Will Not End Spam, Panelists Say - BizReport

It's going to be a long day

2004-11-12T10:27:00.000-08:00

I've been up since midnight. Oh the joys of working graveyards -- your days off are lonely evenings surfing for po.... doing nothing.

I took my car in to ICBC this morning for an insurance estimate on my sunroof and CD Changer. It looks like I'm only on the hook for my $300 deductible, and they are covering the changer even though I don't have any receipts for it (surprising!). I'm pretty happy with that, though of course, not having to spend another $300 on my car this month would be better. Ah well!

Other than that, another of the jobs I applied for last month wants to hire me. So I might be working up on a ski-hill this winter. Excellent!

I still have to take my car to a glass place for measurement and such, then I need to knock out for 3 hours of sleep before I head into work early to get my hair cut. Then it's another shift at work moving boxes. Woo.

Welcome to Spam University!!

2004-11-07T15:29:00.000-08:00

Welcome to Spam University

What's new?

2004-11-07T02:50:00.000-08:00

Wow, it's been a while! Sorry. My roommate is obviously upset that I havn't been posting.

Lots of new things in my life. Nothing earth shattering, but it has been a fairly interesting month. I have a new job, my old work wants to re-hire me, I replaced the clutch in my car, had my car broken into, went to some fun parties, and am considering immigrating to Australia. I may also have been given a few acre's of undeveloped property in the Kootenays.

My new job is "swamping" at a warehouse at night. Basically, when stuff comes off a truck, it is on pallets. My job is to read the paperwork for those pallets and make sure the product isn't stacked too high to be stored in the warehouse. If it is, I move the product onto new pallets. I also get to separate products that have been combined onto a single pallet so they can be put away seperately. It's not very challenging, mentally, but is surprisingly fun and I am getting in shape faster than I would have guessed.

As for my car, I'd been having clutch problems but hadn't put together enough money to deal with them. So the clutch did finally give out on the side of the highway. That wasn't too surprising, though it was inconvenient. I signed up with BCAA and got my car towed to a pullout at the nearest exit so I could spend a few days deciding what to do with it. This is where someone apparently broke my sunroof and stole my CD changer. The clutch replacement cost $1400, which didn't make me happy, and I still have to deal with getting a new sunroof.

For parties, I went to a great halloween party last Saturday. My roommate and her best friend went as a pregnant trailer-trash couple. I went as a carpenter (with a tool-belt full of candy). There were many pretty ladies there, though the one I was interested in hasn't returned my phone-call. Oh well!

As for Australia, I have been planning on going there to live with (or at least near) my Dad for a while. I'm not sure of the exact timeline for this, but I will be applying to the University of Ballarat (where my Dad does research and lectures) as a foreign student. If that doesn't work out, I will figure something else out.

Anyways, not much else to report right now. I am planning on changing the format of this blog a little bit. I had previously been limiting my posts to technical-ish and anti-spam stuff. But I'd like to share more stuff about myself. So, watch out!

Sam

trip cancelled

2004-10-08T02:06:00.000-07:00

It looks like everyone in Vancouver will have to put up with me for the weekend. My trip was cancelled. Ah well.

job fair and then out of town

2004-10-07T20:18:00.000-07:00

The YWCA had a career fair today, so I bundled my self up and went to take a look. Nothing too special, although I do have a few leads to follow up. It was my first career fair, and I'll think I'll go to more. It was easier than I thought it would be.

Also, I am going away (far away!) for the long weekend. I'll be in the middle of the Kootenays. So, if you need me, I'm not home, but if you leave a comment or email me (if you have my email) I'll try to check in.

My printer walks

2004-10-04T14:10:00.000-07:00

I just noticed this today, and I'm not sure why I never noticed it earlier.

While doing a large batch of printing, my printer actually WALKS across the printer shelf above my monitor. I'm surprised it hasn't fallen off the shelf on the occasions where I have left it printing unattended.

Fascinating.

POPFile v0.22.1 released

2004-10-04T13:33:00.000-07:00

I didn't contribute as much to this release as I have to some earlier releases. I have some other things going on right now, though I do hope to increase my participation for our next release cycle.

Get it from sourceforge at http://sourceforge.net/project/showfiles.php?group_id=63137

Release notes: http://sourceforge.net/project/shownotes.php?release_id=272701

GDI+ JPEG viruses now in the wild

2004-09-27T21:19:00.000-07:00

This is what you've all been waiting for, folks. There is now a virus that spreads inside JPEG files targetted towards vulnerable Microsoft implementations. Yet another file format down the drain at email gateways across the world.

Everyone, please, go to Windows Update if you are using a Microsoft operating system, browser, or email software.

I'm really not looking forward to seeing this used in spam.

This virus was noticed on some newsgroup servers: SecurityFocus BUGTRAQ Mailing List: BugTraq

More technical information here: http://www.easynews.com/virus.txt

Internet Task Force Shuts Down MARID Anti-Spam Working Group

2004-09-23T04:41:00.000-07:00

Internet Task Force Shuts Down MARID Anti-Spam Working Group

Yikes :( I don't have alot to say about this. Personally, I think it is bad news.

Click here to become infected

2004-09-23T04:28:00.000-07:00

Click here to become infected

It looks like spammers and virus writers are up to it again. We all know, of course, never to click on unsubscribe links. Well, here's one more reason not to. Some spammers are now seeding unsubscribe links with code designed to exploit unpatched vulnerabilities in Internet Explorer.

So, unless you want to risk your computer becoming part of the network of compromised hosts some spammers are using these days, do not EVER click on unsubscribe links.

Thunderbird Extension for Sender Policy Framework (SPF)

2004-09-22T05:17:00.000-07:00

Joshua Tauberer has released a plugin for Mozilla Thunderbird to perform SPF checking on received emails. Nice.

Thunderbird Extension for Sender Policy Framework (SPF)

Something like this could be really useful if IMAP or POP3 had a method for reliably reproducing the SMTP envelope information on received email. It's too bad end-user applications end up having to muck around inside the RFC-822 Received: headers.

I quit my job on Tuesday

2004-09-17T16:25:00.000-07:00

Yeah, for a personal note (I'm not big on those, you might have noticed).

I gave my 2 weeks notice on Tuesday. I was working at Stardust, a local roller-skating arena. I won't be working there anymore, and I hope I find another job soon.

So if anyone knows of any jobs available in the Vancouver area, let me know.

Geek.com Geek News - Drop the mouse, use your nose

2004-09-16T22:05:00.000-07:00

Geek.com Geek News - Drop the mouse, use your nose

UI navigation using a webcam based on head-tracking. It follows your nose. Wink with your right eye to right-click, left eye to left-click.

It looks interesting, particularly for people with various impairments.

running XMMS instead of KsCD using magicdev

2004-09-11T23:39:00.000-07:00

I don't have an analog audio cable attaching both of my CD drives to my sound card. I think I have one connected directly, but I'm not completely sure. When I drop a CD into a drive, it is hit-or-miss whether KsCD and other analog input CD players can output music.

XMMS, on the other hand, can perform digital extraction from uncabled CD drives. That, and it is a nicely unified player that I use for other audio formats anyways.

Mandrake 10.0, unfortunately, is configured to use KsCD by default when a new CD is put into a drive. This is just extra irritation, when all I want to do is listen to some music.

It looks like there are alot of people out there wanting to run XMMS when they load up a CD, but nobody has a good answer. I now have one, no thanks to magicdev's utter lack of documentation.

To get magicdev to load the CD in XMMS you can't just run gnome-cd-properties (which is "the" way to configure magicdev) and change the command to run /usr/bin/xmms when a music CD is inserted. This would be the simplest configuration change.

The reason you can't just edit the settings in gnome-cd-properties (or heaven-forbid, browse for a program using a nice picker) is because there is UI and no documented way to manipulate the parameters magicdev passes to executed programs. magicdev does seem to provide a special expression-passing language. However, in gnome-cd-properties, the only example of this is "%d", which passes the device name (eg, /dev/hdc).

This parameter format works great for programs that expect it, but XMMS just gets a segfault if it is passed a device (/dev/hdc) instead of a directory (/mnt/cdrom) or a file it understands. So we need to translate /dev/hd* into the appropriate mounted directory. /etc/fstab has the necessary information, we just need to parse it and pass it to XMMS.

There are two places this can be done. One is a per-user setting, the other place you can edit will change CD behavior system-wide, and can only be done as root.

If you can only change your own settings, or want to make changes on a per-user basis, run gnome-cd-properties. Set the command for audio CD's to "/usr/bin/xmms `awk '$1=="'%d'" {print $2}' /etc/fstab`" and click Exit.

If you want to make a system-wide change, open a console, su to root, then use your favourite editor to change the "launch kscd" line in /etc/dynamic/user-scripts/audio_cd.script to "launch xmms `awk '$1=="'$DEV'" {print $2}' /etc/fstab`". Save, and exit.

To test your changes, put a CD into the drive. XMMS should open with the CD's tracks in the playlist, and begin playing.

I hope this helps someone.

Microsoft still burdening anti-spam standards with licencing requirements

2004-09-04T20:43:00.000-07:00

Well, it looks like Microsoft is up to it's old Caller-ID tricks with the child of Caller-ID and SPF. Sender ID was supposed to be the best of both standard proposals. It looks like Microsoft felt that a licence was "better" than no licence. I wonder what Meng Wong thinks of that.

Also, what is the IETF doing considering encumbered technologies for inclusion in any kind of "open" standard?

Sender ID loses supporters - ZDNet UK News

wireless in philadelphia

2004-09-02T00:15:00.000-07:00

http://www.wtop.com/index.php?nid=108&sid=258126

A whole city going wireless? Cool!

A little rant about Microsoft Internet Explorer's color parsing

2004-08-31T17:54:00.000-07:00

Starting the other day I have been having a painful introduction to how Microsoft Internet Explorer (IE hereafter) parses colors in HTML documents.

A warning to all readers, things get strange and very geeky from here on in. Enjoy.

As my profile says, I am one of POPFile's developers. The POPFile team is commited to finding and making sure POPFile is capable of decoding new spammer "tricks". John Graham-Cumming, author and lead developer of POPFile also maintains the spammer's compendium, a catalogue of such spammer tricks.

The newest trick in the compendium is "Flex Hex", which was reported to John in July. POPFile's CVS code learned how to handle this trick shortly thereafter.

The essence of Flex Hex is that IE is very flexible in how it will interpret hexadecimal RGB values in any HTML attribute (I'm not sure about CSS) that expects color data. John sums it up well in the spammer's compendium:

Missing digits are treated as 0[...]. An incorrect digit is simply interpreted as 0. For example the values #F0F0F0, F0F0F0, F0F0F, #FxFxFx and FxFxFx are all the same.

Though the above generalization would have been good enough in 99% of cases, we found some cases where IE deviated from the fairly simple approach of zero-padding the field and zeroing invalid hex characters.

When color strings longer than 8 characters or shorter than 4 characters are used, things start to get strange. Things getting strange, particularly where undocumented, is always to a spammer's advantage. I will lay out here what IE does with unusual, unpredictable, or invalid color data.

If email filtering software isn't aware of how common HTML-enabled email readers will display HTML, malformed or otherwise, it becomes much easier for spammers to hide text within emails in a way that may fool statistical filters or otherwise evade filters.

As an interesting note, IE does this unusual parsing regardless of the doctype declaration, ignoring "standards mode". Mozilla performs similar parsing, differing only in how long strings are handled. However, in standards mode, invalid color notation is completely ignored by Mozilla and the default or parent color is allowed to set the color of the element.

The iframe below contains a slight variation on the DHTML page I used while determining how IE parses colors. I have gone out of my way to make it cross-platform, so other browsers can be tested with it. The two fields can be used to set the foreground and background colors of some text, and then the DOM of the page is sniffed to display the colors, as interpreted by the browser.

A DHTML color testing applet would display here if you had frames enabled. Click here to view it anyways.

Throughout this explanation I will use a notation similar to CSS's RGB( RR, GG, BB) syntax to show how a value is split into red, green, and blue components. This isn't correct CSS RGB() syntax, but I am using it for clarity.

IE's non-CSS color parsing algorithm appears to behave as follows, in order to get to a 6 digit hexadecimal value from any string:

These steps may not be performed in the same order or using exactly the same criteria as IE, but the end result is identical as far as I can tell.

First, remove any hash-marks, then replace any non-hexadecimal characters (0-9a-f) with 0's.

Eg: #zqbttv becomes 00b000.

For lengths 1-2, right pad to 3 characters with 0's.

Eg: "0F" becomes "0F0", "F" becomes "F00".

For length 3, take each digit as a value for red, green, or blue, and prepend a 0 to that value.

Eg: "0F0" becomes RGB( 0, F, 0), which becomes RGB( 00, 0F, 00) or 000F00.

Any value shorter than 4 digits long is done at this point.

For lengths 4 and longer, the field is right-padded with 0's to the next full multiple of 3. This step is important for longer fields.

Eg: "0F0F" becomes "0F0F00", "0F0F0F0" becomes "0F0F0F000" and "00FF00FF00FF00FF" becomes "00FF00FF00FF00FF00"

Next, the string is broken into three even parts, representing red, green and blue, from left to right.

"0F0F00" behaves as expected, becoming RGB(0F, 0F, 00). Any string of 6 characters is done at this point.

Longer strings, such as "1234567890ABCDE" become RGB(12345, 67890, ABCDE). Extremely long strings are split similarly. "1234567890ABCDE1234567890ABCDE" becomes RGB( 1234567890, ABCDE12345, 67890ABCDE).

At this point, the RGB values are truncated individually.

If the individual RGB values are over 8 characters long, they are truncated to 8 characters by removing characters from the left. This, in particular, was unexpected.

RGB( 1234567890, ABCDE12345, 67890ABCDE) becomes RGB( 34567890, CDE12345, 890ABCDE), and so forth.

Once the individual RGB values are under 8 characters long they are truncated by removing characters from the right.

RGB( 34567890, CDE12345, 890ABCDE) becomes RGB( 34, CD, 89) or #34CD89, in more traditional notation.

Any string should be transformed into a 6-digit hexadeximal color by the above steps.

For instance, <font color="6db6ec49efd278cd0bc92d1e5e072d68"> (yes that is random hexadecimal data) will result in IE displaying text in the color "6ecde0", a rather pleasant light blue. This isn't at all what I would have expected before studying IE's behavior. A truncation to "6db6ec", I might have expected or to "072d68" (also a pale blues, coincidentally). However, if you look closely inside the random hexadecimal string, the components that make up the final RGB value are present, and in sequential order: "6db6ec49efd278cd0bc92d1e5e072d68"

To continue decoding this value, it first needs to be padded:
6db6ec49efd278cd0bc92d1e5e072d680

Then split into three even parts:
RGB( 6db6ec49efd, 278cd0bc92d, 1e5e072d680)

Then those parts are left-trimmed to 8 digits:
RGB( 6ec49efd, cd0bc92d, e072d680)

Then right-trimmed to the 2 most significant digits:
RGB( 6e, cd, e0)

And there you have it, the same color that IE will display if you enter 6db6ec49efd278cd0bc92d1e5e072d68 into one of the fields in the test applet above.

The SphereXP

2004-08-30T23:06:00.000-07:00

The SphereXP

This looks like a very powerful and intuitive way to supplement your windows desktop. It places your monitor in the center of a virtual sphere and lets you move and store windows within that sphere. Windows can be moved further and closer to the user, or brought right to the front. I'm not sure how usable it really is, but the videos of it in use present a fairly different UI experience.

An Illustrated Guide to Cryptographic Hashes

2004-08-29T11:16:00.000-07:00

If you've been following the news about potential collisions in the MD5 and SHA-1 hashing algorithms, but don't understand exactly what a hash is, or why this is a big deal, this is an excellent explanation.

An Illustrated Guide to Cryptographic Hashes

GmailFS - Gmail Filesystem

2004-08-29T10:24:00.000-07:00

This rates an 8.5 on my personal geek scale. Linux only at this point.

GmailFS - Gmail Filesystem

GmailFS provides a mountable Linux filesystem which uses your Gmail account as its storage medium. GmailFS is a Python application and uses the FUSE userland filesystem infrastructure to help provide the filesystem, and libgmail to communicate with Gmail.

How to Chat Via Netcat

2004-08-26T03:37:00.000-07:00

This geeky nugget showed up in a newsgroup I frequent. Credit goes to pchelp.

I'm not sure how useful it would be, given the prevalence of things like IM, SSH, and telnet, but printing to a remote user's terminal and allowing them to print back strikes a minimalist bone somewhere in my body.

I'm sure this is possible on *nix (nc originated there), but the poster has limited his instructions to windows. I think this will work on any platform if you substitute all mentions of DOS with console or terminal and give it a try.

-for Windows platforms

Requires Netcat (NC.EXE).

Parties at both ends must know one another's IP address.

Open two (2) command (DOS Prompt) windows. Place one above the other on
your desktop.

Select the upper window. Type this command:

nc [-u] -l -p port

where port = listening port number, known to your remote friend.

(Square brackets indicate an optional parameter. The "-u" switch is
optional. It causes Netcat to use the UDP protocol, which is sometimes
desirable for its relative "stealth," as when tunneling thru a
firewall.)

Now select the lower window. Type this command:

nc [-u] ipaddress port

where ipaddress = the remote IP address
port = the remote port number

(The -u switch is necessary if your chat partner is using UDP.)

The same commands may be entered in the Start...Run dialog, which will
cause the DOS windows to appear. They can also be created as shortcuts.

Assuming your chat partner has opened corresponding DOS windows and used
corresponding commands, you may now each type text in the lower window.
You will each see the other's transmissions in the upper window. Lines
of text are transmitted each time the key is struck.

When sending via UDP, I've found that the sender must hit Enter once
before display begins at the other end.

Ctrl-C will close the connection and exit Netcat. If you've run the
command from the Run dialog or a shortcut, the DOS window will close
immediately.

If you're using TCP and close your sending or receiving Netcat, the
corresponding Netcat at the remote end will close also. UDP doesn't
have this effect, being "connectionless."

If you're behind a NAT router, you must first set up tunneling,
sometimes termed a "virtual server"; directing the desired port/protocol
on the WAN to your own machine's IP/port on the LAN.

You can make a connection to your own machine by using your own IP
address. Handy for testing.

This also works between machines on the same LAN.

Study: Unpatched PCs compromised in 20 minutes | CNET News.com

2004-08-18T23:14:00.000-07:00

Study: Unpatched PCs compromised in 20 minutes

If you are out there with a new computer, please don't ever connect it to the internet without being behind a NAT router or enabling your OS's firewall. Even if it is to just download a 'quick' patch.

Apparently I am Amiga OS

2004-08-18T00:50:00.000-07:00

Which OS are You?

The geek milkshake

2004-08-18T00:27:00.000-07:00

This song starts:

My web log brings all the nerds to the yard,
and I'm like: "mine's better than yours".
Damn right, it's better than yours!
I can link you, but I have to charge!

And continues here

I think it's pretty funny.

Study: Spammers, Virus Writers Getting Chummy

2004-08-17T21:45:00.000-07:00

A new MessageLabs report says more than 86% of the E-mail it sampled in June was spam--and nearly one in 10 contained a virus.
http://informationweek.com/story/showArticle.jhtml?articleID=29101653

Is this thing on?

2004-08-17T04:07:00.000-07:00

Just making a little testy post.