My Security Planet » Tags

29 items tagged "Geek"

Recently, I had a simple python program that created a listening socket, and was uncomfortable running it as root (required to access a port below 1000). I had a quick look around, and found a good blog entry on doing exactly this. However, when running this on OSX, which uses negative UID and GID, I ran into a problem. It turns out that the negative ID is an offset from UINT32_MAX, i.e. 2^32+(-ve UID). The problem is, Python 2.7.1 (Lion's default) os.setgid() was returning an OverFlowError (but not in 2.7.2). I made a mod to the code to handle that case, and figured this pattern may be useful to others wanting to drop privs in a python app.

import os, pwd, grp
def safe_setgid(running_gid):   try:            os.setgid(running_gid)  except OSError, e:              print('Could not set effective group id: %s' % e)
def safe_setuid(running_uid):   try:            os.setuid(running_uid)  except OSError, e:              print('Could not set effective group id: %s' % e)
# Taken from http://antonym.org/2005/12/dropping-privileges-in-python.htmldef drop_privileges(uid_name='nobody', gid_name='nogroup'):   starting_uid = os.getuid()      starting_gid = os.getgid()      starting_uid_name = pwd.getpwuid(starting_uid)[0]
        if os.getuid() != 0:            # We're not root so don't drop, you may want to change this             print("drop_privileges: already running as '%s'"%starting_uid_name)             return
        # If we started as root, drop privs and become the specified user/group if starting_uid == 0:           # Get the uid/gid from the name         running_uid = pwd.getpwnam(uid_name)[2]         running_gid = grp.getgrnam(gid_name)[2]
                # Try setting the new uid/gid           try:                    safe_setgid(running_gid)                except OverflowError, e:                        if (running_gid > 4294967290):                               running_gid = -4294967296 + running_gid                         safe_setgid(running_gid)
                try:                    safe_setuid(running_uid)                except OverflowError, e:                        if (running_uid > 4294967290):                               running_uid = -4294967296 + running_uid                         safe_setuid(running_uid)
                # Ensure a very conservative umask              new_umask = 077         old_umask = os.umask(new_umask)         print('drop_privileges: Old umask: %s, new umask: %s' % (oct(old_umask), oct(new_umask)))
        final_uid = os.getuid() final_gid = os.getgid() print('drop_privileges: running as %s/%s' % (pwd.getpwuid(final_uid)[0],grp.getgrgid(final_gid)[0]))

mutt & iCal (some OSX specific)

Posted: October 24th, 2011, 11:56am CDT

Tags: Geek [edit]
I moved back to the world of civilized e-mail, i.e. mutt. It's been wonderful, and I particularly enjoy hacking my mailcap to display things just how I like them (no PDF sploits for me). However, OSX's handling of calendar files is very irritating in that iCal tries to send responses via Mail.app without giving you much of a chance to do anything. I'd rather handle it in mutt and the cli. This is also generally useful for people using mutt who want to handle calendar files.

I found a script mutt-ical, which does most of what I wanted; parse the ics, ask me what I want to do, then mail the organiser with my response. I made some changes to make it support Outlook generated calendar files, not override your mutt "send" settings, and display the calendar details in plaintext before you decide to accept/decline/tentative it.
- Download my version here. (~~I'd submit a patch, but the developer has no working contact details~~ I worked out how git pull request work :) )
- Copy it into somewhere in your PATH, (or you can specify the PATH in your .mailcap)
- Edit your mailcap to have the following line:
- - text/calendar; <path>mutt-ical.py -i -e "user@domain.tld" %s
  - For added fun on OSX, you can extend it to the following, to get iCal to open it nicely too (iCal cares not for mime types it seems):
  - text/calendar; open %s && ~/bin/mutt-ical.py -i -e "dominic@sensepost.com" %s; nametemplate=%s.ics
  - ~~text/calendar; mv %s %s.ics && open %s.ics && <path>mutt-ical.py -i -e "user@domain.tld" %s.ics && rm %s.ics~~ (I found nametemplate fixes this problem)
- You can force iCal to stop trying to send mail on your behalf by replacing the file /Applications/iCal.app/Contents/Resources/Scripts/Mail.scpt with your own ActionScript. I went with the following: error number -128 Which tells it that the user cancelled the action.
- - Open AppleScript Editor, paste the code from above into a new script, then save it.
  - Move the old script /Applications/iCal.app/Contents/Resources/Scripts/Mail.scpt just in case you want to re-enable the functionality.
  - Copy your new script into place.
Vodacom ZA iPhone Carrier Update

Posted: June 7th, 2011, 3:05am CDT

Tags: Geek [edit]
Yesterday I got sent a carrier update on my iPhone. I was interested in what this does, so pulled it apart, this is the list of changes it made. This is pretty uninteresting and just an excuse for me to understand carrier updated.

Apple has a post on carrier updated here, which specifies the locations the files are downloaded to your machine. They have a ".ipcc" extension, but file shows them to be simple ZIP files. Unlike firmware updates, iTunes does not delete the old version on download of a new one, so it's easy to compare them. You can unzip them, then you'll need to use plutil to convert the .plist files from binary form to XML with the command: plutil -convert xml1 <filename>.plist . After that, a simple diff -u showed the changes with context. This were helpfully explained by the iPhone Wiki's breakdown of the attributes. The relevant changes were:
- The maximum number of Bluetooth modem tethering connections has been set to 5
- Facetime registration SMS'es will not require an opt-in due to cost
- A roaming voicemail number has been explicitly set (an UK number)
- A new "blank" APN was added. I have no idea what this is for, and it doesn't seem to appear on the actual phone as an option.
- Some carrier pictures have been updated
VodaSMS Update

Posted: March 1st, 2011, 7:04am CST

Tags: Geek [edit]

Vodacom switched from the Vodacom4Me portal to a new Vodacom portal. I've updated VodaSMS to deal with that. You can get it in the usual place. The only caveat is that there's a strange MD5 value included in the SMS POST. It is currently consistent across logins, times and users. It may change per day, in which case this will stop working tomorrow. But I'll keep an eye on it and update accordingly.
Scroogle is Dead, Long Live GoogleSharing

Posted: July 5th, 2010, 1:39am CDT

Tags: Geek [edit]

Scroogle is no longer working for the second time this year (I archived the announcement at the end of this entry). The author claims Google deliberately killed the simple interface they were using. I've e-mailed to point out that Google Custom search works fine, but relying on Scroogle isn't going to cut it anymore. The obvious solution is to use GoogleSharing. However, not all devices support it due to the requirement of a Firefox plugin; my phone for example. After meeting Moxie I discussed the idea of including a search interface with the GoogleSharing server. The idea would be that <googlesharing server>:<port>/search would provide a plain HTTP interface to search through the server.
As a precursor to this, I did some playing and realised (later than most it seems) that the GoogleSharing proxy implements a straight HTTP 1.1 proxy. A few quick lines of code, thanks to some help from Andrew Mohawk due to some gzip'ed return data trouble, and you have a very simple PHP interface to GoogleSharing:

<?php
ini_set("user_agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)");
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,"http://www.google.com/custom?q=" . urlencode($_REQUEST['q']));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_PROXY, "http://proxy.googlesharing.net");
curl_setopt($ch, CURLOPT_PROXYPORT, 80);
curl_setopt($ch, CURLOPT_ENCODING , "gzip");
$x = curl_exec($ch);

print $x;

curl_close($ch);
die();
?>

My only worry is that I've been down this road before, 5 years ago, and I want things to happen a little differently this time. What happened then is thousands of porn sites hosting malware decided that privacy enhanced search was just what their customers needed. This resulted in Google seeing several hundred malware infested links linking back to this site. The net result was that I dropped out of Google completely (with no warning or explanation of course). So my intention is not that you use my search interface. That's stupid anyway as you have no reason to trust that I'm not mining your search data. So here is a tarball that can be used to set up your own PHP front-end. You'll need a PHP-enabled webserver with curl. The readme has more.
Archived Scroogle Announcement
July 1, 2010: Here we go again...

We regret to announce that our Google scraper may have to be permanently retired, thanks to a change at Google. It depends on whether Google is willing to restore the simple interface that we've been scraping since Scroogle started five years ago. Actually, we've been using that interface for scraping since Google-Watch.org began in 2002.

This interface (here's a sample from years ago) was remarkably stable all that time. During those eight years there were only about five changes that required some programming adjustments. Also, this interface was available at every Google data center in exactly the same form, which allowed us to use 700 IP addresses for Google.

That interface was at www.google.com/ie but on May 10, 2010 they took it down and inserted a redirect to /toolbar/ie8/sidebar.html. It used to have a search box, and the results it showed were generic during that entire time. It didn't show the snippets unless you moused-over the links it produced (they were there for our program, so that was okay), and it has never had any ads. Our impression was that these results were from Google's basic algorithms, and that extra features and ads were added on top of these generic results. Three years ago Google launched "Universal Search," which meant that they added results from other Google services on their pages. But this simple interface we were using was not affected at all.

It is not possible to continue Scroogle unless we have a simple interface that is stable. Google's main consumer-oriented interface that they want everyone to use is too complex, too bloated, and changes too frequently, to make our scraping operation possible.

After a lot of suggestions from Scroogle users, and a fair amount of publicity, we found a fix and Scroogle was back in 24 hours. This fix was to insert an extra parameter, &output=ie, into the search terms that were relayed to Google. The extra parameter recovered the same interface that we thought was gone forever.

Now it seems like it actually might be gone forever. Late on June 30, 2010, the results produced while using this parameter began to shift to the usual busy Google interface with ads and a left-margin sidebar. Scroogle users saw a Scroogle page that said, "Google returned no results for this search," when in fact Google returned results but our scraper was unable to deal with them. Over the next few days we will attempt to contact Google and determine whether the old interface is gone as a matter of policy at Google, or if they simply have it hidden somewhere and will tell us where it is so that we can continue to use it.

Thank you for your support during these past five years. Check back in a week or so; if we don't hear from Google by next week, I think we can all assume that Google would rather have no Scroogle, and no privacy for searchers.

— Daniel Brandt, Public Information Research, scroogle AT lavabit.com
Simple IF: IP list - the Unix way

Posted: June 22nd, 2010, 2:57pm CDT

Tags: Geek [edit]
ifconfig -u|grep -v inet6|grep -v media| grep -v lladdr|grep -v ether|grep -v status|sed "s/flags=.*//"|sed "s/^.*inet (.*) netmask.*$/1/"|sed "s/^([elfv])/#1/"|tr -d 'n'|tr '#' 'n' && echo

I just want a simple display of the interfaces on my system and their IPs. I was in a rush and came up with that disgusting line. On the one hand it demonstrates the power of Unix, on the other hand it demonstrates the problems with it. So, dear interwebs, please provide me with (in order of preference):
1. A better way of doing it (I'm thinking sysctl, [I'm on a Mac])
2. The right command line magic to get better greppable output from ifconfig
3. An optimised command line, specifically:
  1. How can you combine the multiple "grep -v" commands?
  2. How can I combine the sed & tr commands?
Failing that, here's a command you too can use to give you a fragile list of interfaces and their ipv4 addresses. I've embedded it on my desktop with GeekTool (OSX). It makes the FW logs also embedded on my desktop make more sense :)

UPDATE: I love you my fellow Geeks. The winning solution is from Craig Balding via twitter, who put us all to shame with the ridiculously simple piece of cli kung-fu that is:

ifconfig|awk '/mtu/ {nic=$1} /inet / {print nic " " $2}'

Notable mentions to:
Doug Burks who initially came up with both the shortest, easiest to read & least fragile solution with a combination of (1) & (2). However, it was noticeably slower than the others due to awk. At only 2chars longer, but faster, my modification of his is:

for i in `ifconfig -lu`; do echo -n $i: ; ifconfig $i |grep inet |grep -o "[1-9][^ ]* " | tr -d 'n'; echo; done

Rogan Dawes who greatly optimised ala (3) (with some ugliness from mine to make the tuples take one line):

ifconfig -u | egrep "^[a-z]|inet " | sed -e "s/ flags.*$//" -e"s/^.*inet (.*) netmask.*$/ 1/"|sed "s/^([elfv])/#1/"|tr -d 'n'|tr '#' 'n'&& echo

Haroon Meer who aimed for (1) using OSX's networksetup. However, networksetup doesn't list all interfaces (e.g. the vmware interfaces). Also, combing the output to one line per tuple is a pain.
On Large Companies and Staff Retention

Posted: March 18th, 2010, 4:39pm CDT

Tags: Geek [edit]
Over the last few years I've come to notice a few entrenched ideas that, large consulting companies in particular, seem to be unable to deviate from. These ideas specifically relate to how to get the most out of your technical, particularly security, staff, but I'm sure they apply in other contexts too. I'm certainly no expert and these are just my observations, and while I did notice a steady stream of clever people leaving my $previous_employer, including myself (not clever, just leaving) I had some time to muse on the reasons. I'd love to hear comments from people who have/are running their own tech companies.
Divide Labour Cautiously
In large companies very many support departments and people exist to deal with specific functions of the business. What baffles me is how these departments usually serve to create more work, not less, and it seems the original intention has been lost. For example, at my $previous_employer each manager was responsible for their own invoicing and billing even though people existed to specifically manage this process. What happened was that those people had to report on how the process was running to their higher ups, and so spent their time devising ways for them to manage their reporting. This resulted in additional fields or forms that we needed to complete when doing our billing, instead of someone taking the burden of billing from us.

What's more is that these groups tend to optimise for their limited view of the world or for specific reporting requirements that upper management would like to see. So while it may make sense to them to recover as much money from clients by having staff members allocate every single phone call to a current engagement, the actual burden placed on the staff isn't understood.

This lead me to come up with some guidelines:
1. Recognise that reporting on a process, and performing the process are two different tasks.
2. Don't give a group the role of managing a process if they won't be fully responsible for it, the entire task should be handed over to the group, not just pressured by the group (Keep the group in check by aligning externalities).
3. Balance the needs of upper management with the burden placed on staff, trade off some "nice to have reporting" against "nice to have staff".
Administrative Flocking
With all these support departments requiring to report on this or that statistic, came a small amount of administration for each. Much like how each bird in a flock, or each fish in a school is a small part of the flock/school, so is each piece of admin. However, when taken as a whole, emergent behaviour is observed, which in the case of a flock in a pretty formation, but in the case of admin is late nights performing work that irritates your staff, results in no innovation, no new work and seemingly never ends when viewed over a lifetime.

The impact of this is that in the short term, the admin may be bearable, but in the long term the cumulative weight of it becomes a strong disincentive to remain at the company.

And so, the guidelines:
1. Optimise administration across support departments, and ensure a complete view of the burden placed on staff.
2. Provide support staff whose role it is to perform the administrative work in its entirety and not report on it beyond the reporting that was previously occurring.
Rewarding Managers
At some companies, there's an idea that you start out technical, then grow out of it. This is represented by the seniority distribution of staff. If all your managers "don't really do that anymore" and all the junior staff do the actual work, then you've screwed the pooch. You end up with "managers" performing expensive administration being paid better than staff performing billable work with the only means of progression being to become better at performing expensive administration. This has tons of knock on effects, you keep loosing your most experienced technical staff, your innovation only comes from junior/inexperienced staff and the ability to create services and consistently deliver them is lost.

Fix it:
1. Encourage staff to do what they're good at. If what they're good at isn't what you want them to be good at, consider terminating the relationship.
2. Reward staff for doing what they're good at, don't limit monetary "progression" to a specific style.
Overbearing Rules
Big companies love making standards and policies, even if those policies are untenable, unenforced and piss off staff. This is most prevalent in the internal IT division. For example, at my last employer the policy stated that we were only allowed to store 40Mb of personal data in "My Documents". Nobody did this. Worse still, there were several hundred ways to bypass corporate proxies because of the over excited webfilter (the post office was blocked as a porn site and this blog as "social media"). Instead the rules are used only when leverage is required. What's more, they irritate staff. Facebook can actually be a business tool, sure you can waste time on it, but you can equally waste time with a good book in your car. Leave people management up to line managers not IT. Being in security is even worse, because we need to run all the tools and visit all the sites you aren't supposed to.

What's particularly strange is the reaction when it is found nobody is following a rule. Most often a school teacher "eat your vegetables" approach is applied. There is hardley ever any analysis of "why" nobody is following the rule, or how to incentivise people to follow the rule.

What to do:
1. Set rules when you need to, make sure there are generic enforcement rules in line with required legal things, but don't take it to the level of representing an arbitrary rule at a technical level unless there's a good reason for it.
2. Set rules people will actually follow, if a mistake is made and nobody is following a rule, don't issue several reports "naming and shaming" at least try find the root cause and/or incentivise staff.
LayeredTech Toad The Wet Sprocket - Site Downtime expected

Posted: August 20th, 2009, 3:25pm CDT

Tags: Geek [edit]

Thanks to LayeredTech managing expectation like a drunk (you know he'll throw up, just not when), my end of month deadline changed to today. This site will be down at some point, for some amount of time, till I can bring it back up on the other server. I don't think anyone really cares, but just in case, you know.
Twilter - Filtering Twitter for higer Signal

Posted: July 17th, 2009, 5:36am CDT

Tags: Geek [edit]

I really love twitter, and use it more than I should. The only problem is, like most conversation, the signal to noise ratio isn't wonderful. However, unlike most conversation, this is digitial and "we can make it better". This is where my idea for "twilter" came from. It's just an idea, as I don't have the time or skill to implement it, but I'm hoping this forms a functional spec of sorts for someone who does.
Basically, there are some people I follow because they talk about a topic I am interested in, however, I'm usually not to interested in their personal lives. Likewise, there are many people I follow where I am interested in their personal lives. And I am never interested in tweets about what people had for lunch or their haircut. Ideally, people would just self-enforce, but it's really hard to do.

Because people are rarely consistent, or could have very interesting stuff between bouts of 40 blow-by-blow cricket updates, just following or not isn't granular enough to make sure the signal stays high. I tried creating a signal group, but it was still too noisy, and I missed some of the interesting stuff from some people.

This is where twilter came from. At the simplest level, twilter would filter tweets and only show you tweets about things you have explicitly asked for or explicitly not asked for. For example, anything with the words "haircut" in I would not like to see, ever. These filters could be grouped into blocks of concepts. For example, there could be a "soccer" filter which would look for words or phrases like: "soccer", "football", "Manchester United", "Bafana Bafana" etc. This filter could even be a sub-filter of a greater "sport" filter. Creating these filters would require a bit of work. For example, I've recently been working on determining sentiment from tweets, and words like "interesting" are over-used and can be misleading, whereas words like "awesome" almost certainly imply a positive attitude. At a later stage, or if the right people get involved up front, natural language processing could be used to do this better. There could even be a crowd-sourcing options with 'community' filters or an option to share your filters with others so easy the development burden.

These filter groups could then be applied as a blacklist or whitelist to your whole twitter feed, or more interestingly, individual people. Thus, if I use the examples above, if I follow someone because I'm interested in what they have to say about security only, I would apply an "information security" filter in whitelist mode (i.e. only show me those tweets); whereas if I follow someone I'm more generally interested in but who talks about sport and their haircut quite often, I could apply the "sport" and "minutiae" filters in "blacklist" mode (i.e. show me everything except those).

This brings me to the second part of twilter, the feedback mechanism. I can complain about how uninteresting someone's haircut tweets are, but they'll just look at their follower count and keep doing what they're doing. As twitter is a fairly self-involved activity (follower counts, quitter and all those other services), I would want a feedback mechanism where someone could look up their twitter user on twilter and see what tweets were being filtered and why. Hopefully, this would provide an incentive for people to keep themselves interesting. It will of course allow people to tune things to beat the filters, but if they're that desperate to talk about something many people are filtering, you can just unfollow them ;)

That's the idea. Now who's going to build it?
Monitoring your Laptop/Desktop Processes Reduces Frustration

Posted: June 27th, 2009, 11:10pm CDT

Tags: Geek [edit]

Using a computer can be frustrating; you click on something and it doesn't complete as fast as it usually does, and you don't know why. Advanced users tend to look at their CPU usage, to provide some form of explanation. "Oh look, my CPU is really busy, that's why stuff is slow." This is often turned into a widget/gadget/screenlet that sits on their desktop blinking the current CPU usage.

More advanced users like to know what is nailing their CPU, and have some form of hotkey of screen widget nearby to tell them. But sometimes it takes too much effort for the computer to show you this application while it's thrashing away and I've been looking for a nice unobtrusive on-screen "gadget" that gives me all the information I need. After going through hundreds of windows sidebar gadgets, Mac widgets and now Gnome screenlets, I've hit on a winning strategy (for Linux, but the concept remains the same).

I'm using a semi-transparent Output screenlet to display the contents of the following command:

top -b -n1 -s -i | head -n9 | tail -n3 | grep -v " top " | cut -b1-16,42-50,61-80

People often forget that disk IO is also an important indicator. Sometimes your CPU usage is moderate but your computer is frozen while your disk thrashes away. So I have a second screenlet with the output of:

iotop -n1 -b -o | grep -v "Total DISK READ:" | cut -b1-38,55-80

What does this buy me? Well, with a quick glance I can find out what process is currently killing my CPU or disk. It also includes the PID for quick "kill" or "renice" access (transparent terminals make reading the PID easy). Additionally, in a few weeks, it has given me a far greater understanding of how applications on my computer work and interact with others. For example, Crossover Office (aka wine) makes Xorg flatline a CPU core when it starts a new wineserver (I blame compiz funkiness). I don't actually care about that, what I do care about is I now know how and when to expect delays when starting crossover apps. The end result of this overcomplicated explanation is that the frustration of using a computer has significantly decreased now that I know what to expect.

Also, when I invariable break something, these strings will be here for me to copy paste back into existence.
Connecting to a Microsoft Office Communicator or Live Office Communicator Server in Ubuntu

Posted: January 19th, 2009, 5:07pm CST

Tags: Geek [edit]

As part of my ongoing attempt to not use Windows this year, I have been struggling to find a way to get OCS/LCS working in Linux. Due to some recent work on the SIPE/SIPLCS Pidgin plugin, it is now working. To make it work, first download the broken 'stable' version from the Sourceforge page (currently 1.3.2), and extract it to a directory.
Next, checkout the latest snapshot from the git repository, as version 1.3.3 fixes several problems with 1.3.2. If you're reading this and 1.3.3 is an ancient version, then skip this step and try the stable version from sourceforge first. The latest snapshot can be downloaded from the GIT repository. Just click the first 'snapshot' link at the top right.

Extract the snapshot into the same directory.

Next perform the usual configure/make routine you're used to. Remember to set the correct prefix based on how you have pidgin installed. If it is a binary package it will most likely be /usr, source compiles will be in /usr/local. I am using Ubuntu Intrepid and since chose /usr.

singe@blackguard:~/manual-install/sipe/merged$ ./configure --prefix=/usr
singe@blackguard:~/manual-install/sipe/merged$ make
singe@blackguard:~/manual-install/sipe/merged$ sudo checkinstall --fstrans=0 make install

I use checkinstall to make sure a package is generated. The --fstrans=0 switch is to turn off file system translation due to a current bug. This will actually install the files, so make sure you're running it on a system you want it installed to.

Next you will need to link the sipe libraries into libpurple as it is incorrectly installed to pidgin's directory. You can do this with:

singe@blackguard:~$ cd /usr/lib/purple-2/
singe@blackguard:/usr/lib/purple-2$ sudo ln -s /usr/lib/pidgin/libsipe.* .

Now you're done. Fire up Pidgin and add a new account. Under protocol select "Microsoft LCS/OCS". The options are poorly named. Place your SIP server's address in the 'Proxy' field, select non-standard port then enter the port your OCS server is exposed on. I used 443 for SSL/TLS and selected the SSL/TLS connection type. Next I put my SIP username and password into the 'Username' and 'Password' fields, my domain username into 'Auth User' and domain into 'Auth Domain'.

For example:

Basic

Protocol: Microsoft OCS/LCS
Username: <sip account e.g. bob@company.com>
Password: <domain password>

Advanced

Use proxy: checked
Proxy Server: <SIP server e.g. sip.company.com>
Use non-standard port: checked
Port: <relevant port based on connection type, most likely 443>
Connection Type: SSL/TLS
Auth User: <domain username, e.g. BOB >
Auth Domain: <company domain e.g. COMPANY>
Server Instability

Posted: January 19th, 2009, 4:10pm CST

Tags: Geek [edit]

Sorry for the server instability. There appear to have been some problems with the kernel, which I think are now sorted. We'll see.
WorkTime Script to Prevent Innapropriate Web Surfing

Posted: January 17th, 2009, 8:07pm CST

Tags: Geek [edit]

Not only does BASH cure cancer, but it can stop you from wasting time on the intertubes. While lying on the grass today I realised that I have a few 'jumping off' sites for non-work meanders; gateway drugs of sorts. By blocking these sites, I can stop myself from getting sidetracked most of the time and prevent Work Avoidance Behaviour (WABbing). If you're one of those people who can stick to a schedule, you could even cron it. Read the crufty-4am-produced shell script yourself, or the English below.
The shell script has two variables at the top, the location of your block list and the location of your hosts (as in /etc/hosts) file. Anyone with a modicum of unix knowledge should get how it works now (if not, don't use it). As an additional step I export my Tomboy todo list to HTML and use netcat to serve it up on localhost (trying to use a combination of dbus and the ExportToHTML xsl to automate this, but not succeeding). This ensures that I am not only prevented from being side tracked, but am put back on track.

The block list is formed by listing the base domain for each site, one per line. For example:

singe@blackguard:~$ cat ~/.worktime
facebook.com
bloglines.com
twitter.com
singe.za.net
engadget.com
gizmodo.com
boingboing.net

You'll need to run it as root to modify the hosts file. For example:

singe@blackguard:~/bin$ ./worktime.sh
Invalid argument!
The options are "on" or "off" e.g.:
./worktime.sh on #to enable work time
./worktime.sh off #to enable play time
singe@blackguard:~/bin$ sudo ./worktime.sh on
Get to work!
singe@blackguard:~/bin$ sudo ./worktime.sh on
It's already work time.
singe@blackguard:~/bin$ sudo ./worktime.sh off
Work's done, let's play.
singe@blackguard:~/bin$ sudo ./worktime.sh off
You're already playing.

You can download it here.
Lenovo T400 HSDPA (Ericsson f3507g) on Ubuntu Intrepid 8.10

Posted: December 4th, 2008, 3:27am CST

Tags: Geek [edit]

I needed to get this working, and things didn't work out the box. Here's how to do it.
First off, the hardware does work out of the box, it's just NetworkManager which doesn't know how to talk the right AT commands. The solution is quite simple. You can check if yours is working with the following commands (key bits highlighted):

singe@blackguard:~$ cu -l /dev/ttyACM0
Connected.
AT&F
OK
AT+CFUN=1
OK
Disconnected.
singe@blackguard:~$

The device is ttyACM0. AT&F will initialise the device (same at ATZ), and AT+CFUN=1 will turn the device on. You will know it has worked if you see the WAN light come on under your screen.

Now that we know it's working. I chose to use gnome-ppp to set up the connection. You can use your favourite ppp dialer (e.g. wvdial) to do the same. You'll need to install it with 'sudo apt-get install gnome-ppp'.

Once you're running gnome-ppp. Enter the following settings in the GUI:

username: anything
password: anything
phone number: *99#
Setup->Device: /dev/ttyACM0 (click detect afterwards)
Setup->Device->Init Strings
Setup->Device->Init Strings->init2: AT&F
Setup->Device->Init Strings->init3: AT+CFUN=1
Setup->Device->Init Strings->init4: AT*EIAPSW=1,1,"<apn name>"

This last string defines the APN name. If you are connecting to normal 3G, your APN name will be 'internet'. If you use a custom APN, then change as appropriate.

That's it, close the dialogs, click connect and you're done. Easy as pie.
Corporate OSS - Aventail VPN on Ubuntu

Posted: December 4th, 2008, 3:07am CST

Tags: Geek [edit]
I've decided I'm sick of Windows. I used to use Linux as my primary OS with no Windows, but since joining the corporate world, especially in South Africa, I've been forced into using Windows against my will.

This is for various reasons, and despite my many attempts over three years. There were lots of little battles along the way, like driver support for the laptop I was using etc. Those have mostly been won. However, there are some big battles left, and I plan on tackling them. This is the first of my 'Corporate OSS' entries, where I will document my solutions to these problems, if they exist.

First on the menu is connecting to the network believe it or not.

My company uses PEAP on all it's network points. While great for security, this has posed some problems. The first is that support for wired PEAP in ubuntu is poor at best. I eventually managed to work out what was stopping me. My company uses the Active Directory computer account to authenticate via PEAP. This makes sense so that the computer can get on the network before a user logs on and talk to AD for authentication. However, this makes it difficult for me, as I don't have access to my computer account's password, and Active Directory changes it regularly. I have logged a call to enable PEAP auth for my user account and spoken to people nicely, but the chances of getting this resolved without large amounts of effort are slim.

This leads me to my solution. I am rarely in the office, and spend most of my days connecting in via a client's network, Wifi or HSDPA. However, to get access to those juicy internal network resources, I need to use our corporate VPN. For tips on getting the HSDPA working, you can check my prior entry, although it is hardware specific.

We use the Aventail Connect VPN from Sonicwall. A quick google shows me that there's a linux version of the client. An equally quick e-mail to our VPN support guys gets me an even quicker 'linux-violates-corporate-standards' response, moving on. On a whim I type the URL for the VPN concentrator into my browser. Lo-and-behold, it has a great web-based interface. After logging in I can download the linux version myself. Unfortunately, an ancient version 8 of the client was provided.

Now that I knew what it is called, I do some more googling. Unfortunately Aventail doesn't put a version number in the initial file, so after downloading 6 copies, I strike it lucky and find a version 9. To save you the same trouble, you can get your copy here. Bear in mind this is commercial software and you must have a license to use it.

After unpacking it, you are supposed to run the installer with 'sh install.sh' however, they've made it bash dependant and Ubuntu's default sh, dash, won't do the trick. Edit install.sh to update the first line to point to bash. It will run, and bomb out with an error about missing libraries. Ignore it, it is installed.

However, this is where it gets ugly. The libraries it was missing were libssl.so.0.9.7 and libcrypto.so.0.9.7. These are provided by the libssl0.9.8 package. However, you will need to create your own symlinks to libssl.so.0.9.7. Don't bother, it won't work. There is a problem with the default Ubuntu Intrepid libssl0.9.8 which makes Aventail bomb out on the handshake for no explainable reason. Thanks to Benjamin Smith's work for identifying the problem and solution.

You need to install a fresh version of the openssl libraries. Benjamin provides instructions on how to do this. However, I encountered some complexity.

I am using a 64bit version of Ubuntu, however, the Aventail connect is looking for 32bit versions of the libraries. So we need to make sure the new libs end up linked to /usr/lib32 (/use/lib if you're on a 32bit OS). Second, openssl does not like compiling 32bit libraries on a 64bit system. It will happily insert any -target, -arch or -m switches into the CFLAGS, but it will put them there along side their 64bit equivalents. In the end the linux32 command came to my rescue as detailed in an earlier entry. If you're on a 32bit system then you can ignore much of this.

Once I had a 32bit version of the libraries compiled, as confirmed by a 'file libssl.so.0.9.8' on the newly compiled library, I wanted to make a Debian package. I use checkinstall for these purposes, as it makes creating a package very simple. However, the current version of checkinstall doesn't play well with kernels >2.6.16 as detailed by the developer. The workaround it to use the --fstrans=no switch. This will write the files to their final locations however, so make sure you're doing it on the system you will be using it on. Or, if you are using Intrepid amd64, you can use my 32bit package available here.

Next, to fix up the links, you will need to run the following commands as root to link the libraries in the right place, and make sure you haven't b0rked your openssl (which compiles despite being instructed not to):

cd /usr/lib32/
cp /usr/local/ssl/lib/libssl.so libssl.so.0.9.8
ln -s libssl.so.0.9.8 libssl.so.0.9.7
cp /usr/local/ssl/lib/libcrypto.so libcrypto.so.0.9.8
ln -s libcrypto.so.0.9.8 libcrypto.so.0.9.7
ldconfig
cd /usr/bin
ln -s /usr/local/ssl/bin/openssl openssl
ln -s /usr/local/ssl/bin/c_rehash c_rehash

If you're on a 32bit system then do it in /usr/lib instead of /usr/lib32. The ugly complexity here is that you end up with three packages overlapping eachother:
- libssl0.9.8 - This is the 64bit version of the library
- ia32-libs - This provides the 32bit version of the openssl libraries, which are deleted. It provides other 32bit libs too.
- openssl - This is overwritten with the new version, and contains the shared libraries as well, unlike Ubuntu's package
Either way, a ldd of AvConnect should now paint a pretty picture:

singe@blackguard:~$ ldd /usr/local/Aventail/AvConnect
    linux-gate.so.1 => (0xf7fa2000)
    libpthread.so.0 => /lib32/libpthread.so.0 (0xf7f74000)
    libssl.so.0.9.7 => /usr/lib32/libssl.so.0.9.7 (0xf7f30000)
    libcrypto.so.0.9.7 => /usr/lib32/libcrypto.so.0.9.7 (0xf7ddd000)
    libm.so.6 => /lib32/libm.so.6 (0xf7db7000)
    libc.so.6 => /lib32/libc.so.6 (0xf7c59000)
    /lib/ld-linux.so.2 (0xf7fa3000)
    libdl.so.2 => /lib32/libdl.so.2 (0xf7c55000)
singe@blackguard:~$

Running startct should work, and voila you have internal network access via your VPN.

Next up, the horrors of connecting to an Exchange server, and no Evolution is not the answer.
Compiling 32bit apps on a 64bit Ubuntu

Posted: December 4th, 2008, 2:17am CST

Tags: Geek [edit]

I've just installed my first 64bit OS in the form of Ubuntu's Intrepid 8.10. However, I ran into some problems trying to get my SSL VPN up and running (but that's another story). I ended up needing newer versions of libssl and libcrypto. However, OpenSSL's configure scripts didn't want to believe me when I asked it nicely to make 32bit version. After struggling with various arch, target and -m32 settings, but having 64bit headers still included in the resulting Makefile; I eventually found this blog entry, which pointed me to the helpful 'linux32' app, which is part of the util-linux package. It creates a shell which wraps calls to uname to make it look as though you're on a 32bit architecture. Problem solved.
SOA is a Concept, not a Goal

Posted: November 18th, 2008, 2:19pm CST

Tags: Geek [edit]

I like the idea of a Service Oriented Architecture; all of your applications reorganised as re-usable and generically consumable services ushering in a new capability to mash-up services across your organisation, aligned to business processes rather than application architectures. I just don't think it will happen.

If you build an architecture from the ground up, then possibly you can get a SOA going. Alternatively, if you have a fairly simple business, or one that relies on very few applications, you may get it going. For how long, I don't know. For the rest of the IT shops, I just don't believe it is something achievable. The systems have evolved, so that you end up with a mish-mash of mainframes, Oracle databases with heavy stored procedure reliance, homebrew applications built in some dead language, VB apps on top of SQL, Solaris scripts etc. Now, you could convert all of those to some form of standard (unlikely), or you could wrap them all in a pretty web service. Great, now what? The one guy who knows the dead language won't recode his app to use the new services. Nor will the vendor selling you the next technomasterpiece have made it flexible enough to consume your new webservices. Possible, someone may come up with a new homebrew app which uses your new SOA, but that's one out of many, and it likely won't consume all the services, so just wrapping necessary services in the first place is a better idea.

The concept is great though, and a strong IT architecture team who keep focussed and pushing for it over several years may be able to make some headway. This is very different from the 'implement SOA now' type consulting engagements (internal and external) promised. Additionally, as the pool of devs collectively forgets how to code in the old dead language, and starting building in web services by default, just because that's what they learned at school, some additional possibilities will be realised. However, this leaves me with the strong suspicion that SOA is a concept, not a goal.

I remember the promise of re-usable objects, and a great big store where we could all instantiate our standardised objects from. I remember Microsoft presenting on how this XML stuff would provide new ways of exchanging business data between companies. In a way, these things, happened, but they were incremental innovations that crept into the way we do things, rather than a rearchitecting. Even then, most of your legacy apps still don't do that sort of fancy stuff.

Alternatively, the above could be rephrased as; I'm tired of hearing about SOA, can we get a new architecture buzzword? (Not Virtualisation though)
iCommons is Dead, Long live The African Commons Project (TACP)

Posted: November 18th, 2008, 10:13am CST

Tags: Geek [edit]

iCommons as you know it is dead changed, and is being replaced with The African Commons Project. The whole team from iCommons has moved over to TACP, and unlike Theseus' Ship the name didn't move with it. The new website (if you can't follow hyperlinks) is http://africancommons.org/ and is already starting to fill up with interesting content.
SA Telecoms Edge Toward a Free Market

Posted: November 1st, 2008, 5:08am CDT

Tags: Geek [edit]

I don't think the free market has all the solutions, but in the case of SA's current telecoms landscape, I think it would provide some clear advantages. Our ridiculously inept communications minister's appeal against the original Altech judgement was rejected on all counts with costs. Nice work Altech, and thank goodness for an independant judiciary.
The Large Hadron Collider - Explained

Posted: September 21st, 2008, 10:33pm CDT

Tags: Geek [edit]

Hitchcock got all fed up with nobody getting this XKCD, so he wrote a human readable breakdown of the LHC (Large Hadron Collider). It's a good read, and certainly upped my dinner table conversation skills.
SA VANS can self-provide

Posted: August 29th, 2008, 8:05am CDT

Tags: Geek [edit]

Our ridiculous communications minister's ridiculous mishandling and contradictory corruption has finally come up against the light of reason in the form of Altech Autopage's win in the high court. This means that value added network service providers (VANS) can provide their own networks, and the DoC's back-tracking of their 2005 statement to the same effect, has no legal weight. One step closer to a liberalised telecomms industry for South Africa.

More at Ingrid's blog, and the full ruling available here.
DIY Papercraft Wallet

Posted: July 24th, 2008, 11:15am CDT

Tags: Geek [edit]

This paper wallet is pretty cool. I usually can't stand papercraft as I don't have the patience to cut out lots of tiny little pieces and try and make paper do things it was never supposed to do, just because I feel empower with non-toxic glue. However, this is dead simple (took me about 10 minutes to make) and pretty useful.

The only problem is that it is wide enough for US dollar bills, but not "real world" money. So right now, I'm using it to store all those store cards I don't want to keep in my main wallet. I'll see if I can fire it up in inkscape later and make it larger. There are some great tips in the comments too. Thanks Lifehacker.
SCP Transfer Resuming With Rsync

Posted: July 15th, 2008, 6:55am CDT

Tags: Geek [edit]
I never remember how to do this, so for my own personal blog-memory:

rsync --partial --progress --rsh="ssh -p <remote ssh port>" <from file> <partially downloaded file>
- The --rsh parameter can contain all of your normal ssh command line-fu such as keys, options, ports etc. (Who runs public ssh on port 22 these days anyway?)
- The <from> and <to> follow the normal SCP format of <username>@<hostname>:<filename> or just <filename> for the local copy.
GeekDinner Johannesburg

Posted: June 22nd, 2008, 1:04pm CDT

Tags: Geek [edit]

We had our second Johannesburg GeekDinner yesterday. We're keeping it small until we build a dedicated team/community, so it was more of a GeekLunch. Unfortunately, I missed Yusuf's talk, on why CSS is rubbish, due to a mistimed afternoon nap, but Tristan's on per-user app DBs for scalability was certainly an interesting challenge to the status quo, and his knowledge certainly carried him through his last minute volunteering. I did some live demoing of 0wning a browser with XSS Proxy. We got some serious geek all over the place, which was great, and I think this will grow into something good. Shehnaaz's hand made (from scratch) pizza's were amazing, and she was a gracious host along with Yusuf. The next one has been planned, but we're keeping it invite only until we have it more stable, thanks to nVent for volunteering.
Blogging on TechLeader

Posted: June 5th, 2008, 5:35pm CDT

Tags: Geek [edit]

The guys over at the Mail & Guardian invited me to write for their TechLeader group blog, it is available here. I will be reposting content here after it goes live there. The audience is more technical and less security and the writing will attempt to reflect that.
iSummit '08 Site Launched

Posted: April 14th, 2008, 2:55pm CDT

Tags: Geek [edit]

The iCommons' iSummit '08 site was launched tonight, and I must say it is looking amazing. I am rather biased in this analysis, however, I feel my bias is worthy for Loftwork's killer logo shown on the left. There's something about luminous green which gets me going. I won't be able to attend the conference, but the Second Life programme looks beefed up this year for those of us who want a from-the-couch experience.

I think iCommons is an undervalued organisation, if I were a broker and they were listed I would give it a strong 'buy' recommendation. In digital currency this translates to find out who they are, what they do and then tell others. They have a mandate that extends beyond that of Creative Commons to bridge the gaps between the various 'open access' movements including Wikipedia, Open Source, Free Culture, Open Education, Open access journals etc. I am fortunate enough to know some of the team based on Johannesburg, and can attest that this is a group of highly motivated, passionate people, who are too modest to boast about their own brilliance.

This will be the fourth iSummit, a large conference organised all over the world by 2-5 people! The 10 000ft overview of the summit is best described by the commoners themselves:

There will be two keynote sessions each day, featuring confirmed speakers David Wiley of OpenContent fame, FLOSS advocate and researcher, Rishab Ghosh and Wikipedia's Jimmy Wales. Also look forward to community-specific 'labs' and an Academy track for Commons novices, with extra time to connect and chat. Free space has been planned into the programme to accommodate spontaneous connections as they arise - if a group of like-minded Commoners have an idea that they would like to discuss right there and then, we can help to make that happen.
.tHE pRODUCT Search, powered by The Times, powered by Google

Posted: March 14th, 2008, 10:55am CDT

Tags: Geek [edit]

I just read Colin's entry about how The Times have 'partnered' with Google and included a Google search on their website. I though it was quite strange that he used and advertised this with the term 'partnered' over something both easy to do, and many sites have been doing for several years now. My suspicion is that every now and again these "Web 2.0 Journalists" get far too carried away with buzzwords. Although I do think Colin is a sooper guy.

So, I had a quick look at how this magic 'partner' search works. It's quite simple really, you make a call to google.co.za/custom and pass it all the colours you want in the 'cof' var, along with some other miscellaneous junk (the client and channel vars may be some sort of poor authenticator), including the good old 'sitesearch' var.

I am happy to report that after some fiddling, .tHE pRODUCT is now the second media organisation to 'partner' with Google to provide red search results. Ladies and gentlemen, I present tHE tIMES search:
.tHE pRODUCT Search, powered by The Times, powered by Google
Dominic White

Posted: January 17th, 2008, 12:33am CST

Tags: Geek [edit]

Google has started hating me, and I'm not sure why. This is a test you can safely ignore.

Dominic White

Dominic
Year 2038 Unix Time Overflow

Posted: January 16th, 2008, 4:51am CST

Tags: Geek [edit]

Heard of the year 2038 unix clock overflow bug? The 30th preversary is at 3am this Saturday. If any of your banks are using 32-bit Unix systems to do 30 year home loan calculation you may soon hear about this.
singe@platform:~$ uname -a
Linux platform 2.6.15-27-server #1 SMP Fri Dec 8 18:43:54 UTC 2006 i686 GNU/Linux
singe@platform:~$ sudo date -u 011903142038.06
Tue Jan 19 03:14:00 UTC 2038
singe@platform:~$ date
Tue Jan 19 05:14:07 SAST 2038
singe@platform:~$ date
Fri Dec 13 22:15:52 SAST 1901

My Security Planet » Tags » Geek

Feeds

29 items tagged "Geek"

Posted: November 14th, 2011, 8:08am CST

Tags: Geek [edit]

Posted: October 24th, 2011, 11:56am CDT

Tags: Geek [edit]

Posted: June 7th, 2011, 3:05am CDT

Tags: Geek [edit]

Posted: March 1st, 2011, 7:04am CST

Tags: Geek [edit]

Posted: July 5th, 2010, 1:39am CDT

Tags: Geek [edit]

Posted: June 22nd, 2010, 2:57pm CDT

Tags: Geek [edit]

Posted: March 18th, 2010, 4:39pm CDT

Tags: Geek [edit]

Posted: August 20th, 2009, 3:25pm CDT

Tags: Geek [edit]

Posted: July 17th, 2009, 5:36am CDT

Tags: Geek [edit]

Posted: June 27th, 2009, 11:10pm CDT

Tags: Geek [edit]

Posted: January 19th, 2009, 5:07pm CST

Tags: Geek [edit]

Posted: January 19th, 2009, 4:10pm CST

Tags: Geek [edit]

Posted: January 17th, 2009, 8:07pm CST

Tags: Geek [edit]

Posted: December 4th, 2008, 3:27am CST

Tags: Geek [edit]

Posted: December 4th, 2008, 3:07am CST

Tags: Geek [edit]

Posted: December 4th, 2008, 2:17am CST

Tags: Geek [edit]

Posted: November 18th, 2008, 2:19pm CST

Tags: Geek [edit]

Posted: November 18th, 2008, 10:13am CST

Tags: Geek [edit]

Posted: November 1st, 2008, 5:08am CDT

Tags: Geek [edit]

Posted: September 21st, 2008, 10:33pm CDT

Tags: Geek [edit]

Posted: August 29th, 2008, 8:05am CDT

Tags: Geek [edit]

Posted: July 24th, 2008, 11:15am CDT

Tags: Geek [edit]

Posted: July 15th, 2008, 6:55am CDT

Tags: Geek [edit]

Posted: June 22nd, 2008, 1:04pm CDT

Tags: Geek [edit]

Posted: June 5th, 2008, 5:35pm CDT

Tags: Geek [edit]

Posted: April 14th, 2008, 2:55pm CDT

Tags: Geek [edit]

Posted: March 14th, 2008, 10:55am CDT

Tags: Geek [edit]

Posted: January 17th, 2008, 12:33am CST

Tags: Geek [edit]

Posted: January 16th, 2008, 4:51am CST

Tags: Geek [edit]