Ryan's Journal [entries|friends|calendar] Ryan [ userinfo | livejournal userinfo ] [ calendar | livejournal calendar ]

How to mitigate CERT VU#800113 on OpenBSD [21 Jul 2008|07:18pm] New poisoning attack, out early: VU#800113 If I've helped you set up an OpenBSD router, you are vulnerable. ssh to your router and edit named.conf: su - emacs -nw /var/named/etc/named.conf Modify the options {} block by adding the lines below, which will forward all queries for non-local zones to OpenDNS, who isn't vulnerable to this attack: forward only; forwarders { 208.67.222.222; 208.67.220.220; }; Restart named: pkill named named Verify that you've fixed the issue: ryan@belal ~ $ dig +short porttest.dns-oarc.net TXT z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net. "208.67.216.14 is GOOD: 26 queries in 0.6 seconds from 26 ports with std dev 17317.56" If you see POOR instead of GOOD, you're still vulnerable. UPDATE: xyon points out that you might need to ignore the DNS servers coming down from your ISP via DHCP. Edit /etc/dhclient.conf: supersede domain-name-servers 127.0.0.1 Then restart dhclient: ps aux | grep dhclient # remember the external interface like fxp0 or dc0 or whatnot pkill dhclient dhclient fxp0 # or whatever your external interface was You can check to make sure it worked by looking at /etc/resolv.conf and make sure the only nameserver line is: nameserver 127.0.0.1 UPDATE2: You'll probably want to go to www.opendns.com and sign up for an account to turn off their proxying features. 3 comments|post comment

Games for Children [29 Jun 2008|11:40am] It seems that a common theme of games for young children is a highly restricted nature. This makes sense. The purpose of early childhood games is mostly to teach children what a game is, how to follow rules, what it's like to win and lose, etc. By restricted, I mean that there is generally a very small branching factor -- for example, in Sorry the only choice you have is which of your four pawns to move, and often there's no choice at all. About the most interesting game we play so far is Mexican Train Dominoes. What I don't like about these games is that the outcome is largely random - in essence, the games almost play themselves. I'm wondering if there are good examples of early games that aren't essentially random. I might try out backgammon and checkers, but those are quite a step up from dominoes. I think backgammon would be easier to teach, since its long-term goal is easier to understand and translate into short term goals. An interesting question is whether chess is right out at this point. Is it good to introduce the pieces at an early age so that children can internalize their movements, or to hold off to the point where they might be able to grasp some of the subtleties of the game. I remember being taught chess as a child and thinking that since I knew how the pieces moved, I knew how to play. Nothing, obviously, could be further from the truth. Now that it's summer there will likely be a lot of time for game playing. What games did you like to play as a child? Which of them were random and which taught that choices affect outcomes? 12 comments|post comment

Using exiftool to fix busted EXIF [12 Apr 2008|09:14am] I have a large back-log of photos sitting on my mass storage, basically since the kids were born. I've been working on how to get the stuff out of my private gallery2 instance and onto Photosleeve. One challenge is that some of my EXIF data is inconsistent. Specifically, we rotated some of our original images in a way that did not reset the EXIF Orientation tag. So in newer, savvier, orientation-aware image viewers (like ZoomBrowser or, in fact, Photosleeve) the image gets double-rotated. As a quick fix, I've just cleared all the Orientation tags on Tall photos. I did it with almost no effort, thanks to the incredibly wonderful exiftool, which can happily say I've put to use as a stand-alone perl script, a perl library, and a stand-alone Windows EXE. Anyway, here's the awesomeness: find . -name \*.jpg -print0 | xargs -0 exiftool -n -if '$File:ImageHeight > $File:ImageWidth' -IFD0:Orientation= The inherent sexy power of the -if construct is thrilling. It also does super cool stuff like let you offset all the date-related tags by an hour with -AllDates+=1:00. Don't leave home without it. post comment

Daniel Day-Lewis == Hugo Weaving [09 Apr 2008|12:46am] Just watched There Will Be Blood. Did Daniel Day-Lewis's voice remind anyone else of Agent Smith (Hugo Weaving) from The Matrix? post comment

EXIF orientation - math or lookup? [02 Apr 2008|01:54pm] EXIF orientation numbers are kind of random. Starting at "normal", here's the number of 90 degree clockwise rotations needed to fix an image: 1 (0) -> 6 (1) -> 3 (2) -> 8 (3) -> 1 (0 mod 4) So I've got these stuffed into a list (1, 6, 3, 8) and traverse it mod the length to figure out what to do when someone wants to rotate a photo clockwise or counter-clockwise. Is there some mathy way to avoid the list in this case? For a moment I thought it was just (5*i % 8) + 1 given index i. Although that works for 0 -> 5 -> 2 -> 7, unfortunately 7 + 5 mod 8 ain't 0. 3 comments|post comment

Estimate value of pocket change by volume? [31 Mar 2008|12:14pm] Google fails me. Anybody know of a tool or guideline or something that will tell me about how much the slightly more that 2 quarts of pocket change I've accumulated in my bank might be worth? Obviously it would have to make some kind assumption about the ratios of the coins to one another. I don't even know how reasonable this request is. 4 comments|post comment

Server Beach discount/rebate code [28 Mar 2008|07:32pm] If any of you guys are looking for a web hosting provider, I've been really happy with Server Beach so far. I can refer you and we both get a rebate if you stay a customer for 3 months. They're reasonable but not super-cheap, so it might not be great for personal hosting. They basically just pre-load a box with Debian or RHEL, stick it on a static IP, and email you the root password. Anyway, my code is 6SFCS63VW8. If you have any questions about them, just let me know. 2 comments|post comment

I <3 Linux System Rescue CD [24 Mar 2008|02:10pm] I have been very pleased with this Linux System Rescue CD. It's a gentoo based bootable ISO that has a host of great tools on it. I have used it several times for fdisk+ntfsresize and it's much handier than booting to a full distro LiveCD. It also has a bunch of different boot modes, including one to an autonuke program to clear off hard drives. Highly recommended. post comment

[21 Mar 2008|10:55am] wrexen has a nice write up of How to improve your Scrabble play post comment

Latest emacs-snapshot renames *some* modeline faces [07 Mar 2008|01:54pm] Today ubuntu auto-upgraded me to emacs-snapshot 20080228-2~gutsy. Oddly, my modeline became unreadable. Slight investigation shows that modeline, modeline-highlight, modeline-buffer-id have all had a - inserted: mode-line... However, modeline-mousable and modeline-mousable-minor-mode didn't. Weird. post comment

SMTP forwarding based on sender with postfix on Ubuntu 7.10 [05 Mar 2008|07:50pm] Ok, so I went ahead and played around with postfix to see if I could get it to forward the mail the way I wanted. This seems like a really bad idea on a true multi-user system, since I'm pretty sure it would let anybody on my box send mail as me simply by specifying my email address in the smtp envelope. There's an article on setting up two postfix instances to do smtp forwarding where the assumption is that each account on your box should be magically transformed into a single outgoing smtp account. I was able to glean a lot of info from it, but it wasn't quite what I wanted. I've got postfix 2.4.5-3ubuntu1. Docs suggest that I would have had less trouble with the TLS configuration in 2.5, but I didn't really feel like recompiling it. Set up sender-dependent relaying Create sender_dependent_relayhost, which maps sender addresses to outgoing servers (don't forget postmap). # cat > /etc/postfix/sender_dependent_relayhost ryandjohnson@gmail.com [smtp.gmail.com]:25 ryan@innerfence.com [server1.gambitdesign.com]:25 # postmap sender_dependent_relayhost Require TLS for the relays Create smtp_tls_policy that requires TLS with valid certs for our relay hosts. In part this is necessary to guarantee that our passwords aren't sent in the clear, since gmail doesn't support anything else. # cat > /etc/postfix/smtp_tls_policy [smtp.gmail.com]:25 secure [server1.gambitdesign.com]:25 secure # postmap smtp_tls_policy Set up passwords Create sasl_password that configures your username/password for each host. # cat > /etc/postfix/sasl_password [smtp.gmail.com]:25 ryandjohnson@gmail.com:nopaste [server1.gambitdesign.com]:25 ryan@innerfence.com:nopaste # chmod 600 sasl_password # postmap sasl_password Fix TLS certificate validation We need to link in the openssl roots and take the smtp client process out of chroot. This kind of sucks, but I didn't really see any other way to do it. # ln -s /etc/ssl/certs /etc/postfix/certs # $EDITOR /etc/postfix/master.cf -smtp unix - - n - - smtp +smtp unix - - - - - smtp Hook it all up in main.cf # $EDITOR /etc/postfix/main.cf + +# Relay according to the sender address +sender_dependent_relayhost_maps = hash:/etc/postfix/sender_dependent_relayhost + +# Turn on TLS for the smtp *client* (for relaying) +smtp_tls_CApath = /etc/postfix/certs +smtp_tls_policy_maps = hash:/etc/postfix/smtp_tls_policy smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache +# Use SASL authentication over smtp *client* (for relaying) +smtp_sasl_auth_enable = yes +smtp_sasl_password_maps = hash:/etc/postfix/sasl_password +# allow plaintext (over TLS) +smtp_sasl_security_options = noanonymous + Fire it up, test it out # postfix reload # sendmail -f ryandjohnson@gmail.com -t ryan@innerfence.com From: ryandjohnson@gmail.com To: ryan@innerfence.com Subject: test message The quick brown fox jumps over the lazy dog. # tail /var/log/mail.log Be sure when you're testing it you view all the headers on the mail you receive, to ensure that you get domain key signatures, SPF passes, and all the other modern goodness which is really why you want to do it. Next steps Well, now it's time to figure out how to get mutt to do the right thing. I'm pretty sure that account_hook + envelope_from will save the day. post comment

gnus for mail with automatic smtp selection [05 Mar 2008|11:45am] Yesterday I spent some time setting up gnus for mail. While I'm happy to be using emacs for composition, and I'm ok with the gnus user interface, it seems really *slow*. Also, I haven't figured out how to get gnus to periodically check for mail/news without me switching to it and hitting 'g'. So my gmail tray thinger lights up, I switch to gnus, then have to M-g on nnimap+gmail:INBOX, which takes more than just a second. And loading each mail is quite pokey as well. So I'm considering going back to the setup I had in college, basically mutt+emacsclient. But since mutt doesn't natively support smtp, that means trying to figure out how to configure postfix to appropriately relay my mail based on the sender. Which is apparently doable but will probably eat several hours unless it only takes five minutes. Lazyweb, if you could point me at a working config that doesn't use sendmail, I'll probably switch to that MTA and cargo cult it. Speaking of choosing an smtp server based on the sender, I actually got gnus doing precisely what I want, with this bit of fun: ( There be elisp here ... ) With this setup, replying or composing while I'm looking at an IMAP folder automatically uses that from address, and then my advice automatically swaps out the correct smtp params. I should really have a list of them or something but I'm not invested enough in gnus for mail yet to take the time. 1 comment|post comment

Free sofa-bed (Seattle area) [27 Feb 2008|03:00pm] I need to get rid of my sofa-bed. I've had it since college. It's not the latest fashion, and it's spectacularly heavy. But it's free. I'll probably post it to craigslist later today. post comment

Red Hat Liberation Fonts [24 Feb 2008|08:32pm] I love Red Hat's Liberation Fonts. They are a wonder of clarity. The monotype is way better than DejaVu, and a bit better (and FREEer) than Consolas. The only issue is that it's not as good as DejaVu at the l/1 difference. And for some reason O and 0 look the almost exactly the same. But the cleanness of the font wins me over nonetheless. They're not in the default ubuntu repositories or anything, so grab them and check them out if you haven't seen them. Update: In comments, codeman38 pointed out that there are newer better versions of the Liberation fonts. See Red Hat Bug 427791, which contains an attachment with a tarball, couple of rpms, and zip file with the new versions of fonts. 2 comments|post comment

If you want something done right, you have to pay people ... [15 Feb 2008|01:03pm] Honestly. I mean, I think it's great that the animal shelter is staffed by volunteers. And I sympathize with the shelter's desire to combat the feline overpopulation problem. But, really: Wed Afternoon: We select a cat (Lucy). We're told she's scheduled for surgery on Friday, so we can pick her up Saturday. Wed Evening: We get a phone call. They're going to bump Lucy's surgery up so that we can pick her up on Friday. We're overjoyed. Thurs Evening: We get a phone call. The vet couldn't fit Lucy in, so she's going to go with her original slot. We can pick her up Saturday. We're disappointed, but that was the original deal, so whatever. Fri Morning: We get a phone call. Somebody forgot to take away Lucy's food, so she can't undergo anesthesia. No chance of surgery over the weekend. Now we can't pick her up until TUESDAY. At this point, please, can we just get the cat? We'll sign a contract saying we'll have her spayed as soon as possible. Sheesh. post comment

Free Safari through my local library? [13 Feb 2008|03:44pm] It appears that if one has a Snohomish-Island county library card, one can access O'Reilly Safari for free through the library website. At least, that's how I'm interpreting this. The library membership eligibility requirements seem fairly liberal, but I don't quite understand who is or isn't. In any case, I've applied for a card, so I hope to be getting one in the mail soon. Since I do live in Snohomish county, I'm hoping my chances of approval are high. post comment

CFBs [06 Feb 2008|02:05pm] I like GE HELICAL bulbs. I hate "Conserv-Energy" bulbs. The GE ones come on right away and are almost instantly bright. The Conserv-Energy bulbs have that annoying delay when you flip the switch and take a long time to come to full brightness. FYI post comment

Public Service Announcement [29 Jan 2008|11:55am] Do not ever use Microsoft Publisher to send email. This may seem obvious, but today I got some emails from a college recruiter that were honestly the most reprehensible emails I've ever gotten. The text/plain was empty. The HTML bit was just an embedded image; the sole content of the image was awful 1992 no-anti-aliasing pixelated text. Not copy/paste friendly. Not search friendly. Not reading friendly. Anyway, I emailed him back and got a perfectly normal email back. Apparently others had hassled him before me. But I got him to tell me what travesty of a software product produce such a heinous item. In its defense, I'm sure Publisher meant well, allowing your mom to email her "Cat of the Month" newsletter, which had exactly the same crazy multi-column layout as the print version. I wonder if he was exploiting some kind of "mail merge" feature or something. 4 comments|post comment

$@ [22 Jan 2008|06:24pm] If you've ever written a bash shell function, and you don't know the difference between $@ and "$@", you'd better go look it up, because you have some bugs to fix. post comment

Firefox: spell check any field [22 Jan 2008|12:31am] I hadn't noticed, but by default Firefox only spell checks "long" text fields. You can of course configure firefox to spellcheck all text fields 1 comment|post comment

navigation [ viewing | most recent entries ] [ go | earlier ]