" /> kasia in a nutshell: September 2004 Archives

« August 2004 | Main | October 2004 »

September 30, 2004

Presidential Debate

... everyone else is blogging it, I won't bother...

It is interesting to read the different view points on the debate from both sides.

"Kerry clearly won!"
"Bush totally kicked Kerry's butt"

Makes me wonder what the definition of "win" actually is?

September 21, 2004

Yay!

She's back! She's back! She's back!

No idea where she was for nearly six days, but she's clean, looks about the same weight and is not hungry so probably in someone's house. I'm just glad to see her back and healthy.

(This is of course, my kitty-cat).

Cronable svn updates

Running "svn update" is really simple and speedy, but I like having a nightly cronjob updating my local copy of the code, so I wrote a script that does just that and sends me a small, quick summary of what it did, paying special attention to conflicts.

I really don't care what files have changed, were added, etc, but I do care which files have merge conflicts.. so that's what this script does.. output looks something like:

Tue Sep 21 15:40:50 2004 Updated /home/ktrapszo/test

1 Conflict Detected!

Conflicted files:
/home/ktrapszo/test/test.java

2 files added
13 files updated
0 files deleted
0 files merged

Finished update in 13 seconds

That's really all I care to see, if I want specific updates on specific files I can always check the daily changelog email.

So for those who work like me and like an automated update that only sends a small summary of important info, the script is here.

September 19, 2004

Book reviews

I have an annoying habit.

After, not before, I finish reading a book I read the reviews. Most people probably (I didn't poll for this, just guessing) read reviews before picking up a book to get a general idea of its readworthiness. Not me. I hate reading anyone's opinion on a book before I've sampled the story myself. Oh, I may skim through the ratings just to see if it's generally liked or just a horrible stinker.. but reading the actual text of the reviews colors how I see the book later. Or worse: gives away a story line.

I find ratings somewhat useful. If a book has a lot of "great, fantastic, 5+++++ stars" ratings combined with a lot of "boo, horrible, waste of time, hiss hiss" ratings then it probably is at the very least controversial enough to be interesting. After all, only a fascinating book could possibly inspire enough people to love it or hate it so much it leaves a mark on its ranking.

Ratings aside, reviews are fascinating to me -- not, not the good ones, I don't bother with those. If I liked the book then I don't need anyone else confirming its delectability. I love reading the bad reviews. The ones who think the book stinks (particularly if they go into great detail why) and the ones who violently disapprove of the author (and how could so many people love this drivel!). There is something delicious about a pointy, knife-twisting picking apart of a book, particularly when the person behind it claims to have never finished it (I couldn't stand it after 10 pages!).

(pick your favorite deity) bless Amazon for creating its review system, it is most entertaining to my twisted mind.

I miss my cat

September 17, 2004

How to inspire the wrath of users

On a website that uses only text ads (you can turn off) and only to unregistered users, put a tiny, little, unobtrusive icon pointing to firefox.

No kidding..


1..
2..
3..
4..
5.. (probably more will show up later).

Makes me want to put up a big, blinking, purple, flash, scrolling ad for something obnoxious instead.

September 13, 2004

You know you're getting old when..

You see an ad for one of those music-compilation CDs and the music packed into it is something you still consider 'new music'.

Mini-guide to common geek misconceptions

Reading things like "A Girl's Guide to Geek Guys" and "The Guy's Guide to Geek Girls" (linked to by Jeremy who should know better) makes me cringe. I've got all the angles covered here: I'm a girl, I'm a geek and er, okay, I'm not a guy -- but I know many geek guys. What are you people thinking when you write these things?

Let's clear some things up.

  • The Star Trek thing.

    Star Trek is not a geek thing. Not all geeks like Star Trek, heck, most geeks I know never watch it. Would you people stop equating geeks with Star Trek freaks? Who the hell is Ivanova? The first guy to buy me a Star Trek mousepad as a cute gift would wear it as a collar in about fifteen seconds or less.

  • Branded tshirts.

    So people think geeks wear tshirts with brand names because they're proudly displaying their loyalty? That's cute and funny at the same time. T-shirts at conferences are free, t-shirts at conferences come emblazoned with logos and brand-names, ergo, geeks often wear tshirts with brand names because they're free. Unlike the rest of you gap-labled yuppies, we don't pay to advertise corporations.

    Unless you count my Free Software Foundation tshirt, I paid for that, but that was really more of a donation than a purchase. Sort of like the emacs manual, yah, i'll ever read that!

  • Geeks can fix things.

    Hahahahahahahahahahahahahahaha -- that's all I'm going to say on the issue.

  • Geeks have no social life.

    Let's define "social life" :

    social: Pronunciation: 'sO-sh&l Function: adjective 1 : involving allies or confederates <the Social War between the Athenians and their allies> 2 a : marked by or passed in pleasant companionship with one's friends or associates <leads a very full social life>

    life: Pronunciation: 'lIf
    Function: noun
    1 a : the quality that distinguishes a vital and functional being from a dead body

    In other words, alive and spending time with allies and friends. I think we covered that one with conventions and IRC quite well, thank you very much. The common misconception here seems to be that getting drunk and rowdy in a bar is somehow more desirable than an intellectual discussion over a gaggle of laptops. We do the former as well, you just don't think of us as geeks when you see it -- the laptops are usually missing, that's why.

I think it's clear where this is going? Geeks come in all shapes and sizes, but damnit, they don't all like Star Trek!

September 12, 2004

Secure access to your server checklist

With the recent increase of break-in attempts via ssh, here's a little checklist of making sure your server is as secure as you can make it while still being able to access it from the outside.

  • Do not run ssh in Protocol 1 compatibility mode. This is sadly, enabled by default in many installations, you can test yours by simply telnet-ing into it.

    % telnet unix-girl.com 22
    Trying 66.198.51.100...
    Connected to cygnus.unix-girl.com.
    Escape character is '^]'.
    SSH-2.0-OpenSSH_3.7.1p1

    Mine's safe, unsafe configuration would show:

    SSH-1.99-OpenSSH_3.7.1p1

    To disable Protocol 1, set this in your sshd_config file.
    Protocol 2

  • Do not allow root login via ssh at all. Root is probably the most common targeted account for brute-force attacks. To disable root login in sshd_config:

    PermitRootLogin no
  • Enable key authentication, keys are more secure than passwords. In sshd_config:
    PubkeyAuthentication yes
    AuthorizedKeysFile .ssh/authorized_keys

    In your home directory:

    % vi ~/.ssh/authorized_keys
    -- insert public key in the file -- :wq
    % chmod -R og= ~/.ssh/

  • Disable password authentication altogether: I'm not that sure of this one, it is a lot more secure but then you'll either have to sprinkle your private key in places (I don't want that) or keep a backup system with your private key on it to which you can access from everywhere without using a key.

    PasswordAuthentication no

  • Make sure you do not have any of these accounts on the system:
    • admin
    • test
    • guest
    • user
    • webmaster

    These are a huge magnet for brute-force attacks.

  • Make sure these common (and others) accounts use /bin/false or /bin/nologin for shell:

    • mysql
    • oracle
    • server
    • backup
    • data
    • apache
    • web
    • nobody

    .. and have no passwords:


    % passwd -l mysql
    ...

    You do not need to login to those accounts, ever, if you do you're doing something wrong.

  • Make sure you're using the configuration file for sshd that you think you are. I've seen many servers where the file used is in /usr/local/etc instead of the more intuitive /etc/ssh/. This is determined by the -f flag in sshd startup.

    If you find two of these, it's probably best to just delete the one you're not using so as not to confuse yourself.


I'll add more as I think about it..

September 11, 2004

ssh scanning on the rise

I'm seeing about four times as many attempts at ssh entry & scanning in logs on various, mostly-unrelated servers.. I wonder if there's some vulnerability that has not been reported yet?

Something is definitely going on... are others seeing this too?

Edit: found it.

September 10, 2004

Time flies when you're having fun

I didn't occur to me until this morning (my mind works in funny ways) that I have been running this weblog for over two years. The anniversary actually passed in July.

That's two years of mindless rambling, some silly rants and technical information nobody needs.. and all this fits in a 4.5MB MySQL database and 18MB worth of HTML pages. The MySQL apache log on the other hand is up to 1.2GB. What could one do with 1.5 years worth of apache logs (since March 2003) for a personal website?

That's 6,855,670 requests from 350,965 unique IPs (that query took 6min 15.30sec in case you're curious, no index).

September 08, 2004

MySQL hates me lately

Yesterday, I had to resize tables. Who knew they would reach 4GB each in such a short period of time? They do grow quickly.. don't they.

Today, I had to deal with aftermath of a server running out of space (damnit, I will install some better monitoring, I promise!) and learned that you need 2.2GB of free space to run repair on a 2.4GB table.

Time to prune some data.

September 04, 2004

Running community websites

.. is really a chore. I cannot imagine anyone would do this for pure satisfaction of creating something useful. While that's great.. and I enjoy helping others, it's the few jerks who chooose to make everyone around them miserable to compensate for their lack of a meaningful life that make it annoying.

This is where running your own server comes in handy.

(1) web server


RewriteCond %{REMOTE_HOST} 24.171.49.245
RewriteRule (.*) http://www.joke-archives.com/computers/howtogetalife.html [R,L]

(2) mail server


/^From:.scgower@charter.net/ REJECT This server does not accept e-mail from \
idiots, thanks for playing

Petty to do this? Probably.. Petty to post it in a weblog where I know it will be read by a lot of people and archived by google? Most definitely.
Does it feel great? Most certaintly..

Don't call a girl who knows unix a "cunt".

September 03, 2004

Subversion on hpux

HP Unix (or as I like to call it h-pox and a pox it is) is not a popular platform and thanks to my recent exposure to it I completely understand why. The non-ansi C compiler it comes with is a winner as is the fact that its getpass() library only accepts 8 characters (what is this, the 80s?) as I just learned. The hard way.

So if you want to compile the Subversion client on this OS, it will only work with short passwords.. unless before configuring you let APR know not to use its own getpass() instead of the system's.

The way to do that?


setenv ac_cv_func_getpass no
Before you run configure on the source. (Adjust syntax for your favorite shell of course, I'm a tcsh gal)

This tip brought to you by Joe Orton of the Subversion user's list. Thanks!

September 02, 2004

Nostalgia

When searching for help with hpux + http authentication issues came accross the original Apache http server anouncement on comp.infosystems.www.servers.unix from 1995.

Folks, we in the Apache Group are happy to announce a new public-domain HTTP
server based on patches to NCSA's 1.3 httpd called "Apache".  It fixes many
bugs, in both performance and functionality, and it includes the following
new features: 
 
      Content negotiation (for all you who want to do HTML 3 right!)
      Multiple Domain Names (http://foo.com/ & http://bar.com/)
      Custom error responses (internal redirects to pages or script)
      Send "as is" file types - for including HTTP headers with documents
      More HTTP spec compliance
      DBM-file based user authentication

Ah.. the good old days
link

September 01, 2004

I must be too cynical

More and more people offer gmail invitations on forums and other discussion medium..

"I have x invites, contact me with your email address"

.. and of course my first thought is "Looking for valid e-mail addresses to spam!".

I fear I grow more cynical by the year.. maybe if this election doesn't go to Bush it'll improve. Maybe.