Articles for the

This is how I upgraded the Squid package from 3.1.19 to 3.2.6 on my Ubuntu 12.04 installations. The 3.2.x branch contains support for multiple cores, so that's a pretty important update to have. 12.04 is an LTS release, so I'm really not sure why 3.2.6 hasn't been backported to it. Anyhow, here's how I did it:

Set up the dquilt shell alias as described in the Debian New Maintainer's Guide:

alias dquilt="quilt --quiltrc=${HOME}/.quiltrc-dpkg"

Create ~/.quiltrc-dpkg containing

I recently evaluated several open-source HTTP proxy servers. I was looking for something lightweight and fast, without a persistent cache or with no cache at all.

The mechanism we employ to increase the security, integrity and privacy of systems and the communication between them are never absolutely effective. They evolve over time, some are abandoned, others are hardened incrementally, yet others are replaced by supreme alternatives. The encryption algorithms deemed secure today may become obsolete with a new mathematical break-through or with the advent of computational devices that are orders of magnitude more performant compared to their predecessors. Security, as a goal, requires continued effort, and, as a property of a system, can be measured on a scale. It involves making trade-offs: only if the prize is high, do we need to go the extra mile, otherwise we do get away with compromising on security, pun intended.

I recently was exposed to an example of the all-or-nothing approach to security. Google suddenly (as in 'without notice') dropped support for self-signed certificates when fetching mail from external POP3 accounts over secure connections. Granted, self-signed certificates do compromise the security of TLS. But that doesn't justify someone deciding for us that we shouldn't be using them. Interestingly, the suggested mitigations involve abstinence (as in "you can always leave Gmail") and ignorance (as in "you can always use unencrypted POP3").

I recently had to get into the Mosh pit with my good old friend Hardy Heron aka Ubuntu 8.04 TLS.

wget --no-check-certificate https://github.com/keithw/mosh/zipball/mosh-1.2.2
mv mosh-1.2.2 mosh-1.2.2.zip
unzip mosh-1.2.2.zip
cd keithw-mosh-df955aa
sudo sed -i -r 's/#\s*(.*hardy-backports.*)/\1/' /etc/apt/sources.list
sudo apt-get update
sudo apt-get install build-essential autoconf automake libprotobuf-dev \
                     protobuf-compiler libncurses5-dev zlib1g-dev libio-pty-perl
./autogen.sh
protobuf_CFLAGS=" " protobuf_LIBS="-lprotobuf" ./configure --prefix="/usr"
sed -i s/LITE_RUNTIME/SPEED/ src/protobufs/*.proto
make
sudo make install

There are plenty of openly accessible DNS servers available that do name resolution for you. Most Internet providers run them for their customers. There are also DNS providers that encourage you to replace your ISP's name server with theirs. OpenDNS is one example. They even do it without charging you! But remember, hardly anything on the Internet is free. Someone will have to pay the bill. AFAIK, OpenDNS' business model is based on advertising revenue, so the advertiser pays the bill. This is how it works: If you accidentally type a URL with a nonexistent domain name, OpenDNS will resolve it to one of their web servers instead of returning an NXDOMAIN error. The web server will then serve a page with web search results related to the mistyped domain name and some advertisements.

The dbd-mysql gem assumes (?) an i386 architecture when building the native component of the driver. You'll need to set ARCHFLAGS appropriately and point the build at the installation of MySQL.

sudo env ARCHFLAGS="-arch x86_64" \
     gem install mysql -- \
     --with-mysql-config=/usr/local/mysql/bin/mysql_config

That should fix it.

I use Google Notifier to have my Gmail account checked for new mail periodically and automatically. I have a secondary Gmail account that I don't use that often but that I would like to have notifier check as well. Unfortunately, Google Notifier currently supports a single Gmail account only. Here's a simple hack that works well for a few gmail accounts. In a nutshell, you need to clone the application package and modify the bundle id in the clone's Contents/Info.plist file.

1. Copy the Google Notifier application from Applications to a temporary location.

I'll have to break sad news to you: /etc/resolv.conf has been made redundant in Mac OS X. The dig and nslookup utilities still read it but most applications use a different mechanism for picking DNS servers when resolving host names. They generally go through Darwin's resolver library which instead of reading /etc/resolv.conf looks up DNS servers via the SystemConfiguration framework backed by configd. Survival of the fittest, I guess, or, Darwin's intelligent design.

Ok, ok, I'll stop trying to be funny ... Anyways, this would be all swell if there wasn't the occasional need for manually specifying DNS servers. For me this need typically arises when I connect to a VPN managed by an operator from hell. After hours and hours of hard work (my fingertips still hurt from all the googling) I present to you a solution:

With the VPN connected, launch scutil with root privileges:

hannes-mbp:~ Sysop$ sudo scutil
Password:

List all network services with DNS configuration:

> list State:/Network/Service/[^/]+/DNS
  subKey [0] = State:/Network/Service/A3551F2D-62CE-1234-B79A-6EE50CA7AE30/DNS
  subKey [1] = State:/Network/Service/F194302A-846C-4321-9325-6813DAE148F2/DNS

Pick one and show its contents.

> show State:/Network/Service/A3551F2D-62CE-1234-B79A-6EE50CA7AE30/DNS
<dictionary> {
  SupplementalMatchDomains : <array> {
    0 : 
  }
  ServerAddresses : <array> {
    0 : 192.168.1.74
    1 : 217.0.43.81
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}

Ahh, this is the one! So let's get rid of those pesky servers. Obtain a working copy of the DNS configuration entry. It's called ... drum roll ... well, obviously: "d" (rolls eyes).

> d.init
> get State:/Network/Service/A3551F2D-62CE-1234-B79A-6EE50CA7AE30/DNS
> d.show
<dictionary> {
  SupplementalMatchDomains : <array> {
    0 : 
  }
  ServerAddresses : <array> {
    0 : 192.168.1.74
    1 : 217.0.43.81
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}

Reset the ServerAddresses entry to an empty array:

> d.add ServerAddresses *
> d.show
<dictionary> {
  ServerAddresses : <array> {
  }
  SupplementalMatchDomains : <array> {
    0 : 
  }
  SupplementalMatchOrders : <array> {
    0 : 100000
  }
}

Write the working copy back:

> set State:/Network/Service/A3551F2D-62CE-1234-B79A-6EE50CA7AE30/DNS

Note, that the line

d.add ServerAddresses *

clears the ServerAddresses array, thereby removing all DNS-servers tied to that particular connection ("service" in Apple-talk). Without service-specific DNS servers, Mac OS will fall back to DNS servers from other network services. Not sure how exactly that works. If you want to specify particular DNS servers, use

d.add ServerAddresses * 10.0.1.2 112.21.44.66

By the way, the "*" signifies array values, so it's not some kind of wild card.

Wireshark has a preference setting for the font of the capture display but it won't let you change the main font used for other UI elements such as like menu, toolbar and dialog windows. The default for the main font is illegibly small on my Mac OS X Leopard system -- I used Macports to install Wireshark and its dependencies. To fix it you need to add the gtk-font-name setting to your .gtkrc-2.0 preference file:

echo 'gtk-font-name = "Sans 14"' >> ~/.gtkrc-2.0

This will affect all applications using the GTK 2.0 toolkit but I guess that's ok.

A close relative of mine asked me to help him with choosing, installing and maintaining a blog for him. I am a big fan of Drupal (the software behind this blog, in case you were wondering) but just couldn't bring myself to recommend it. Don't get me wrong, Drupal is IMHO superior in almost all technical aspects but its user interface is just not as easy to use as WordPress. The person in question being a fairly inexperienced user of web technologies, usability was a major concern. The result can be admired at Hartwig Schmidt's blog.

I use mod_authn_dbd to check HTTP authentication credentials against a MySQL database. After switching from Basic to Digest authentication I got 500 errors and No DBD Authn configured! in the server's error log. It took me a while to realize that it wasn't enough to change

Jsp2X is a command line utility for batch conversion of JSP pages to JSP documents, i.e. JSPs in well-formed XML syntax (aka JSPX, see chapter 5 of the JavaServer Pages^TM 1.2 Specification and chapter 6 of the JavaServer Pages^TM 2.0 Specification). It is written in Java and incorporates a parser derived from a combined JSP+XHTML grammar using the ANTLR parser generator. It tries very hard to create JSPX output that portable across engines. Jsp2X was designed to be used in an iterative fashion in which it alerts the user of potential problems in the input.

Whether a VPN connection has the "Use default gateway on remote network" option enabled has big impact on how network traffic from your machine is routed.

Today I ran into a subtle issue regarding the order in which Windows Vista queries connection-specific DNS servers. I tested a setup with a PPTP VPN server that also provides DNS name resolution services to its VPN clients. For that purpose I ran both a BIND 9 name server and a Poptop PPPD daemon on the same box. It is dual-homed, i.e. one interface is the private interface of the VPN tunnel endpoint and the other one is the public Ethernet interface through which the server is linked to the internet. I configured BIND to listen on both interfaces.

It took me sometime to find Ubuntu torrents that work. I noticed that the .torrent files on the official Ubuntu server and its mirrors point to dead torrents. After some digging, I found this tracker to be most up to date. In case you're stumbling over this problem too, give it a try. It seems to be the official Ubuntu tracker.

To make a long story short, do not ever shop at Letstalk.

I ordered two Motorola E815 cell phones from Letstalk on July 06, 2006 along with a Verizon family plan for my wife and I. The two handsets arrived on July 11. The two holsters I had ordered for the phones were too big although Letstalk advertised them as accessories for the E815.

After a week the battery of one of the phones started to show signs of a defect. Although it had been charged all night, it would only hold the charge for 10 hours without any calls made or received. A call to the Letstalk customer service number yielded an RMA number that was needed to send the phone back to Letstalk for exchange.

[This article is now somewhat obsolete because vmware-server have been included the official portage tree. There is no need for a separate overlay. The bug reports still apply. This is an updated version of a two previous article on the subject.]

The new VMware Server is going to replace VMware's GSX Server product. And it's more than just a new name: VMware will supposedly release it free of charge. Being still in beta testing, there are currently no stable ebuilds available for it on Gentoo Linux. Fortunately, Mike Auty and others are working on one and they are doing a fine job. They also seem to be streamlining and consolidating other related VMware ebuilds. You can keep track of their progress on these Bugzilla bugs:

• Problems regarding the vmware-module ebuild: 137422.
• Problems regarding the vmware-player ebuild: 137423.
• Problems regarding the vmware-server ebuild: 137424.
• Problems regarding the vmware-server-console ebuild: 137425.
• Problems regarding the vmware-workstation ebuild: 137426.
• Problems regarding the vmware-workstation-tools ebuild: 137428.
• Problems regarding the vmware overlay in general: 122500.

The VMware Server ebuilds are not part of the official stable Gentoo portage tree so if you want to install them on your system you will have to jump through a few extra hoops. Fortunately this process has become very convenient and straight-forward thanks to Gunnar Wrobel's layman.

Update: Apparently, I forget easily. Or should I say forgive? Just came back from the Apple Store with a brand-new iPod touch. Good news is that it doesn't have a hard-drive but uses Flash memory instead. Also, the Hold switch is gone/virtual. Make of it what you want but I'm leaving this article up.

Being what's usually referred to as an early adopter, I was one of the first people to buy an 1st generation iPod. And I didn't even have a Mac. So I relied on a software called ephPod to upload and manage songs from my PC. That software still exists but is bug ridden and not as versatile as iTunes, which is what I use now with with my 40G 3rd generation iPod.

I had difficulties downloading the Ruby Plugin for jEdit today. The main site of the plugin seams to be down and the instructions don't mention certain dependencies. Until Rob fixes those problems, all necessary files will be available for download at Diary Products.

[This is an updated version of a previous article on the subject.]

VMWare is going to replace its GSX Server product with the new VMware Server. And it's going to be more than just a new name: the best thing about it is that VMware releases it free of charge. Being still in beta testing, there are currently no stable ebuilds available for it on Gentoo Linux. Fortunately, Mike Auty is working on one and he is doing a fine job. You should keep track of his progress on Gentoo Bugzilla bug #122500. For people with little Portage experience (author included) it can be a bit complicated to throw together an ebuild from bugzilla attachments.

The frequent visitor of Diary Products knows that it runs on the LightTPD aka Lighty web server. The machine that hosts Diary Products is serving other sites as well so it needs to have some kind of virtual hosting mechanism in place. I use LightTPD's very straight-forward and easy to use mod_simple_vhost module. The only draw-back with LightTPD is that it doesn't support directory specific configuration files similar to Apache's .htaccess files. But this is not such a big deal for me because as much as I liked the convenience of .htaccess, I always considered it a waste of cycles and a security issue. The ideal solution in my opinion would be one which

[02/28/2005: Update - More Changes]
[03/02/2005: Update - Still Bugs in IE]

After this site has been using the old, boring, standard Drupal theme for two years, I am now proud to present my own creation: the new Diary Products theme. It uses the phptemplate engine and is a hybrid between table-based and CSS-based layouts as I am not a follower of the pure "Look Ma, No Tables" approach. There are still a few glitches here and there but overall I am quite happy with it.

Ever wondered why port scanners like nmap are able to tell that some of the ports on your server are protected by a firewall? Have a peek at this nmap transcript:

Starting nmap 3.75 ( http://www.insecure.org/nmap/ ) at 2006-02-23 22:54 CET
Interesting ports on doodah.com (12.34.56.78):
(The 1658 ports scanned but not shown below are in state: closed)
PORT     STATE    SERVICE
21/tcp   open     ftp
22/tcp   open     ssh
53/tcp   open     domain
80/tcp   open     http
3306/tcp filtered mysql

I'm quite sure my firewall blocks access to the mysql port. Yet it bugs me that it is possible to tell that I have MySQL installed on my system simply by performing a port scan.

[This is and outdated version of the article. Read the new version!]

VMware Server is going to replace GSX server. The best thing about it is that VMware releases it free of charge. Being still in beta testing, there are currently no stable ebuilds available for it on Gentoo Linux. Fortunately, Mike Auty is working on one and he is doing a fine job. You should keep track of his progress on Gentoo Bugzilla bug #122500. For people with little Portage experience (author included) it can be a bit complicated to throw together an ebuild from bugzilla attachments.

I stumbled upon the Tab Mix Plus extension for Firefox yesterday and I fell in love with it on the spot. Finally there's someone who understands tabbed browsing and realizes what's missing in Firefox' default implementation. I urge the devs to incorporate this extension into head. This is not an extension, it's crucial! If you use tabs, go get it! If you understand the difference between Ctrl-Tab Ctrl-Tab and Ctrl-Tab-Tab, run and get it!

Some of the features:

• Session saver (When starting Firefox, it restores all tabs that were open when you quit Firefox)
• Undo closing a tab
• Open new tabs next to existing ones instead of at the end of the list.
• Ctrl-Tab moves to the previously active one instead of the next one in the tab list.
• Organizes tabs in multiple rows if you have many tabs open.
• Ctrl-W'ing the last tab doesn't close Firefox anymore.
• Customize mouse and keyboard events, tab font and color.

All of these are optional. If you don't like one, you can switch it off.

If you are a user of Urchin 4 or 5 you might have noticed that Urchin’s “Countries” report does not match the standards that Urchin has set for professional website statistics.  It seems to be Urchin’s weak spot.  It might be ok for you but I was certainly disappointed when I discovered that Urchin determines (or should I rather say: attempts to determine) a visitor’s location from a database that is derived from reverse DNS lookups. This type of location reporting can hardly be considered state-of-the-art, even less so for a commercial website log file analytics application. This article is about how Urchin 5 can be fooled into using true Geo IP mappings for its Countries report.

Urchin is a professional web log analysis and statistics application. It was recently acquired by Google and what used to be called Urchin 6 On Demand is now being integrated into Google Analytics. I don’t know for how long the stand-alone Urchin 5 will be around but right now it is still used by many individuals and corporations. I was not happy with the way Urchin deals with dynamic URLs, i.e. URLs that have query parameters in them. After playing around with Urchin 5's advanced filters for a while, I came to the conclusion that they can be employed to improve Urchin's dynamic URL handling.

One might think that it wouldn't be so difficult to setup Visual SourceSafe 2005 on Windows Server 2003 with IIS such that users can access the SourceSafe database using the Visual SourceSafe 2005 Internet plugin. But dude, I was so wrong! I managed to get it working in the end but it took me an etire day. Anyway, this isn't a complete HowTo. I would just like to point out a few not so obvious caveats.

The other day I decided that I wanted to switch my laptop's German language version of Windows XP to the English language version. I could have reinstalled Windows XP from scratch but that would have meant losing all my settings and configurations and, since I have fine-tuned my system, many hours of work would have gone down the drain. Furthermore, I wanted to maintain the German version for certain tasks. What to do?

Let's skip the introduction. You probably googled this article anyway, so you'll know what I'm talking about. This is the scenario: You use group policies to publish or assign software packages (usually Windows Installer MSI) to your Windows workstations. At some point it would be convenient to move a package from one group policy to another, without triggering a complete reinstallation.