Planet SysAdmin


January 29, 2012

Chris Siebenmann

Thinking about spam rejection and abuse addresses

Thinking about spam rejection and abuse addresses

Somewhat recently we got a spate of spam messages to our abuse address, which set me to thinking about the mostly theoretical issue of how to treat email to it.

(It's a mostly theoretical issue for us because the volume of spam and other email to our abuse address is very low in general, so we're not at all likely to change anything about it.)

On the one hand, visible spam rejection of email to abuse addresses is one of the things that really gets on people's nerves; it's famous for rejecting real spam complaints because, of course, they contain spam. Your spam, that people are trying to complain about.

On the other hand, email to abuse is going to go through our spam scoring system and get tagged if the system thinks it's spam. Pretty much everyone here either discards spam-tagged email outright or filters it to a separate folder. My mail filtering deliberately excludes email to abuse (among a few other things), but I don't know if anyone else either bothered or even thought of it; it's not necessarily something that comes to mind when you're setting up personal email filtering.

And finally, I can't think of any actual real email to our abuse address that we've gotten in the last five years or so (since I moved to here). It's all been spam. So as a practical matter, any filtering or rejection that we do on abuse email is unlikely to affect real complaints, because we don't get real complaints (hopefully because our users and machines don't generate spam, as opposed to people just not complaining about it).

(The other aspect of email to our abuse address is that I suspect most people are going to complaint to the central university-wide abuse address instead of abuse at our specific subdomain. The central people will then get in touch with us through our internal contact address, not our abuse address.)

This is of course a specific instance of the general spam rejection versus spam filtering dilemma. If you reject email people at least know; if you filter, there's at least a theoretical chance that you'll recover from filtering mistakes. The stakes are higher for the abuse address because it is one of the addresses that has a very high chance of false positives (non-spam classified as spam).

The most pragmatic thing to do in a situation like this is to apply spam-filtering to your abuse address. This blackholes real spam to keep it from bothering people while carefully not saying anything to real senders who had their messages misclassified. But this pragmatism sort of bothers me because it's lying to real senders just to pacify them (their email is being ignored either way but you're deliberately doing it silently so they don't know). It would be more honest to use spam rejection on the abuse address, and it might do some good to reduce the level of spam. If legitimate email to your abuse address really is vanishingly rare, it also shouldn't affect very many people.

So what's the right answer? I have no idea.

(My current approach of exempting the abuse address from my personal filtering would not be viable if it got a lot of spam. At that point I would probably remove the exemption and let spam-tagged email to the abuse address get quietly filtered away, mostly because it's easier than trying to persuade everyone that maybe we should do spam rejection for email to abuse.)

by cks at January 29, 2012 07:25 AM

January 28, 2012

Everything Sysadmin

See all the "Best Picture" Oscar nominated films in 2 days

I usually don't blog about something that has so little to do with system administration, but in this case I consider it a "time management tip".

Each year AMC theaters run their "Best Picture Showcase". They show all of the "best picture" nominated films in a marathon. They show 4 films on one Saturday and the other 5 on the following Saturday. This year it is Sat, Feb 18 and Sat, Feb 25. You can buy tickets for either or both days. (Some theaters show all 9 in a row on one day.. 23 hours of movies!)

We went last year and it was awesome. We had seen some of them already but it was fun seeing them again. The schedule includes a break between each film and a big break at inner. We went to a theater far enough away that it felt like we were on a mini-vacation.

For all the details go to: http://go.amctheatres.com/bps

Highly, highly recommended!

(We'll probably go to the one in New Brunswick, New Jersey.)


January 28, 2012 05:37 PM

Chris Siebenmann

How I use FvwmIconMan

How I use FvwmIconMan

I've mentioned FvwmIconMan in the tour of my desktop and sort of mentioned part of how I use it, but I've never really explained the details.

As I've set it up, FvwmIconMan is essentially a compact taskbar for my various sorts of terminal windows. In a dense display, it shows the window name for each one (well, the first part of it at least), an indicator if the terminal has been iconified, and an indicator if that terminal has the keyboard focus. This is part of how I work around not having conventional titlebars on terminal windows; the window name information from the titlebar is dumped in small text in the 'taskbar', and through long experience I can pick out the label for the current window pretty easily.

(Possibly I should make the current window more distinctive than it is right now. A lot of my FvwmIconMan configuration, much like a lot of my fvwm configuration in general, dates from days with much slower machines that had much more limited graphics.)

Left-clicking on FvwmIconMan's label for a window toggles whether or not it's iconified. Like other taskbar implementations, an iconified (or 'minimized') window is only present as a label in FvwmIconMan; to deiconify it, I have to go click on the label. This means that I care a lot about finding the window labels for specific windows, and I do two things to help with this. First, the window labels are always sorted into alphabetical order; if and when a window is renamed, the order shuffles (this is very important for my use of xterm's ziconbeep feature). Second, I give my windows very consistent names based on either the host they're on or what I'm using them for (and sometimes both). This scheme usually works okay but breaks down a bit if I have a lot of iconified windows on the same host; usually I don't and this isn't an issue. Lots of non-iconified windows on a single host are generally not a problem because they're directly visible and I usually keep them straight by how they're arranged on the desktop.

(This alphabetical sorting does mean that the label for a particular window isn't in a consistent physical spot; it can jump around wildly depending on what other windows get named or renamed. This doesn't bother me, partly because a lot of my terminal windows come and go rapidly anyways. Non-alphabetical taskbars actually drive me up the wall because I never can find anything once I have more than a few things running, or at least I can only find them by scanning through the entire taskbar.)

Some taskbar implementations only show windows from the current virtual desktop or virtual screen or the like. While I use virtual screens I have FvwmIconMan configured to include all terminal windows, regardless of where they are. Among other things this lets me easily yank terminal windows between virtual screens; I move to another screen, then iconify the window and immediately deiconify it again (windows always deiconify on the current virtual screen) with two clicks on the window's label. I can also use FvwmIconMan to switch to the virtual screen that holds a particular deiconified terminal.

(Iconified terminals aren't on any particular virtual screen; they've been effectively swallowed by FvwmIconMan.)

Sidebar: terminal windows versus Firefox windows

A long time ago I would have confidently told you that I did this for terminal windows, and only for terminal windows, because they were by far my most numerous sort of window and I also often had a lot of them iconified. If I had the iconified windows represented as real icons on the root window, I would run out of space; therefor I condensed them all into a much more compact area. Then my Firefox window habit grew out of control and at this point I often have as many iconified Firefox windows as I have terminal windows.

So why do I have a taskbar for terminals and real icons for Firefox? The simple answer is that useful Firefox window names are too long, whereas I can make xterm window names short enough that I can pack them in very compactly. Because Firefox window names are long, a taskbar that showed enough of the titles to remind me what they were would be too big to be feasible. Instead it actually takes less space to have real icons and count on my spatial memory to remember what the Firefox icon over there is for.

(Well, the spatial memory plus the bit of the start of the window title that fvwm shows me below the actual Firefox icon.)

by cks at January 28, 2012 06:35 AM

January 27, 2012

Chris Siebenmann

Why metaclasses work in Python

Why metaclasses work in Python

I've covered what you can do with metaclasses (1, 2, 3, 4) and even, sort of, the low level details of how they work (1, 2, 3). But I've never covered the high level view of why metaclasses work, ie what overall Python features make them go (partly because I am so immersed in Python arcana that much of that stuff feels obvious to me, although I doubt it actually is).

To start with, in Python everything is an object and all objects are an instance of something (yes, there are spots where this gets recursive). This includes even things that you wouldn't normally think of as objects, such as functions. Crucially, this includes classes: classes are objects. Any time you have an object in Python, a lot of its behavior is usually provided by whatever it is an instance of (to avoid confusion, I'll call this the type of the object). Classes are no exception to this; a lot of how classes behave is handled by their type, even things like how a new object gets created when you call the class.

(For simplicity, I'm going to ignore old-style Python 1.x classes from here onwards and assume that all classes are new-style Python 2 classes that ultimately subclass object.)

To avoid a point of confusion: classes have ancestor ('base') classes that they inherit from (or just object(), the root class). However, classes are not instances of their base class; we can see why this has to be when we note that a class can inherit from multiple base classes. You can't be an instance of several different things at once. So classes exist in a two-dimensional relationship; they inherit from one or more base classes, and at the same time they are instances of something that provides much of their 'class' behavior. The type of classes (the thing that provides the 'class' behavior) is called type().

(This two dimensional structure can get a bit weird.)

In some languages, the creation of classes is black magic that happens deep in the interpreter and isn't something you can do inside the language (even if the classes are visible as objects). Python has instead chosen to expose the ability to create classes by hand; you you can do this by calling type() with the right arguments (and then binding the class object to a name), just as you create instances of normal classes by calling the class itself. As part of creating classes yourself by hand, you can obviously manipulate class creation; you can create a new class with whatever methods, base classes, and so on you want.

(What's odd about type() is that despite it being a class, you can call it with a single object to get the type of the object.)

Python is also an unusual language in another way; in Python, things like defining functions and classes are themselves executable statements. Python doesn't parse your program, create all the functions and classes, and then start running your code; instead it starts running your code and things like def and class execute on the fly (as does import and so on). So it's natural to have your code running as classes are being created.

The combination of these two things means that Python can easily provide a way to hook your own code into the process of creating the class objects for classes that are written in straight Python, with 'class X(object): ....'. Python is already running code in general when this happens, and the mechanisms of creating classes by hand means it's relatively easy for Python to hand you the bits of the class-to-be so you can modify it and then have everything continue onwards to create a new class. This is why metaclasses can change classes as they are being created.

The other half of why metaclasses work is that Python allows classes to be instances of something other than type(). Since classes get a lot of their 'class' behavior through normal instance method inheritance from type(), a class being an instance of something other than type() lets the other thing intercept or change the normal as-a-class behavior for that class (for example, what happens when you call the class). This is why metaclasses can do things with a class after the class has been created.

by cks at January 27, 2012 05:40 AM

January 26, 2012

RISKS Digest

USENIX Update

SCALE10x Follow Up

Phew! Those SCALE folks know how to put on a fabulous event! A big THANKS to all the organizers, volunteers, exhibitors, and attendees for making SCALE10x the best one yet. Also, I’d like to thank everyone who stopped by the USENIX booth. I loved seeing so many familiar faces and old friends, and it’s always [...]

by Rikki Endsley at January 26, 2012 10:38 PM

TechRepublic Network Administrator

Manage your Windows systems remotely with PowerShell Server

Derek Schauland shows you how to set up PowerShell Server, a tool that allows you to use SSH to remotely administer Windows systems through a command-line PowerShell interface.

by Derek Schauland at January 26, 2012 02:00 PM

Standalone Sysadmin

PICC Submissions: only 5 days left! Submit now!

I just submitted a proposal for an hour long talk for this year’s PICC Conference in New Jersey. I shouldn’t have waited so long, but at least I got it in.

Submissions are being accepted through the end of the month, and it’s really super-easy to do. All you need is a short paragraph describing the talk or poster session that you’d like to give. Email that to submissions@picconf.org, and they’ll consider it. It couldn’t be easier!

If you’d like, you can also read the Call For Papers online. Hurry and get it in!


by Matt Simmons at January 26, 2012 11:28 AM

Anton Chuvakin - Security Warrior

Chris Siebenmann

The drawback of modern X font handling gets mysterious

The drawback of modern X font handling gets mysterious

Back in The drawback of modern X font handling I covered how modern X font rendering happens in the client and so can vary from client to client, going from nice on one client to bad on another. I illustrated this with xterm on Fedora and Ubuntu displaying the same font, Fedora well and Ubuntu badly. I now have a good reason to change to using xterm with modern fonts, so I spent part of today poking at this issue; the results have turned this into a genuine peculiar mystery.

What I have so far:

  • the problem does not happen with all programs on Ubuntu. So far xterm and GNU Emacs have the bad font rendering, but Firefox, gnome-terminal, and TK-based programs such as exmh and tkmsg do not; they render DejaVu Sans Mono just like Fedora does.

  • the problem only happens with some monospace fonts, not all of them. The Ubuntu machine I was testing on has 11 candidate fonts listed by 'fc-list :scalable=true:spacing=mono: family'; seven of them show the problem but four do not.

    (The good four are TlwgMono, Tlwg Typo, Courier New, and FreeMono. Unfortunately my preferred xterm font is DejaVu Sans Mono.)

  • the problem is not the Ubuntu version of xterm, the Ubuntu app-defaults file for xterm, or even the Ubuntu Freetype library; I have built the Fedora xterm and my version of Freetype on Ubuntu and used the Fedora app-defaults, and the bad rendering is still there.

  • I've directly set several fontconfig font rendering options that might be doing this without changing anything; at this point I haven't seen any difference with autohint, weight, embolden, or aspect (the last was a wild shot). Similarly, Xft X resources (cf) do nothing that I can see.

    (Forcing autohint=true actually makes the Fedora font rendering slightly but visibly darker while leaving the Ubuntu rendering unchanged for both the good and bad programs.)

  • the problem doesn't happen with xterm on some FreeBSD machines I have handy; they render DejaVu Sans Mono the good way.

Clearly something mysterious is happening in the depths of the Ubuntu version of Xft or something it calls, but only if it's invoked in the right (or wrong) way. Unfortunately I don't think there's any good way for non-experts to see what font rendering choices are being made (the fontconfig library can be coaxed into some debugging output, but it's pretty much 'exports only' from what I can see), so I have no idea if I'll be able to figure out a solution that lets me use the font I want.

(Changing to gnome-terminal is not a solution for me.)

by cks at January 26, 2012 06:23 AM

Racker Hacker

Getting started with SELinux

I used to be one of those folks who would install Fedora, CentOS, Scientific Linux, or Red Hat and disable SELinux during the installation. It always seemed like SELinux would get in my way and keep me from getting work done.

Later on, I found that one of my servers (which I'd previously secured quite thoroughly) had some rogue processes running that were spawned through httpd. Had I actually been using SELinux in enforcing mode, those processes would have probably never even started.

If you're trying to get started with SELinux but you're not sure how to do it without completely disrupting your server's workflow, these tips should help:

Get some good reporting and monitoring
Two of the most handy SELinux tools are setroubleshoot and setroubleshoot-server. If you're running a server without X, you can use my guide for configuring setroubleshoot-server. You will receive email alerts within seconds of an AVC denial and the emails should contain tips on how to resolve the denial if the original action should be allowed. If the AVC denial caught something you didn't expect, you'll know about the potential security breach almost immediately.

Start out with SELinux in permissive mode
If you're overly concerned about SELinux getting in your way, or if you're enabling SELinux on a server that has been running without SELinux since it was installed, start out with SELinux in permissive mode. To make the change effective immediately, just run:

# setenforce 0
# getenforce
Permissive

Edit /etc/sysconfig/selinux to make it persistent across reboots:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=permissive

Adjust booleans before adding your own custom modules
There are a lot of booleans you can toggle to get the functionality you need without adding your own custom SELinux modules with audit2allow. If you wanted to see all of the applicable booleans for httpd, just use getsebool:

# getsebool -a | grep httpd
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_network_connect --> on
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> on
httpd_can_sendmail --> on
... and so on ...

Toggling booleans is easy with togglesebool:

# togglesebool httpd_can_network_memcache
httpd_can_network_memcache: active

Now httpd can talk to memcache. You can also use setsebool if you want to be specific about your setting (this is good for scripts):

# setsebool httpd_can_network_memcache on

Tracking your history of AVC denials
All of your AVC denals are logged by auditd in /var/log/audit/audit.log but it's not the easiest file to read and parse. That's where aureport comes in:

# aureport --avc | tail -n 5
45. 01/24/2012 04:23:29 postdrop unconfined_u:system_r:httpd_t:s0 4 fifo_file getattr system_u:object_r:postfix_public_t:s0 denied 1061
46. 01/24/2012 04:23:29 postdrop unconfined_u:system_r:httpd_t:s0 2 fifo_file write system_u:object_r:postfix_public_t:s0 denied 1062
47. 01/24/2012 04:23:29 postdrop unconfined_u:system_r:httpd_t:s0 2 fifo_file open system_u:object_r:postfix_public_t:s0 denied 1062
48. 01/24/2012 14:01:58 sendmail unconfined_u:system_r:httpd_t:s0 160 process setrlimit unconfined_u:system_r:httpd_t:s0 denied 1123
49. 01/24/2012 14:01:58 postdrop unconfined_u:system_r:httpd_t:s0 4 dir search system_u:object_r:postfix_public_t:s0 denied 1124

Summary
There's no need to be scared of or be annoyed by SELinux in your server environment. While it takes some getting used to (and what new software doesn't?), you'll have an extra layer of security and access restrictions which should let you sleep a little better at night.

Getting started with SELinux is a post from: Major Hayden's Racker Hacker blog.

Thanks for following the blog via the RSS feed. Please don't copy my posts or quote portions of them without attribution.

by Major Hayden at January 26, 2012 04:28 AM

January 25, 2012

TechRepublic IT Security

Symantec says to disable pcAnywhere after source code exposure by Anonymous

Symantec acknowledges a breach that exposed the source code for pcAnywhere. Users are advised to disable it immediately until software updates are available to resolve vulnerabilities.

by Selena Frye at January 25, 2012 08:08 PM

The Lone Sysadmin

5 Minutes with vCenter Operations Manager 5

I installed the new vCenter Operations Manager 5 about an hour ago. Whoa. I had the pleasure of meeting Kit Colbert, Praveen Kannan, and Martin Klaus last April when they were in town, and I know they, and the rest of the team, have been doing a lot of work on the product. It really shows. Here are my first impressions, literally.

1. The install procedure is very straightforward, in that I was able to get it fully installed without reading any documentation. The product is a vApp now, and comes with two components, the Analytics VM and the UI VM. You need two IPs, and despite the OVF import process prompting for the IPs those IPs need to be in an IP Pool configured for the network. No biggie. You do need some decent CPU, RAM, and disk for this thing to run, though, 4 vCPUs between the two VMs, 16 GB of RAM, 352 GB of disk for the “small” install.

2. It’ll only attach itself to one license, so if you have split your licenses into parts you need to go back into the license portal and combine them. No big deal. I was not able to proactively add the licenses to vCenter, it didn’t like them, but after I registered my vCenter server with vC Ops Manager I was able to. Perhaps the license component of vCenter is extensible, and it does that as part of the registration process.

3. Holy crap, it can send email alerts now. That was my #1 complaint about the older versions. You can also configure the “time remaining” and alert badge thresholds, which is nice. For example, I know it takes my organization at least 90 days to get a new server installed: one month for people to stop telling me that I’m required to use VMs (uhh, these are what VMs run on) and approve the purchase, one month for the vendor to ship, one month for it to be racked & configured & burned in, etc. So I set the time remaining to 90 days (from the default 30).

4. The new notification setup is nice. I can actually get an alarm from something in the standard edition now! It looks pretty simple but I’m okay with that, it looks like it’ll work fine. I’ll mess with this more in the next month. My “upgrade” was basically a fresh install, so it’ll need to learn what normal looks like again. I don’t want it alarming until it does that. Right now, it thinks one of my hosts is in trouble because it’s doing 7.7 Mbps of disk I/O… we’ll let that settle down. That’s actually the power of this type of product, though — the analytics engine that can tell normal from abnormal once it learns what the usual situation looks like.

5. I’m not sure that I like the VMs being children of the physical hosts, but as I think about it that’s exactly the relationship, right? So perhaps it makes sense. The down side will be that I’ll just have to direct my coworkers to use the search functionality when looking for a VM. The whole interface is a lot cleaner, though, and it looks like it’ll be much easier to use than the old versions.

Good job, guys!

Related posts:

  1. Update Manager, VMotion, and Me
  2. Tivoli Storage Manager on ESX Server 3.0
  3. Update Manager & Loss Of VMotion Capabilities


Did you like this article? Please give me a +1 back at the source: 5 Minutes with vCenter Operations Manager 5

This post was written by Bob Plankers for The Lone Sysadmin - Virtualization, System Administration, and Technology.. Licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License and copyrighted © 2005-2011. All rights reserved.


by Bob Plankers at January 25, 2012 08:08 PM

Standalone Sysadmin

Sometimes, you just have to do something to make yourself happy

Today, I’m in San Jose at the Wireless Mobility Symposium, and while we were planning it, Stephen Foskett jokingly suggested that we needed a “geek-o-meter” to help gauge the technical level of the presentations. It sounded like so much fun that I had to do it. And since it’s the Wireless symposium, it had to be wireless, too, right? Right.

So I went to the store and bought the cheapest R/C car I could find ($7), took it apart, attached a piece of foam to the wheel, attached an arrow to the foam, made a suitable geek-o-meter image, and had it printed out and mounted on a foam board last night at FedEx.

Today, I unveiled it at the symposium:


(Image by Matthew Norwood)

If you’re curious, the things are, from left to right, a kid’s toy computer, Milhouse from the Simpsons, Alton Brown, Adam and Jamie from Mythbusters, Rear Admiral Grace Hopper, and Sheldon Cooper from The Big Bang Theory.

Yep, I built a radio-controlled Geek-O-Meter that the Wireless Field Day delegates can control from their seats in the audience. I suspect I’m a little too proud of myself.


by Matt Simmons at January 25, 2012 07:00 PM

The Lone Sysadmin

Hey! Go Vote For This Blog!

Hey readers, I’m on the ballot for the top 25 virtualization blogs this year. If you are a virtualization person (and who isn’t these days) would you go to http://vote.vsphere-land.com/ and vote for the blogs you read? It takes about a minute, tops. This blog is “The Lone Sysadmin (Bob Plankers)” in the middle column with all the other “The” blogs, and I’d appreciate you including me in your 10 votes, if you can.

I’m an independent blogger, too, but didn’t make the independent list. Independent bloggers are important to the computing community because we aren’t required to have certain opinions by our employers. Regardless, it’s stuff like this that keeps me interested in blogging because it’s a way to see that people actually use what I write. If you want to see more how-tos like How To Install Microsoft SQL Server 2008 R2 for VMware vCenter 5, comparisons of scale-up vs. scale-out in infrastructure host sizing, or timely discussion of breaking news like the vSphere 5 licensing changes please give me one of your 10 votes.

You can also vote for your favorite storage, cloud, news, scripting, and video blog, too, many of which overlap with general sysadmin sorts of things. No networking blogs this year, it seems. Maybe next year the virtualization community will realize that we need to talk to our network guys.

Thank you!

Related posts:

  1. Vote On VMworld 2010 Content
  2. Why I’m Not Reading Your Blog
  3. Strange Characters in My WordPress Blog


Did you like this article? Please give me a +1 back at the source: Hey! Go Vote For This Blog!

This post was written by Bob Plankers for The Lone Sysadmin - Virtualization, System Administration, and Technology.. Licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License and copyrighted © 2005-2011. All rights reserved.


by Bob Plankers at January 25, 2012 05:22 PM

The Nubby Admin

How a DevOp Solves Every Systems Administration Problem

I’m hoping to explore the DevOps phenomena a bit more, as I’ve seen what I believe are some colossal stretches of reasoning lately. To be sure, what I’ve gathered of that general line of thinking seems to be quite an improvement on the standard systems thinking. However, as with anything, it seems to have been speciated, inbred and over sold.

As a result, if you listen to the more rabid proponents, the following is The One True Solution to all systems engineering and administration problems.

If anyone wants to take a critical exploration of the DevOps movement, holla!

by Wesley David at January 25, 2012 02:59 PM

Chris Siebenmann

The death of system administration: I'm all for it

The death of system administration: I'm all for it

Recently there was a little Twitter commotion about Julian Dunn's Chef, devops, and the death of system administration (he later clarified his views). Although it may surprise people, my snap reaction to the idea of the death of system administration was 'good'.

(I have a number of other reactions to portions of this debate, but 'good' was my first one.)

Most of what many people think of today as 'system administration' is scutwork, at best boring and uncreative. Racking servers, configuring switches through interminable web or CLI interfaces, running network cables, installing OSes in any way that takes more than about one line of typing, writing an Apache or a mailer or Samba config file yet again, restoring files for people, and so on. That's what I'm talking about. At best these are interesting the first few times you do them; after that, very much not.

(System administration wasn't always this sort of work, but times have changed.)

Unless you really do like spending your time doing that or you feel that that sort of work is all that you have to contribute, you are better off without this near monkeywork. Regardless of what your job is called after 'system administration' goes away and the dust settles, you will have shifted to doing actual engaging and creative work and you'll be contributing much more to your organization's success. As I've written before in a different context, having spare time from ordinary day to day 'system administration' is what you need in order to create the big wins. The ultimate version of this spare time is not to have to do the ordinary day to day gruntwork at all.

As you may have gathered, I am not particularly fond of the scutwork currently involved in a great deal of 'system administration' (although I think there's uses for doing it every so often). As far as I'm concerned, the sooner this sort of system administration dies the better.

(At the same time, let's not fool ourselves. This death of system administration will put a significant number of people out of work, ie those people who are currently well paid to do nothing but this scutwork. Many of them do not currently have the skills to move up in the food chain; they will either move down to be less well paid operations monkeys or have to change fields entirely. This is going to be a wrenching process that will be very unpleasant for the people involved, and we should both have sympathy for them and understand the full implications of this shift we're casually discussing, advocating, and cheering for.)

(As a corollary, if you have junior people in your organization and you believe in this shift you should be working with them to make sure that they're developing the skills they'll need for the future, not just spending all of their time doing scutwork for you. And you should be honest with them about how you see their future.)

by cks at January 25, 2012 06:48 AM

January 24, 2012

SysAdmin1138

Judicial rubber-hoses

The other day a Colorado court ordered a defendant to produce the unencrypted contents of their own laptop. This is what I called "rubber hose cryptography", and previously we've heard of efforts in the UK to compel decryption. It has now happened here, and not at the US border. Unlike the UK, this decryption demand in Colorado is not based on a law that specifically says that courts can demand this.

Wired article

The counter-argument is quite clearly the 5th amendment right guaranteeing the ability to not self-incriminate. If that decryption key only exists in your head, and disclosing it would incriminate you, then you don't have to yield the key.

This judge disagreed. I'm not a lawyer, so I can't tell what legal hairs were split to come to this decision. But the fact remains that this judgment stands. The only concession he appears to have made for the defendant is to preclude the prosecution from using the act of disclosure as a 'confession', but the data yielded by the disclosure is still admissible.

by SysAdmin1138 at January 24, 2012 09:03 PM

The Lone Sysadmin

Can’t Change Virtual Disk Formats When Targeting a Datastore Cluster

As I work more and more with vSphere 5 I am finding a few anomalies. One of them appears to be a bug where you cannot switch a VM’s disk format during a storage vMotion, when you target a datastore cluster. To be more precise, it looks like you should be able to, but it doesn’t end up happening.

The workaround is to disable Storage DRS for that VM, target a datastore directly, then edit the Storage DRS settings afterwards to re-enable DRS for that VM.

This is what it looks like when I try. I select “thin provision” from the virtual disk format, choose a datastore cluster (in this case it’s my “Tier 2″ cluster), and click next:

 

Looking at the VM settings to confirm that it’s thin… hey, wait a second:

 

That’s not what it’s supposed to be. But, when I move it back and try it again with Storage DRS disabled (and be careful, it likes to flip the format back to “same format as source” when you check the “disable” box):

 

Then it works fine:

 

If you edit the datastore cluster properties (Datastores and Datastore Clusters -> Select the cluster -> Edit Datastore Cluster -> Virtual Machine Settings) you can re-enable Storage DRS for that VM:

 

I’d suggest putting it back to “Default (Fully Automated).”

VMware Support has opened a bug on this, and my SR is 12133278201 if anybody needs it.

Related posts:

  1. Change the Default PSP in VMware vSphere 5
  2. Wrong Kind Of Cluster, Pal
  3. When to Cluster, When to Build Big


Did you like this article? Please give me a +1 back at the source: Can’t Change Virtual Disk Formats When Targeting a Datastore Cluster

This post was written by Bob Plankers for The Lone Sysadmin - Virtualization, System Administration, and Technology.. Licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License and copyrighted © 2005-2011. All rights reserved.


by Bob Plankers at January 24, 2012 08:52 PM

Everything Sysadmin

What to do about SOPA/PIPA?

The headlines like, "Sen. Reid kills SOPA bill" should really read, "Sen. Reid tells people SOPA is dead so Hollywood can work on more stealthy bill."

What to do about this kind of thing in general?

Joel Spolsky nails it:

(1)
The internet seems to ignore legislation until somebody tries to take something away from us... then we carefully defend that one thing and never counter-attack. Then the other side says, "OK, compromise," and gets half of what they want. That's not the way to win... that's the way to see a steady and continuous erosion of rights online.
The solution is to start lobbying for our own laws. It's time to go on the offensive if we want to preserve what we've got. Let's force the RIAA and MPAA to use up all their political clout just protecting what they have. Here are some ideas we should be pushing for:
* Elimination of software patents
* Legal fees paid by the loser in patent cases; non-practicing entities must post bond before they can file fishing expedition lawsuits
* Roll back length of copyright protection to the minimum necessary "to promote the useful arts." Maybe 10 years?
* Create a legal doctrine that merely linking is protected free speech
* And ponies. We want ponies. We don't have to get all this stuff. We merely have to tie them up fighting it, and re-center the "compromise" position.

(2)
The dismal corruption of congress has gotten it to the point where lobbying for legislation is out of control. As Larry Lessig has taught us, the core rottenness originates from the high cost of running political campaigns, which mostly just goes to TV stations.
A solution is for the Internet industry to start giving free advertising to political campaigns on our own new media assets... assets like YouTube that are rapidly displacing television. Imagine if every political candidate had free access (under some kind of "equal time" rule) to enough advertising inventory on the Internet to run a respectable campaign. Sure, candidates can still pay to advertise on television, but the cost of campaigning would be a lot lower if every candidate could run geo-targeted pre-roll ads on YouTube, geo-targeted links at the top of Reddit.com, even targeted campaigns on Facebook. If the Internet can donate enough inventory (and I suspect we can), we can make it possible for a candidate to get elected without raising huge war chests from donors who are going to want something in return, and we may finally get to a point where every member of congress isn't in permanent outstretched-hand mode.

Read the entire thing here: https://plus.google.com/u/0/117114202722218150209/posts/4GgaRiSyaTf


January 24, 2012 05:07 PM

TechRepublic Network Administrator

Why the time is almost ripe for Solid State Disks in the data center

Scott Lowe considers Gartner's prediction that Solid State Disks (SSDs) will be popular in 2012. Prices are coming down and performance is good, but how reliable are they for the data center?

by Scott Lowe at January 24, 2012 05:00 PM

Standalone Sysadmin

Wesley David tackles the piracy issue

I think my article on software piracy touched a nerve with a lot of people.

I’ve been arguing my case with Philip Durbin since then on Google+. I’ve had almost innumerable conversations with people on twitter about it. And it apparently spurred Wesley David into writing a piece talking about the moral side of the issue. Interesting stuff.

And for the record, because A LOT of people have asked me about it, my definition of theft is straight out of Merriam-Webster.

I think if you read the article that I wrote, I never said anything about right vs wrong, or illegal vs legal, and that was on purpose. I have mixed feelings about all of it. It’s obviously wrong to take something of someone else’s without their permission. On the other hand, I don’t think that it’s necessarily wrong to do something that’s illegal if the law is in the wrong, either.

Slightly related is YCombinator’s recent Declaration of War on Hollywood. YCombinator wants to fund startups that will eventually eliminate Hollywood Studios.

Joel Spolsky recently wrote a piece on Google+ advocating legislation that causes the elimination of software patents and the rolling back of copyright protection. And this is from a guy who’s company makes copyrighted software.

Between you and me, I think there’s something going on, society-wise. As a group, we’re looking at things differently than we did, even two years ago. I’m not sure if all of the SOPA blackouts would have happened then. I don’t know if it changed with the Arab Spring or not, but it just feels like people are more cognizant of their ability to make change to the world around them. And I think that’s a great thing, and very promising.


by Matt Simmons at January 24, 2012 03:31 PM

Chris Siebenmann

Why I use exec in my shell scripts

Why I use exec in my shell scripts

As with the little example yesterday, a fair number of my shell scripts end with running a program and when they do, I almost invariably go the little extra distance and do it with exec. In the old days, the reason to do this was that it used slightly less resources, since it got rid of the shell process and left only the process for the real program you wound up running. But, while I was around then, the reason I use it today isn't that; it's that it lets you freely edit the script while that final program is running.

At this point some of you may be going 'wait, what?' That's because most Bourne shell implementations are a little bit peculiar.

In most interpreted languages on Unix (like Python, Ruby, and Perl), the interpreter completely loads and parses the script file before it starts running it. This means that once your script has actually started running, once that initial load and parse has finished, you can freely change the script's file without the interpreter caring; it will only look at the actual file and its contents again if and when you re-run your script.

Bourne shell implementations have historically not worked this way (and it's possible that it's actually impossible to preparse Bourne shell scripts for some reason). Instead they not only parse the script on the fly as it executes, but also they read the file on the fly as the script runs. This means that if you edit a shell script while it's running you can literally shuffle the code around underneath the script. When the shell resumes reading and parsing the script after the current command finishes, it can be reading from partway through a line, from something that it had already read, or (if you deleted text) wind up skipping over something that it should have run. This often causes the shell script to fail with weird errors or, worse, to malfunction spectacularly. This can happen even if the shell is on the last line of the script.

But if you end a shell script with exec, you avoid this. The actual shell interpreter effectively exits (by turning itself into the actual program) and so there's nothing there to try to read anything more and get confused by your edits.

(Of course nothing helps if you can't use exec; then you just have to remember to never edit the script while it's running, at least with an editor that overwrites the file in place.)

Sidebar: a detailed example of what happens

Let's start with a little script:

#!/bin/sh
echo "a"
firefox

Run this script. While Firefox is running, edit it so that the echo string is four or five characters longer (using vi or some other editor that overwrites files in place). When you exit Firefox, the script will complain something like 'script: line 4: efox: command not found'.

When the shell was running Firefox, its read position in the file was just after the newline at the end of firefox. When you edited the script and added more letters, that same byte position was now pointing to the e in the 'firefox'. When Firefox exited and the shell resumed reading from that byte position, it read 'efox<newline>', saw a perfectly valid command execution, and tried to run 'efox' (and failed).

(It reports that this happened on line 4 because it knew it had already read three lines, so clearly this is line 4. As a corollary, you can't trust the line numbers that are printed when something like this happens.)

by cks at January 24, 2012 05:06 AM

January 23, 2012

TechRepublic IT Security

Facing down the Ramnit virus on Facebook: Tips for protection and clean-up

Bob Eisenhardt explains how the Facebook virus Ramnit works, why it's so bad, and how it can affect much more than a Facebook account.

by Bob Eisenhardt at January 23, 2012 08:55 PM

The Lone Sysadmin

Change the Default PSP in VMware vSphere 5

One thing I do to my VMware ESXi hosts is set the default Path Selection Policy (PSP) for certain Storage Array Type Plugins (SATPs) to do the right thing. This eliminates my need to reconfigure each datastore’s multipath settings on each host, and helps guarantee that a new LUN added by someone other than me will function correctly from the start. Consider it part of my “make it easy to do the right thing” sysadmin mantra.

This has been covered by others at various points for older vSphere versions, but the vMA & esxcli changed some with version 5, so here are the commands I use. I have two different arrays, one that is active/active without a specific SATP (so it gets caught by VMW_SATP_DEFAULT_AA) and one that supports ALUA (which is covered by VMW_SATP_ALUA). Both are compatible with round-robin; the ALUA array communicates the correct paths for I/O to ESXi and it does the right thing.

esxcli -s hostname.yourco.com -u root -p PASSWORD storage nmp satp set -s VMW_SATP_ALUA -P VMW_PSP_RR

esxcli -s hostname.yourco.com -u root -p PASSWORD storage nmp satp set -s VMW_SATP_DEFAULT_AA -P VMW_PSP_RR

It takes a reboot for this to take effect.

This is also very compatible with my suggestion to use bash ‘for’ loops on the vMA, but I would do it on a test host, or one host in maintenance mode, first, to verify correct behaviour in your own situation.

Related posts:

  1. Use ‘for’ Loops with the vSphere Management Assistant
  2. Can’t Change Virtual Disk Formats When Targeting a Datastore Cluster
  3. ALUA Rocks


Did you like this article? Please give me a +1 back at the source: Change the Default PSP in VMware vSphere 5

This post was written by Bob Plankers for The Lone Sysadmin - Virtualization, System Administration, and Technology.. Licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License and copyrighted © 2005-2011. All rights reserved.


by Bob Plankers at January 23, 2012 06:30 PM

TechRepublic IT Security

Megaupload, Anonymous, SOPA and the Internet fallout

Patrick Lambert digests the tempestuous events of last week and what it means for the future of the Internet. Was the Megaupload bust really related to SOPA's failure? Was Anonymous' reaction...

by Patrick Lambert at January 23, 2012 05:40 PM

Testing just how good Next Generation Firewalls are

Next Generation Firewalls are supposedly the next best thing. Are they though? Michael Kassner decided to find out.

by Michael Kassner at January 23, 2012 03:06 PM

The Nubby Admin

Software Piracy and the Existence of Moral Absolutes

(Before I start, I’d like to make it clear that I am not “calling out” anyone. This post started out as a comment on the blog post I refer to below, however my words quickly grew in number and I decided to make my own blog post on it. This post is intended to be a spinoff of Matt’s post. This topic is tangential to the post referenced below, and not in response to it.)

In a recent post by Matt Simmons titled “The real loser in software piracy isn’t who you think“, the Standalone SysAdmin posits an interesting theory. To summarize, software piracy may cost better, alternative products their userbase. If people need to twiddle a few pixels, the Photoshop brand immediately captures their attention. As a result a person may pirate Adobe’s software when a better, less expensive or possibly free alternative to Photoshop would have been just as good.

I completely agree with the above, and it’s a viewpoint that I had never considered outright. I think I’ve thought along those lines without realizing it though. In my experience, if someone with only a little computer background wants to put an all-in-one server in their office to manage printing, file shares, their internet gateway and etc. I am slightly disappointed that Microsoft’s Small Business Server product is usually the first and only product that comes to mind. There are so many alternatives! ClearOS, Untangle, and others are awesome alternatives often with a free tier that can get you started.

However, because the SBS brand is so large, and people think “I guess that’s what I need,” they’ll likely implement it and never consider the alternatives. In some instances, they may improperly license the software. If even just one quarter of the organizations that are not properly licensing SBS would move to an alternative product, I believe that would make the industry better. Microsoft would see clear competition from the growing userbase of other products and have a better idea on how to improve. The alternative products would increase their userbase and know how better to support their customers. Customers get great products all around! Generally speaking, it would be a win-win situation for everyone involved.

Often in discussions concerning software piracy the supposed dollar amount of lost revenue for the software company is brought up. Upon investigation those numbers are built on some flimsy presuppositions about the buyer’s intent. Users of software will often not truly be legitimate candidates to purchase the software. However, this is where I find the topic to be most interesting. When the topic of morality gets introduced is when things get fascinating. That’s also when you’ll see some truly jaw dropping logical and philosophical gymnastics.

Let’s talk a bit about morality. Are there absolutes or are there not? Is this purely a financial equation or is there more at stake here?

Definition of Terms

I’ll be using some quotes from Matt’s post as my springboards, but not as a direct response to him (this isn’t about two people disputing, but about different and yet related ideas being fleshed out). Also, I’m not focusing on the recent takedown of MegaUpload. I’m also not focusing on one pirated product over another. This is as generalized as I can be.

The first thing that needs to be determined in talking about “software theft” is “what is theft?” From Matt’s post:

As many people have said, theft is the taking of something which deprives the owner of use.

Before any topic can be given a thorough treatment, a definition of terms must take place. In this case, I’ve never heard of theft being defined as the deprivation of use from an owner. Perhaps it’s regional? That definition sounds more like some definitions of larceny. Theft does not, in my layman’s understanding of the term, primarily consider deprivation of use. Theft is usually defined along the lines of the taking of property that is owned by one person or entity without their consent. No validity is given to the consideration of if the object was useful to the original owner.

Perhaps you’ve seen dilapidated cars from two or more generations ago sitting on a farm. Certainly the owner is receiving no use from it, but taking it would still be considered theft (although I realize there are often tiered designations to the types of theft based on the dollar amount of what was stolen). That is, theft is defined as the taking of property that is owned by one person without their consent.

Certainly in the realm of software it gets tricky because you’re not dealing with cut-and-dried physical goods. In the physical world, it would be as if you could clone the junked automobile and then use it (perhaps for scrap metal, I don’t know). But you can’t perform an atomic copy of something in the physical world so it’s a moot point. Yes, you can copy a design and get in trouble with copyright infringement, but that seems to be an entirely unrelated phenomena. In the virtual world, you can perform an “atomic” copy of a thing – and that fact blurs some lines slightly.

However I believe the key to the situation is a realization that license terms on a software package define what acceptable use is. One you take those terms into account it is easier to understand how theft would be defined in the case of intangible software. Software companies by and large do not “sell” the software to you, but basically sell you the right to use it. It’s a contract for use. If a contract states that in order to use some software you have to pony up some cash then it “is what it is” and no amount of legal wrangling can reverse that. Going outside of that contract would be considered some form if illegal activity.

In the end, it is a non-consensual use of a product that has certain restrictions made upon it. Perhaps the term “theft” is over simplifying the behavior. Perhaps “breach of contract” would be better? That might be especially true since most software makes you accept an agreement before you can use it. Technically you are then bound by that contract. Define it how you will, we’re still dealing within the realm of morals, so at least we haven’t gotten too far off track.

Of course, I also find it laughable whenever software piracy is mentioned and people assign monetary value to the “stolen” software…as though the options were either “steal this software” or “pay for it”. A false dichotomy if I ever heard one.

If people say “one million copes of this software have been stolen, and the software costs $500 per copy, that means the company has lost half a billion dollars!!1!” then they are most certainly making a false dichotomy. Not all of the one million people have $500 to spend and even if they did, they would not necessarily spend it on that software if they were forced to make a choice.

This is where, often, the conversation with someone turns finances into morality. “Well I wouldn’t pay for it anyway!” or “I only use it once in a great while!” or, my favorite, “The software company has plenty of money. They’re not losing that much because of me.” As if, somehow, arguments of convenience or shareholder meetings shift the foundations of right and wrong.

Finances Vs. Morals

Certainly the dollar amounts that are brought up around software piracy are smeared around to make the software companies seem like helpless victims. When you look into the numbers, it’s highly unlikely that Adobe, Microsoft, Autodesk, Symantec and etc. aren’t losing a ton of real money. They might even be gaining value in the long run with their products being used by more people who carry that brand in their minds from then on.

However is the discussion about software piracy all about numbers and branding? Can a person change right and wrong based on their own convenience or their determination of how much a company needs more currency?

I’d like to focus this topic less on the numbers and more on how one behaves after digesting the numbers. My question for us all to think about is this: What determines right and wrong? Here are the numbers and a fairly accurate interpretation of them:

[Those that download commercial software without paying] didn’t have $500 to buy photoshop. Did Adobe really lose that $500 that wouldn’t have been paid to them? No.

Most of us would agree with that. Framed within the context of “a person doesn’t have $500 and furthermore wouldn’t spent it on the software if they had it” then the software maker didn’t lose money. However, if we then take that likely reality and use it to excuse a breach of contract, we start determining right and wrong based on profit and loss. In the presence of moral absoulutes, a thing that has certain contractual usage restrictions on it being used outside of those restrictions is still wrong. Typically, that “wrongness” is only superseded if there is considerable harm to another person unless that contract is broken.

“That money didn’t exist. Assigning it a value is dishonest.”

Certainly the numbers are trumped up to an extent. On that there is little dispute. Where do we go from here? Can we go from “I don’t have the money to buy this software,” to “I’m going to intentionally break a contract so that I can use it anyway”?

At this point in a discussion on software licensing (or music, movie and other entertainment licenses), the discussion usually continues spinning its wheels. Volleys of words like “fair”, “greedy”, “corporations” and “big business” get lobbed.

A product has value independent of a person’s ability to pay for it. A product is then sometimes priced disproportionate to its value. Or, oddly, value is manipulated by price, but that’s another discussion. If a company, within their legal rights, sets a price on a product that a person feels is disproportionate to its value, does that person’s personal evaluation of the price/value equation allow them to morally break contract and use the software outside of its licensing restrictions?

We could argue about the fairness of current licensing practices, the greed of corporate licensing practices, the value of a product in comparison to its price and if software patents are detrimental (please, no GPL fanbois). Those things are important to talk about, however in the context of determining morality, if those smell fishy, that’s because all of them combine to form one giant red herring distracting us from the real point. The real point is centered on how one determines right and wrong.

Absolute Uncertainty

The question of absolutes now comes up. Is it ever right to take something that is not yours? If a loved one is dying, and you can steal medicine to save their life, is it wrong? If you and others are locked in a prison camp during a war and face almost certain death, is stealing the keys from the guards okay? Is killing your guards okay?

Those are extreme examples, but valid nonetheless and thus not in the realm of straw men. It shows us that, usually, there is a line when theft and even killing become acceptable. (Even so, there are those who believe in pacifism to the point of never fighting back even in the defense of your or another person’s life.)

The question remains, is there ever a time when it is acceptable to break a contract or license? Once you figure that out you can answer the following questions with certainty and be able to backup your view: When is it okay to break a contract? When is it okay to perform an act that is punishable by law? Does solvency determine right and wrong and if so when?

I think moral absolutes is the heart of the issue of software being used outside of license restrictions (I hesitate to call it “theft” or “piracy”). If there are none, then this topic is wasted energy. If there are absolutes, but they contradict honoring software licensing then we should at least define them and be aware of why we do what we do. If there are absolutes, and they say to honor law in so far as the law does not clearly contradict other absolutes (e.g. a law requiring you to punch a random person in the face), then the topic is rather simple, in spite of arguments about practicality. Your pragmatic need for a software title notwithstanding, show some fortitude and don’t break a contract / license agreement (essentially dishonesty). Go find a product whose licensing you agree with or do without.

For myself, I am a license pest. I actually read some EULAs. I actually follow them to the best of my ability. For example, I recently bought an OEM copy of Windows 7 for a workstation I built for my small business. According to strict licensing interpretation you are not allowed to install the OEM version of Windows straight onto a PC from the DVD. You are supposed to use the OEM Preinstalltion Kit or the Express Deployment Toolkit. So, I got rid of the installation that I had initially made, turned one of my other PCs into an EDT server and installed the OEM version of Windows across my home network onto my workstation.

Who would have known? What difference does it really make? For one, I would have known. Secondly, I believe the difference is in how a person continually builds their character. If you are unfaithful in the little things, it makes unfaithfulness in bigger things a little bit easier to justify. If people that I know have little or no problem breaking contracts and licenses, my trust in them is eroded. If a person rationalizes things in such a way as to take relatively clear cut restriction and justify breaking them in the absence of clear harm to another person, i wonder what else that person could justify.

I am not here to point fingers, flex my “morality,” or get anyone to behave the way I do. I am here to encourage you to stop and consider yourself. Stop and consider why you choose what you do. Consider why you think what you think. Consider everything. Have a reasoned defense. A new topic that has been intriguing me is that of dialectic reasoning. One of my favorite quotes is attributed to Socrates:

The unexamined life is not worth living for a human being.

Do not live an unexamined life.

What do you think about software licensing? Is it okay to break the license terms? Is there a practical limit? I’d love to hear your thoughts.

by Wesley David at January 23, 2012 02:14 PM

TechRepublic Network Administrator

Using vSphere datastore view to see VMs inventoried on disk

vSphere VMs can move around at a moment's notice. In this blog post, Rick Vanover shows how to use a handy vSphere view to see where VMs live on datastores.

by Rick Vanover at January 23, 2012 02:00 PM

Chris Siebenmann

Every so often, I solve a problem with a hammer

Every so often, I solve a problem with a hammer

For reasons beyond the scope of this entry, I maintain a special Firefox profile and instance for uploading pictures to my Flickr account. Back in the old days, Firefox had a very convenient behavior for this: when it asked you to choose files to upload in an upload form, the default directory was the current directory that you'd started Firefox in. This meant that I could cd to the day's photo directory, start my Flickr Firefox instance, and have the GTK file chooser dialog start in exactly the right directory. Then at some point Firefox changed this so that the default file chooser directory was something like your configured download directory.

I poked at this off and on but couldn't find a way to make Firefox get its old behavior back. So recently I decided to fix the problem with brute force. The script that I use to start my Flickr Firefox instance now looks somewhat like this:

#!/bin/sh
ln -nsf $(pwd) $HOME/CURDIR
exec firefox -P flickr "$@"

This is inelegant and not a real solution, but it makes things a lot more convenient; it's now much faster to navigate to exactly where I want to be. Sometimes that's the right way to deal with a problem, when either the real solution is too much work or the problem is too small to justify anything more than a quick hack.

(I suppose that this could be slightly improved by putting the symlink directly in the download subdirectory. I'm not sure why I didn't do that.)

by cks at January 23, 2012 05:16 AM

Ben's Practical Admin Blog

Introducing the Dell iDRAC Powershell Library

Hot on the heals of the iLO Library, I am pleased to release the Dell iDRAC Powershell Library. This is a script that you “dot include” in the beginning of any script you are writing so that you can have access to the functions. The library is a wrapper for the Dell RACADM DRAC Tool [...]

by Ben at January 23, 2012 12:37 AM

January 22, 2012

The Lone Sysadmin

Use ‘for’ Loops with the vSphere Management Assistant

The VMware vSphere Management Assistant (vMA) claim to fame is that it has a UNIX shell and the vSphere CLI installed, making it handy for a lot of things, and makes cutting & pasting comands real easy when it’s paired with a decent SSH client. One of my favorite ways to use it is with ‘for’ loops in the shell, to make the same change to all of my ESXi hosts.

Let’s say you have a list of servers you want to make a change to, like using esxcli to set the HBA queue depth. My list is a text file I create in nano or vi (see my post on installing nano on the vMA), one host per line:

goat.farmco.com
cow.farmco.com
sheep.farmco.com
esxi-chi-halsted-prod-293.bignofunanimalsco.net

I will refer to this file as “FILEWITHALLYOURHOSTSINIT” below. The default shell on the vMA is called ‘bash’ (it’s the Bourne Again SHell, the original Bourne shell was just ‘sh’ and wasn’t open source). In bash you can feed the contents of the file into a for loop. Just type this in:

for NAME in `cat FILEWITHALLYOURHOSTSINIT`
do
echo $NAME
esxcli -s $NAME -u root -p PASSWORD system module parameters list -m qla2xxx
done

A few points here. First, you can also collapse this into a one-liner, either by writing it with semicolons or just using the up arrow after running it once to see how bash collapses it in the history (try typing ‘history’ to get a list of all your commands):

for NAME in `cat FILEWITHALLYOURHOSTSINIT`; do echo $NAME; esxcli -s $NAME -u root -p PASSWORD system module parameters list -m qla2xxx; done

Second, you can change NAME to whatever you want, that’s just the variable that is created to hold the line-by-line output of the cat command there. Obviously you then have to update $NAME in the rest of the command…

Third, the ‘cat’ command is short for conCATenate. Given a list of files it’ll output them all, then you can redirect the output to another file. Give it one file and it’ll spit just that file out. Try it on another file, like “cat /etc/passwd” and see how it works. There’s also the ‘less’ command which will page output (like ‘more’ does on other OSes, but ‘more’ wasn’t open source, so they rewrote it and called it ‘less’). Try “cat /etc/passwd | less”

Fourth, if you don’t echo $NAME it’ll be hard to know which host you’re talking to if something goes wrong, especially with big lists.

Fifth, the `cat FILEWITHALLYOURHOSTSINIT` — those are backticks, not single quotes. Backticks tell the shell to execute that command and use the output from it in the next stage (the for loop in this case).

Sixth, if you omit the line with the esxcli command in my example above you can try it without actually doing anything.

Seventh, this is in no way a vMA-only trick, it’ll work on any system with bash installed. In fact, most shells have a way to do this, and a little Google action will get you the right syntax.

Last, this is a great way to do things fast, including screwing stuff up. With great power comes great responsibility. BE CAREFUL.

Related posts:

  1. Install the nano Editor on the VMware vMA 5
  2. VMware vSphere 4 Thin Provisioning: Pros & Cons
  3. Change the Default PSP in VMware vSphere 5


Did you like this article? Please give me a +1 back at the source: Use ‘for’ Loops with the vSphere Management Assistant

This post was written by Bob Plankers for The Lone Sysadmin - Virtualization, System Administration, and Technology.. Licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License and copyrighted © 2005-2011. All rights reserved.


by Bob Plankers at January 22, 2012 07:26 PM

That grumpy BSD guy

SSH Mastery: A Very Welcome Addition to Any Unix User's Bookshelf

The first paragraph of this book's afterword reads:
"You now know more about SSH, OpenSSH and Putty than the vast majority of IT professionals! Congratulations".

That claim will be true for any reader of SSH Mastery who has read the book up to that point and has incorporated at least some of the elements of the configurations it describes into their own environments.

"But why a book dedicated to a single command?", you might ask. Almost all Unixes and Unix-likes have incorporated OpenSSH, the free SSH that is developed as part of the OpenBSD project, and OpenSSH comes with excellent documentation in the form of several extensive man pages.

Well, that question in itself justifies this title's existence (there are in fact several programs in the OpenSSH suite), and readers familiar with Michael Lucas' work will appreciate hearing that his latest work is task-oriented and well written, covering anything from the basic secure shell access through to the peculiarities of setting up a virtual private network (VPN) using OpenSSH. An enterprising reader would be able to find all the information in this book or close equivalents using the OpenSSH man pages or other online sources, but this book provides a very concise guide to both the basics and some rather advanced concepts and provides you with the vocabulary and understanding that you will need in order to successfully navigate the man pages.

This book has several highlights, such as the very sensible and useful discussion of key based authentication and how to set things up for a passwordless existence, a number of suggestions on how to distribute and maintain both host keys and user keys as well as very readable and useful introductions to various kinds of tunneling, forwarding and proxying available using the OpenSSH tools.

In particular I enjoyed reading the description of SSH-based virtual private networks (VPNs) in Chapter 13. This is one of the most clearly written and useful treatments I've seen of that subject, and for many readers this chapter alone will be worth the price of the book or even considerably more.

The book very sensibly covers OpenSSH on OpenBSD, FreeBSD and Ubuntu Linux, and users who are compelled to use Microsoft Windows desktops will be pleased to hear that configuration and use information for Putty, the most popular and free SSH client for their environment, is included too everywhere it's relevant to the task at hand.

Before Michael W. Lucas' new title was released in January 2012, the most recent widely available book about the Secure Shell protocol (SSH) and applications that support it was an O'Reilly title dated 2005. So even with high quality documentation available via the manual pages, it was time for a new title on the subject.

This title conveniently grew out of one of Michael W. Lucas' other technical writing projects, the second edition of Absolute OpenBSD. The SSH chapter of that manuscript simply kept growing until it made sense to branch the text off to a separate book. This probably means that the treatment of SSH in the upcoming OpenBSD title will be slimmer again, but separating out the OpenSSH parts as a separate book with information for several different environments added makes sense because it makes high-quality information about important tools available to a larger audience.

I am convinced SSH Mastery is a title that Unix users and system administrators like myself will want to keep within reach on their Kindles or other ebook readers for a quick and convenient refresh of important concepts. If you're a student or learning your Unix skills, you will certainly find this to be a very handy guide that helps you
grasp both the basics of SSH and several advanced concepts that are hard to find well described elsewhere.

The ebook is available in several formats via Amazon and other ebook outlets, a printed version is planned but was not yet available at the time of writing (January 22, 2012).

Title: SSH Mastery: OpenSSH, PuTTY, Tunnels and Keys
Author: Michael W. Lucas
Publisher: Tilted Windmill Press (January 18, 2012)

by noreply@blogger.com (Peter N. M. Hansteen) at January 22, 2012 05:30 PM

Chris Siebenmann

My view of the purpose of object orientation

My view of the purpose of object orientation

A while back I read Rise and Fall of Classic OOP. This caused me to realize that I am kind of a heathen as far as object oriented programming is concerned, probably because I came to explicit OO late and never actually learned how to do it the 'right way'. You see, to me object orientation is a technique for code organization and nothing more.

This gives me a very pragmatic view of when to write OO code and when not to; I use objects and classes where they make my code simpler, and I don't use them when they don't. I don't consider them something that has to be followed at all costs or as the only way to model the real world (or any arbitrary artificial world). If the real world entities that you're working with aren't amenable to being wedged into an OO hierarchy, then don't. Given the wide variety of both code structure and ways of organizing code so that it makes sense, it would be fairly absurd to say that OO is always the right answer; it is just one technique among many. Sometimes it's the right answer, sometimes not.

(Of course, some languages as so in love with OO that they don't give you a choice about it; you can't really have freestanding functions and data containers.)

I won't say that all of those OO examples that modeled the real world always struck me as a bit hokey and artificial, because honestly I never really thought that much about it (and any small example is hokey and artificial if you really look at it). But if people are switching towards my view of the purpose of OO, I'm all for it.

(I would be shocked if this was new and novel. I sure hope that lots of people have had this thought before me, because it just feels so obvious.)

by cks at January 22, 2012 07:27 AM

January 21, 2012

The Lone Sysadmin

Install the nano Editor on the VMware vMA 5

The VMware vSphere Management Assistant (vMA) is a handy appliance for interacting with your environment via the Linux command line. I use it a lot, and I’m starting to get more of my team to use it. The problem is that it only ships with the vi text editor, which, described politely, is sort of arcane. Being a UNIX guy I’m used to it, but for others that just want to edit a file it’s overkill.

For those situations I like nano, a simple open source editor. To install it on the vMA issue the command:

sudo zypper install nano

If you’re prompted for a password use the one you set for vi-admin (or whoever you’re logged into the vMA as).

I got a bunch of errors when I did this:

File './suse/x86_64/nano-2.2.6-3.1.x86_64.rpm' not found on 
medium 'http://download.opensuse.org/distribution/11.4/repo/oss'

as if download.opensuse.org has a mirror that’s hosed, but I kept retrying (r) when it prompted and after a few times it succeeded. A little sketchy, but for my purposes it works.

And, of course, type ‘nano’ to fire it up. “nano /path/to/filename” to open a file, Ctrl-X to exit & prompt to save, Ctrl-O to save, Ctrl-W to search, Ctrl-K to cut, Ctrl-U to paste (cut first, then paste again for copy).

Related posts:

  1. Use ‘for’ Loops with the vSphere Management Assistant
  2. iPod nano Cures Colds
  3. How to Install Microsoft SQL Server 2008 R2 for VMware vCenter 5


Did you like this article? Please give me a +1 back at the source: Install the nano Editor on the VMware vMA 5

This post was written by Bob Plankers for The Lone Sysadmin - Virtualization, System Administration, and Technology.. Licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 3.0 Unported License and copyrighted © 2005-2011. All rights reserved.


by Bob Plankers at January 21, 2012 08:07 PM

Pantz.org

Stop leasing that cable modem

The bill

I got my Comcast bill again (they keep sending those things) and saw my charge for leasing my cable modem was now $7. The last time I remember looking it was $5 (close to as bad). I could not believe I was spending $84/yr to lease a cable modem. I had looked years ago at cable modems and remembered the price being close to $100. I seemed to have bad luck with them in the past and would have one or two go wonky on me at least once a year.

Leasing a modem

Since I would loose about 1 modem a year I could just have it replaced because of the lease. I figured at around $100 a pop it was worth it. If I ever upgraded my service to a faster speed and needed a DOCIS 3.0 modem it would be the same amount of money. Right now I have a plan that is well within DOCIS 2.0 speeds. For those that don't know DOCSIS 2.0 speeds are 42.88 Mbit/s down and 30.72 Mbit/s up for one channel. DOCSIS 2.0 has a maximum of 1 channel.

Buying a modem

I decided to do some research on modem prices. First I looked at DOCSIS 3.0 modems. The DOCSIS 3.0 modems are in the $75 and up range. For this price if you fry a modem a year it might be worth leasing. My internet speed plan with Comcast did not need DOCSIS 3.0 speeds so my next search was for DOCSIS 2.0 modems. I was hoping that DOCSIS 2.0 would be the older tech and that the price would have dropped by now. After searching Amazon for DOCSIS 2.0 modems let me tell you the price has really dropped. I found tons of slightly used DOCSIS 2.0 modems for $10-$20. $10-$20!! Are you kidding? I could buy 3 of these modems and it would still be saving money over leasing a modem. Hell, I could do that each year and it would still be less than leasing a modem. I looked on Comcasts approved cable modem page to ensure compatibility with their equipment, and bought one of these Comcast blessed modems (Webstar DPC2100) for $17 on Amazon.

Up and rocking

The modem came in a plain Amazon box with just the modem, power adapter, and a Cat-5 cable. I unhooked the old modem and plugged in the new modem. Then made the call to 1-800-COM-CAST, and gave the nice lady my MAC address off the cable modem. She put it in and just like that I was back on the interwebs. It has been a week with no problems. Speed tests confirm that this modem and the old modem are the same. Why did I not do this sooner? Ugh! Do yourself a favor and get a cheap used cable modem and stop paying for the leased one.


by Pantz.org at January 21, 2012 07:38 PM

Steve Kemp's Blog

So mega-upload is gone

So the site http://megaupload.com/ has been taken offline, amidst allegations of knowingly conducting in piracy.

There are probably a lot of legitimate users who have lost access to their uploaded files, even if they were offsite backups you can imagine a user owning a website which now has a million dead-links.

This reminds me of a conversation I overheard on Jon Dowlands blog - the summary is that he'd written a (useful) tool to extract attachments from Maildir folders and was wondering how to store and access those attachments. The upshot seemed to be magical URLs of the form:

  • https://file.example.com/sha1/509c2fe2eba509e93987c3024a74d74583c274bd

The comments covered an alternative which was hash:///sha1/xxxxxxxxxxxxxxxx, which then becomes close to the magnet:// schema.

I've not yet thought things through, but I can't help thinking that with the redundency already present in the internet we should be looking at non-server-specific links. Yes there are times right now when you might want to address a specific file on a specific server - but otherwise? Wouldn't it be nice if you could just access a file from "anywhere" which happened to have the right contents?

Already my nonporn-but-definitely-adult-site makes its images available as /img/$md5sum.jpg - and similarly the storage at the back-end of my random image upload site uses SHA1 hashes to store the actual files.

To make this more complete what we need is something that crawls the internet to find files by hash; then add support in browsers. Obviously this must be async and could introduce timing issues, but fundamentally it seems like a reasonable approach to the problem of a single host going offline.

(Consider what happens if imgur.com disappears. All those links would die, yet 99% of the images would still be available somewhere.)

I'm tempted to suggest microformat format but I need to consider the matter. Right now I'm going to immediately update my current image hosts to use, at the very least:

 <a href="/foo" rel="sha1:xxxxx md5sum:xxxx">
  <img src="foo.jpg" alt="img name">
 </a>

The unfortunate thing is you cannot have a 'rel="xx"' attribute for an image. So you either have to encode it in the parent link, or add it to the alt attribute which is suboptimal.

ObQuote: "Now, they tell me I paid my debt to society." - Oceans Eleven (2001)

January 21, 2012 12:42 PM

Standalone Sysadmin

Umm…can I have your old SSD?

The thought occurs to me that there is a lot of concern about the health of SSDs by admins who don’t have a lot of experience with them.

I don’t have a lot of experience with them either, but I’ve spent a decent amount of time learning how they work, why they fail, and reading about the various failure modes. The problem is that I have no hands-on time with old, failed, failing drives.

What I’d like is to see some failing (or old/slow/etc) drives first hand. My ultimate goal is to write a small SSD health check that can be plugged into Nagios (or whatever monitoring system you want to use). As of right now, there’s no SSD health check on Nagios Exchange, and I think one that actually did check would be valuable.

Of course, there will be limitations (like when the SSD is part of a RAID array, or really really old, or the drive is so dead that it doesn’t respond), but still, the lack of ANYTHING is kind of frustrating.

Since I’m not made of money and time, I can’t just go buy a bunch of SSDs and wait on them to die in interesting ways. This is where you come in :-) I’d be interested in taking (or borrowing, if you’d prefer) your old unhealthy drives. I can get my own reference shiny-new drive(s), but I’m more interested in drives that are long in the tooth, either because they’re just old, or because they’re slow from all of the writes that you’ve been putting them through, or whatever.

I’d prefer drives with the SMART extensions, but I’m not overly picky, I guess. Since I don’t need dozens, I can probably pick up shipping as long as you’re in North America.

If you can help me out with my little project (or have suggestions on how I can acquire drives like this), please drop me a line or comment on this story. Thanks!


by Matt Simmons at January 21, 2012 12:32 PM

Chris Siebenmann

The C juggernaut illustrated

The C juggernaut illustrated

Perhaps it is tempting, looking back at history from the vantage point of today, to say that C succeeded so much because it was at the right place at the right time. As you could tell the story, all sorts of people in the 1980s wanted a low level programming language, C was around, and so they seized on it. Any similar language would have done; it's just that C was lucky enough to be the one that came out on top, partly because of network effects.

(This story is especially tempting to people who don't like C and Unix.)

This significantly understates the real appeal of C at the time, even and especially to people who had alternative languages. A great illustration of this is C on the early Macintosh. You see, unlike environments like MS-DOS (which had no language associated with it, just assembler), the early Macintosh systems already had a programming language; they were designed to be programmed in Pascal (and the Mac ROMs were originally written in Pascal before being converted to assembler).

This was more than just an issue of Apple's suggested language being Pascal instead of C. The entire Mac API was designed around Pascal calling conventions and various Pascal data structures; it really was a Pascal API. Programming a Mac in C involved basically swimming upstream against this API, full of dealing with things like non-C strings (if I remember right, Mac ROM strings were one byte length plus data). I believe that Mac C compilers had to introduce a special way of declaring that a C function should have the Pascal calling convention so that it could be used as a callback function.

Despite all of this, C crushed Pascal to become by far the dominant programming language on the Macintosh. I don't think it even took all that long. Programmers didn't care that dealing with the API issues were a pain; working in C was worth it to them. It didn't matter that Pascal was the natural language to write Mac programs in or that it was a perfectly good language in its own right. C was enough better to displace Pascal in a hostile environment.

C did not win just because it was at the right place at the right time. C won in significant part because it was (and is) a genuinely good language for the job it does. As a result it was the language that a lot of pragmatic people picked if you gave them anything like a choice.

by cks at January 21, 2012 06:04 AM

January 20, 2012

TechRepublic Network Administrator

Microsoft's ECI may provide best options for virtualized environments

Virtualizing and deploying VMs is the easy part; scaling the solution in a simple matter becomes the hard part. Rickatron offers one easy way to scale modern infrastructure.

by Rick Vanover at January 20, 2012 07:51 PM

Chris Siebenmann

Another Russ Cox regexp article: How Google Code Search Worked

Another Russ Cox regexp article: How Google Code Search Worked

Russ Cox has just added another article in his series on regular expressions; this one is titled Regular Expression Matching with a Trigram Index, or How Google Code Search Worked. It's as worthwhile as all of the previous three.

by cks at January 20, 2012 05:54 PM

Standalone Sysadmin

The real loser in software piracy isn’t who you think


You might have heard that the US Government recently shut down MegaUpload, an online “file locker” which was used by many pirates to store their illegally acquired and transmitted software. Of course, the fact that it was used by a great number of people to store completely legitimate files was irrelevant to the DOJ.

But it did get me to start to think about software piracy, and consider the harms that it causes, and what its detrimental effects really are.

So what is the nature of software piracy, anyway? Is it theft, as lawmakers would have you believe?

As many have said, theft is the taking of something which deprives the owner of use. If you steal a car, the owner of the car can’t use it anymore. So it’s certainly not theft as it would be defined in the physical world.

However, a software pirate is taking something that, if acquired legitimately, would have required them to pay the copyright holder money. The copyright holder did not get their money in the case of pirated software. But is that theft? The copyright holder wasn’t materially injured, but they were not justly compensated for the use of their property.

By that logic, it sounds to me like software piracy is more akin to trespassing than it is to theft.

Of course, I also find it laughable whenever software piracy is mentioned and people assign monetary value to the “stolen” software…as though the options were either “steal this software” or “pay for it”. A false dichotomy if I ever heard one.

Let me just say this…I was in college and I knew a lot of people who pirated software. I can tell you with 100% certainty that none of the people who had the newest copy of Photoshop on their computer would, if unable to steal it, say “gee, I guess I need to pony up $500 to buy photoshop so I can alter this picture of my professor”. They didn’t have $500 to buy Photoshop. Did Adobe really lose the $500 that didn’t get paid to them? No. That money didn’t exist. Assigning it a value is dishonest.

Another option is to use an alternative piece of software to accomplish the same thing. As it turns out, Adobe does make several versions of Photoshop. Photoshop Elements is around $60, or about 1/10th the price of Creative Suite. But guess which one is pirated more?

I’m not going to link to the Pirate Bay, but you can check if you want. If you don’t want, you can just take my word that Adobe Photoshop Elements 10 currently has 462 seeders, while Photoshop CS5.1 Extended Edition has 5,881. It’s really interesting that the the ratios between price and seeders is so close. I’m going to have to investigate that further at some point.

Nevertheless, you can see what’s happening. Not nearly as many people are pirating Photoshop Elements. Is it because the pirates who would have “stolen” it bought it instead? I have my doubts. I suspect that it just isn’t as appealing to pirate as the more expensive option.

More people pirate CS5 because there’s no disincentive to them for doing it, compared with Elements. “In for a penny, in for a pound” is the phrase (incidentally, pound is a reference to the monetary denomination, not the weight, for my fellow Americans who have never really thought about the it). If you’re going to pirate something, you might as well pirate the most feature-rich application available, right? They’re not going to hold a trial and find you less guilty. No one will complement your restraint for having “only” pirated Photoshop Elements. So why not get CS5?

So imagine a perfect world, where there is no software piracy. What are the options? Well, we take the false dichotomy listed above, and we can immediately add “Don’t use software in this manner”. In other words, there is always the option to not photoshop your professor’s head onto a donkey. I think we all know that this scenario is unlikely.

The 4th option is to use an alternative software, such as the above-mentioned elements. However, we’ve seen that would-be pirates are less likely to use that, probably because they’re unable or unwilling to spend money. There is, of course, alternative alternative software. Not every image editing program is made by Adobe and sold for money. Software like The Gimp has, I would estimate, 80% feature matching with Photoshop. And of that 20% left out, there are essentially 0 features that the average young, run-of-the-mill software pirate would be interested in. Most of the features are professional level, having to do with things like printing and high end modeling. For casual (or even mid-to-high level) photo editing, The Gimp has everything you need. And it’s 100% free.

So why aren’t people using it?

Well, a lot of people are, but why aren’t the pirates using it instead of pirating photoshop?

I suppose it depends on what their goals are. There are software pirates who collect software much like I collected baseball cards when I was a kid. There are also probably the print shops out there who pirate software because they’re running so close to red that they really can’t afford to buy another copy of CS5. Aside from those two extremes, I’d guess most are “casual” software pirates. People who need to do occasional image editing, who use their software, but aren’t in love with it, and only continue to use it because they’re familiar with the interface and because it’s easy to get.

That last group, the “casual” pirates, are where we see the bulk of the damages in terms of claimed income lost, and also where it’s the most ridiculous, because there’s absolutely no need for them to use something as powerful as Photoshop when something like The Gimp would be just as valuable to them.

And this is the true evil of software piracy. Those users who don’t need any features specific to the software that they’re pirating are actively shrinking the user base for the free software that fills the same niche. Every user that pirates Photoshop when they could be using The Gimp (or paint.net or pixlr or any of these) takes resources away from the others. Of course, when the price of The Gimp (or whatever) is the same price as Photoshop CS, they make the same choice as when they choose between CS and Elements.

These users aren’t stealing software, they’re stealing userbase.

Does that affect you? Yeah, absolutely. How?

Because publishers can write losses to piracy off of their taxes.

So these people who pirate software casually are increasing the counts of piracy, which allows the publishers to claim losses that aren’t really losses, as I’ve explained. Because the publishers are claiming less income, they pay less in taxes…which essentially robs the government of its income.

Who is stealing from who?

What are your thoughts about all of this? Is there a solution that doesn’t involve a massive upheaval of the copyright laws? What can or should be done?


by Matt Simmons at January 20, 2012 04:47 PM

The Nubby Admin

Need Some Comic Relief? READ MOAR SPAM!!

I was stopped in my mouse tracks the other day while attempting to achieve Inbox Zero for a certain client’s stack of e-mail tickets. I received a spam email message that was so bad, it was good. I really got a lift out of it. I’m going to reproduce it here in case there is a poor, languishing IT worker that needs a chuckle. Any search engine hatred I get for reproducing a spam message will be well worth it.

The piercing comedy comes from the fact that this spam message does not seem to be simply packed with pseudo language to skirt around spam filters. It appears to be a legitimate attempt at ensnaring new customers for a cut-rate web hosting service in… shall we say… a certain Cyrillic-using Eastern European country. Also, the entire message was in 24 point Times New Roman, blue and underlined.

To whomever crafted this treasure of the English language (or whoever ran it sideways through a Slavic -> Huli -> Ewok -> English -> Chinese -> Inuit -> English translator), I shower you with virtual rose petals. You, dear ones, are my heroes for the day.

Welcome to e…e.biz !

We also provide services DDoS’a!

Every day our world is moving forward, walking in the footsteps of new technologies. With the development of the Internet and poyavlyaniem any electronic goods, and hence the electronic money. Currently, the volume of transactions on the Internet billions of U.S. dollars. And always someone with someone else is paying.

On our site you will be able to make the exchange of electronic money on the most favorable rate. We work with the most popular and liquid electronic payment systems of the world, including Liberty Reserve, Perfect Money, Liqpay and others.

Why are you with us advantageous?

The answer to this question is most important in the exchange – Safety and course. In two of these parameters, we offer you the best possible terms. Currency exchange rates in our exchange points are the lowest in the world. If you find a more profitable course of our – immediately vsyazhites with us and we will make the course even better! Our site is a business card – we do not ask, so do not keep data about you and your accounts. The transaction goes online (communicating with the operator), so both you and us are not afraid of break-ins.

Electronic Payment Systems

In the world there are many electronic payment systems. There is a very popular system, and there is less. Each system is different committees, the level of safety, liquidity, market and policy development on the Internet. Therefore, we only work with payment systems that allow their customers to easily make transfers in combination with high safety. Of the banks, we chose the largest and most reliable – Privatbank with his payment system Liqpay.

Constantly we are exploring e-commerce market and add areas of exchange of money online.

Sincerely Administration …

Contacts:

Email # 1: e…e.biz @ ya.ru

Email # 2: e…e.biz @ gmail.com

Skype: e…e.biz

ICQ: 6…390

E…e.biz

 The Takeaways

First, providing your customers with DDoSs is a selling point.

Second, “poyavlyaniem” isn’t a word, but it should be. So now it is. I think it means “Refunds will be paid in borscht.”

Third, seriously, why are you with us advantageous?

Fourth, the largest and most reliable bank is Privatbank with his payment system Liqpay

I hope you all learned something from this.

by Wesley David at January 20, 2012 02:29 PM

Chris Siebenmann

How not to do repeated fields in web forms

How not to do repeated fields in web forms

There's a certain sort of web form which really wants to make sure that you've entered something correctly, so they ask you to enter it twice in two different fields. You've probably seen this in some web form sooner or later; this is the 'please enter your password again in this field too' or 'please re-enter your email address' field. I tend to think that this is bad on its own, but I've now seen an even worse implementation of this basic idea, which I'll call an anti-confirmation field, one that's practically designed to create errors.

What the people behind this did was quite simple: they made it so that their second fields would not accept pasted input (probably using JavaScript, which I had on because I didn't feel like finding out which bits of the registration process required it). I had to retype both my email address and my password by hand, which was especially annoying because I was pasting both of them from elsewhere. I call this an anti-confirmation field because of course retyping things by hand is more error-prone than pasting things in; in fact, I twice made a mistake retyping the password.

(My web password for this site was a strong random password, as usual. Random jumbles are hard to transcribe accurately by hand, especially when they jump back and forth between character case.)

I suspect that the website designers justified this by saying that they were worried about people entering a bad email address by hand in the first field and then 'confirming' it by just cutting & pasting it into the second field. However, even at its best this logic doesn't work for password fields since browsers don't let you copy the plaintext content of a password field once you've entered it. I also suspect that the designers do not have any actual data on how many genuine errors this prevents (versus how many artificial errors are created).

Sidebar: how to measure the numbers

Assuming that you've committed yourself to (anti-)confirmation fields in the first place, you just need to track field values across time when a submission fails because of mismatched fields. In a transcription error the first of the two fields will turn out to be correct (ie, the same as the final submitted value) and the second field will change. In a genuine error the first field will be different between the failed submission and a subsequent valid one.

Doing this with email addresses raises basically no security issues. If you do this with the password field you'll want to one-way hash them somehow in your tracking data.

by cks at January 20, 2012 03:59 AM

January 19, 2012

The Blog of Ben Rockwood

Sending Email with Attachments from the Command Line

I have lots of awesome CLI based reporting tools. One was so awesome that other people in the company wanted to get it on a regular basis but they preferred to see it as CSV so it could be manipulated in Numbers or Excel. Modifying my report to output CSV was easy, I just added a conditional that replace my pretty column formated printf() with an ugly comma separated printf(). Sending CSV in email is easy, just pump it into ”sendmail -t”.

I quickly realized that using sendmail “as usual” sucked, because the CSV was in the body of the message, not an attachment. The solution was to send a Multi-Part MIME message. Doing so is easier than you think.

Lets look at a template example, piece by piece:

From: $FROM
To: $TO
Date: $DATE
Subject: $SUBJECT
Mime-Version: 1.0
Content-Type: Multipart/Mixed; boundary="ATTACHMENT-BOUNDRY"
Return-Receipt-To: $FROM

Some body stuff here, this is your message

Notice above that From, To, Date, is all pretty standard stuff. What is special is that we specify the MIME Version (1.0) and then set the content-type to “multipart/mixed”. Following that is a boundary string. A boundary string is an arbitrary string that represents the different parts of your message. In our case, it will separate the body from the attachments, but it can also be used for providing both HTML and Plain Text versions of a message in a single mail.

--ATTACHMENT-BOUNDRY
Content-Disposition: attachment;
filename="$FILENAME1"
Content-type: text/plain;
charset=US-ASCII;
name="$FILENAME1"
Content-Transfer-Encoding: quoted-printable

$ATTECHMENT_DATA1

The next section of of our message is noted by the boundary string prefixed by two dashes (--). Note that they are before but not after the boundary string! Next is the metadata about this portion of the message, namely the Content-type, encoding, and disposition.

It is important to note that Mail.app (OS X) is more strict about attachments than Thunderbird or Gmail. If you do not include a content-disposition it will register the section as just another part of the body. Mail.app requires that you be very careful about syntax, whereas Thunderbird and Gmail have a "I know what you meant" attitude.

--ATTACHMENT-BOUNDRY
Content-Disposition: attachment;
        filename="$FILENAME2"
Content-type: text/plain;
        charset=US-ASCII;
        name="$FILENAME2"
Content-Transfer-Encoding: quoted-printable

$ATTECHMENT_DATA2

--ATTACHMENT-BOUNDRY--

Here we have a second attachment. We could add as many as we wish, but notice that it ends with our boundary string again but now its surrounded by dashes front and back. This signifies the end our parts.

Thats really about it, pump all this into "sendmail -t" (ie: cat mymail.txt | sendmail -t, or equivalent) and away your mail goes.

One word about attachment type. Above the content type of the attachments was "quoted-printable". That or 8bit are fine for normal text such as CSV, but if you wish to send binary data you will want to base64 encode it (see BASE64(1) for syntax) and set the content-type as "base64".

by benr at January 19, 2012 07:46 AM

Chris Siebenmann

Let's make it official: Solaris 11 is closed source

Let's make it official: Solaris 11 is closed source

You may remember back in August 2010 when there was a leaked Oracle memo that said, among other things:

We will distribute updates to approved CDDL or other open source-licensed code following full releases of our enterprise Solaris operating system. [...]

At the time I noted that 'full releases' might be construed to be 'Solaris 11' instead of the next 'Solaris 10 update X' release and was unhappy about it. That was then. Now it's been a couple of months since Solaris 11 was officially released to the world and, well:

; cd onnv-gate
; hg incoming
comparing with [...]
searching for changes
no changes found
; hg log | fgrep date | sed 1q
date: Wed Aug 18 15:52:48 2010 -0600

I think it's safe to conclude that there will be no further updates to public (Open)Solaris source code from Oracle, ever. Solaris is now a closed source, 'source-not-available' operating system once again (and probably stronger than it ever was; it used to be sort of possible for universities to get Solaris source code, but I doubt that's on the table from Oracle).

(I'm sure that almost everyone concluded this some time ago. Sometimes I remain hopeful even in the face of all but certain disappointment.)

This matters a lot for us; our ZFS spares system and parts of our ZFS status monitoring system are built around information obtained from undocumented internal library interfaces because there is no other alternative. It seems extremely unlikely that we will ever upgrade to any future version of Oracle Solaris. Lack of (Open)Solaris kernel code also significantly reduces the usefulness of DTrace, one of the theoretical signature Solaris features.

(It is vaguely possible that some version of Solaris will sometime expose public interfaces for the information we need, but frankly I really doubt it. All evidence to date suggests that it is strongly against the engineering culture of ZFS; they had five years to do it and steadfastly didn't. I will skip any number of angry remarks.)

by cks at January 19, 2012 05:44 AM