Bigbro's foray into the scary world of blogging
Google Chrome is Google's browser and provides a refreshingly fast interface to (in particular) Javascript heavy websites. It's also a pretty good general browser, but like many others presents dire warnings of doom if you attempt to view a https secured website which doesn't have a recognised certificate. (Or more correctly, doesn't have a certificate signed by an authority recognised by Google.)
Most other browsers provide a method of installing root certificates but Google decided that they would use an already established certificate management system external to the browser, the NSS Security Toolkit. So if you want to view websites secured by free CACert SSL certificates or have the need to browse to sites secured by self-signed SSL certs (like the https management interface for my Linksys WRT54g wireless router running Tomato firmware for example) then you'll want to add some certificates to your NSS database. Fortunately, it's pretty simple to do...
First, let's install the CACert root certificate. Installing this means that Google Chrome will trust the identity of sites signed by CACert issues certificates. This is a good thing and saves clicking the "Proceed anyway" button every time.
Like many people I run Ubuntu on a number of servers with DNS being just one of the services provided. Bind 9 has worked extremely well to date, though I recently came across a conflict between AppArmor (note American spelling) and bind which resulted in slave domains not being replicated correctly. This happened on my systems some time on or after 2009-07-29 (and I'm only getting around to writing up the blog post now... I know...) If you see lines similar to the following in the output of dmesg, or in your system log, you may have the same problem:
audit(1234567890.462:15891): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/etc/bind/zones/slave/tmp-bkTe208LbH" pid=123 profile="/usr/sbin/named" namespace="default"
audit(1234567890.460:15892): type=1503 operation="inode_create" requested_mask="w::" denied_mask="w::" name="/etc/bind/zones/slave/tmp-3VUN2uHFUI" pid=123 profile="/usr/sbin/named" namespace="default"
To explain briefly what this means: AppArmor is an extra layer of security which effectively makes sure that system programs are allowed only limited access to the system, even though they may run as root. This helps significantly in the case of a root escalation vulnerability being discovered, since if AppArmor is correctly configured your system is somewhat compartmentalised so damage should be limited. Without this, a root privilege escalation in a daemon would allow full read and write access to the entire system, with predictably bad results. Permissions for various daemons under AppArmor are configurable in files under /etc/apparmor/ and /etc/apparmor.d/ (on an Ubuntu system at least.)
Under Ubuntu it appears that AppArmor is misconfigured for BIND 9, specifically with regard to the default setting that slave zones - where your DNS server is acting as a secondary DNS server for some domain(s) - are stored under /etc/bind9/zones/slave/. From the log lines above it's clear that AppArmor is disallowing writes to this location for BIND, with the result that secondary / slave zones can never be updated. This is a bad thing.
Fortunately, there is an easy solution. Either update your BIND config to write slave zone files somewhere else, or update AppArmor to allow BIND to write to the slave zones directory. I chose the latter, accomplished by adding the following line to /etc/apparmor.d/usr.sbin/named
/etc/bind/zones/slave/** rw,
This allows bind to read and write to the slave directory, enabling it to create the files it needs to store updated zones coming via AXFR transfers from master DNS servers. You can test by running rndc reload and watching the syslog and file timestamps in the slave directory. You should also no longer see log writings with the denied_mask="W::" key-value pair as above.
Thanks to alphageek for the first clue as to what was going on and hopefully this blog entry will provide a more secure fix for the problem.
posted at: 13:31 | path: /technical | permanent link to this entry
...is really hard. Particularly when it's law and unlike engineering, for every rule there's at least one exception. I am not having fun here :-( That is all. I promise to be (marginally) less grumpy once exams are over.
posted at: 18:11 | path: /observations | permanent link to this entry
Since moving to Ubuntu 9.04 and 9.10 I've had repeated problems with my Dell D430 being able to suspend. One of the things that Apple got right with their laptops was that when you close the lid, the computer goes to sleep and it wakes up again ready for use upon opening the lid again. I used to enjoy similar functionality on my Dell D430 until moving to the more recent versions of Ubuntu - which is a real pity. I always hate to see regression instead of progression, particularly when it comes to open source.
I thought the issues were resolved finally until a large update was issued which my laptop installed on 1st May 2010, and now I'm back to a laptop that I have to shut down to move about again - no suspend for me. This makes the laptop significantly less useful and is pushing me (and others) towards replacing portable hardware with Apple products, since they just work. I can't speak for the world in general, but I and the people I regularly deal with don't have time to deal with intermittently faulty systems and laptops that may or may not lock up when you shut the lid (losing any work that was not saved.)
I'll try and provide a better bug report to Ubuntu, but as a reminder to myself, the following update was what has killed suspend again. Also, if you're a Dell D430 owner running Ubuntu 9.10, DO NOT grab the latest updates!
I have installed 10.04 (Lucid) on a D420 but I can't say I've tested it properly yet. I'll get around to putting it on the D430 shortly - and hopefully will be posting a good news story about how suspend works again and proper regression testing has been instituted such that it doesn't get broken again.
Aptitude 0.4.11.11: log report
Sat, May 1 2010 12:35:10 +0100
IMPORTANT: this log only lists intended actions; actions which fail due to
dpkg problems may not be completed.
Will install 34 packages, and remove 0 packages.
172MB of disk space will be used
===============================================================================
[INSTALL, DEPENDENCIES] linux-headers-2.6.31-21
[INSTALL, DEPENDENCIES] linux-headers-2.6.31-21-generic
[INSTALL] linux-image-2.6.31-21-generic
[UPGRADE] aisleriot 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] compiz 1:0.8.4-0ubuntu2 -> 1:0.8.4-0ubuntu2.1
[UPGRADE] compiz-core 1:0.8.4-0ubuntu2 -> 1:0.8.4-0ubuntu2.1
[UPGRADE] compiz-gnome 1:0.8.4-0ubuntu2 -> 1:0.8.4-0ubuntu2.1
[UPGRADE] compiz-plugins 1:0.8.4-0ubuntu2 -> 1:0.8.4-0ubuntu2.1
[UPGRADE] compiz-wrapper 1:0.8.4-0ubuntu2 -> 1:0.8.4-0ubuntu2.1
[UPGRADE] glchess 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] glines 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnect 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnibbles 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnobots2 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnome-blackjack 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnome-games 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnome-games-common 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnome-mahjongg 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnome-sudoku 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnometris 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnomine 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnotravex 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gnotski 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] gtali 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] iagno 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] libdecoration0 1:0.8.4-0ubuntu2 -> 1:0.8.4-0ubuntu2.1
[UPGRADE] libpq5 8.4.3-0ubuntu9.10 -> 8.4.3-0ubuntu9.10.1
[UPGRADE] linux-generic 2.6.31.20.33 -> 2.6.31.21.34
[UPGRADE] linux-headers-generic 2.6.31.20.33 -> 2.6.31.21.34
[UPGRADE] linux-image-generic 2.6.31.20.33 -> 2.6.31.21.34
[UPGRADE] linux-libc-dev 2.6.31-20.58 -> 2.6.31-21.59
[UPGRADE] same-gnome 1:2.28.0-0ubuntu1 -> 1:2.28.0-0ubuntu3
[UPGRADE] tzdata 2010h-0ubuntu0.9.10 -> 2010i-0ubuntu0.9.10
[UPGRADE] tzdata-java 2010h-0ubuntu0.9.10 -> 2010i-0ubuntu0.9.10
===============================================================================
Log complete.
posted at: 14:19 | path: /technical | permanent link to this entry
Today D decided that after months of tearing around the house pushing her buggy, she could walk all on her own. Nothing is safe any more - particularly the poor dog who is learning that his erstwhile relatively quiet life can now be disturbed by a screaming running infant. Comedy++
posted at: 21:16 | path: | permanent link to this entry
I've not done a Link of the Day thing for ages... but perhapas that's because meebo.com is the first webapp to impress me in some time.
...is a pile of epic fail (on Linux at least.) I like the idea of full-text searching - but I also like my laptop to not have the CPU at melting temperature all the time and the fans running at full speed as thunderbird burns through CPU indexing what I can only assume are the same messages over and over and over again. I also like to start blog posts with a hearty generalisation, even if the behaviour is something relatively specific to my situation - it grabs the reader's attention and makes sure they read the remainder of the article ;-)
Normal behaviour, and better use of your CPU can be restored by disabling full text search / indexing. You can do this by setting the advanced configuration option mailnews.database.global.indexer.enabled to false, or as this has obviously become a big enough problem for enough people, the Edit | Preferences | General tab now has a checkbox marked Enable Global Search and Indexer. Unchecking this will also turn off this feature.
More usefully, some exceptionally bright spark has made a plugin called GlodaQuilla available. It's experimental but has not yet set fire to my laptop or caused my pets to explode - your experience may be different of course and any use of experimental plugins is completely at your own risk. I did the following and now have a full indexed search of the subset of my mail that interests me, along with a much more responsive machine (and some 500MB of disk space no longer used by the full-text index)
/home/$username/.thunderbird/random.default/global-messages-db.sqlite on my Ubuntu Linux machine. You'll need to find your own global-messages-db.sqlite yourself, but the path above should give you a clue as to where it is.I set up my eeePC 701 as a fileserver in the house over the Easter weekend. It runs Ubuntu and with a little configuration happily shared a few USB disks over the home network with SAMBA and NFS. Most importantly it ran pretty cool and didn't use a lot of power - important for something that was going to be left on all the time.
All worked well until the last couple of days when I noticed some pretty strange messages appearing in the logs. A reboot resulted in GRUB giving me the dreaded Error 17. Further investigation seems to indicate that the SSD has shed its mortal coil. Poo! Cue research to determine whether it's more cost and time efficient to get a replacement SSD or just buy a Mac Mini.
posted at: 22:33 | path: /technical | permanent link to this entry
...possibly some of the most delicate software in the known apple universe. Once again either it or something separate has caused corruption on the time machine backup disk, and once again nothing has recovered my machine short of 'reboot' typed at the command prompt. It seems that if anything goes wrong with Time Machine it just sits there consuming resources giving the user no clue that anything has even gone wrong. Thanks a bunch Apple. I'm hugely confident that my data is safe with you and your dubious software.
Fortunately, last weekend saw me set up a Linux based server solution which allows me to back up most data to a known working, safe solution that I can recover data from. And if there's an error with it, I'll find tons of info in /var/log/syslog most likely, instead of the cast canyon of nothingness that Apple seems to see fit to provide users with. I won't even mention the stupidity of Apple's Disk utility giving time estimates as to when it might be finished - I've seen Windows copy operations estimate time better.
Yes, this is a bitter article and yes, I find Apple's hardware and software to be generally of a decent standard - but I'm trusting my data to this backup solution and this is the second time I find myself putting the pieces back together. I have zero faith in Apple Time Machine any more.
posted at: 23:46 | path: /rants | permanent link to this entry
...that I had ordered the Disney channel on Sky for the benefit of my small child. Apparently I was almost right... ;)
posted at: 18:45 | path: | permanent link to this entry
We at HEAnet labs have been testing 3G mobile broadband USB dongles for some time now, and the key weakness identified is the problem that data download is asymmetric. This means that while you can download content at high speed, uploading content is much much slower. This means that 3G dongles are unsuitable for things like uploading large photographs or video information to the interwebs. This severely restricts their usefulness - or at least, it used to.
While the technology of 3G and in particular the USB dongles means you are limited to an asymmetric connection, by changing the polarity of the USB power feed you can alternate between high speed upload and high speed download. This means making up a USB cable yourself, but as John Beale helpfully demonstrates, this is pretty easy. Just (carefully) swap the black and red wires.
This still leaves us with the problem that the connection is asymmetric, but that's easily solved by using iptables and a second USB dongle with the polarity set to normal. Effectively, we want to configure iptables to route the download traffic through USB dongle A (which is wired normally) and route the upload traffic through USB dongle B (wired with the polarity reversed.) Thanks to PaulJ on the ILUG list for providing a basic config for iptables:
ip route add default \change x and y so that x/y == bandwidth ISP1 / bandwidth ISP2
nexthop viadev weight x \
nexthop viadev weight y
...disk has corrupted. that would explain its inability to run backups for some time. Thanks Apple for such useful error messages ("Failed!") - helpful. *sigh*
Fortunately it's only my backup that's corrupted, and hopefully a 'Disk Utility' repair will put that back in a working state.
posted at: 23:31 | path: /technical | permanent link to this entry
...or at least not annoy those attempting to respond to it.
For whatever reason, I've been asked to complete an unusually large number of surveys recently. I get customer surveys from suppliers I deal with at work and as a student I frequently get asked to participate in questionnaires to assist other students in their research. If I feel a survey is reasonable I'll happily respond to it - but I find myself getting annoyed with surveys for the same reasons over and over again. Some surveys have been so annoying I've abandoned them half way through, wasting my time and probably not providing any feedback to the surveyor.
Remember that most people who fill in surveys are giving of their limited free time to provide you with some useful feedback. Respect their time and good will and try to make things easy for them. Here, for reference of anyone who would like me to respond to their survey, are my top tips for making your survey more likely to be completed and returned:
Just a note of congratulations to Phillips who appear to provide electronic copies of their product manuals online. I'm torn though between pointing out how this is a good thing(tm) and berating them for the fact that it is not at all obvious how to remove the dust collecting cylinder of their FC 8738 Animal Care vacuum cleaner.
As an aside, despite the label 'Animal Care' neither Puppy nor Kitten are too enamoured by the scary noisy machine. Perhaps they read 'care' in a more Al Pacino sense of the word. (Completely justified in Puppy's case as everyone knows vacuum cleaners are canine specific interdimensional portals.)
posted at: 14:21 | path: | permanent link to this entry
Bórd Scannán na hÉireann in association with Monster Animation and Design present this short film about transport within Dublin. As someone who uses public transport in Dublin almost every day of the week, I regret to say I largely agree that their title - "Not There Yet" - expresses the state of play pretty accurately.
posted at: 17:47 | path: | permanent link to this entry
I'm going to try making a small project in Ruby on Rails, so first I need to install the development environment on my laptop. More for my own future reference than anyone else's benefit, here's what I did:
sudo aptitude update (because it's just a good idea)
sudo aptitude install ruby-full build-essential (This installs emacs. wtf?!? Oh well...)
wget http://rubyforge.org/frs/download.php/60718/rubygems-1.3.5.tgz (Find the latest RubyGems package from rubyforge.org)
tar xzvf rubygems-1.3.5.tgz
cd rubygems-1.3.5
sudo ruby setup.rb (It appears to hang for a while with no output but eventually works and returns you to a prompt. So far so good...)
sudo ln -s /usr/bin/gem1.8 /usr/bin/gem
sudo gem update --system (Should say nothing to update if you've pulled down the latest version)
sudo gem install rails (Install rails)
All done and nothing remaining but to check that MySQL is up and running and start developing actual code.
posted at: 18:19 | path: /technical | permanent link to this entry
With the wealth of information available on the internet, I find I'm using it more and more to learn about new things, to remind me about things I have failed to retain or indeed to discover those new subject areas that I should gain some understanding of.
Unfortunately (for me), more and more material is being presented in video format, particularly with the increasing ease with which one may create and upload something to YouTube and similar sites. This is good - with both visual and auditory stimulation information tends to be better retained. However, I am currently limited to 3G bandwidth (as in HSDPA from a mobile provider, not 3Gbit/s - which would be lovely ;-) ) and I'm finding that this pretty much precludes me from using video. It's no longer reasonable to have to wait 8 times the length of a video clip to download it.
Interestingly, given the Irish governments recent underwriting of 'broadband expansion' within the country through the medium of HSDPA coverage, their own website defines broadband as (from broadband.gov.ie):
"Broadband is an always-on Internet connection that gives you high-speed access and downloads for a flat rate monthly charge.
Everything works faster, from downloading emails and files (such as pictures & mp3's) or streaming movies and radio."
I write in English and Irish reasonably frequently, with an occasional sojourn into German and French too. Of course, there is also a requirement that I be able to correctly punctuate and accent the names of colleagues with non-Anglicised names too - so that leaves me with some fairly extensive requirements for keyboard layouts. My operating system of choice is Ubuntu Linux and I consider myself fortunate that the international flavour of the developers appears to have rubbed off on its multi-lingual configuration.
If you want one language and layout, simply choose System | Preferences | Keyboard and choose the Layouts tab. There you can add or remove layouts at will - I prefer the Ireland UnicodeExpert layout as it allows me to type English, Irish, German and French (and probably other languages too) without changing layout at all. Note that if you want to add this layout 'by language' it's under English, rather than Irish or Gaeilge/Gaelic.
Once you have selected this keyboard layout you can, of course, type in English as normal. Note that it's a 'UK' keyboard layout rather than American (i.e. the quotation marks are above the number 2 and the @-sign is above the single quote character. Also, the hash is next to the Enter key and the monetary pound sign is above the 3.) To get letters with fadas on them, as required for Irish, simply use (usually) AltGr + vowel. AltGr + o produces ó for example. This makes typing as Gaeilge go han-shimplí ar fad. Níl a lán rudaí níos éasca ar chor ar bith.
As well as this feature - the ability to get fadas (or French acute accents) with a single key-combo, things like umlauts are not too difficult: a simple AltGr + : (colon) followed by a vowel will give an umlaut over the letter. AltGr + : followed by 'e' gives ë - easy-peasy. Note that AltGr + ; (semi-colon) will do - it 'implies' the Shift key, saving you from having to be a concert pianist or an emacs user to key the keystrokes right. AltGr + ^ (the 6 key) and an appropriate letter puts a hat over the letter. AltGr + ~ (tilde) puts a tilde over letters like 'n' for Spanish (I think...) There are lots more characters and languages supported without changing keyboard layout.
posted at: 12:25 | path: /technical | permanent link to this entry
Gwibber is a handy microblogging client, but it would be nice if it:
It's almost an old album now - at least Rachael's battered copy that I found is. Wonderful to rediscover an artist / band after a break from listening. Unfortunately, every time I listen to the flute solo in Gethsemane I cannot help but pictre Bill Bailey astride the conductor's podium demonstrating the ficticious and enchantingly aloof qualities of the transverse orchestral flute, conjuring up visions of titanic grandeur. "Iceberg! Dead ahead!"
posted at: 21:47 | path: /music | permanent link to this entry
