Category: technology-and-computing

Like watching a baby playing with a loaded gun…

Baby face closeup

…Is what Miles said about me setting up my own virtual private server on the weekend. Yep I finally took bull by the horns and slapped down my credit card and decided to go with Hub.org for Cubicgarden.com's new resting place. To be fair I didn't really know what I was getting myself into. See I kind of thought Tomcat and Apache would be installed and ready to go. But nope I finally logged into my FreeBSD box and quickly found out that it was a barebones box and I would need to do the configuration of applications, permissions and users. Well trust me, this is no easy thing. I mean there something very different about running unix on the desktop and running it as a server. In a server environment permissions and applications running all need to be kept under tight wraps. I would agree this should be the case for a Desktop environment too, but you can be a little more flexable with the configuration of a desktop machine. Put it this way, being a admin with root access to your own server is certainly compareable to building your first F1 car then racing it along the streets of Monte Carlo. Or as Miles puts it a baby with a loaded gun.

Either way, with thanks to Miles and tons of resources online like this one, I'm almost up, running and hopefully pretty secure. Rather than the usual Apache 2.x and Tomcat 5.5.x type configuration with mod_jk, I've gone for Tomcat 5.5.x with Pen in front for a reverse proxy and load balancer. Miles suggested Pound and Balance but I couldn't get Pound to compile without seriously messing with OpenSSL and Balance didn't seem to forward HTTP traffic without stripping away the header information. Pen is just like Pound it would seem, but also runs on Windows which is good to remember for other projects I may have in mind with my old Windows 2000 box. So yeah its a pretty sweet setup so far and means I loose the overhead of running Apache when all I really want is Tomcat. By the way, I was very close to installing Resin 3.x but decided against it for now.

Compiling Cocoon only took 2 mins once I finally untared and gunzipped the source. Can I just say how much of a nightmare Compression is? This guide was very useful for not only uncompressing files (tar -xvvzf cocoon2.1.8.tar.gz) but also compressing them. It took me a while to work out the correct parameters to compress a directory of files and its contains but keep the permissions and modified dates (which is extreamly useful for moving blojsom blog entries) . tar -cRvzf archive.tar foldertocompress/. Anyway, Cocoon is running happily in Tomcat now and Blojsom is also running fine with everything this blog has up till Feb 26th. So I'll have to do another update just before I swap over to the new server. This will also mean there will be a period of maybe 2 days when the blog and RSS feeds may time out or seem out of date. Don't worry I'll warn you in advance of the exact day.

So what next on the horizon? Well I need to do some more securing and enable Log4J on Tomcat and Cocoon. I've also still got to sort out basic Unix type things. For example while I was setting up the server, the only text editor I had was vi and the only shells were tsch and some other weird ones. Yep thats right no Nano or Bash. I don't know how I managed, but trust me I'll be avoiding vi when ever possible. I've already chpass all the users and made Bash the default shell. Beyond this, I'm considering Hamachi for Linux which would mean I could securely login to Blojsom, Tomcat and anything else from anywhere without setting up that crazy port forwarding in Putty. This sounds over kill but I'm tempted to at least run Hamachi on my Smoothwall Firewall server at home.

In regards to Cocoon, well my next step which I had planned to do if I was not writing this long blog post, would be to install Saxon 8.7 (good to see a .net version btw) in Cocoon using this guide (I know it works, i already installed Saxon 8.4 on the development machine at work). While with Blojsom, I will start trimming down some of the outstanding issues I had.

Oh before I finish, did I say how great Wget and Sudo are? Loaded gun indeed.

Comments [Comments]
Trackbacks [0]

Virtual Private Java Hosting choices

So I almost made my mind up when I thought I'd check out what people were saying about 4java.ca. The first result got my attention, as its someone looking for a private Java servlet hoster too. Erik also decided on 4Java.com but was considering Addr.com which I've honestly never seen before. I was a little put off by there image driven site but quickly found the lighter version which is much easier to navigate and compare prices. However I couldn't really found anything about the actual hosting besides they support Java Servlets. So I checked out the comments to the blog entry. Hub.org gets my vote for worst designed and styled hoster site, but there prices are nice and cheap at only 11.99 dollars for a basic Tomcat VPS setup. They also as standard run Cocoon 2.1.3, OpenLDAP and Jabber! Now thats something worth shouting about. KGBbinternet are simply too expensive for what you get. I mean you have pay 60 dollars a month to get 15gig of bandwidth a month. Cubicgarden.com is currently using about 6gig in webpage access and RSS and I expect that to grow over the coming year. Back to the blog, someone else pointers Erik to eapps which was one I considered a while ago.

Later this evening I spent some time talking to the live help at hub.org and they pointed me to the Cocoon hosters list, but that was not very fruitful. But I have to say the person on the other end did seem to know what they were talking about and seemed to be less sales and more sys op. At one point I did send the link to my blog about being told to leave Interadvantage and remarked it was the first time he's ever seen someone told to leave for such reasons. I also spent some time talking to Miles about Memory usage in Java Servlet containers. He had some great questions to ask any Java hoster. Whats the permanent generation set to on the JVM if at all? What's the command line used to start the JVM? Whats the percentage of customers which go over-bandwidth a month? and Email addresses of 3 customers I can correspond with. I've yet to get any response back from Hub.org but there certainly looking like the right choice if I can keep my bandwidth down to less that 8gig a month. As Miles has remarked already, I'm not using 304's in blojsom and I'm not Gzipping responses. So realisticly it shouldn't be a big problem. Those famous last words…

Comments [Comments]
Trackbacks [0]

Moving cubicgarden.com again

For quite sometime I've been having issues with running Blojsom on a shared Java host. See its possible but not ideal. It would seem Blojsom is best placed in a dedcated servlet container where it can have room to move. So for quite some time I've been holding on to my very cheap shared hosting by Interadvantage. The System Admistrator has been helping me out for quite some time but it just seems Cubicgarden.com is just generally growing in popularity and outgrowing its small plot of internet land. For the last 2 months I've been trying to cut down on system hit by using OSCache and Log4j to solve the errors I might be getting. But it came to a head just recently… here's a slightly edited email I recieved.

I've noticed that whenever your site gets hit hard, our server's load goes way up and other sites become unresponsive. This is particularly a problem in the mornings, from about 8 – 12 AM our time. I assume all the geeks over here who are addicted to your blog get their RSS feed (because you get a lot of RSS traffic then), and then go hit your blog if they see something of interest.

I also took a look at your stats, and about 25% of your page loads come from crawler.bloglines.com.

At any rate, your site is successful, and active, and it depends on Blojsom. When it's getting hit, your site dominates a loaded Dual Xeon server, so I think it's unlikely we can reduce the load to an adequate level just by tweaking Blojsom. Sadly, I again need to encourage you to look for another host. I don't think it's fair for you to try and host your blog in a shared environment; I really think you should put it on a VPS or dedicated server so that Blojsom can't hog CPU and memory that is being shared by other sites.

This came to a head this morning because our company president was trying to do something on your server at 10:00 AM, and he was very upset by the performance. He wants resolution to this situation, and suggested we give you 30 days to find a different host.

It has been fun working with you, and I'm sorry to write this note. I do wish you the best in your future endeavors.

Gratefully,

interAdvantage Administrator

So once again I'm on the look out for a good java hoster which provide virtual private servers for people on tight budgets. So far the cheapest I've found is 4Java.ca's private tomcat at 14.95 candian dollars a month for Tomcat 5 with 600meg of space and 10gig of data transfer. But Daily Razor's RazorBLAZE package attracts me because they also supporting Cocoon cost 19.95 american dollars a month for 5gig of space and 80gig of data transfer which is fantastic in comparision. VPS land seems ok too at 3gig of space and 40gig of bandwidth. One of the things I loved about Interadvantage which seems hard to to come by is, the friendly and knowledgable system administrator. The System admin has been working with me for quite some time and I know for a fact that this email was something he didn't want to write. We tried to get Cocoon working in a shared environment but came to the conclusion that it was not possible with serious security overrides. So please don't blame the ISP for this letter, its my fault for trying to slot a popular blog and amazing blog software in a shared environment. I'm sorry to the other people on the same server and I'll be moving soon.

So if you have any other hosts which do Java servlets, allow for at last 5gig of transfer data a month and cost as little as 10 pounds a month do please recommend them to me in the comments.

Comments [Comments]
Trackbacks [0]

Steve Gibson says Windows Metafile was a backdoor

So while in the shower today I was listening to Leo Laporte and Steve Gibson's Security now number 22. I almost fell in the shower after hearing the possibility that Microsoft maybe covered up a backdoor in Windows. Simply put Steve Gibson is suggesting that Microsoft or some people involved in the code for the Windows Metafile (WMF) put in a backdoor. Aka it was not a flaw or vunerability, a backdoor! If this is true I'm speechless.

Its easy to think of this as a conspiracy and put on your foil hats now but this deadly serious. Even Steve has admitted if he's wrong he will be the first to admit he's wrong but he really doesnt believe this. He's actually put a lot on the line for this. Personally I think this is just a long line of the mainstream lying to us. Think about it Sony and there badly written DRM and worst still badly written Rootkit. Lies and more damm lies. Even when there pants were down they tried to cover it up by saying people didnt even know what a rootkit was so why tell them. I remember quoting Miles in my post about the Rootkit saying Apple and Microsoft must be pissing themselves with laughter. Well its now Microsoft's time and Apple are not getting away clean. Theres lots of talk about iTunes in the context of useage patterns feedback and the reduction of uses of the sharing feature across the versions. So Apple users don't even laugh because Apple are hardly saints either.

But back to this claim of a backdoor in Windows. If it turns out to be true (and honestly Steve's explaining actually makes a lot of sense I have to say). We have to wonder how many more there are? Who put this backdoor there and who actually knows about it? I expect by the time this gets out there it will make the large news sources quickly. I've not looked on Digg, slashdot, boingboing yet because I'm on the 10am train into London Bridge. Tell a lie, I just did a search through Digg on the my aggregator and this came up (which is close but not the same) this came up.. I'll digg it when I get back online in about 20mins. Looking at the date of the Digg story (7:30am) its still too early for most of the Western world and may not have had time to circlate yet. Steve did say this was a exclusive to Security now and he's only known about it for about a day at most. Anyhow, we shall see what happens. By the way the people who came out of this smelling pretty sweet has to be Hackers. If it wasn't for hackers and reverse engineering we would never know. This is critical to remember no matter how it turns out.

Comments [Comments]
Trackbacks [0]

Windows WMF Metafile Vulnerability fix from reverse engineer

Well is this is a good way to start 2006 Microsoft. A very serious exploit was found in Windows during last week, and this time its a 0day exploit which means there's no patch available from Microsoft yet. Actually Microsoft are advising people to unregister the shimgvw.dll which is not a fix in anyones wildest imagination.

But luckly some reverse engineer called Ilfak Guilfanov has reversed engineer the shimgvw.dll and written a patch which runs on all 32/64bit Windows (aka no 95, 98 or ME support). From what I've read, it sounds like the patch is pretty safe (llfak has actually open sourced the code I believe) so I would recommend you download this patch till Microsoft sort out an official patch. And honestly do it now as there are tons of worms written for this exploit and there coming from many different directions. IM, Email, Browser, etc, etc. Oh by the way theres a checker too.

Pass this information to as many people as you can…

Comments [Comments]
Trackbacks [0]

VPN tunnel your way to safe ground with Hamachi

Hamachi on windows

What is Hamachi?

Hamachi is a UDP-based virtual private networking system. Its peers utilize the help of a 3rd node called mediation server to locate each other and to boot strap the connection between themselves. The connection itself is direct and once it's established no traffic flows through our servers.

Hamachi is not just truly peer-to-peer, it is verifiably secure peer-to-peer.

Believe it or not, but we are able to successfully mediate p2p connections in roughly 97% of all cases we dealt with so far (few tens of thousands as of early March). This includes peers sitting behind different firewalls and/or broadband routers (aka NAT devices).

Oh my goodness, if you have not tried out Hamachi and want access to your home network from elsewhere. You need to try it out! I heard it about it ages ago but dismissed it because I didnt really see the need. Well that was before I learned about how insecure Wifi can be. So during hearing this week's Security Now podcast

I spent a hour checking out Hamachi. At the moment it runs on Windows and Linux but after verison 1.0 (there currently 0.99) it will be developed for the Mac too. I dont see why you cant run the Linux version on a Mac command line but I'm sure there is a reason. So anyhow once you got it installed you can follow the Wizard which is a little too simple but good for those not deeply into networking, its easy to escape at anytime.
Once your setup its just a matter of making a new network or joining another one. You can easily make one and the the security is then all hanged off your stupidly impossible to crack password. GRC recommends some 63 character password string which can be generated here at the High security password generator. I actually went for a stupid 96 ASCII character password with all types of characters. I'll switch it down to 63 because Hamachi uses a 256bit AES crypto for authentication. After setting the password and name of the network you can go to another machine and do the same but this time hit join and enter the same details.

Before you know it your on a new type of network. Actually a 5.x.x.x IP address. I didnt even know you could actually have one of those for a network, I always thought 10.x.x.x was the lowest things went. Ok so once you got two machines on the same p2p network your away. I was able to tunnel out of my work network and on my own computer at home and launch VNC and access the net and machines attached to the same physical network. Everything is accessable and the speed is amazing. Oh yeah by the way, I only had to open one port on Smoothwall for it to work, most firewalls and NAT environments can be traversed without opening ports and port forwarding according to the Hamachi creators. I did nothing to the work network, like Skype it just worked. Crazy but true. I also tried using Hamachi with some of the sniffing tools out there and glad to say it works perfectly. All traffic is secured and even insecure connections like POP3 retrivial can not be discovered as it all looks like normal web traffic. Honestly I cant wait for version 1.0 of Hamachi. Its solved so many of my problems its untrue.

Comments [Comments]
Trackbacks [0]

The Fall out over the Sony Rootkit/DRM

Sony BMG logo

The backlash against the SonyBMG rootkit and DRM has been one heck of a rollercoaster ride which doesnt seem to be ending anytime soon. Here's some highlights in case you have missed them. interlaced with some Cluetrains.

A couple of lawsuits have been filed against Sony for breaking there EULA.

Then Sony issued a patched which is impossible to find (everything sony is impossible to find on there site to be truthful) and does not actually remove the DRM, well what do you expect?

Talking about the EULA, some very interesting clauses and points to consider when buying your next CD

Sony's Exec, Thomas Hesse (President of Sony's Global Digital Business) replied to the whole issue of Rootkits and DRM by saying What users dont't know cant hurt them… (A must listen by the way!). And echoing Miles thoughts, Apple and Microsoft must be pissing themselves with laughter. Thomas Hesse has some balls saying what he said and the bloggers will have the last say about his ridiculous comment.

#14 Corporations do not speak in the same voice as these new networked conversations. To their intended online audiences, companies sound hollow, flat, literally inhuman.

New virus uses Sony BMG software, yep that very badly written code for the RootKit has been lerverged for a virus which hides via Sony's Rootkit.

The complete list of SonyBMG Rootkit CDs at the EFF

Apple Anti rip software found on the same Sony BMG CDs. Usual discussion on Slashdot about Mac users and will Sony bring DRM to linux too?

The power of the blog outlines what's been already seen by in other areas like the Kryptonite lock. When will the mainstream media actually pay attention to what there children are reading online?

#6 The Internet is enabling conversations among human beings that were simply not possible in the era of mass media.

#94 To traditional corporations, networked conversations may appear confused, may sound confusing. But we are organizing faster than they are. We have better tools, more new ideas, no rules to slow us down.

And of course some fun, Sony I download your music


At long last, Sony halts production of 'rootkit' CDs

Sony BMG Music Entertainment said Friday that it will suspend production of CDs with copy-protection technology that has been exploited by virus writers to try to hide their malicious code on PCs.

The decision by the music label comes after 10 days of controversy around the technology, which is designed to limit the number of copies that can be made of the CD and to prevent a computer user from making unprotected MP3s of the music.

Security experts blasted the technology because it uses “rootkit” techniques to hide itself on hard drives and could be used by virus writers to make their malicious code invisible. The first remote-control Trojan horses that took advantage of the cloak provided by Sony BMG surfaced this week.

“We are aware that a computer virus is circulating that may affect computers with XCP content protection software,” the record label said in a statement Friday. “We stand by content protection technology as an important tool to protect our intellectual property rights and those of our artists. Nonetheless, as a precautionary measure, Sony BMG is temporarily suspending the manufacture of CDs containing XCP technology.”

Lets hope thats the end of XCP and its rootkit. Somehow, I know it wont be.

Comments [Comments]
Trackbacks [0]

Messy haxoring with metasploit caught on iptv

Its not quite as cool as it may sound from the title. I just watched epioside 13 of my lame-ass iptv soap, The scene. yes everyones got there weakness but if you put this against other soaps like Hollyoaks then it comes out quite well. Anyhow, I got a real kick out of main character trying to get root on windows box hosting a FTP server. They used the well established metasploit to find a flaw and exploit it. To be fair its one step up from the hack in the matrix reloaded and they did do a little homework to use the nice opensource framework metasploit. Its certainly a fine line between security tester and exploiter but the best tools always are.

Talking of which if you didnt catch the Security now podcast number 9 about rootkits, please do as it will give you a good old wake up call. I've been personally aware of rootkits for quite a long time but I didnt know spyware, adware applications were starting to use them just so they cant be removed from a computer. Its crazy, but its true. Honestly I wouldnt wish a rootkit on my worst enemy, I just cant imagine anything worst. Anyhow, Steve and Leo do a great job explaining how rootkits work. It is however really good to know Microsoft and Sysinternals are working on the problem. I did try out SysInternal's Rootkit Revealer on all my machines and I'm clean as expected but its good to be sure. I suggest everyone should give it a try, at least till Microsoft add rootkit scanning to there malicious software removal tool. No one likes to be rooted…

Comments [Comments]
Trackbacks [0]

More than enough memory formats to ponder on?

Ok so correct me if I miss one.
CF, SD, SM, MMC, XD, RS-MMC, miniSD, MS, MS pro, MG, MG pro, ATA and of course MS duo. All make up the complex, confusing and nightmare eco-system of Flash memory.

I personally think Sony memory stick is the worst of all of them with 4 different types of Flash memory formats which seem largely incompatable with each other. The licencing also keeps Memory Stick(s) prices quite high and I believe there are only 4-6 makers which can actually legally make them. I like what Sony do sometimes (psp and playstation) but come on now, its time to let go of memory stick and let the market decide. Ok enough about Memory stick for now. MMC, ghezz dont start me off. Why didnt it just merge into SD? MMC looks the same, acts the same but has odd voltages which dont work with certain devices, SD just works plus it has IO capbilities. Honestly I dont care if its called SD or MMC but they should have sorted it out before the mini's were produced. MiniSD fits smoothly into SD but is the true of Reduced sized MMC? I've not seen any sign of such a smooth interchange. Oh well, at least Smart media is slowly going away but the very odd xD has replaced it. I dont know why xD is around, what advantage does it have over SD and MMC? Lower voltage? What's the point?

On a positive finishing, Flash memory is getting really cheap now. 1gig SD and CF is about 35 pounds now and USB thumb drives are really becoming ubiquious. The 4 gig Flash memory in the ipod nano sounds like a lot now, but Samsung have already showed off 4x the space (16gig). With all this in mind, 2-4gig could be just around the corner but I assume other formats are also just around the corner too. Some suggestions for new names. xD nano, SD micro, SD-MMC, Mini Micro MMC, reduced micro sized SD, Memory stick super duo magic gate pro. Nahh, it will never catch on.

Comments [Comments]
Trackbacks [0]

Do you Firefox beta or Deer Park alpha it?

I've been using Deer Park alpha 2 for quite sometime now, but recently with the Firefox 1.5 beta publicly available I've been tempted to change. So after reading Uche's review of Firefox 1.5 beta I decided to actually install both of them on my machine. I have not used SVG for quite some time, but svg plus xforms seems like a logical step forward for browser technology

I still have not got around to installing IE7 or even Opera 8.5 free edition. But I'm sure there time will come.

Comments [Comments]
Trackbacks [0]

Changing the small things in software

Influence can be such a subjective thing, but just recently I've been able to shape or even influence the things around me so much more. Maybe that influence has always been there, in each and everyone of us?

So talking about influence and shaping, here's some things which I would like to shape.

Fireant
I've been looking for something to replace Blogmatrix Jaeger for downloading rich media via RSS for quite some time and Fireant seemed to be it. However there are a range of things which I think Fireant should take from Jaeger.

When Jaeger downloads a piece of media it names the file the same as the enclosure. However when Fireant downloads a media file it makes up a random filename like 9CBF0ACB9207FD9079A0342FA98EC69764756802.mp3 which is no good if you want to transfer stuff to your mobile phone via traditional routes (copying a file). Jaeger actually allows you to choose what type of filename you want, say a sequence of numbers, a date and time or just a filename.

Also, Fireant has support for copying files to ipods and psp's but what about removable storage cards, pocketpc, smartphones, etc?

I can understand why Fireant supports Torrents directly, but how about a option to use an external torrent application? I mean how bad is it when you got two torrent applications running at the same time unaware of each other? Yeah a recipe for a lot of trouble. I suggest a simple option which sends the torrent url or file to the other specified torrent application.

OPML import needs work, PocketRSS has a really nice feature which I actually suggest a while ago. It will go and grab a OPML file from a preset URL every week, month or whatever. So this means you dont need to manage two or more subscription lists. See the problem which you realise after a while, is that any blogger can add enclosures to there RSS. This means unless you provide the same list to Fireant, you may miss out on something interesting. Jaeger would actually automaticly download any enclosures from any subscription, there was no distiction between podcasters and bloggers (which I think is the correct way to go about this).
Somewhat related, is the fact that Fireant can be used as a normal RSS reader. This is once again good in theory but its really terriable in practice. It would be great to turn off all subscriptions which dont have enclosures, you know just let Fireant monitor all the feeds but only shows media items.

Blogging applications
I dont know what happened to Flock, but I'm still using a combination of Blojsom's Bookmarklet and Wbloggar. I thought about buying Ecto but I'm wondering why none of the blogging applications support the range of Microformats? And futher to that, if I drag a calendar entry from outlook or sunbird into my blog application wouldnt it make it make logical sense to automaticly create a Hclaendar link? The same should be true of contacts?
Wouldnt it also be great to be able to define some of those meta elements for entries in the blogging application? Say this entry is a certain creative commons licence and uses these tags. This should be common like how you can set the category and define trackbacks in most modern blogging applications.

Social software
I've outlined all my ideas for change in the bank of ideas. Feel free to vote on my thoughts and others.

Comments [Comments]
Trackbacks [0]

First few days using the bluetooth keyboard

small size bluetooth keyboard

So at long last I got it and have used it quite a bit. But I really got to try it out at a political blogging lecture I attended just recently. The complains I heard from other users about the keyboard timing out after a minute or even less didnt seem to happen to me. Generally my ipaq would turn off before the keyboard would. It is a bit of a pain having to reconnect when the ipaq has switched off but even that only takes 2secs and only requires you to press a key. None of that bluetooth bonding each time, which was a relief to discover.
I was not able to bond my 3G Phone with the keyboard of course but unexpectly my tablet would not pair with the keyboard. After a browse through the Stowaway forums and Microsofts FAQs, it seems the Toshiba bluetooth drivers are utter crap and they dont support the HID profile along with others like the Audio profiles. So I attempted to remove the toshiba bluetooth drivers and force the service pack 2 ones into action. However its going to take more work as none of them working now.

Generally the Bluetooth keyboard is pretty great and I highly recommend it. I just cant wait to make proper use of the keyboard when at a conference or decent lecture. My thoughts of using the bluetooth keyboard as a interface for most of my machines may have been a little forward thinking on my part. Oh well at least I'm half way there.

Comments [Comments]
Trackbacks [0]

bbc.co.uk/opensource

http://www.bbc.co.uk/opensource provides information about open source projects from the BBC. It lists projects developed by the BBC where the source code has been released as open source.

For the BBC, open source software development is an extension of our Public Service remit. Releasing open source software helps our audience get additional value from the work they've funded, and also get tools for free that they couldn't get any other way. It also allows people outside the BBC to extend projects in such a way that may in future be used in the BBC.

Well, backstage.bbc.co.uk and the creative archive now include bbc.co.uk/opensource to the amazing line up…

Comments [Comments]
Trackbacks [0]