Google trashed my Google Site's Content

When I forked Regen2 from Funtoo over a year ago I created a web page for it on sites.google.com. The hosting and uptime were both right for what I needed. The dns has long expired but I went to sites today to find a public link to the content, only to find that at some point they upgraded sites and completely trashed all the content I had put on there. Sure they have a revision control on there now... but it doesn't contain ANY of the content I had left. WTF Google? I'm sure someone is going to say 'backups' but honestly, I killed the project, whatever was there wasn't really important to me anymore. But I didn't expect that it would get trashed in some Google update.

Bad Customer Service from T-Mobile

So about 2 months ago I got fed up with Sprint (they suck for different reasons) and I already knew that they had better service coverage than Verizon in my area. My friend suggested T-Mobile, so I went and got setup with them for a 14 day trial period. I took the phone made some calls tried the web browser, I didn't like the blackberry itself, but that's besides the point. When I got the phone home, no service, not even outside the house, making T-Mobile worse than Verizon. I didn't want to run 10 miles into town that day, the next day we had a blizzard, so wednesday, two days later I took it back. They charged back everything and everything seemed good. Until a few weeks later when I got a $10 bill for usage. I just finally got around to dealing with customer service today. They say it's accurate, and no they can't do anything. So basically as an FYI to anyone else, don't try T-Mobile unless you already know that their service will work for you because they are going to charge you anyways. This shouldn't be, your service doesn't work for me, you shouldn't charge me to tell you that. Now if I move I probably won't look at them for a service change, had they handled this in an amicable manner I probably would have as soon as there network wasn't an issue. I'm also going to tell anyone who asks about cell provider's about it. Yes $10 isn't much, but it's the principle of me having to pay them anything after I had made it clear I wasn't sure it would work and I just wanted to see if it was an option.

Can't Find Google's OpenID

I think that Google's (not Blogger's) OpenID is a failure. It's not memorable and you can't find it. I've been trying to figure out where google has my OpenID listed for 30 minutes now. This is not the first time I've had to do this. I usually use Blogger's because it uses my blog's url, but it's currently error-ing with a typepad blog. Why can't google use something like google.com/username ? something we could remember. Why isn't it listed in an obvious place in my account details? Why is it when I search "google openid" it talks about the announcements all over the place, but never how to find out what your url is.

UPDATE:
Found it on lenni.info

UPDATE:
it's this https://www.google.com/accounts/o8/id

Bypassing disabled accounts with KDM

So the most common way of disabling an account in a unix system is changing the users shell in /etc/passwd to /bin/false or /sbin/nologin. However, I've discovered on Arch Linux that if I do this only shell login's are disabled, I was still able to log the user in with gui via kdm. I also tried using usermod --expiredate 1. this was not effective either however. the only way I found to lock the account from kdm login was to do a passwd -l accountname, which only locks password authentication. This means key and token authentication should still work. My real concern is that if the user was set to login without a password that it would still be bypass-able. My personal opinion is that I shouldn't have to do more than 1 thing to disable a user account in a 100% effective manner. Currently Arch Linux (and maybe more) fails at this. I'll post a fix later as I investigate further.

Bugs I filed are at kde and Arch Linux

EDIT: expire date worked... just not immediately, very odd.

EDIT: Here's a proper /etc/pam.d/kde

#%PAM-1.0
auth        required    pam_nologin.so
auth        required    pam_unix.so nullok
auth        required    pam_shells.so
auth required pam_tally.so onerr=succeedfile=/var/log/faillog
account     required    pam_access.so
account     required    pam_time.so
account     required    pam_unix.so
password    required    pam_unix.so
session     required    pam_unix.so
session     required    pam_env.so
session     required    pam_limits.so

FSDaily security fail (see image)

Hint, Hint! FSDaily don't access your db with the root account. and definitely make sure that, that error page doesn't show that to users.

More Security = Better. Wrong!

So I just had a discussion on #ubuntu-server on freenode about why my not having a password to connect to postgresql via a socket (read local cli) is insecure. So I asked them, how exactly is it that someone is going to get this access? The answer "there are bad people on the Internet". I'm sure many people right now are agreeing with them and thinking I'm crazy. Let's discuss my setup though shall we.

Postgres: I'm using Ident, and not just sameuser ident. no I had to set a custom rule in the pg_ident.conf file for this user to access because the systemuser != the db user. so just typing psql at the command line should you get access still won't get you into the db. you have to know which user/database to connect to. But that's not that hard right? in fact it's trivial.In addition you have to be a certain systemuser, only one works.

User Access: There is only one user account on the system that can be logged into (it's not root or a generic name). Only 2 people have the credentials to get shell access. One is my host, who happens to have physical and kvm access. The other is me who has ssh access.

SSH: I have ssh on a high port with no password authentication, or root, allowed.

So in order to passwordlessly access the database you would have to ssh into the system from a remote location or find an exploitable bug in apache (the only other service listening, or the kernel) that allows you to switch to my non apache user (meaning root access).

In addition, this system user had rw access to the entire website which includes a file containing the password to the database in plain text. So let's say I created a .pgpass file or variables? what exactly is it that would keep anyone who has access to this account from gaining access to the database? in fact wouldn't it just make it easier, since pgpass has a known location and contains all connection info including the username/dbname string?

But why do I need passwordless access anyways? I wrote a script that dumps the db every hour to a git repo and then pushes that to a remote.

Could I secure it further? yeah I could. I could make the script run as a user who can't log in at all and then put a pgpass in that users account. I'd have to properly ACL the webroot to give the correct write and read access. But is all this really necessary? maybe and I might do it, but at this point it's not nearly as important as it was for me to get backups up and running, because regardless of all the security I implement, if I have no backup and someone finds that loophole in one of the pieces of software and uses it, I might just be screwed. At least now I can restore the site if it gets attacked.

P.S. I was having a problem with my backup not being run by cron, never did figure out why.

can't reach google.com for at least 4 hours

no it isn't my browser, no it isn't my computer, and no it isn't my network. It could be my isp's network I don't really know.

I can't contact google... tried mailing webmaster, but guess what.

Thank you for writing to Google. We'd like to assist you, but we only
respond to messages submitted through our online contact form. Please
visit http://www.google.com/support/ to submit your message, and we'll get
back to you soon. We apologize for any inconvenience, and we look forward
to hearing from you.

Regards,
The Google Team

that's great... guess what? I can't reach that url. I can't reach google.com or google.co.uk

but gmail works, images. works, code. works, video doesn't, I can ping google.com, I can telnet to google.com on port 80. But the site doesn't load. I get weird errors. I'd love to talk to a support person and give them a chance to help. But I can't reach them.


here's my error message... (one of them)

window.google={kEI:"3SEhSNfDBoj0ebezqYEI",kEXPI:"0",kHL:"en"};
window.clk=function(b,c,d,e,f,g){if(document.images){var
a=encodeURIComponent||escape;(new
Image).src="/url?sa=T"+(c?"&oi="+a(c):"")+(d?"&cad="+a(d):"")+"&ct="+a(e)+"&cd="+a(f)+(b?"&url="+a(b.replace(/#.*/,"")).replace(/\+/g,"%2B"):"")+"&ei=3SEhSNfDBoj0ebezqYEI"+g}return
true}; window.gbar={};(function(){var c=window.gbar,e,g,h;c.qs=function(a)
{var
d=window.encodeURIComponent&&(document.forms[0].q||"").value;if(d)a.href=a.href.replace(/([?&])q=[^&]*|
$/,function(f,b){return(b||"&")+"q="+encodeURIComponent(d)})};function
l(a,d,f)
{a.display=h?"none":"block";a.left=d+"px";a.top=f+"px"}c.tg=function(a){var
d=0,f=0,b,m=0,n,j=window.navExtra,k,i=document;g=g||
i.getElementById("gbar").getElementsByTagName("span");(a||
window.event).cancelBubble=!m;if(!e){e=i.createElement(Array.every||
window.createPopup?"iframe":"DIV");e.frameBorder="0";e.scrolling="no";e.src="#";g[7].parentNode.appendChild(e).id="gbi";if(j&&g[7])for(n
in j)
{k=i.createElement("span");k.appendChild(j[n]);g[7].parentNode.insertBefore(k,g[7]).className="gb2"}i.onclick=c.close}while(b=g[++m

It's be great if google would get back to 'lil ol me faithful customer of 10 years.

EDIT: A friend has forwarded this message too them for me.

EDIT: and we're back, this has been ~5 hours of google shame. I never was contacted...

EDIT: Finally contacted

Thank you for your note. We appreciate your sending us a screenshot.
Clearing your browser's cache can resolve a number of problems you may be
experiencing while using Google or other sites on the web. Below you'll
find instructions for clearing your cache in Internet Explorer (IE) 6,
IE7, Mozilla Firefox 1.5 and earlier, and Mozilla Firefox 2.0: ...

I guess google doesn't Read what I say either, because I told them that I tried different browsers and different machines.

Tagged - A site that doesn't get it right

Tagged yet another Social Networking site. I don't mind that these sites want to connect to my email and check for contacts... but always ALWAYS allow me to skip that section. I find it poor security to enter my password just because something asks for it. Fortunately I was smart enough to stop entering data, and click a link in the 'welcome to' email to go straight to my profile. I'm adding them to the hall of shame for being a security risk.

The only reason I'm even joining this is to be able to communicate with an old friend who I haven't heard from in a long time.

EDIT: HA! on top of this they won't allow me to post my blogspot url in my profile. Well I guess you know how little I think of them.In fact they won't allow you to use the word blogspot anywhere. It's 'banned content'.

EDIT: just to add another thing their site acts like complete crap in firefox on linux.