Maintainance Problem

Although open source means worse case scenario you can grab the source and maintain it yourself often this doesn't happen. Many awesome projects just go into obscurity and I'm sure many people aren't even aware they are no longer maintained. There was no announcement, no project closing, no call for help. The developers just stopped coding, maybe they died, who knows.

I'm starting a blog called Maintenance Required (maybe I'll do more later) to list software that needs someone to take care of it. I probably won't find everything, but maybe I can get a few good projects picked up. Feel free to contact me if you know something not on the list.

Would you steal a buck? How about a can of soda?

Would you steal a buck? How about a can of soda?

An interesting article questioning why people make predictably irrational decisions.

msysgit shouldn't be used

Unfortunately the developers of this project are the kind that I don't want to deal with. Their documentation is below average, and the average documentation is already sad. Instead of plugging in to msys, they require you to use their fork of msys. I call it a fork because it isn't a 1:1 copy, they add and removing things as they see fit. Their primary installer doesn't include msys.bat (apparently other installers do) this makes launching the msys bash environment easy. They don't explain why you should pick one installer over another. I asked how I should add the git programs to an existing msys install and never got an answer. I complained that git didn't work with the msys vim-7.1 port, ultimately the response I got was git is a developer tool and as a developer I should be able to help myself, and I was ruining there fun coding (I'm sorry even if I am a developer what makes your think I have time to fix YOUR project and MINE.

I'm sorry that they don't want to support their product, make it better, or work with the parent projects (msys)

On their site it says that eventually they are planned to become an officially supported git method. I hope this isn't true, as user support will be horrible.

This unfortunately means I can't use msys as part of the reason I was going to use it was for git. I will have to switch to cygwin instead.

iptables for the average desktop user

The Best guide for learning the basics of iptables is here
Linux 2.4 Stateful firewall design for the most part it continues to apply to the 2.6 kernel. The only things that won't apply to your linux system will be: emerge if you aren't on gentoo, and the kernel options which have changed since 2.4 and even a couple of times during 2.6.

I'm not going to cover those here. If you need help building your kernel or installing iptables I suggest that you consult with either the iptables home page or even better your distribution. Chances are it is already installed, and may even be configured.

First Let's see if we have any rules.

The following commands require root access, and can be run in a root shell, with sudo, or in a shell script by root

iptables -L -v

your output should look something like this if you have no rules

Chain INPUT (policy ACCEPT 211 packets, 27413 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 312 packets, 211K bytes)
pkts bytes target prot opt in out source destination


If it looks different no worries it just means that your distro has already installed rules.

If so make sure BEFORE CONTINUING to flush them. FIRST check to make sure your policies are set to accept (you can see that in caps above) if they are anything else run


iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT


now that your policies are clean you should flush the rules

iptables -F #flush all rules
iptables -X #delete all chains


all right now hopefully you are at a clean state. If you have ever used iptables for nat you may not be, but that is beyond the scope of this article.

Now we need to create rules, since this is for normal deskop users you shouldn't have any services listening, also you shoudn't be routing anything.

to disable routing with iptables (I'm ignoring the kernel setting for this)


iptables -P FORWARD DROP

# set all forwarded packets to go bye bye if they reach the end of the chain

the output chain is good on accept for the normal user, only a masochist would want to write rules for it. You generally should trust your outbound traffic.

Now to secure input

iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -P INPUT DROP

#this rule drops all packets with a bad state
#accept any packets that have something to do with ones we've sent on outbound
#accept any packets coming or going on localhost (this can be very important
# set all packets not matching these rules to drop

Various linux distro's may require you to do something special to save these rules so that they survive a reboot. consult your distributions community.

If you have rules that you want to keep but also want to use mine I suggest putting mine first, you should do the -A rules in reverse but use a -I for insert.

When dealing with iptables always take care when applying iptables -P DROP. You can be locked out of the machine or the internet if you apply this without the appropriate rules in place.

That's it. your desktop should be secure from an attacker that you aren't allowing in. There are of course other things that you can do to make it even more secure but those are beyond the scope of this tutorial.

Tagged - A site that doesn't get it right

Tagged yet another Social Networking site. I don't mind that these sites want to connect to my email and check for contacts... but always ALWAYS allow me to skip that section. I find it poor security to enter my password just because something asks for it. Fortunately I was smart enough to stop entering data, and click a link in the 'welcome to' email to go straight to my profile. I'm adding them to the hall of shame for being a security risk.

The only reason I'm even joining this is to be able to communicate with an old friend who I haven't heard from in a long time.

EDIT: HA! on top of this they won't allow me to post my blogspot url in my profile. Well I guess you know how little I think of them.In fact they won't allow you to use the word blogspot anywhere. It's 'banned content'.

EDIT: just to add another thing their site acts like complete crap in firefox on linux.

msys - native *nix on windows

msys home

This is not a virtual machine, not an emulator, and technically not linux. This is a native linux like environment on windows, including BASH, the coreutils, vim and more. Brought to you by the wonderful people who brought us mingw. If you are a *nix person and HAVE to use windows I highly suggest you install this. With this Firefox, Opera, Pidgin, and many more cross platform apps you will start to feel to home in windows.

EDIT: You can get git for it here. msysgit

really nice

if you are using the cfq io scheduler in linux you can use ionice to nice your io. so to really nice something you would do


nice -n 19 ionice -c 3 programname


this may not be the best idea on all programs but it works. If a program is beating your hd and cpu and you don't want it to run this when starting it.

what hack to do first?

Lets see, I could work on the ipset init script bug (meaning write the init script) for gentoo. I could start digging into amarok 2's sql.I have to figure out my Linksys WRT54GL and whether I want openwrt or ddwrt or just to leave it as is. I could be hacking my web app, or regen2. So many choices, so little time.

I don't really feel like doing the router now. So that's out. Sometime this week though.

Perl by Example not on O'Reilly's Safari

I like Safari. It's a great product that I pay ~$500 a year for. I just started a Perl class and the book is Perl by Example. Guess what it isn't on safari or at least searching for the exact title doesn't find it. I've queried the O'reilly and Prentice Hall people. I pay $500 a year, all the rest of the 'By Example' Books are there, I want my book.

EDIT: O'Reilly's response

Thank you for contacting us about this.

Please note that the books available on Safari Books Online are added to the service at the exclusive discretion of the individual publishers by their internal online content teams and according to their internal guidelines and procedures.

Hence I have forwarded your title request to the respective online content team for consideration. Also please note that due to various resource restraints, our participating publishers may not be able to make all titles available on Safari.

If you have any other questions, please reply to this email. We will be glad to help you in this regard.

EDIT: It's been a couple of weeks and the teacher has given an assignment from the book. The book is still not of safari. I will have to buy it, it seems.

EDIT: It's out now Perl by Example, 4th Editon

Ah typical as usual some company has made my life harder even though I'm paying them to make it easier, given I understand the reason. But I don't have to like it.

Just answer the question!

I don't mind when people offer additional advice. But when a question about package Y is asked don't suggest package X (unless you have to say not possible in Y but it is in X). I mean when I ask how do I fix this dependency blocker in portage don't suggest paludis. The blocker would still exist.

If I ask which files are my config files so I can migrate them. don't say move all of your files. Answer the question asked.

If you want to answer it with a link fine. Just make sure the link is specific (e.g. if I ask a question don't point me to the docs without citing a specific section. chance are I looked there).

If you don't know, it's ok to say you don't know.