Debian and OpenSSL blunder - goodbye debian?

I'm sure you've read about Debian's OpenSSL blunder. If not here's a recap on Linux.com.

I'm just wondering... is it possible that the pain will be so great for admins that the great stable debian will be discontinued from production server use? I would (but I don't use debian based systems for anything but livecds), seriously this is a hugely idiotic mistake the pain of which is only beginning. This may in fact be the biggest security blunder I have ever heard of in open source.

dvorak vs manufacturer's

The Dvorak Keyboard is supposedly better than the qwerty keyboard.

Theoritically all you have to do is change the keyboard layout in your OS and then pop the keys off your keyboard and re-arrange them (technically the second step isn't required but nicer). However all the keyboards I've seen attache the F and the J differently (they also have the home row bumps). Why do they attach them differently? why does it matter to them? is that really needed? I know it isn't anything functional. Do they really have an interest in keeping us from swithching?

can't reach google.com for at least 4 hours

no it isn't my browser, no it isn't my computer, and no it isn't my network. It could be my isp's network I don't really know.

I can't contact google... tried mailing webmaster, but guess what.

Thank you for writing to Google. We'd like to assist you, but we only
respond to messages submitted through our online contact form. Please
visit http://www.google.com/support/ to submit your message, and we'll get
back to you soon. We apologize for any inconvenience, and we look forward
to hearing from you.

Regards,
The Google Team

that's great... guess what? I can't reach that url. I can't reach google.com or google.co.uk

but gmail works, images. works, code. works, video doesn't, I can ping google.com, I can telnet to google.com on port 80. But the site doesn't load. I get weird errors. I'd love to talk to a support person and give them a chance to help. But I can't reach them.


here's my error message... (one of them)

window.google={kEI:"3SEhSNfDBoj0ebezqYEI",kEXPI:"0",kHL:"en"};
window.clk=function(b,c,d,e,f,g){if(document.images){var
a=encodeURIComponent||escape;(new
Image).src="/url?sa=T"+(c?"&oi="+a(c):"")+(d?"&cad="+a(d):"")+"&ct="+a(e)+"&cd="+a(f)+(b?"&url="+a(b.replace(/#.*/,"")).replace(/\+/g,"%2B"):"")+"&ei=3SEhSNfDBoj0ebezqYEI"+g}return
true}; window.gbar={};(function(){var c=window.gbar,e,g,h;c.qs=function(a)
{var
d=window.encodeURIComponent&&(document.forms[0].q||"").value;if(d)a.href=a.href.replace(/([?&])q=[^&]*|
$/,function(f,b){return(b||"&")+"q="+encodeURIComponent(d)})};function
l(a,d,f)
{a.display=h?"none":"block";a.left=d+"px";a.top=f+"px"}c.tg=function(a){var
d=0,f=0,b,m=0,n,j=window.navExtra,k,i=document;g=g||
i.getElementById("gbar").getElementsByTagName("span");(a||
window.event).cancelBubble=!m;if(!e){e=i.createElement(Array.every||
window.createPopup?"iframe":"DIV");e.frameBorder="0";e.scrolling="no";e.src="#";g[7].parentNode.appendChild(e).id="gbi";if(j&&g[7])for(n
in j)
{k=i.createElement("span");k.appendChild(j[n]);g[7].parentNode.insertBefore(k,g[7]).className="gb2"}i.onclick=c.close}while(b=g[++m

It's be great if google would get back to 'lil ol me faithful customer of 10 years.

EDIT: A friend has forwarded this message too them for me.

EDIT: and we're back, this has been ~5 hours of google shame. I never was contacted...

EDIT: Finally contacted

Thank you for your note. We appreciate your sending us a screenshot.
Clearing your browser's cache can resolve a number of problems you may be
experiencing while using Google or other sites on the web. Below you'll
find instructions for clearing your cache in Internet Explorer (IE) 6,
IE7, Mozilla Firefox 1.5 and earlier, and Mozilla Firefox 2.0: ...

I guess google doesn't Read what I say either, because I told them that I tried different browsers and different machines.

ext3 defaults update and grub breaks

GRUB vs. the Inodes: Who Needs a Bootable System, Anyway?

So apparently ext3 decided to bump the default inode size to 256 however grub 0.97 can't boot this and grub people aren't about to fix it because they are working on grub 2. Yeah that sounds about right... don't maintain your existing code base even though your next product isn't out yet.

Amarok is doing this too, it's quite annoying, and very poor develompment practice. Features are one thing but maintenance is another. You know what's bad? Grub 2 was in development 2 years ago if I remember right. Maybe I should add grub to Maintenance Required Since it's current maintainers don't want to fix system breaking bugs.

And shame on the extents devs for changing it in the first place....

recipe for success

Example 1

In 2003, an Internet meme known as "How You Remind Me of Someday", or "Nickelback to Back", was created to illustrate the similarities between the songs "How You Remind Me" and "Someday".

In response, bass player Mike Kroeger said "I think that's remarkable for someone to notice that there is a hit quality. If all hits sound the same, then sorry. When you are a band that has a distinct style such as us or AC/DC, that happens. When you have a distinct style, you run the risk of sounding similar."

--Wikipedia (NickelBack)

Example 2
Batman vs The Dark Knight Trailer

So the Question is? is there actually a recipe for success?

is there a difference between short term, medium term, and long term success? How is it that the Parthenon is greater than the Empire State Building (or even the tallest building currently being constructed) Why has Beethoven and Mozart survived the Centuries but Michael Jackson (Prince of Pop) couldn't survive the decades.

Could we analyze and find formula's for success perhaps there are more Golden Ratio's.

Making secure recoverable passwords

For the basic you need a calculator with a decimal to hex function. Your OS should have one built in (scientific mode), many calculator's do to. For advanced you'll need special hashing software, suggestions for it can be found below.

Windows	HashCalc
Macintosh	MacHash
Linux/(*nix)	Gnu Coreutils

Now that we have the software we need. You'll need an 8 digit (minimum) number that you won't forget. Guess what numbers fit the bill perfectly. Dates. All date's can be expressed in 8 digits, but they require a year. The date we'll use (for example) is Linux's Birthday. August 25, 1991 (I recommend something more personal like your anniversary or birthday).

So we are going to write down the date we picked for the password (note we aren't done yet).

something like

Linux BDay

Date's can be formatted in several ways, Just make sure to remember the numeric format you use. For our example we'll use the ISO 8601 standard. Which leaves our example date in format, YYYYMMDD, looking like 19910825.

So let's make a note of the format (to throw people off use a diff format say DDMMYYYY).

Linux Bday ISO

whatever you do make sure YOU understand your note, but that it isn't easily understandable by OTHERS.

alright... now we're going to take our number and make it hex. So open your calculator enter 19910825, then use the convert to hex function and you should have this 12FD0A9 (if you aren't using our example you may have a different 'number', or it may not be displayed exactly like this, display's vary between calculators). This is your first basic password. you can use it as is, or you can make it a bit more secure by using one of the hexadecimal notations. example: 0x12FD0A9. You can add a word or funny characters to either side of it to make it stronger too, just make sure to note anything you add to it.

Due to a Rainbow Table database you should make sure your password is at least 8 characters but I would recommend no less than 9.

But your hex number is less than 9 and what do the programs you listed have to do with this?

good point... let's make something a bit more crypto and less predictable.

Take the same date and plug it in to your hash creator, I'm going to use an md5sum for my first example.

if you put 19910825 into md5sum you get 6f9822851dfc6c1045c6fef827e5d729 (for you nix people enter the number like this 'echo -n "19910825" | md5sum'
on the cli otherwise you might end up with newline issues because different operating systems use different newlines).

so lets say you need an 12 character password you could just use the first 12 characters of your hash, example: 6f9822851dfc if you need an 8, example: 6f982285 ,etc etc.

if a stupid 'cracker' or black hat hacker get his hands on your actual password he might think he hasn't decrypted it fully because it'll look like a hash or memory error. want to throw people off even more just remember you aren't using the first 8 but the first 8 after the first 2 example 9822851d.

Or use a different has like sha1 or sha512.

Ultimately you could make your note to yourself like this

Sha1LinuxBDayISO to a non IT person this will look like a random password as is.

Also the cryptographic hashes take words too. So you could do your name. Caleb into an md5sum is

9ced73b8525de1db8e232ad575baa9dd

but it's different if I use caleb.

2f0154d7db348840676529dd72f1c034

if you always enter them the same you will always get the same result back. I guarantee after a couple days typing your new password you won't need to have it written down. If you work at a place that requires things like monthly changes.. just put the date you changed it on in to create the hash. Just make sure no one knows but the number/word(s) you used and the hash you used or they will be able to duplicate your password. Of course you're smart and you added somthing to it right? like a symbol (!@#$%^*{}|:"<>?[]\;',./) will all work find if the auth methods allow it.

have fun never having a hard time creating passwords again.

Tracking your home directory with a VCS

Josh Carter has done some interesting benchmarking in this area.

His tests include Subversion, Mercurial, Git, and Bazaar

More Advice to a Young Developer

More Advice to a Young Developer

I think most of it applies to IT In general or even the world at large.

Poor Support - READ WHAT I SAID

For Starters I'm annoyed and ranting. I'm going to pick on some particular companies, but this problem applies to the WHOLE support industry.

Stop using generic scripted answers for problems where they obviously don't apply. I've used them myself in the support industry, but where they apply.

Examples are paraphrased
Example1: Amazon.com and there poorly worded emails

Me> I received an email saying that I had recently bought or viewed lawnmowers, I haven't. Has my account been compromised?

amazon> this email is phishing...(generic phishing email reply here)

(I received another similar)
Me> Hi I received an email that says I've bought or viewed power tools. Here are the headers, they pass spamassassin and googles filters. Plus I've checked it myself. Maybe, you could fix the emails to not to suggest that I've purchased or viewed something I haven't.

amazon> this email is phishing...(generic phishing email reply here)

Solution: disable amazon from sending me emails on products... and it worked. I guess amazon's support should have paid attention?

Example2: safari.oreilly.com

Me> I can't get this book to load... I'm not sure why. The 'spinner' keeps going
round and round but it doesn't load. I don't have problems with anything
else.

(ok so I could have been clearer on 'anything else' what I meant to say was 'any other books'.)

Safari> I tested the book and do not experience any issues. Here's How to enable scripting in IE.

Me> I'm sorry wouldn't I have had problems with 'anything else' if I didn't have scripting enabled? Also I'm not using IE and it's not on my OS (I don't use windows).

Solution: this seemed to resolve itself overnight... I didn't change anything.


Stop telling me that it isn't an issue when it is. because you are too lazy to do simple checking.

Example3: bugs.gentoo.org

Me> new PackageA Stabilized can't be used by packageB version...


Gentoo> PackageB version is unstable marking invalid
(I poke around)

Me> This is a problem on the stable version as well

Gentoo> Oh...

Solution: I mask packageA to keep it from being pulled... as they seem to refuse de-stabilizing a package that causes problems.


There are always other support problems. But the 2 worst I think are not actually paying attention to a support request, and not doing more than a cursory check, for the validity of a problem.

EDIT: If your company/whatever has this problem, you aren't alone, the almighty google has this problem too.

firefox 3 beta5

I installed firefox 3 beta5 the other day. I't really fast and has some really cool new features. Unfortunately it's still too buggy for me. I'm downgrading back to 2.0 I'll see firefox 3 when it's stable.