Archive 4.8.2005 - 19.8.2005

first Django application live

So, my first Django application is live - not finished yet, but at the moment already so good that it's better than the old PHP mess that was running before. And it's about my image gallery at viele-bunte-bilder.de. At the moment there is user registration and everything related to it - but I'll probably implement that later. Or maybe not. Let's see.

In any case, it's already quite nice - I can upload pictures directly from iPhoto again (which was the most important advantage of the old gallery software) and the files are in the filesystem, not in a database - which was also quite an important point.

The software itself is of course available - anyone who wants to browse, I have set up a Trac instance with my Django experiments.

Since 2007 nothing has been online.

ObjectiveCLIPS

Way cool: Objective CLIPS is a new development environment for OS X. From the description:

Using Objective C runtime introspection, CLIPS, and FScript, it is possible to write intelligent Cocoa applications. Any Objective C object can be asserted as a fact in CLIPS, however, CoreData provides an additional meta model along with object persistence.

CLIPS is an expert system environment that is based on a Lisp dialect and enables the management of rules and facts, as well as reasoning about them. FScript is a scripting language inspired by Smalltalk that works directly with the ObjectiveC classes in OS X. Both together should enable pretty cool things, especially since databases and documents can also be easily created with CoreData. And both languages (CLIPS and FScript) I found quite interesting in my experiments with them - CLIPS was even used by me for a longer time as a "Lisp replacement", because it is indeed a rather old-fashioned Lisp, but is equipped with powerful additional abstraction possibilities.

RSS 3 - twice

Again someone who thinks they can create a great new format: RSS 3.0 - and that someone is too stupid to google first. Because otherwise they would have stumbled upon RSS 3.0 and maybe thought about it.

Oh well, thinking isn't one of the usual activities of great inventors of syndication formats, as we already noticed in the discussion around Atom. I'm still convinced that all syndication formats are a large-scale net psychological test.

Heise also has something about it. And just like Rogers Cadenhead - who is on the RSS Advisory Board.

Writing PlugIns describes how to create iPhoto Exporter Plugins. Could be quite interesting.

SHA-1 is going down the drain

In any case, if the 2^63 attack against SHA-1 that was just announced hits. Now, the first reference implementations will probably be targeted. 2^63 is quite crackable with today's computing power, there are already some initial experiences. And thus, it is probably only a matter of time before, similar to MD5, hash collisions for real documents can be produced. It's quite strange to see how the field has changed in terms of the computing power that can be brought to bear.

1&1 is acting up

Now there's a forced redirect:

When customers of the provider 1&1 in Karlsruhe establish a new DSL connection and then start the browser, they are now always shown the 1&1 portal.

Great. And if these first requests come from some scripts of a server at the DSL connection, the scripts will fail. Just because 1&1 had another rarely stupid idea. And we have to explain to the customers again why something obscure doesn't work - and all of this just for marketing nonsense.

The world is ending in 2029

Because the sky will fall on our heads. Which is a good thing, because in 2037 the Unix epoch will expire and all computers will go crazy. And so we are spared the chaos.

Oh, and whoever believes all this, I have a very nice bridge to sell ...

Django has taken an important step for the release 1.0: anonymous sessions. Sessions were previously tied to user login in Django, but now it also works without registration. Much nicer than creating thousands of cookies for the user.

Cooperative Linux is a port of the Linux kernel as a Windows application. This allows you to run Linux as a Windows application without needing a virtualizer like VMWare.

CRUD with Django

Create, Read, Update, Delete - the standard functions of classic interfaces - can be easily assembled with Django. For this, there are Generic Views. On Postneo there is now a CRUD Tutorial, which shows how simple such interfaces can be put together with Django.

London: Doubts about the police version in the Menezes case

There are legitimate doubts about the police version in the Menezes case in London:

A surveillance video shows that the 27-year-old was wearing a light denim jacket and did not behave suspiciously in the subway station, the broadcaster reported. He calmly entered the station, accepted a free newspaper, and took the elevator to the platform. Only there did Menezes run to a train and take a seat in a carriage. A witness also stated that the trained electrician was overpowered by an officer. Shortly afterward, police officers shot Menezes multiple times in the head. An autopsy revealed that the body had seven headshots and one entry wound in the shoulder. However, the police had fired three more shots whose projectiles had not yet been found, ITV continued.

And how do all the shoot-to-kill advocates explain this away now? So they don't have to think about the madness of their stance?

Something interesting in Rails

Finally an application in Ruby on Rails that goes beyond the usual example applications - and is not just a weblog or a totally pointless to-do list management or something similar: VitalSource is an iTunes-like application for books with a corresponding backend and a frontend also based on Rails (but integrated into the application):

Apparently their backend applications have been running Rails for a while. But they've recently released their client software, and it runs Rails as well. Except... you won't see it running in a conventional browser. As the picture shows, the Rails app runs embedded within the client executable: in the case of the Mac client it uses WebKit to render the responses from the Rails app.

I was already fed up with all the Rails applications - which all sounded like textbook exercises.

A comparison of Django with Rails is a rather good comparison of Rails and Django. However, comparing two systems that address quite different topics is naturally quite difficult - but the article at least tries to position the two frameworks against each other.

Poor Jörg Jaksche

Also honest. Someone snatches the stage victory from him at the finish line. Sorry, but sometimes cycling is really unfair. Too bad - I would have given today's stage victory to Jörg Jaksche, he really kept attacking. Twice less looking back and maybe he would have won after all.

Living Data

Funny title, isn't it? Well, I just noticed something while dealing with web frameworks and other applications, specifically in the Ruby and Python environments. Namely, the way mini-data is stored and how configuration data is handled, for example.

In the Java environment, there is an inflation of XML mini-languages - mountains of dead data. Dead because this data only exists in XML format and can only be processed and modified using XML tools. For example, if I have constantly repeating or algorithmically describable configuration blocks (e.g., a mountain of quite similar-looking URL patterns for a web framework), I can only generate these using XML tools - e.g., generate them from simpler formats using XSLT. Or I write small tools for this.

In Ruby, the situation is similar - only that instead of XML, YAML is used here. Ultimately, however, this is not better - the configuration is still a dead file.

But both in the Python environment and in various other dynamic languages, there is a good alternative to this: just use a module in your programming language. For example, Python modules live - if the structure is complex but partially repetitive - simply write a small Python function that helps with the dynamic creation of the config. If the config should partially come from database contents - simply write a Python function that reads this data from the DB at runtime and mixes it into the config. Living configuration data, after all.

Of course, security issues come into play here - we don't want to repeat the PHP mistake with the eternal eval. What is urgently necessary for this would be a clean sandbox for such modules. Unfortunately, there is a massive hole in the implementation right there in Python. There were bytecode hacks in the past, which were also revived - but these are just hacks. The method of building a pseudo-sandbox using restricted imports and proxy objects, as Zope does, is also not the be-all and end-all.

Perl offers a very clean method here - as is usual for all security features in Perl, this is of course used by almost no project - to regulate down to the smallest detail what the code in such a sandbox is allowed to do - and thus a configuration via Perl module is definitely better secured than in languages without such a concept.

Java itself, of course, has a pretty sophisticated security management system - necessarily, as it is also supposed to run in browsers with very restricted rights. This security model is also usable for applications and could be used, for example, for servlets or Java configs - especially since you can also easily translate files at runtime and load them dynamically with Java. Now explain to me why the Java people are so fixated on XML when they have the best foundations for secure living data ...

We will ignore the safe model of PHP here, because it is a soda-or-seltzer model - either every code runs under safemode, or none at all. What we would need is a selective activation of different security classes for a single code block or module import (ok, PHP also doesn't have module imports, only includes - I say, we just ignore it).

So far, you can only work with living configurations in Python if you are sure that the configurations are only edited by users without malicious intent. Django, for example, only uses living configurations - it would therefore be a pretty stupid idea to make the configuration files editable via the web for centrally hosted applications.

We urgently need a clean sandbox for Python. I even believe that this would be a more important subproject than the various syntactic extensions that are repeatedly addressed.

wxWindows now also for Common Lisp

wxCL provides Common Lisp libraries for using the brilliant wxWindows GUI library. Very nice - I have already appreciated wxWindows in its Python incarnation, and in Scheme (via DrScheme) it is also very helpful. Now Common Lispers can use it too. I know that in Common Lisp, of course, CLIM (today often in the form of McCLIM) is the toolkit of choice, especially since it is much more powerful than wxWindows. But still, it's nice to have a cross-platform GUI library, especially because it is available for more than one programming language.

the strange tendency of PHP programmers to eval

Vulnerabilities in PHP modules endanger (once again) numerous web applications - and once again it's XML-RPC. They are still using eval - and that's for evaluating tags. Seriously? Sorry, folks, but this is just ridiculous - eval has already blown up in your face, why weren't all those calls removed back then? Or at least properly secured?

And people wonder why I don't have much faith in PHP software ...

Lazy Posts in WordPress

The new Wordpress 1.5.2 should finally fix the slow posting - caused by pinging - by moving the pinging to the shutdown, i.e. after the actual request-response chain. In German: with 1.5.2, pinging should no longer cause an eternal wait on the browser. It would be very nice if that actually works.

Since there are also security fixes included, an upgrade is generally sensible. Although WordPress, for a PHP application, functions surprisingly stably - but still, there are undoubtedly one or two skeletons in the closet.

Update: well, it hasn't really gotten faster when posting ...

Seashore is an image editor for OS X based on GIMP libraries and formats. It already looks quite nice, even though it currently has almost no features (especially the filters are missing). But maybe something like this will one day become a native OS X GIMP ...

Turn off spotlight on removable drive

sudo mdutil -i off -E /Volumes/VOLNAME/ should disable Spotlight on a volume and discard the index. Hopefully - it's annoying when my backup drives are supposed to be indexed every time. Or when the found applications appear in the Open With lists, even if the drive is not connected at all ...

trac - Easy Software Project Management

trac is a web interface for Subversion repositories. However, it is not just the appropriate web interface - it also includes a wiki, a bug tracking system, a milestone management, and very comfortably created reports based on the bug tracking. And all of this in a very easy-to-install package - on Debian, an apt-get install trac is sufficient and then with trac-admin initenv a Trac instance can be created. It also looks quite appealing and the functions are very well integrated - links from the tickets to the wiki or links from changeset descriptions to the wiki or the bug tracking are easy to make and of course help enormously in managing software changes. Additionally, there is a nice timeline that documents and links changes to the system over time - among other things, also to a very comfortable changeset browser.

I have now thrown away all the handmade stuff for TooFpy and switched to trac. Just the possibility of assigning my ToDo list, which was previously managed in the source tree, to planned releases via tickets brings a lot of overview to the project.

Yep, anyone who has to manage a software project should definitely take a look at trac, because anyone who is not necessarily a control fetishist will certainly be happier with the rather open structure of trac than with some overengineered parts.

kenosis is a Python library for a simple P2P protocol that is based on XMLRPC. Simple and straightforward, but without any form of encryption - should therefore be used over externally encrypted or otherwise secured channels.

Nitro is a web framework for Ruby. Clearly positioned as a competitor to Rails, it addresses some of Rails' weaknesses - for example, the rather meager Object-Relation-Mappers in Rails via ActiveRecords. Nitro uses Og instead. Otherwise, the features are significantly more developed - more code, less hype.

RBL Operator Again

After I already wrote about it in April, it's now also in the Heise Ticker: RFC-ignorant: All .de domains under suspicion of spam. The ignoramuses of RFC-Ignorant will certainly not change their minds, but perhaps now the one or other provider will remove this absurd block list from the mail configuration.

Fuck, I'm slowly getting really annoyed by awstats.pl. I'm already considering switching back to webalizer, which only produces stupid static output. But it can also do less.

Privacy Update under OS X

In IRC, identd, and Privacy I complained that proxies with SOCKS support were rather thin on the ground - meanwhile, things have improved significantly. Because X-Chat Aqua is now in a state that can be described as very usable - after many years of using Snak, I have actually switched.

X-Chat Aqua supports SOCKS and thus allows direct use of tor. However, this is not SOCKS4A - therefore, DNS resolutions are still visible. Ideally, you simply enter the server's IP address, so no name resolution needs to occur.

With Jabber, things now look very good with PSI - PSI is very usable under OS X and the display problems of older versions have also been fixed. And PSI also works with tor.

Browsing over tor was already possible before, but with the current Mac OS X Builds of tor, it is also very easy to install. Tip: I created my own network configuration, with which I can easily change the proxy settings. With this, I can then simply turn Privoxy+Tor on and off in the Apple menu as needed. Of course, this only works with browsers that get their proxy settings from the system settings.

Using ssh over tor is easily done with the ProxyCommand stuff. Instructions are in the Torify HowTo. Many of the tips mentioned there also work under OS X, as there is a normal Unix underneath.

On the Bavaria Fuss

Nothing comes to mind other than a hearty: Keep it up, Mr. Stoiber! - it's true, the Left Party couldn't wish for a better election helper than the raging dwarf from the backwoods. Okay, his outbursts lack a certain degree of appropriateness - it's quite annoying when people in Bavaria are supposedly so terribly smart, but the head of state once again doesn't understand what democracy means. Well, whatever happens, Mr. Stoiber, one thing is certain: we will not be governed by Bavaria. And the way you are currently dismantling Mrs. Merkel, suddenly everything is possible again for the SPD. Thanks to you and your colleague Schönbohm, who with their absurd statements have probably mobilized more East German voters than Gysi and Lafontaine together ...

Mac OS X Intel hacked to run on standard PCs

It's quite bitter when OS X Intel is already hacked before it's actually available:

MacBidouille reports that the Apple Developer kit version of Mac OS X x86, released to developers in early June, has been "hacked" to work with a PC notebook. The report includes a video showing Mac OS X x86 booting natively on a Pentium M 735-based notebook.

And this despite TPM and similar tricks. Maybe Apple should switch back to PowerPC after all, which is not more secure, but at least there's no alternative hardware at bargain prices like with Intel.

RIP last.fm

In das Netzbuch: last.fm verhärmt sich selbst Ralf describes how last.fm is leaving reality. I will also have to say goodbye to my earlier recommendation - there are already enough proprietary streaming clients, we don't need another one - especially not if it doesn't even work properly. Too bad - it was a nice way to discover new and interesting music. But not like this.

SCO-Patent-Fallout?

Speculation is rife that a lawsuit by an eFax company against competitors for using Asterisk could be related to SCO and all the nonsense surrounding it:

Now, Groklaw is speculating about the extent to which the move could be a general patent attack on free software. The reason for this is a close connection between the SCO Group and j2. Among the supporters of the software company, which has been in a heated dispute over intellectual property in Linux components, particularly with IBM, for a long time, is the investment firm Krevlin Advisors. It is also a major shareholder in j2.

But even if there's nothing to the rumors, the whole thing will certainly be idiotic and annoying again - and yet another proof that software patents and business method patents are utter nonsense. In any case, Asterisk (essentially a telephone system implemented in software) could soon become another battleground - if only because it may appear as a threat to one or another manufacturer of smaller telephone systems. And the market for telephone systems is, after all, characterized by very strange sales strategies and even stranger contractual situations (not without reason, telephone system maintenance contracts are occasionally declared invalid for violating good morals).

XchatPython is a plugin for X-Chat that allows you to write extensions in Python.

Sooo cool!

BlackDog is a PowerPC computer with 64 MB of memory and a 512 MB flash disc in a mini case that you can plug into any PC with Windows or Linux via the USB port. The PowerPC processor then takes over the keyboard, mouse, and screen, and starts its Debian Linux, whose desktop you can then see on the PC.

The device runs solely on USB power and also has additional biometric access control via fingerprint. Wow. A nice little hacker kit for on the go, you just need to find a host computer.

And it is completely open and hackable in terms of architecture - there is even a hacking competition to develop interesting applications for it. Although I already know what I would put on it - all the necessary network tools. I think I need to motivate the boss at the company to take a closer look at what you can do with such a device. I haven't had such a strong desire to have something for a long time.

Information about the Canon EOS 5D has surfaced

The rumors about the Canon EOS 5D already sound quite interesting - a full-frame sensor camera for 3500 could certainly tempt me. The previous contenders in the full-frame sector were just outrageously expensive (yes, the 5D is too, but the utopia has come a bit closer).

Oracle Cluster File System 2 for Linux

The Oracle Cluster File System could already be a nice alternative to GFS and Coda - at least if this really happens:

The Linux developer responsible for the Linux Kernel 2.6, Andrew Morton, wants to include the Oracle Cluster File System version 2 in the official Linux Kernel as soon as possible. Linux 2.6.14 could already contain OCFS 2 and would then be the first cluster component in the official Linux Kernel.

The previous cluster file systems suffer from the lack of integration - most of the time you can't use them in every kernel version. What is interesting to me is how independent the nodes really are and whether there is also a single point of failure in the Oracle Cluster File System, as there is e.g. the Locking daemon in OpenGFS. So far, we have not been very successful in evaluating cluster file systems in the company, actually they were all somehow stupid ...

The Hidden Boot Code of the Xbox

In The Hidden Boot Code of the Xbox the X-Box-Linux programmers explain how the security code of the X-Box is structured and how Microsoft built in 3 errors in 512 bytes of code. Lots of kindergarten security mistakes. - as Bruce Schneier calls it.

Also nice is the conclusion of the article:

So with the first version of the MCPX, Microsoft was too naive and apparently did not understand basic security concepts. After they had learnt their lesson, they designed a pretty good system with the second version of the MCPX - but the implementation still contained at least three security holes (Visor, MIST, TEA). They were too fast releasing a new version of the MCPX, spending a lot of money in trashing tons of already manufactured MCPX chips and manufacturing updated ones, apparently without any further code audit which should have revealed the security holes.

512 bytes is a very small amount of code (it fits on a single sheet of paper!), compared to the megabytes of code contained in software like Windows, Internet Explorer or Internet Information Server. Three bugs within these 512 bytes compromised the security completely - a bunch of hackers found them within days after first looking at the code. Why hasn't Microsoft Corp. been able to do the same? Why?

Exactly. Why doesn't Microsoft get this right? Why does Microsoft repeatedly fail so badly at security? And don't give me the silly excuse that the bugs at Microsoft are found so quickly because it has so many users - this is basic knowledge that would be required. This is just sloppy.

And now, Mr. McBride?

Shit hits Fan for SCO:

A: There was a release of SCO LinuxWare release 7.1.2 that included the Linux kernel personality and SCO Linux-release 7.1.3 included the Linux kernel personality. At first when it first shipped it did include the Linux kernel packages which were subsequently removed.

I find this somehow fitting when SCO is caught using the Linux kernel - which is under GPL - in their products at least temporarily and delivered with them. Could be one reason why they are now trying to denounce the GPL as un-American and unconstitutional.

Yep. Makes sense.

Not Intelligent Design, but rather the Google-Bombing of the expression naturally.

EU Commission acting alone again

This time with a direct attack on common sense and the bio-system: EU Commission approves import of genetically modified corn:

Controversial genetically modified corn may now be imported into EU countries as animal feed. The EU Commission made this decision unilaterally.

I'll repeat: I am actually pro-EU and see only a functioning European Union as a viable long-term path for our region. But not with an EU Commission that makes arbitrary decisions that go against common sense. And all of this only for the financial benefit of a non-European company whose sole aim is to crack the European market and dominate it just like other markets.

Hand Darl McBride the Frog Pills

Here's the translated Markdown body:

now he's really going off the deep end:

In detail, McBride lists ten points that speak for SCO and against Linux. Thus, OpenServer is supposedly much cheaper than Linux systems that work with hidden annual licenses, has a superior kernel, and offers significantly higher security than Linux systems where security gaps remain open for weeks. McBride repeatedly emphasizes that his company owns Unix and, for this reason, enjoys greater trust among customers. Furthermore, SCO, as the owner, ensures that there are no splinter groups of incompatible system variants.

Rarely seen such a compact block of bullshit

Mathematical Ignorance

It's almost modern to talk about how bad you were at math (I wasn't, I was very good at math - and yes, I really enjoyed math), but when you read James Gosling asking questions about sine/cosine and the meaning of the period definition with 2*Pi, you really scratch your head. Slava Prestov at least sees in this the explanation why most programmers ask really stupid questions about the simplest mathematical problems, when even the big shots in the industry don't understand basic trigonometry ...

International Components for Unicode is a library of reference implementations of all Unicode standards, specifically concerning character transformation, normalization, and sorting, but also many other localization issues such as date formatting, etc.

PyICU is an integration of the ICU C++ interface into Python. Seems quite comprehensive in terms of scope. Integration with Python string data types is also provided.

You never stop learning

I thought I knew most of the tricks of ssh. But I stumbled upon one that is banal and simple, but was not known to me: the ProxyCommand option. With this option, you can define a tunnel for a specified host that is established before the actual connection is made. With the program nc (Netcat) on the computer one before the target system, you can tunnel through a chain of firewalls wonderfully, especially when working with Auth-Forwarding. Simply build a section similar to this into the .ssh/config:


 Host safe
 Protocol 2
 User me
 HostName 192.168.0.42
 ProxyCommand ssh door nc -q 0 safe 22

Here, when ssh safe is used, a connection to the computer door is established internally via ssh door, and then a Netcat connection to the ssh daemon on the actual target computer safe is created there. This can also be used wonderfully over several ssh hops to transport files directly between two systems through a chain of firewalls. Ssh is just genius, if it didn't exist, you would have to invent it.

(in my case, I needed this for darcs - it can only push repositories over ssh)

on the way to media monoculture

Springer is taking over ProSiebenSat.1 - and will likely soon launch their neoliberal opinion campaign multimedially and then send their trash on all channels. A democracy needs an independent, strong press - but one that does not pursue its own political agenda. Therefore, we can probably say goodnight to another piece of democracy when a corporation like Springer will soon bridge the media gap.

Connecting databases to Python with SQLObject is a quite nice introduction to SQLObject - one of the nicer Object-Relation-Mappers for Python.

Environmental Clearance Sale in D-Village

It was to be expected, the state government presents environmental policy goals - and what does that bring:

Environmental protection will also have "high priority" in the new NRW state government - promises Environment Minister Eckhard Uhlenberg. But he wants to reduce the influence of nature conservation associations.

And then there are various other niceties, in principle a dismantling of what has always distinguished NRW's environmental policy from the rather weak stance of the federal government (and probably a merit of Mrs. Höhn - not that anyone believes the SPD in NRW has been particularly environmentally conscious).

Unicode HOWTO for Python. Python programmers should read.

Crypt::PasswdMD5 is a Perl module that hashes MD5 passwords the same way Linux and Solaris do.

md5crypt.py is the same algorithm for MD5 passwords, this time in Python.

Store passwords as hashes - safe?

Not quite new (it was new last summer, but I somehow missed it, the underlying paper is even two years old), but still interesting: Project RainbowCrack is a project aimed at creating tools for faster cracking of hashes. Hashes can normally only be resolved through brute force - supported by algorithmic weaknesses (as recently found in MD5 and SHA1). However, there is an approach to create the more complex calculations that arise during the brute-force process (i.e. essentially algorithmic sub-steps) in advance - for example, if you only intend to crack passwords with a maximum number of characters.

Of course, this does not come for free: you trade computing time for storage space. Tables for cracking up to 14-digit Windows passwords occupy a casual 64 GiB of memory. The practical relevance of the approach and the tools may become obvious from this quote:

Some ready to work lanmanager and md5 tables are demonstrated in Rainbow Table section. One interesting stuff among them is the lm #6 table, with which we can break any windows password up to 14 characters in a few minutes.

There is also a web interface to a distributed computing cluster for Project RainbowCrack, through which you can send MD5 hashes to an MD5 cracker, which then - if it is a string with a maximum of 8 characters - spits out the plain text. And this thing is constantly building more Rainbow Tables, making cracking faster and faster.

Just as a warning for those who think that a simple MD5 hash (or ultimately almost any hash) on the password would be sufficient. Unix systems typically use salted hashes - the password is extended by a plain text and then the hash is formed together with it. This extends the password in principle, even if the extension is of course not secret - for the computing time or the table size it doesn't matter, the passwords are simply longer and thus harder to crack. But it is also only a matter of space until they are not secure.

Better are passphrases instead of passwords - just simply normally long sentences. On the one hand, you can often remember these better (many people cannot remember a phone number, but can quote lines from poems) and on the other hand, they are simply longer (and especially flexibly long), so that Rainbow Tables as an attack method are out of the question. The algorithmic weaknesses of MD5 and SHA1 remain, of course.