Tonight gordonmessmer came over and we installed the exhaust system, put a bit of gas in the tank and did a few last minute checks. The engine started and ran on the second kick. This is even more amazing considering that we soon discovered that the left cylinder wasn't firing (pulling the plug wire did nothing to engine RPM.) Turns out that the left carb was completely dry. The float needle was jammed and there was no gas getting in at all. I cleared that and we kicked it again and it ran way better. Did another spark plug cap pull check and now it was the right side that didn't want to run on it's own. Pulled the plugs and the right side was running rich so after resetting the carbs and a bit of tinkering things were balanced up a bit better. Then the engine really wanted to run. It actually starts halfway through a kick now.

So I took it for a ride around the block. It's been so long since I've ridden it that I'd forgotten what it's like. It was a blast. Gordon had a goofy grin on his face when I accelerated past him on the street. I did a lap around the block with the transmission bolts finger tight to align things. Then Gordon tightened them down and I pulled it around into the driveway again.

I'm having a celebratory drink tonight. There's still some fine tuning to do, the timing isn't right and the carbs are still only coarsely tuned, but it runs and that's cause for celebration!

I pulled the R50 out of the garage today to do some work on it and was startled by how good it looked in the daylight. The clean engine makes a huge difference:



Tonight I filled the bike with fluids, gapped and installed plugs, checked the valve clearance and checked things over. I think that the last thing is the exhaust (that doesn't fit, but that's another story), fill the tank and kick it over. We'll see how well that goes, maybe tomorrow.

On the sidecar front, I pulled it into the garage and had a closer look. I tried to pull some of the nuts and bolts apart but they are pretty well gone. I think that I'll try using electrolysis to remove/undo the rust and see if that helps. In the mean time, have a look at the awesome plate that is mounted on the nose of the sidecar:

Upon returning from Open Source Bridge in Portland last week, I collected my thoughts from the convergence of configuration management developers and wrote The Configuration Management Revolution, centered around the idea the something bigger is happening than we’re acknowledging.

Today Tim O’Reilly posted a blog entry about the origins of Velocity. He says “I had been thinking in the abstract about the fact that as we move to a software as a service world, one of the big changes was that applications had people “inside” of them, managing them, tuning them, and helping them respond to constantly changing conditions.” which builds on his post three years ago about operations becoming the “elephant in the room”.

That article is worth revisiting. It tails off commenting on the lack of open source deployment tools. That has definitely changed, as we have a number of open source options in the operations tool space now. O’Reilly has published a few books on operations as well, although hasn’t taken the step of considering it a category in their book list yet.

The web is full of howtos, blog posts and assorted notes on piecing together open source software to build a server. One doesn’t have to be an expert on all of the ingredients, but rather be able to figure out how to assemble them. As time goes on, the problems of the past become easier to solve; former creative solutions become mainstream and the industry leverages those advantages. This frees up mindshare for something new. I’ll emphasize that this doesn’t mean one no longer needs to have some understanding of why the server works, but the time spent engineering that particular solution is reduced because we already have the wheel, so to speak.

Writing configuration management and thus infrastructure howtos may get one started, but it’s the old way of thinking. If you can write infrastructure as code, you can share infrastructure as code. It is essential that this is achieved in a format that both promotes sharing and is relatively easy. Take the Munin and Ganglia plugin sites for instance. Munin is relatively easy to get started with and has a simple enough site for exchanging plugins. While I consider Ganglia technically superior, it’s community is not. I tried submitting to Ganglia’s plugin site once and failed. This step has to be more than a site where files are dumped, it needs community support.

I asked Luke about this at OSBridge and he said Reductive Labs plans to have a module sharing website online soon for puppet. For now, you can find an number of puppet modules in the wiki. Opscode is on track, with their chef cookbooks available as a git repository on github, combined with a ticketing system allowing users to fork, modify and contribute changes. There’s even a wiki page helping to instruct how to leverage these.

Of course, you’ll always need experienced engineers to design and tune your infrastructure. However, the time and mindshare savings from creating a LAMP stack by setting a tag or role to ‘lamp’ is immense. As Opscode produces more open APIs between parts of their product, my mind imagines the offspring of the Chef UI and virt-manager. How long until the popup touting “New features are available for your web cluster”?

The revolution is coming, and it’s about time I wrote about it.

About a year and a half ago I was settling in to a new system administration job at a startup. I was told a consulting company would be coming in to bootstrap configuration management for us. I had previously glanced at cfengine out of curiosity, but ended up spending only a couple of hours looking at it. In my mind configuration management was analogous to unattended software installation, which I was definitely in support of, but had yet to perceive how it was going to change how I viewed infrastructure.

That consulting company was HJK Solutions. Some of my coworkers had previously established relationships with a couple of the partners of HJK, but I didn’t know anything about them myself. I was along for the ride. They gave us a presentation where they showed iClassify and puppet working together to automate infrastructure for other clients, but it wasn’t until the next meeting where we made technical decisions about the implementation that I really came to appreciate their insight. It is much more interesting why someone makes a choice than the choice itself, and this was my first of many since opportunities to incite the opinions of Adam Jacob.

A year of using puppet later, not only was I hooked but my excitement about the possibilities of configuration management had grown beyond what the software could do at the time. Both my excitement and frustration was apparent and got me a sneak peak at Opscode’s Chef. The design of Chef embodies “the unix way” of chaining many tools together insofar that it allows us to take building blocks that are essentially simple on their own but from behind our backs present a system that is revolutionary enough we almost fail to recognize the familiar pieces of it.

Chef is a systems integration framework, built to bring the benefits of configuration management to your entire infrastructure.

This is not an article about Chef, this is about the big picture. However, if you take enough steps back from that statement it becomes apparent that Opscode is building toward that picture. I want to share with you the excitement that short description garners inside of me.

Configuration management alone is the act of programmatically configuring your systems. Often the benefits are conveyed in support of process, but in more agile communities different advantages are touted; such as allowing one to wrangle larger number of servers by reducing build times in the name of vertical scalability, building more maintainable infrastructures by leveraging the self-documenting side-affect of configuration languages, and reducing administrator burnout by cutting a swath in the number of repetitive tasks one must perform. These are unarguably significant boons. Nevertheless, one does not have to look hard to find a curmudgeon reluctant to change, claiming they don’t want to learn another language, that having systems run themselves will surely cause failure, or perhaps some skynet-esque doomsday scenario. History is not short of examples of luddites holding steadfast against new technology, but it is somewhat paradoxical to see this mentality held in such a technologically oriented field.

The recent Configuration Management Panel at the Open Source Bridge conference in Portland amassed many relevant core developers in one city long enough to provide a good vibe for the direction of the available tools and underscore our common charge. But the focus was more about how we will get more users of configuration management tools than why they are going to have to use them. In retrospect, perhaps I should have asked of the panel their views of how configuration management will reshape systems administration.

Configuration management is about more than automation. Some who have foreseen this have started to convey this by discussing managing infrastructures rather than systems. In analogy, the power loom, Gutenberg press, and intermodal shipping container were not merely time saving tools of automation. These inventions reshaped more than their workforce and industry, but also the global economy.

I’m fully aware of the tone set by such a call of prophecy. How will a tool that helps us configure multiple machines at once make such significant ripples in our day to day lives of the future? It will because we will be enabled to solve new problems that we did not yet realize existed. As other technological advances served as a catalyst for globalization, the industrial and scientific revolutions; changing how we build our information infrastructure leaves us poised for an exciting set of challenges that do not yet exist.

So… I got my Debian router online. I expect to add ipv6 support to my network real soon now.

The permanent storage is a 2G CF card with a CF to IDE adapter. The system has 1G of memory. The quagga bgpd has a full IPv4 table loaded. It looks like it’s eating around 180M to do that. I bet this could be reduced by storing some of those data to an RDBMS. I’ll talk with Paul about it one of these days.

I plan to start the RIP daemon up here shortly, since the new OpenSolaris VM will make use of it. If I can get a static IP on the secondary link, I’ll set up another Quagga server on it and see about doing some load balancing.

The system currently supports VPNs using OpenVPN. I’ve got one set up between the Everett and Seattle locations. The Seattle location is using a WRT54G running OpenWRT. It is a pretty capable box but is not able to handle a full BGP table due to memory constraints (16M).

The router supports the following routing protocols using Quagga:

• RIP
• RIPng
• OSPFv2
• OSPFv3
• BGP

The router supports the OLSR protocol (for wireless mesh routing) using olsrd

The router supports 802.1q VLAN trunking and tagging using vlan.

The router supports 802.1d bridges using bridge-utils

The router supports the following tunnel types using iproute:

• IPv4 in IPv4
• gre
• sit
• isatap
• IPv6 in IPv6
• IPv4 in IPv6

The router supports traffic shaping and traffic control using iproute

The router supports firewalling and network address translation (NAT) using iptables

The router supports monitoring using snmpd, and munin

The router supports intrusion detection and/or prevention using snort

Decided recently to pick up a Readynas NV+ to supplement our file storage at the office. I have the Readynas Duo at home and have been quite happy with it. It is a linux based NAS appliance and after installing a few add-ons you can have a remote root shell and apt packages to install [...]

I spent most of Friday night playing around with a laser cutter. This is the best toy since the stick. Seriously.

Also, I am now the proud but slightly worried owner of this sidecar:



The price was very good, but it needs work. Fortunately all the parts that I'll need seem to be reasonably easy to come by. I think that I'll leave the boat looking ratty for now, it'll match the R50. The frame will need a lot of work though, and a new wheel.

Oh boy, I have another project. :P

One year after I bought the R50 it was once again in the driveway getting worked on:



I spent the day doing things like installing the carbs and electrics. Surprisingly the battery survived the long sleep with a full charge. I unwired it from the bike (previous owner had hard-wired it in) and cleaned up the connections a bit. While doing so the battery's fuse laid down it's life for the cause.

Click below for more pictures from yesterday. I'm so very pleased with how clean and shiny the engine is now.


There's still plenty to do, but I hope to try starting it in the next week or so. The only piece I don't have is a good rear brake shoe, so while I'll be able to start it I may not be able to ride it for a little while.

...but at the end of it I once more own two motorcycles rather than one plus a pile of parts. It's even close not running yet but all the big pieces are together and I sat on it (and made vroom vroom noises) and rolled it out of the garage.

Pictures to follow.

I recently upgraded Dell OMSA to 6.0.1 on a number of Ubuntu Intrepid and Jaunty hosts using sara.dl’s packages and got a warning that the mptsas driver version 3.04.07 was below the minimum supported version. The version from ‘modinfo mptsas’ confirmed I was on the right track looking at this driver. A quick look revealed no update in 2.6.29.4 or 2.6.30-rc8, so I went searching for the drivers source.

LSI’s site is terrible. I have Dell 1955 blades, and the Dell SAS5/iR chipsets are really LSI SAS1068s. I searched the drivers page for SAS1068 eventually and found the right download page. I grabbed the 4.18.00 archive file.

After decompressing it I found a dkms folder and rpm. I eventually gave up and used this to build a dkms deb with the following commands:

sudo apt-get install dkms
sudo rpm -i mptlinux-4.18.00.00-1dkms.noarch.rpm --no-deps
sudo dkms mkdeb -m mptlinux -v 4.18.00.00
scp /var/lib/dkms/mptlinux/4.18.00.00/deb/mptlinux-dkms_4.18.00.00_all.deb OTHERHOST:


Then install that deb on the otherhost (with the LSI based chipset) and it will install the correct modules via dkms. I rebooted and used modinfo to verify that mptsas was now version 4.18.00 and ‘omreport storage controller’ now reports ‘Ok’ instead of ‘Degraded’ again.

I’m no fan of software raid. Pretty much, ever. At my last job, for whom I still consult, my predecessor was really into technology creep. All of the workstations used that awesome fake raid that is actually implemented in the mass storage driver and is therefore pretty useless and can actually reduce your paths to recovery from disk failure. I’ll leave out the list of arguments against software raid. It just simply isn’t worth it.

I showed up to a call with a server with an 0×7b error. Of course, Microsoft has this cool feature by default where servers automatically reboot when they blue screen. So nobody knew this was the error until I showed up and tried the “don’t automatically restart on BSOD” option under the F8 startup menu. I’m used to this error from moving system images between hardware, especially with virtual machines. As it turns out, the other values inside the parenthesis are actually useful. If the second value inside the parenthesis is 0×00000010, then you’re likely dealing with a disk in a software raid mirror set (dynamic disk) that Windows has marked as failed, and thus won’t start from.

The trick, which took me a while to nail down, is getting a boot.ini setup to boot from another disk. Since you can’t actually access this partition even in the Recovery Console, you can’t edit the boot.ini to tell it to start from the other disk. In the end, I formated a floppy using simply ‘format A:’ on an XP desktop (would you believe this entire data center lacks a Windows server with a floppy drive?), then copied ntldr, ntdetect.com and boot.ini from another Server 2003 machine with the same service pack to this floppy. Then I changed the boot.ini to contain:

[boot loader]
timeout=60
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=”DISK 0″ /noexecute=optout /fastdetect /3GB
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS=”DISK 1″ /noexecute=optout /fastdetect /3GB
multi(0)disk(0)rdisk(2)partition(1)\WINDOWS=”DISK 2″ /noexecute=optout /fastdetect /3GB
multi(0)disk(0)rdisk(3)partition(1)\WINDOWS=”DISK 3″ /noexecute=optout /fastdetect /3GB


If you’re not familiar with this file, you may want to read about ARC paths. Remember that ntldr and ntdetect.com are hidden, system and read-only by default, although it’s fine to leave this options unset. ‘attrib -s -h -r C:\ntldr’ will make the file accessible so you can copy it to a floppy. I have to assume when you format a floppy from an NT based operating system it puts a bit of code in the bootsector to look for these files.

I then booted from the floppy and for me I then chose ‘DISK 1′ and the system started up fine. I went pulled the failed disk (carefully guessed which disk it was by the disk order in disk management and the scsi id jumper settings) and replaced it. In disk management, right click the good disk, “remove mirror” and choose the missing disk. Then right click again, “add mirror” and choose the new disk. Drink coffee.

It’s late and I can’t figure out how to run ‘fixboot’ and ‘fixmbr’ with a disk mirror, so I’m still using the floppy disk to boot and choose either disk to start from.

Saturday I met up with gordonmessmer, Morgan, cooncat and Grant at Ride West's parts and apparel swap. I didn't actually need any parts or apparel and had intended to just show up to hang out and eat BBQ brisket. Of course I ended up buying a bunch of stuff. The Haul:

• 70's BMW manual by Clymer.


• Busted up side case with a working locking mechanism to repair my case with a broken latch.


• A pair of Craven Golden Arrow Panniers in remarkably good shape.


• A Teknic 1 piece leather suit.

I wasn't sure about the Cravens until I talked to Kevin about them and he offered me a good deal on a rack that would attach them to the R50. They weren't my first choice mostly because I never thought that I'd be able to get a set so cheaply.

The suit was on the end of the rack where lots of people had been looking at it. It's labeled a '46 Euro' which I think confused people a bit. I'm a size 40, but it fits me great. It was a completely ridiculous deal. As far as I can tell it was something like 75% off retail price. I'm not sure what they cost originally since it's an old model and I can't find much info about it online. I have to say that I look pretty good in it.

Recently ran into some heat issues in a mini computer room that has a window in direct line of the sun and problematic HVAC. Picked up a network enabled environment monitor so I could have some data to show when trying to get the issues resolved. Originally I was thinking about getting the Websensor [...]

If you are using maven for builds or dependency management you will notice that by default maven always attempts to pull dependencies from the public maven repository (repo1). After reading documentation and examples I thought you could easily override this by specifying a local repository in your respective project object model file (pom.xml). Example. Not the [...]

Windows XP / 2003 have always been treacherously unstable when moving them between hardware, so much so that fresh installs are wired into my head as being the only option. I’m tired of having three different virtualization platforms, and I don’t want to rebuild these machines. ‘Virtual Server 2005 R2′ is the first to go.

To deal with getting 0×000000ce / 0xce BSOD’s with processr.sys, set both/either of these key/values to ‘4′ in the registry before migrating the machine, or on the first startup:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Processor\Start
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Intelppm\Start

To avoid getting a 0×0000007b / 0×7b BSOD on startup due to the mass storage controller changing, run the registry modifications in MS KB 314082. I save the text inside the “copy here” block to a .reg file and ran it before converting below, and it was enough.

Then use the free VMWare vCenter Converter to convert the Virtual PC image (it has to be off) to a vmware image. On the third step of the wizard, under options, I set the disk controller from automatic to ide. Copy the resulting vmdk file to your KVM host.

Use qemu-img or kvm-img to convert the disk image from vmdk to qcow2:

kvm-img convert -O qcow2 server-ide.vmdk server-ide.qcow2

You can then use KVM to run this disk image. I use libvirt, I simply copied another libvirt xml file, removed the MAC addresses from it, removed the uuid, updated the guest name, and point it to this disk, specifying ‘ide’ as the ‘bus’ in the disk’s target element.

It takes the keyboard and mouse a few moments to work on the console the first time, I assume the devices are being detected in the background. I had one ‘PCI device’ detected without a driver, I let it stay that way. I set the resolution up by hand. On an early run I had issues with the VGA driver, but I can no longer recreate this.

If you were using a static address, you may need to follow the directions in MS KB 269155 to delete the old network interface that is now hidden or you’ll get an error about the address being in use.

Definitely leave a comment about how this works for you. It’s like playing with fire.

Here’s a libvirt xml for kicks:

<domain type='kvm'>
  <name>server</name>
  <memory>786432</memory>
  <currentMemory>786432</currentMemory>
  <vcpu>1</vcpu>
  <os>
    <type arch='i686' machine='pc'>hvm</type>
    <boot dev='hd'/>
  </os>
  <features>
    <acpi/>
  </features>
  <clock offset='utc'/>
  <on_poweroff>destroy</on_poweroff>
  <on_reboot>restart</on_reboot>
  <on_crash>destroy</on_crash>
  <devices>
    <emulator>/usr/bin/kvm</emulator>
    <disk type='file' device='disk'>
      <source file='/srv/kvm/server/server-ide.qcow2'/>
      <target dev='hda' bus='ide'/>
    </disk>
    <interface type='bridge'>
      <source bridge='br0'/>
    </interface>
    <input type='mouse' bus='ps2'/>
    <graphics type='vnc' port='-1' autoport='yes' listen='127.0.0.1'/>
  </devices>
</domain>

I'm not a huge fan of fish, so a third sushi place going in on Broadway seems like a stretch to me, but I'm glad something is taking the place of the now gone bbq place and now long-gone magic dragon.

Anyone want to bet on what goes into the old Dilletante? My money is on pho or ice cream.

The Cisco 3524XL doesn’t support PaGP or LaCP, you simply configure etherchannel by adding ‘port group N’ to each interface. The port group takes the configuration of the first interface in the port group

! Cisco 3524XL
interface FastEthernet0/1
 description uplink to 6509
 port group 1
 switchport trunk encapsulation dot1q
 switchport mode trunk
end

The 6509 supports more dynamic protocols, and will try to use them unless you specify ’switchport nonegotiate’ on the portchannel interface, which is key. Otherwise everytime you turn on ‘channel-group 4 mode on’ the ports will go down on the 3524XL and the ports on the 6509 will go into the ‘err-disabled’ state until you ’shut’ / ‘no shut’ them.

! Cisco 6509
interface GigabitEthernet7/7
 description sw03 - rack 3
 no ip address
 switchport
 switchport mode trunk
 switchport nonegotiate
 channel-group 4 mode on
end

interface Port-channel4
 description sw03 - rack 3
 no ip address
 switchport
 switchport trunk encapsulation dot1q
 switchport mode trunk
 switchport nonegotiate
end

It took me a little while to narrow this down. Building a kvm guest with vmbuilder via libvirt I was getting the error “unknown OS type hvm”. When I compared the output of ‘virsh capabilities’ on a good host and the one that wasn’t working, the later was missing the kvm hvm entries. When I checked out the init script for kvm, I realized the the kernel module wasn’t loaded and a quick check of dmesg confirmed that virtualization was disabled in the bios.

When i first moved to Capitol Hill, i spent more hours than i could count at the arcade playing Mortal Combat or drinking shots and drawing at Broadway Espresso. I met some great people here, developed a love for the neighborhood, and a happy addiction to caffeine.

Nearly two decades later, it all comes down for light rail construction.

Change is inevitable, I look forward to the wormhole to other neighborhoods, I will miss my old seat at the bar.

I'm completely wiped out today due to getting paged late last night for a problem that took a while to clear up. I had intended on sleeping in but had promised a coworker that I'd give him a ride to work so that didn't work out.



In the long run however, it worked out very well. Being completely out of it I couldn't really focus on work so I ended up looking on craigslist for BMW stuff. Right at the top was a listing for 'BMW Carbs' for $75 so I had a look. They were listed as being for a '55 R50 so I dropped the seller an email and figured I might hear back. A few minutes later my phone rings and I get his address and head for Burien. Upon pulling into the driveway the guy looks a little familiar. Turns out I met him once at a VME meeting. Why do I remember him? Because he used to own my bike. Yes indeed, the carbs he had for sale were the carbs that were installed on my bike at the factory. Epic Score.

They are in remarkably good shape considering they were pulled and tossed onto a shelf 30 years ago. The only part missing is a slide return spring and the only non-rebuild part that needs help is one of the threaded rings that hold the top on. One odd thing is the red/white dust that came out when I opened things up. I'm not sure where that came from. The inside of the float bowls appears to have corroded a bit but is probably workable. Of course the floats are shot, one has even been patched with JB Weld.

Included with the carbs were an extra set of lever-tops for the carbs. This is extra great because I was on the look out of a set to replace the banged up set on the current carbs.


He also had a pair of bar end turn signals for $50 so I picked those up even though I'm not sure I want to use them. One is new and unused, the other used and in need of a lens. Since they are $90 each new I figured I couldn't really lose.

These are one of my favorite parts of the /2. I just love how they blend into the design so cleanly.

Things didn't work out for me to get down to Olympia to crack open the transmission and deliver the vlave covers so I went ahead and shipped the covers and ordered the tools. They showed up on Wednesday and work a treat. gordonmessmer came over on Thursday and we pulled the transmission apart. All the gears look pretty darned good, including the kickstarter sector gear which frequently has bad wear on one end. I managed to knock out the seals but don't yet have the kickstart lever off. Once I get that done I'll take the casing to the local transmission shop for cleaning in their industrial wash.

Over the weekend I took a look at the rear brake shoes. I've got new brake compound for them so I drilled out the rivets and stripped off the old compound being careful to keep it went to prevent dust. Unfortunately what I found is really annoying. At some point in the past someone has replaced the brake compound but in doing so drilled out the holes that the rivets go through. Unfortunately this means that my rivets won't hold the new compound on. I've got a few options but I've not decided on which I want to use just yet. Ideally I'd get someone to weld up the holes so I could re-drill them to the right size.

I use Munin for some graphing of system and application stats. Like most graphing open source projects its based on the widely used RRDTool. I recently was moving my munin instance from a xen instance on 64bit Ubuntu install, to a bare metal 32bit install. Moving munin consists of the moving the munin.conf file and moving [...]

Just in case you were wondering what they looked like outside of their plastic shells, here they are:

Nanostation 2, Nanostation 2 Loco, Pico2 and Bullet2

Why can’t System Administrators get network design?

Sometime around 1997 I built my first ISP. I was doing computer repair for a man at the time. Internet access was just getting situated in my small city. This man wanted in, but showed up at my house in frustration one night because he couldn’t figure out how to get the router to work. He came sporting a $100 bill and told me it was mine if I fixed it. I suppose it was going to be much more than he had been paying me hourly, but I was more interested in the problem then the pay, and he was frustrated. He had a Livingston Portmaster 2ER, a pile of external modems, and a 56K frame relay uplink to another local ISP. This ISP was always more network gear than computers, because he was “thrifty” mostly, despite owning a computer store. There was an NT 3.5.1 box, a Linux box, and for a little while before it got reappropriated, a FreeBSD machine as well. As fanciness like 56k modems came out and customers grew, hardware scaled out. It remained mostly network hardware.

Ever since then, every network I’ve inherited has been a mess. There have been design ideals focused around age old buzzwords like “security” that results in a pile of expensive security gear that’s essentially useless because proper implementation and design simply wasn’t understood. All of them have grown their L2 infrastructure out horizontally, usually with terribly cheap switches, but often with terrible not so cheap switches as well. Patch Panels and cabling have always run amok, usually with patch cables two to three times longer than necessary stuffed into the cable ducts.

VLANs are almost always used on a single switch, then individual switches are plugged into access ports to provide a switch for every VLAN. Or worse, the switches are all broken up into multiple vlans, with an uplink cable for each VLAN. It’s obvious that concepts like trunking and vtp are simply not understood. These don’t add complexity cost, they simplify what otherwise tends to be a disaster.

I find myself up early lying in bed thinking about the second round of ripping out erroneous unmanaged switches and migrating a live production network to a proper hierarchal design. Suddenly I realized it shouldn’t have to be this way, and really wish more administrators had at least the knowledge of a CCNA. Small companies don’t usual get the benefit of administrators who take the time to understand technology, and usually suffice on consultants who draw a direct line between something functioning and it being right, unfortunately between something not working and it being wrong as well. The latter is almost always because they failed to understand the problem and instead blamed the vendor or technology, from then on spouting that using a SAN creates a SPOF, domain controllers can’t be virtual machines, portable A/C doesn’t actually do anything.

As I trudge through my memory recalling these kinds of misguided attempts at wisdom, they all have a common denominator: not knowing the cause of the problems they are having. You have to understand the technology you’re leveraging. It’s absolutely essential that you know why your network works, not only that it does at the moment.

We've been listed on reddit

Interesting to see all the commentary.

K2 defaults to adding:

‘Published by btm on April 16, 2009 in Uncategorized’

to posts, which doesn’t include the time, which is sometimes contextually important. This is controlled in ‘theloop.php’ in K2, which uses the date_format, which you can set under ‘Settings -> General’ in the wordpress configuration. The format is the php date format. Simply using ‘r’ is the best, since it provides a nice RFC 2822 formatted date like:

‘Published by btm on Mon, 20 Apr 2009 09:28:48 -0700 in Uncategorized’.

The project I worked on last year got posted to MAKE: blog!

This totally made my weekend.

It recently clicked in my head that all the blades with small swap partitions were because they had their OS installed when they had very little RAM in them. So I set out to modify the Ubuntu 8.10 preseed install to create a larger swap partition and configure LVM while we were at it.

This proved difficult. Mostly because the better documentation of debian-installer (preseed, partman-auto) has features that aren’t in the version in Ubuntu.

Just got this working:

d-i partman-auto/disk string /dev/sda
d-i partman-auto/method string lvm
d-i partman-lvm/device_remove_lvm boolean true
d-i partman-lvm/device_remove_lvm_span boolean true
d-i partman-auto/purge_lvm_from_device  boolean true
d-i partman-auto-lvm/new_vg_name string system
#d-i partman-auto/init_automatically_partition \
#  select Guided - use entire disk and set up LVM
d-i partman-auto/expert_recipe string                         \
      boot-root ::                                            \
              40 300 300 ext3                                 \
                      $primary{ }                             \
                      $bootable{ }                            \
                      method{ format } format{ }              \
                      use_filesystem{ } filesystem{ ext3 }    \
                      mountpoint{ /boot }                     \
              .                                               \
              2000 10000 1000000000 ext3                      \
                      $lvmok{ }                               \
                      method{ format } format{ }              \
                      use_filesystem{ } filesystem{ ext3 }    \
                      mountpoint{ / }                         \
              .                                               \
              8000 8000 200% linux-swap                       \
                      $lvmok{ }                               \
                      method{ swap } format{ }                \
              .

d-i partman-lvm/confirm boolean true
d-i partman/confirm_write_new_label boolean true
d-i partman/choose_partition select Finish partitioning and write changes to disk
d-i partman/confirm boolean true

Friday was my birthday so I took the day off and had some fun. I decided to take a ride on my Rockster in my new Aerostich suit, visit some people and places and just generally do what I felt like. When I took off it was starting to rain a bit so I stopped in at Ride West to see if they had a rain fly for my tank bag (something I've put off buying.) They didn't have one in stock, but Omar had one that he'd snagged from the 'free' bin at the last parts swap and passed it along to me!

From there I headed down to Dauntless Motors which is out in the middle of farm country. I was given a full tour of the shop and got to see several sweet rigs. We discussed what I'm looking for and to my surprise that turns out to not be as pricey as I thought. Not cheap enough to do it now, but at least I have something to aim for.

After that I rode down to Brooks Motor Works where Kevin was pulling out the race bike to give it a spin. We didn't get it on the road but it did fire up after we poked and prodded it a bit. We then had a look at my cylinders.

I then rode north again stopping in at my parent's house for a while. My mom had made me cupcakes, so I ate 4 of them (what? they were small!) and then set them up with GMail and explained the use of the archive button. I had planned on going home via Vashon island and visiting a friend out there but unfortunately I ran short on time and had to jet home via I-5. I hadn't realized just how stiff my legs were until I stopped just off the freeway. Upon putting them down on the pavement (and circulation returning) I proceeded to yell inside my helmet. It was pretty therapeutic so I did it a few more times.

Julie and I then headed over to lisa and henry's for a party. It was awesome to see them again. After that we had a late night snack at Bilbao. I highly recommend the crispy potatoes.

It was a full day, but a good one.

I brought heads for the R50 to Kevin Brooks who went over what he could do for them. He's been doing some really interesting stuff with the engine on his "Bonita Rapide" 1955 R50. Most of the really interesting work has been done on the heads. He's lightened the valve train by 40% by replacing the valves with custom stainless steel valves with longer, thinner stems. The keepers are now made of titanium, and the springs have been lightened to suit. The results of this are less stress on the valve train and more room for air and fuel to get into the cylinder. It also looks so nice that it's a shame to cover it up. In theory I'll not only going have a more robust engine but I'll also have a bit more power too.

Next weekend I'll be heading down again. I'll be dropping off the valve covers for cleaning and I'll also be cracking open the transmission with Kevin's help. That's the last major component to be opened up. It really needs new seals and the bearings should be inspected.

In other news, the final drive is apparently on it's way back to me now. Things are really starting to come back together! Here's what's left to do:

• new seals and bearings for the transmission
  
• blast and paint the cylinders
  
• re-line the rear brake shoes
  
• bolt everything back together
  
• profit? hah!
  

Recently upgraded my laptop to the pre release Ubuntu 9.04 ( jaunty jackalope). One of the things I have been looking forward to is the Evolution MAPI plugin that is a result of work done by the Openchange project to implement MAPI stacks on both the client and server side. Evolution has been able to [...]

It took me a little while to put the pieces together to figure out how to take a vm-builder created vm and use briding with it instead of kvm/qemu’s user-mode networking. All the pieces are available on the internet, but there was some emphasis lacking to make it all clear to me.

You’ll need to have a bridge set up on your host. Install the ‘bridge-utils’ package first. Then the relevant section of my /etc/network/interfaces file looks like:

# The primary network interface
auto eth0
iface eth0 inet manual
up ifconfig $IFACE up

auto br0
iface br0 inet static
address 10.0.0.60
netmask 255.255.255.0
gateway 10.0.0.1
bridge_ports eth0
bridge_stp off
bridge_maxwait 0
bridge_fd 0
bridge_hello 0

You could probably use ‘dhcp’ instead of a ’static’ address on the bridge. The point is that your ipv4 address should be on the bridge, not on the actual interface.

Then create a ‘br-ifup’ script in your vm directory. This is based on /etc/qemu-ifup. This script is passed the name of the interface (tap0) which brings the interface up, and then adds it to your bridge.
#!/bin/sh
#sudo -p "Password for $0:" /sbin/ifconfig $1 172.20.0.1
sudo /sbin/ifconfig $1 up
sudo /usr/sbin/brctl addif br0 $1


Then run kvm with something like this:

sudo kvm -m 128 -smp 1 -drive file=disk0.qcow2 -net nic -net tap,script=br-ifup

‘/etc/kvm-ifup: could not launch network script’ means that the script passed in ’script=’ could not be found.

‘Could not initialize device ‘tap” means that kvm is unable to create the TAP/TUN interface. Running kvm as root via sudo is the easy solution.

‘warning: could not open /dev/net/tun: no virtual network emulation’ probably means that the ‘tun’ module isn’t loaded. You can load it with ’sudo modprobe tun’.

The tap interface is removed from the bridge when the guest is shutdown.

Hadn't noticed this before, but Hollywood Video has some problems with their neon. Or maybe not.

I wonder how long it's been like that.

gordonmessmer and I managed to remember to take pictures of the crank before we re-installed it. It's not much different, just a bit cleaner. It's most noticeable on the rods:

Yesterday I took the cylinders into a local shop, but they don't do the kind of blasting I need, nor the painting. Instead they referred me to a one of their sister companies that does. I'll have to find time to get out there during business hours. Maybe one morning next week.

Last night I packed up the final drive to ship out for a bearing replacement and re-shimming. I dropped it off at the post office after work today. Hopefully it won't be gone long.

I also mostly closed up the bottom end last night. I've still got to pound the oil pan back into shape but otherwise it's all back together. It looks like this again:


Next up for tearing apart is the transmission. I'm also going to have the heads cleaned up and reworked, but that's not something that I can do myself. I'm hoping to talk to an expert about it this weekend.

I’m putting together a WISP, I guess.

Here’s the mast in the basement prior to mounting it:

Here’s the fancy antenna strapped to the chimney:

Here’s the rack of computers that will be participating on the network:

Looks like the SSL cert for gmail and google apps mail expired yesterday 5/2/09. Sent email to security@.

I got to hang out with some very cool people this weekend. I met up with cooncat, Morgan and Grant at the Ride West bike swap. I very nearly bought a totally sweet 1979 R65, black with white pinstripes. Fortunately for my bank account I deferred. It was a pretty sweet bike though. After the swap we went up to Capitol Hill for happy hour and just hung out and chatted. I definitely need to spend more time with those folks.

Part of our discussion was of course about the R50 and cooncat requested an update, so here it is!

I got the crankshaft back from Brent's Motor Works last week. It looks great and was essentially completely rebuilt. gordonmessmer came over and we spent an evening getting the crankcase back together. We were not as well organized this time and had to take the front bearing carrier off an extra time because we forgot the oil pump. We also forgot the oil splash ring so the crank had to come out again. In the end we got it all back together and everything seated properly. I'm glad that I sent the crank out because it's slightly shorter now which keeps the rear slinger from rubbing on the inside of the crankcase.

Then last night I heated up the flywheel (all 12 pounds of steel) and fit it on the end of the crank. The runout is just slightly over the limit at about 0.0045". I'm ready to call that good enough unless there's a fix that doesn't cost too much.

Tonight I sat down with the pistons, cylinders and my set of micrometers. The cylinders are dead on round with no taper. The pistons are as close to the exact same size as makes no difference. The wrist pins are pretty much perfect. The only thing that's possibly out of spec is the piston skirt to cylinder clearance. At the moment it's 0.006". The book says 0.0046" is the max, but I've got it on good authority that the book is being stupid. The pistons are aluminum and the cylinders are steel. It doesn't take too much heating up before you've used up that 0.0046 and are looking at a seized piston. I've got an email out to an expert asking his opinion. If he says they are too loose then I'll find someone to knurl the piston.

Tomorrow I may take the cylinders into a local shop to see about getting them cleaned up. They really need a good blasting and a lick of paint.

Pictures are still on the camera, I'll try to post them soon.

I’d like to extend huge thanks to the hundreds and hundreds of people who have showed interested in Synapse these first few weeks. This project is a huge undertaking, and all the support really means a lot.

I’ve read every tweet and nearly every comment on Reddit, Lifehacker, and other blogs, and the message is clear: the world is ready for better Linux software, and a better instant messenger. People are encouraged by Synapse and looking forward to it’s future. No pressure, right?

Huge HUGE thanks to everyone who has reported bugs, helped with troubleshooting/triaging, and shared their feedback in the conference room and on the forums. Synapse is still an alpha product so there have been plenty of problems, and quite frankly I’ve been a bit overwhelmed :). All the help has been great.

Lots of bugs have already been fixed including better icon support when running under KDE, support for proxy servers, and eliminating many many crashes.

The first user-contributed plugin was just merged in, adding preview for wikipedia urls (Thanks goto!):

You can also now add multiple accounts, just note support for this is still a bit rough around the edges.

So what’s next? First I’d like to make absolute sure that nobody will find Synapse less useful than other open-source products. In addition to fixing all the open bugs in the tracker, the plan for this week is to focus on implementing two major features:

1. Logging and a conversation history browser.
2. Linked Accounts aka transports/gateways. This will make it possible to communicate with friends on other networks, so if you’ve been holding off on switching to Synapse because most of your friends haven’t switched to XMPP yet, hang tight!

I’d also like to add official packages for other distributions very soon, starting with openSUSE and Foresight. If you can help with either of these, please let me know! Big thanks to trontonic for working on ArchLinux support.

There’s been great international interest in Synapse as well. So far members of the community have offered to translate Synapse into Russian, French, Italian, Ukrainian, and German… so making Synapse translatable will be a major short-term goal as well.

Once all this low hanging fruit is taken care of, we’ll be switching gears back to new innovative features. We’ve got a few things in mind, and would love to hear your ideas on the forums.

Challenging the status-quo is never easy. If you’re looking for a fun and exciting project with tremendous potential to get involved with, I hope you’ll consider joining us and help make the vision reality.

Or lack there of. Blog is back online.

So, I’m attaching a radio to the chimney. I don’t want to have to bring it down every time I need to flash the firmware, so I’m also running an rs-232 cable up to it along with the PoE data/power cable. Since they don’t have anything pre-built, I wired one myself. I also made a png of the schematic I used. It is probably wrong. The rj-45 should probably have been flipped over, ‘cuz as it stands, I need to attach a null-modem converter and a rj-45 to db-9 converter I got from Sun from the last Try & Buy thing I did. It would probably be easier to wire up the rj-45 end as a second db-9 end. I’ll probably do that tonight. But this is the current state, and I’ve confirmed that it works just fine. The cat-5 is about 100′ in length, and I saw no loss of signal. YMMV.

Anyway, that’s the dealio.

On the way back home today, I noticed police tape all over the south end of SCCC. Turns out there was a suspicious package, which turned out to be nothing, I asked a cop about it and he told me it was "Typical finals week behavior".

Oh, I got a new camera today too. Hopefully this translates to more posting.

Two or three times now libvirt (0.4.4-3ubuntu3.1, Ubuntu Intrepid 8.10) has automatically generated overlapping MAC addresses on me. I can’t find the source for this MAC address generation in 0.4.4, but in 0.6.1 which is included in Ubuntu Jaunty 9.04 it’s virGenerateMacAddr in src/util.c. This leads me to believe it’s been rewritten, and I’m hoping it’s better. It looks perfectly fine.

I've been watching a good bit of Top Gear lately. It's an amusing show and I do like cars and whatnot but something has started to nag at me. All of the cars they showcase from 50 mpg economy cars to super-cars that get as little as 2 miles per gallon are all insanely wasteful of the energy we put into them. Even the Prius only manages to make slightly better use of the wasted energy. We are driving around thinking that we are doing great at 50mpg when all we are really doing ultimately is converting fossil fuels into waste heat. We even have specialized systems on the vehicles to cool the engine and the brakes where we 'generate' it all.

I'm tired of it.

I want a car that is efficient. I'm not talking about 50 mpg. I'm not talking about 100 mpg. I'm talking about a car that uses only as much energy as is required to change my altitude from origin point to destination plus a bit to deal with friction.

Robert Heinlein made an astute observation about technology in his novel The Rolling Stones:

Every technology goes through three stages: first a crudely simple and quite unsatisfactory gadget; second, an enormously complicated group of gadgets designed to overcome the short comings of the original and achieving thereby somewhat satisfactory performance through extremely complex compromise; third, a final proper design therefrom.

This three stage theory applies itself well to a large number of technological fields. Unfortunately for many we're still stuck at stage two. Look at space flight. The shuttle is an amazingly complex piece of equipment. I think that for computers and communication we are actually making our way into stage three. Sure, a computer is a frighteningly complex machine, but we are constantly simplifying the user interface.

The one place that we're solidly stuck at phase two is cars. In fact, we just keep pushing the level of complexity further and further. Heinlein described the internal combustion engine thusly:

These unbelievable museum pieces were for their time fast, sleek and powerful--but inside their skins were assembled a preposterous collection of mechanical buffoonery. The prime mover for such a
juggernaut might have rested in one's lap; the rest of the mad assembly consisted of afterthoughts intended to correct the uncorrectable, to repair the original basic mistake in design--for automobiles and even the early aeroplanes were "powered" (if one may call it that) by "reciprocating engines."

A reciprocating engine was a collection of miniature heat engines using (in a basically inefficient cycle) a small percentage of an exothermic chemical reaction, a reaction which was started and stopped every split second. Much of the heat was intentionally thrown away into a "water jacket" or "cooling system," then wasted into the atmosphere through a heat exchanger.

What little was left caused blocks of metal to thump foolishly back-and-forth (hence the name "reciprocating") and thence through a linkage to cause a shaft and flywheel to spin around. The flywheel (believe it if you can) had no gyroscopic function; it was used to store kinetic energy in a futile attempt to cover up the sins of
reciprocation. The shaft at long last caused the wheels to turn and thereby propelled this pile of junk over the countryside.

This was published in 1952. In the intervening 57 years we have just continued to refine this design further. A modern car still has lumps of metal thumping back and forth and dumps all that energy as wasted heat. Heinlein continues:

The prime mover was used only to and to overcome "friction"--a concept
then in much wider engineering use. To decelerate, stop, or turn the
heroic human operator used his own muscle power, multiplied
precariously through a series of levers.

Despite the name "automobile" these vehicles had no autocontrol
circuits; control, such as it was, was exercised second by second for
hours on end by a human being peering out through a small pane of
dirty silica glass, and judging unassisted and often disastrously his
own motion and those of other objects. In almost all cases the
operator had no notion of the kinetic energy stored in his missile and
could not have written the basic equation. Newton's Laws of Motion
were to him mysteries as profound as the meaning of the universe.

Nevertheless millions of these mechanical jokes swarmed over our home
planet, dodging each other by inches or failing to dodge. None of them
ever worked right; by their nature they could not work right; and they
were constantly getting out of order. Their operators were usually
mightily pleased when they worked at all. When they did not, which was
every few hundred miles they hired a member of a social class of
arcane specialists to make inadequate and always expensive temporary
repairs.

Despite their mad shortcoming, these "automobiles" were the most
characteristic form of wealth and the most cherished possessions of
their time. Three whole generations were slaves to them."

Sadly all true. We've even surpassed three generations.

Now don't get me wrong. I'm totally a gear-head. I've got a bunch of tools and even spent a good chunk of today adjusting some bits of metal that thump back and forth. I love the engineering that went into creating such a device. To me they are truly are fantastic machines. However...

They lack elegance.

A truly elegant solution to a given problem is usually the simplest. It's pretty clear that today's cars are not simple. You can't even work on them yourself anymore without computer interfaces and huge toolboxes filled with all sorts of precision machines (trust me, I've bought most of them!) What we need are simple vehicles. There's just one thing holding us back: electrical storage. Electric cars really are the best. They are simple, efficient and quiet. We have had a perfect motor since 1882 so that's taken care of. In the last few decades advances in transistor fabrication have brought us both cheap micro-controllers and inexpensive heavy duty power transistors. What we lack is good power storage. Batteries have only marginally improved in the last few decades. Lithium ion batteries (0.54 MJ/Kg) are the latest and greatest and yet still have a far lower energy density than gasoline (~55 MJ/Kg). The current crop of ultra-capacitors is even worse at about 0.02 MJ/Kg. EEstor has patented a capacitor that beats LiOn at 1.0 MJ/Kg. That should be dense enough to get us going with electric cars... if it works.

Once we sort out the storage we'll be on our way. Cars will recover 90%+ of the energy used in braking. They will be efficient. They'll even be fun to drive. I can't wait til the guys on Top Gear get a real electric car to play with. I don't think that the Tesla Roadster is quite there yet, but once we get the power storage problem solved those three yahoos will be humming a different tune, though I'm sure they'll complain that the cars don't make the noises that they love.

I just wish I could build that car. Maybe one day I will at least get to work on one.

I finally packed up the crank and shipped it out to Brent for inspection and truing.

The final drive is also still in pieces while I figure out how to get the pinion needle bearing removed. It's pretty happy where it is but needs replacing. I want to get the final drive back together so I can start on the transmission.

Haven't done a whole lot this weekend. At the moment the primary internet connection to home is down and I just finished fixing the secondary that I broke the other day. Turns out that I have 4 connections available to me from home, each of varying reliability and speed. I just wish I could make them automatically failover or something.

Today I did manage to get down to the garage to do the valve adjustment and throttle body sync on the Rockster. It's amazing how much that can effect how the bike runs. The valves were pretty close, only had to adjust the exhaust on both sides. The throttle bodies were way out (1/2 turn or more) and was probably the reason the milage had dropped of late.

In amusing bird related news, while tinkering with the internet connection I heard Niko call out from downstairs... only he sounded a good bit too clear to be that far away. Careful exploration found him at the top of the curtains at the bottom of the stairs. A good 8 feet from the ground. He's sitting on the top of the laptop now, he earned it!

Today I’m extremely happy to officially announce the project I’ve been working on for the past few months. It’s called Synapse, and while it may look like just yet another instant messaging client, it’s actually much more than that.

The web has changed a lot over the past few years. Web applications now offer rich user experiences and beautiful interfaces, video has has become ubiquitous, the ability to mix and match content from different sources is now not only easy, but widely accepted by companies that would have once sued you for doing so. Most importantly, more and more of our daily lives continues to move into the “cloud”.

With all the focus on the web, a lot of people have been dismissing desktop operating systems as nothing more than something required to run a web browser. Unfortunately, Linux, which has suffered from unpolished UI applications for a while, has been hit especially hard by this trend.

Even though there have been lots of exciting advances to the platform (Mono, DBus, Cairo, Gstreamer, KDE4, etc.), few developers focus on supporting Linux, and Linux applications rarely receive the same polish and attention to detail as web applications.

Although it makes me unpopular, I’m not ready to give up on Linux software development. I feel strongly that there’s a place for both web and desktop applications, and exciting opportunities for integration between them.

The state of instant communication and collaboration, especially on Linux, has been stagnant for many years. In fact, there have been few advances since IRC, which was invented in 1988 – nearly 20 years ago.

For the most part, we’re still limited to expressing ourselves using only plain text. Image sharing and file transfer rarely work, we can’t make voice/video calls, there’s been little to no integration with the Web, and a lack of innovation all around.

Sci-Fi movies have been envisioning amazing communication tools for years – tools that appear infinately flexible and act like magic.

The goal of Synapse was to see if it was possible to bring this magic to reality.

Any sufficiently advanced technology is indistinguishable from magic.
- Arthur C. Clarke

History has a tendency to repeat its self, so my first step was to determine why other similar projects have failed to foster innovation. One of the failures, in my opinion, is the desire to be multi-protocol. If any new feature needs to work everywhere, the result is often that it works poorly everywhere, or not at all. What we’ve seen with many projects is that they implement only the lowest common denominator across everything, and then stop there.

Just as Apple understood when they decided to throw away OS9 and switch to something new that was designed from the ground up to do exactly what they needed, having a solid base is extremely important. Fortunately, there’s already a mature, open, and all-around wonderful chat protocol out there: XMPP.

Although I suspect this will be one of the most controversial features, Synapse is designed to only support XMPP. If this upsets you, relax and hear me out.

Unlike any of the legacy proprietary networks, XMPP is an open and distributed system. Anyone can run their own server and communicate with people on any other server. In addition, the “X” in “XMPP” stands for “Extensible”. Any piece of the protocol can be extended without breaking compatibility with software that doesn’t understand the extension. This is a perfect fit for Synapse because it means there’s never anything stopping you from implementing your great idea.

Many people will say that this all sounds great, but that it doesn’t matter if nobody else is using it. Standard chicken-and-egg problem? I think there’s already proof that it is possible to overcome this. Skype appeared out of nowhere and now has millions of users. XMPP can do the same, it just needs an awesome client that offers features nobody else has, just as Skype offered working voice chat when nobody else did. And of course, XMPP already has a huge head-start thanks to Google. Remember, Synapse can talk to any other XMPP server/client, including Google Talk.

All that said, legacy networks will likely be supported through server-side transports that translate other protocols into XMPP, but if Synapse is truly successful, I’m confident it just wont matter.

Synapse is a very new project. I’m confident that it already offers a few compelling features, but overall isn’t groundbreaking in its current state (and is certainly not bug-free). My hope is that Ive succeeded in expressing my long-term vision, and can interest other people to join the project.

Pre-built packages are available for Ubuntu, with support for additional distros on the way. If you want to get involved, or just want to share your ideas, you can join the conference room or post on the forums.

I look forward to your feedback!

Download Synapse »

Everyone else was doing it, and even though I don't normally fall into the memes, I was curious.

Thanks Wordle for the app, bummer it's a total pain to link/re-blog.

A few minutes ago I got a cold call on my cell phone. I almost didn’t answer, I tend not to answer calls to my cellphone from unknown numbers. I have teams of lawyers and medical people out there looking for me sometimes, so sometimes I must.

The caller said that my SSL certificate was expiring soon with Company A (who I forget because it’s an old certificate for email I don’t use anymore since I switched to Google for mail) and they’d like the chance to win me over. I paused as I added this all up in my head. After I realized it was just telemarketing, I said “No, thanks” and hung up. Then I get an email from them. Scroll down and read it, them come back.

I like the Creating Trust Online part. Is this a strong arm technique meant to scare me into purchasing from them? Are they trying to create some kind of trust in a “we know more than you, buy our stuff” way? Is this Louis character rogue or is this standard operating procedure?

Ways to get me to never buy products or services from you:
1) Call me
2) Call me, then send me an email

I almost filed the call under weird and forgot about it, thanks for the email that I can search for later when I’m shopping for SSL certificates so I know who not to call.

Delivered-To: btm@loftninjas.org
Received: by 10.142.215.17 with SMTP id n17cs645196wfg;
        Thu, 12 Mar 2009 10:48:23 -0700 (PDT)
Received: by 10.150.95.15 with SMTP id s15mr422861ybb.247.1236880102854;
        Thu, 12 Mar 2009 10:48:22 -0700 (PDT)
Return-Path: 
Received: from sharon.nj.office.comodo.net (mail.nj.office.comodo.net [38.104.66.254])
        by mx.google.com with ESMTP id 1si2384323gxk.79.2009.03.12.10.48.18;
        Thu, 12 Mar 2009 10:48:19 -0700 (PDT)
Received-SPF: pass (google.com: domain of louis.cicero@comodo.com designates 38.104.66.254 as permitted sender) client-ip=38.104.66.254;
Authentication-Results: mx.google.com; spf=pass (google.com: domain of louis.cicero@comodo.com designates 38.104.66.254 as permitted sender) smtp.mail=louis.cicero@comodo.com
Received: (qmail 13908 invoked by uid 1001); 12 Mar 2009 17:48:17 -0000
Received: from mmonroe.comodo.net (HELO louisc) (192.168.68.79)
    by sharon.nj.office.comodo.net (qpsmtpd/0.40) with ESMTP; Thu, 12 Mar 2009 13:48:17 -0400
From: "Louis Cicero" 
To: 
Subject: Info on compromised root key
Date: Thu, 12 Mar 2009 13:48:16 -0400
Message-ID: 00a201c9a33a$b955fa20$4f44a8c0@comodo.net>
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_00A3_01C9A319.32445A20"
X-Mailer: Microsoft Office Outlook 11
Thread-Index: AcmjOrkMPeS02oldT1mZI5bKFnL3rA==
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350
X-Comodo-Virus-Checked: Checked by ClamAV on sharon.nj.office.comodo.net
X-Comodo-ClamAV-Virus-Program: ClamAV 0.92.1

This is a multi-part message in MIME format.

------=_NextPart_000_00A3_01C9A319.32445A20
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

http://www.computerworld.com/action/article.do?command=viewArticleBasic
 &articleId=9124558&intsrc=it_blogwatch

http://bits.blogs.nytimes.com/2008/12/30/outdated-security-software-threaten
s-web-commerce/

1024-bit encryption is 'compromised'

Upgrade to 2048-bit, says crypto expert

Written by James Middleton

vnunet.com  

According to a security debate sparked off by cryptography expert Lucky
Green on Bugtraq yesterday, 1,024-bit RSA encryption should be "considered
compromised".

The Financial Cryptography conference earlier this month, which largely
focused on a paper   published by
cryptographer Dan Bernstein last October detailing integer factoring
methodologies, revealed "significant practical security implications
impacting the overwhelming majority of deployed systems utilising RSA as the
public key algorithm".

Based on Bernstein's proposed architecture, a panel of experts estimated
that a 1,024-bit RSA factoring device can be built using only commercially
available technology for a price range of several hundred million to $1bn.

These costs would be significantly lowered with the use of a chip fab. As
the panel pointed out: "It is a matter of public record that the National
Security Agency [NSA] as well as the Chinese, Russian, French and many other
intelligence agencies all operate their own fabs."

And as for the prohibitively high price tag, Green warned that we should
keep in mind that the National Reconnaissance Office regularly launches
Signal Intelligence satellites costing close to $2bn each.

"Would the NSA have built a device at less than half the cost of one of its
satellites to be able to decipher the interception data obtained via many
such satellites? The NSA would have to be derelict of duty to not have done
so," he said.

The machine proposed by Bernstein would be able to break a 1,024-bit key in
seconds to minutes. But the security implications of the practical
'breakability' of such a key run far deeper.

None of the commonly deployed systems, such as HTTPS, SSH, IPSec, S/MIME and
PGP, use keys stronger than 1,024-bit, and you would be hard pushed to find
vendors offering support for any more than this.

What this means, according to Green, is that "an opponent capable of
breaking all of the above will have access to virtually any corporate or
private communications and services that are connected to the internet".

"The most sensible recommendation in response to these findings at this time
is to upgrade your security infrastructure to utilise 2,048-bit user keys at
the next convenient opportunity," he advised.

But a comment   from
well known cryptographer Bruce Schneier casts doubt on Bernstein's findings
in practical application.

"It will be years before anyone knows exactly whether, and how, this work
will affect the actual factoring of practical numbers," he said.

But Green, much to the clamour of "overreaction" from the Slashdot
community, added: "In light of the above, I reluctantly revoked all my
personal 1,024-bit PGP keys and the large web-of-trust that these keys have
acquired over time. The keys should be considered compromised."

Whatever the practical security implications, one sharp-witted Slashdot
reader pointed out: "Security is about risk management. If you have
something to protect that's worth $1bn for someone to steal, and the only
protection you have on it is 1,024-bit crypto, you deserve to have it stolen

Louis Cicero

Business Development Executive - Comodo 

Direct Line 1- 908- 376-0145

Main Office US: +1 888.COMODO1 (888.266.6361) ext.4062

Fax US: +1 866-405-5816

Louis.Cicero@Comodo.com 

Creating Trust Online

Comodo   Helps
Leading Cutlery eTailer Increase Individual Transactional Value By Over 250%

Normally I would use ‘openssl passwd’ to generate encrypted passwords for scripts and config files, but it doesn’t appear to support sha256 and sha512 yet. There doesn’t appear to be an openssl ticket for this yet. Ubuntu has switched to using SHA512 by default (see ENCRYPT_METHOD in /etc/login.defs). In the course of tracking down the use of passwd/root-password-crypted not working in a jaunty pxe/network install (LP: 340841), I needed to generated a sha512 password to replace the md5 password in the d-i config file.

15:11  cjwatson> $ echo cjwatson:foo | chpasswd -S -c SHA512
15:11  cjwatson> cjwatson:$6$K./rc/OhIRi$ylKWgewTkGP3TyXfwj8nnKyIhph66WucLseLjGKKzRM0oRcuRzng2szcC/JZpY13dLxmlILx7eSfdfMHTruH40

I’ve been working on testing jaunty before it goes live. Winbind stopped working and I initially assumed it was another configuration change. In the end, it was. The caching functionality wasn’t very straight forward so it took me a while to get to a point where I could test configurations without the cache messing with the results. Intrepid to Jaunty is Samba 3.2.3 to 3.3.1, which being a different major version includes some changes. Mostly the internet is chock full of examples that don’t specify the version of Samba that they’re for, and it’s been changing a lot.

It looks like 3.0.21a added support for ‘idmap backend = ad’ for retrieving uid/gid information from active directory. At some point ‘idmap config’ showed up, for maintaining multiple domains. I assume this was around 3.0.25 where ‘idmap domains’ showed up. Apparently with 3.3.0, the ‘idmap backend’ is back, which became depreciated with the 3.0.25 changes. There is talk in the release notes of using ‘idmap uid’ and ‘idmap gid’. I’ve seen errors about these not existing, I just went without. Without further ado, here’s my working winbind config:

[global]
security = ADS
server string = %h server (Samba %v)
workgroup = WM
realm = CORP.WIDEMILE.COM
idmap config WM : backend = ad
idmap config WM : schema_mode = rfc2307
idmap config WM : range = 1000-20000
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind nested groups = Yes
template shell = /bin/bash
template homedir = /home/%U
allow trusted domains = No

The other interesting thing was the caching. I eventually read the code while watching the output of ‘winbind -i -d10 -n -s /etc/samba/smb.test.conf’ and saw that ‘-n’ which is supposed to disable caching doesn’t affect the idmap cache. The ‘winbindd_cache.tdb’ and ‘winbind_idmap.tdb’ files were not said cache. It ended up hiding in ‘/var/run/samba/gencache.tdb’, with who knows what else. You need to delete this file manually each run. I filed a bug over it too.

Last week, Eric over at ExtremeBoredom.net told me that the Mike and Key Flea Market was happening over the weekend, so after a quick non-planning session, we woke up at 4AM, packed Schuyler’s car (not pictured) full of Nanostations and headed down to Puyallup to show the local HAMs the cheap, unlicensed way to do a long distance data link.   Our last minute planning actually got us a great table next to the girl scout cookies,  and Schuyler’s giant pyramid of NS2s got us a lot of questions.    

I didn’t get a chance to check out the whole show or buy anything fun (I wanted to pick up an oscilliscope for no particular reason) because I was too busy at the booth and slightly dazed from my head cold,  but Schuyler got a box of Metricom hardware and a Tower Beacon (his neighbors will hate him soon).      I did get