zen.org Communal Weblog

I got this Apple Mighty Mouse at work. I configured it so when you squeeze it it switches spaces. The only problem is now when I’m at home I squeeze my mouse to switch my KDE desktops, and it doesn’t work. One of these days I’m going to crush the mouse in my hand, and shards of plastic is going to rip into my skin hindering my ability to type for life.

I’m waiting a few hours at the Thompson Toyota, my Prius is getting some minor work done to it to pass state inspection, it still takes a few hours. They have a wireless connection to the Internet, but even though last time I connected without problems this time my PII Debian system was not happy. So I checked out the bank of beat up Gateways with vagabond keyboards in the corner. I wiggle the mouse, and up pops the Ubuntu Heron! Wow! I can tell from the scribbled out tag that these are likely hand me downs from Thompson Lexus, I bet them bastards over there now have Vista. I expect that they just didn’t want to pay for Licenses, but I can do some work!

The neat part is that other people are actually using them. By default there are no icons on the desktop, so some people can’t find Firefox right away, but they find it. The card games seem most popular thought, at least today. I guess Ubuntu really is a user friendly system.

As of today, Sunday 3rd August 2008, Google reports that there are 981,000 Web sites on which Barack Obama is “accused,” “suspected” and “thought to be” Muslim.

He is, of course, a Christian. However, IMO, that fact is totally, utterly and absolutely irrevelant.

What deeply disturbes me is that none of the news reports/sites/comments I’ve found never even comes near to apologising to members of the Islamic Faith for the obnoxious, overt, bigoted slurs against them.

What would be our reactions to similar comments about our being “suspected,” of being Roman Catholic, Evangelical Chirstian, Jewish, Hindi, Taosit, Bhuddist or any other Faith?

Is this sort of thing just? Is it fair? Is it respectful of others?

I think not. For shame.

I post it here so I can find it again if needed again. Sometimes I just want to see everything that is going on in a perl object. Sort of what Java’s toString() function does when printing out maps or lists. This is what I ended up with. Now it’s public domain!

our $join = ' ';
sub to_string{ # ug, java
    my $s = shift;
    my $out;
    if (ref $s) {
	if ($s =~ m/ARRAY/) {
	    $out .= '[' . join($join, map {
		to_string($_);
	    } @$_) . ']';
	} elsif ($s =~ m/HASH/) {
	    $out .= '{' . join($join, map {
		"$_=" . to_string($s->{$_});
	    } keys(%$s)) . '}';
	} else {
	    $out .= $s;
	    warn "How do i display '$s'?";
	}
    } else {
	$out .= quotemeta($s);
    }
    return $out;
}

Sure, someone told Hill to take up ironing…just like folks (um, hello Bill?) suggested Obama was a boy, not a serious threat. Yes, she was compared to everyone’s ex-wife on the steps of divorce court—I fell off the couch when Mike Barnacle came out with that line!—but so what? It was an accurate description of her screechy delivery the day before.

But it seems to be fine when others suggest Michelle exudes black anger. Or that McCain dotters. Why is it okay to report those subjective views, as long as the subject isn’t the Hillster? Remember comments about Barack’s bowling technique? How about his funny ears? But no one can comment on Hillary’s appearance. I’ve not heard any discussion about her disappeared wrinkles for example—it’s news that she dropped years of stress from her face for the campaign; I want to see a poll on how everyone reacts to the new-Hill versus the old version. Why not? Didn’t we hear about Obama’s white shirts and how so-so GQ they were, I guess uppity on a black guy. No one spends time spooning out regrets for those hard-hitting shots. So why does Hillary deserve apologies when she sure took off her elbow-length gloves whenever she wished—to sucker-punch her opponent? Seemingly, she will not tolerate a broken nail.

The reverse-sexism being forced down the throat of this 67-year old blogger is blocking my airway—and I started out over a year ago as a Hillary Hag (See my 02/10/07 “A Hen-Party for Hillary” post.) This isn’t the reasoned feminism of the 60s; I’m speaking here of blatant bias by women against men. I’m talking about elderly females accusing males of sexism when what they really want for their heroine is preferential treatment because she’s a woman.

They and she shouldn’t be able to have it both ways. Face facts, all Hillary Hags: Hillary lost big-time. It looks better than it was as the memory-challenged media now has embraced her new math. (Given her miscalculations, I began to believe for the first time that girls really do have trouble with arithmetic.) So why exactly should she receive anything other than what the fallen men did? How is it Hillary deserves a world-class psychological severence-package and if Obama—whose campaign was as pure as a baby compared to the dirty tricks the Billary machine churned out—doesn’t deliver it, he receives contempt? When Edwards left the campaign trail, why didn’t the pandering-showboat set sail for poor him? How come Richardson wasn’t kowtowed to when he dropped out? And Biden? These guys just left. Period.

This reverse-sexism is an embarrassment to women of a certain age like me, who did go out and carve careers, who did raise their kids and bake cookies, who don’t today whine that their own lost opportunities are men’s faults.

I no longer have any respect for Sen. Clinton. I think her manipulating of our sisters is pathetic and self-serving. And I’m losing respect—pay attention Barack—for the men who’re scared of being labeled chauvinistic if they fail to acknowledge the heart sewed to the sleeve of a certain set of personally-tailored pants-suits.

Shame, Hillary, shame on you. And guys? Act like men. Please.

For the last 4 weeks I’ve been home traumatizing, my now almost 4 month old, Linus. I’ve been singing “Oh no, no, I never go to work” (see Track 10 of of They Might Be Giants‘s Here Come the 123s). Next Tuesday it’s back to work for me. What’s happened to me in the past 4 weeks? Linus has gone from a drooling, breast sucking, sleeping no more then two hours at a time baby; to a drooling, bottle sucking, sleeping no more then 4 hour at a time baby. Sweden didn’t make the it to the knockout round of Euro2008. No tree hit my house. Zoë turned 4 (today!). I’ve watched lots of Star Trek on on cbs.com (I’m just starting season two!). My CSA started up (mmmm, fresh peas). By far the worst thing that happened is that my kompisar from NEC, and then Princeton University, died. Now, I get to go back to my own office, I don’t get to share one any more. A lot can happen in a day, let alone 4½ weeks.

As described by Jeffrey Feldman in The Huffington Post, commentator Liz Trotta of Fox News was trying to be funny when she said we should favor the assassination of both Osama bin Laden and Senator Barack Obama. (You can watch it if you don’t believe me.).

Apparently it’s okay to joke about it before they’re elected.

Robins have been around for a few weeks. Last weekend I saw some bees flying around, but got sad when I found a dead carpenter bee in my garden. Hopefully he just stayed out a little to long in the cold. Last night I clinched Springs arrival, Linus and I where walking back form a evening walk along the canal and we saw bats. No sight of the white groundhog though.

A friend of mine is set up with a satellite Internet connection to his home in a not-all-that-rural part of Ireland. He’s been hosting his domain from there, with all email traffic and such going to his local server. Until recently, it was a perfectly workable solution, even with the normal supply of spam, virus, and other junk mail arriving.

But nearly two weeks ago, his domain came under attack from a bunch of spam botnets. Uncountable messages were forged to various places, all of which set up with the Sender: header to be totally random addresses @domain.ie. Unfortunately his ISP said they would not help block the traffic. (As opposed to could not.)

The workaround we came up with pushed his traffic through a virtual-hosted system I have set up over in the US with johncompanies.com (yes, a blatant plug, but I really like their service). There were a few steps I had to take in configuring Postfix before they added the MX record for his domain to reroute everything. (This is on a system running Debian GNU/Linux version 4.0, codenamed etch, using postfix 2.3.7.)

• In main.cf, add his domain to relay_domains (which already existed for other domains I MX with).
• Since he uses a lot of different email addresses (to make it easy to catch re-use and selling of them), I didn’t set up a relay_recipient_maps hash table. That would have been even cooler with its ability to block every single address except for the few that are in fact valid. In this case, however, he had a number of variants of addresses he used so it wasn’t a practical choice.
• Add to smtpd_recipient_restrictions the line
  

  check_recipient_access hash:/etc/postfix/maps/access_recipient

  and created the file /etc/postfix/access_recipient containing

  postmaster@domain.ie  REJECT
  MAILER-DAEMON@domain.ie       REJECT

  and then ran postmap access_recipient as root. I should note I did not put a line like domain.ie OK which would have let all other mail for the domain go through—but usurped any other rules that smtpd_recipient_restrictions may try to do after my access_recipients entry.

• I created a /etc/postfix/access_sender file with the lines below. The first was used because his server will never receive mail from someone in his domain.
  

  domain.ie       REJECT
  MAILER-DAEMON@  REJECT
  MailerDaemon@   REJECT
  abuse@          REJECT
  admin@          REJECT
  Administrator@ REJECT
  autoresponder@  REJECT
  bounce@         REJECT
  info@           REJECT
  majordomo@      REJECT
  Majordomo-Owner@ REJECT
  nobody@         REJECT
  postmaster@     REJECT
  savrequest@     REJECT
  senderchallenge@ REJECT
  spam@   REJECT
  vacation@       REJECT
  

  Then I had to run postmap access_sender as root. In main.cf, for smtpd_sender_restrictions I added

  check_sender_access hash:/etc/postfix/access_sender

  as well.

• I found I wanted to add some rules that used regular expressions. After installing the postfix-pcre Debian package, I created a new file /etc/postfix/access_sender.pcre with the lines
  

  /.*bounces\@/   REJECT
  /confirm-return.*\@/    REJECT

  and in main.cf gave smtpd_sender_restrictions yet another entry of

  check_sender_access pcre:/etc/postfix/access_sender.pcre

• Following the hints from a post by Justin Mason, I created a new file /etc/postfix/header_checks and gave it the lines
  

  /^Content-Type: multipart\/report; report-type=delivery-status\;/       REJECT no third-party DSNs
  /^Content-Type: message\/delivery-status; /     REJECT no third-party DSNs

  A second file, /etc/postfix/null_sender, had

  <>      550 no third-party DSNs

  In main.cf I gave the smtpd_sender_restrictions list the new entry of

  hash:/etc/postfix/null_sender

  and also added a new line defining header_checks as

  header_checks = regexp:/etc/postfix/header_checks

  Finally I had to run postmap null_sender as root.

• In master.cf I had to adjust the smtp unix and relay unix entries to only do 2 processes, not the default of 20, since having my machine try 20 simultaneous connections to his machine wouldn’t help. Under each, respectively, I had to add
  

  -o smtp_destination_concurrency_limit=2

  and

  -o relay_destination_concurrency_limit=2

  I’m still not positive if the maximum of 2 processes would make these options necessary. I should note that this particular system I was setting up did no other mail delivery, so this change was okay. If you’re doing this on a fully production-level host, you might find a different way to throttle the delivery connections going to a specific host, instead of this change which makes all outgoing mail connections happen only two-at-a-time.

• He’s closed port 25 on his router to try to at least stop the flood. Instead, he’s opening a random port number (like 1767) and having it listen there for new mail. I’ve made postfix deliver it by creating a /etc/postfix/transport file with the lines
  

  # 20080327 help fight the flood, tunnel the mail to its real destination, e.g., his server is 1.2.3.4
  domain.ie     :[1.2.3.4]:1767
  .domain.ie    :[1.2.3.4]:1767

  and ran postmap transport as root. Into main.cf I added

  transport_maps = hash:/etc/postfix/transport

• After all of this was done, I had to do postfix restart

The end result, with Justin’s rules in particular, has had thousands and thousands of attempts get blocked trying to get through the door. Some still trickle through, even after the amavis/clamav/spamassassin content filter has processed them.

This is the final accumulation (with a few I already had):


smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/access_sender,
check_sender_access pcre:/etc/postfix/access_sender.pcre,
hash:/etc/postfix/null_sender

header_checks = regexp:/etc/postfix/header_checks

## Steps from http://www.akadia.com/services/postfix_spamassassin.html
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks,
reject_unauth_destination,
reject_unauth_pipelining,
reject_invalid_hostname,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_unknown_sender_domain,
reject_unknown_recipient_domain,
check_recipient_access hash:/etc/postfix/access_recipient,
check_recipient_access pcre:/etc/postfix/access_recipient.pcre,
check_policy_service inet:127.0.0.1:60000,
permit


(The check_policy_service line is for my use of postgrey, another simple step which drastically reduced the amount of spam my own server was getting.)

Please let me know if any of the instructions above prove to not work out properly for you.

P.S. A command I found handy watching the logs to see what was getting through for attempted delivery, even after everything above:

sudo tail -f /var/log/mail.log | egrep -v '((RCPT|connect(ion)?).* from |smtpd_peer_init)'

For the longest time I’ve been sticking with having to only ever visit www.ros.ie using W1ndow$ on my laptop. Being self-employed, every two months I have to give some tax to The Man.

This time, I decided to look again to see if anyone has discovered a way to do this without that other OS. Luckily, I found some notes by Andrew S. Townley explaining exactly how. He’s found the link into the ros.ie site to get at the actual KCrypto Java applet that it uses (and claims fails to start).

As described, I put it into /usr/lib/jvm/java-6-sun-1.6.0.03/jre/lib/ext and restarted Firefox. Now the login page on the site worked fine, and I could get in. Yay!

P.S. I’m doing this under Ubuntu 7.10 (Gutsy Gibbon).