Sound Card Third Victim in Amp’s Killing Rampage; Suspect Remains At Large

April 30th, 2008 by Dan Fuhry

Yep. Now I’ve lost the sound card too. Needless to say I think this Pioneer amp is too fast and too furious. So I’m gonna be removing it from my lineup. Now all I have to do, is convince Logitech to send me another set of speakers, which I know I’ll get right this time.

There’s only one problem: I’m now stuck with the crappy AC ‘97 audio built into my motherboard and I lack a MIDI port, something that I use extensively. So I’m gonna be looking around for a half-decent sound card and probably a job to pay for it (and possibly *more* new speakers). Looks like fate has finally caught up with me.

Posted in X-540 speakers | No Comments »

216 days, 17 hours, and one big fat panic

April 29th, 2008 by Dan Fuhry

216 days and 17 hours. That is how long my server was up without interruption according to the uptime command as of this afternoon. Not bad for an area that gets power outages like crazy this time of year (it hasn’t happened in exactly that many days).

The important thing is that I beat Neal Gompa’s record, 200 days. We’ve been in friendly competition about it for quite a while now and I was quite excited when uptime counter finally reached 200 days. There is a good and valid reason that it’s over now.

Last night I was fiddling around with NFS shares trying to make the Ubuntu live CD bootable with PXE. (I have no life. :P) Unfortunately I messed something up and got rpc.mountd to deny all mount requests, thus locking me out of 80% of my home directory from Nighthawk, and messing up my network boot system which uses Pelswick as a TFTP server. A reboot looked more and more imminent as I could not seem to get nfsd to unload (it’s built as a kernel module). Today in the late afternoon I took Bigmomma to runlevel 1 and gracefully stopped enough services to be able to peacefully umount /home, after which nfsd unloaded.

The problem came when I remounted /home and realized that I had been meaning to mount it with extended attribute (xattr) support enabled. I realized that I had not done this and once again umounted the device. When I did so, I got a big fat kernel panic, the first one I’ve seen in kernel 2.6.14.

So I let it sit there for a minute thinking about all that the server had been through during the last 216 days and decided that Bigmomma was about due for maintenance. So I turned the system off, pulled out the CD burner and 3.5″ floppy drive that were only used during the installation, blew 7 months’ worth of dust out of the case, replaced the cover, and booted her back up. She’s happily serving files and web pages again. :)

I did end up with a few “double free or corruption” messages from rpc.mountd so NFS isn’t quite perfect yet. It’s still a little unsteady even after recompiling the nfs-utils SRPM. Still working that part out.

Posted in Uncategorized | No Comments »

Logitech X-540 speakers: a bad experience, start to finish

April 28th, 2008 by Dan Fuhry

Well, whaddya know. I suppose that I’ll have to rewrite a little of my story but I think it will be better now that it’s more complete.

Basically what happened is I got two dead babies. One of ‘em was shipped from geeks.com and the other straight from Logitech. Both were completely dead on arrival. That’s the short version.

The long version is this: I ordered a new set of Logitech X-540 speakers from geeks.com for $115 including shipping. They were all that fit in my budget, and I figured they would be okay for the price. They came in and I got them all installed and they were working OK for an hour or two. I was adjusting some cables on my amp when it accidentally got switched to FM mode and started sending static to them - moderately loud static.

Now, mind you, this has happened to my old speakers, in fact they took tons more abuse than even that. But the fact that Logitech makes their DSP boards *that* cheap is just insidious. The speakers immediately stopped working, with strange noises being produced when turning the volume control and several other weird problems. IMHO for $115 these things should be able to withstand that. If I remember correctly they weren’t even turned up all that loud, which means absorbing that signal should not have been a problem.

Since the item got shipped manufacturer-direct, I contacted Logitech and they said that I had a defective set. Understandable. They also told me to go back to the seller since I had the item for less than 30 days. The resulting e-mail conversation was quite a funny one:

Support rep: “Please reply back to this email if you have purchase the X-540 speaker system for more than 30 days. The replacement unit will come from us if you have purchased the speaker system for more than 30 days. I look forward to your reply.”

Me: “According to my records I placed the order on April 12, 2008. I’ll e-mail back and re-open the support case on May 12 or so if I don’t have any luck with geeks.com. Thank for getting back so fast last time, I really appreciate it!”

Support rep: “Thank you for taking the time to reply my email and elaborating further on your issue. Since 30 days has passed since you have purchased the X-540 speaker system, I would like to proceed with issuing a replacement unit for your defective X-540 speaker system. In order to proceed with this, please provide me with all the details below.”

Me: “Attached is a screenshot of the order history window showing the purchase in question. Again from my previous message, I placed the order on April 12, 2008. So a month has not in fact passed yet since my order. The retailer from which I purchased the set has not replied to my message that I sent a week ago as of today, so as far as I’m concerned Logitech is not obligated to send out a new set until approximately May 12 assuming the retailer chooses not to provide support. Thank you again for the support.”

Support rep’s boss two days later: “Your fulfillment has been shipped. The following products were included: 1 | X-540″

No tricks, no cheating, that’s what really happened. They said it would take 10 to 14 business days to process; it took 1. That was a good sign, +1 for Logitech’s customer support.

Now if only their products were half as good. The new set was dead on arrival - I got absolutely no sound out of it and saw that the power LED was dimmer than it should have been. What a mess. So I now have two completely unusable subwoofer units and 10 satellite speakers sitting in my basement waiting for me to learn their fate.

I hope Logitech takes this as a lesson. No doubt that they built good speakers - the construction is solid and setup is straightforward and simple. But there is a huge problem with the circuitry that drives those speakers, and that is that it’s just way too cheap. It can’t handle even a normal signal - one would have to turn the output volume on their PC down just to avoid overloading the circuitry. That’s a problem because most users will leave the software volume all the way up and control the audio volume with the physical knob on the control pod.

Either way, I’ve e-mailed both geeks.com and Logitech about this and am waiting for them to reply. Chances are that if one doesn’t do something then the other will, but the worst that could happen is me being out $115 and learning an important lesson: to avoid Logitech hardware at all costs.

Posted in X-540 speakers | No Comments »

Database accident, some stuff lost

April 19th, 2008 by Dan Fuhry

Due to a little problem with my MySQL management script I just did the unthinkable and accidentally dropped the database for this blog. Not pretty, but I gotta deal with it. The most recent post I made a few days ago is gone, but that’s it, the rest is in Google’s cache, and posts since October were just restored from a full database backup I made. (Yeah, I’m due for another one. Long overdue, really, considering the fact that I’ve been so good about keeping Germantown backed up. Silly me…)

So things are going to be a little hairy for a few days. I will have to manually restore a lot of posts, which will take time. Hang tight.

Posted in Uncategorized | No Comments »

200 days and counting

April 12th, 2008 by Dan Fuhry

I’m immensely proud to announce that Bigmomma has just hit her 200th day of local uptime. This is a huge milestone for me because I’m starting to feel like I’m getting a handle on server administration now, and keeping her up for this long shows that I’ve got her at a state where I think she is at a very reasonble level of stability and security. She’s been running kernel 2.6.14 on Fedora Core 4 for all this time, and so far the issues I’ve had have been either human error or really minor bugs.

This also means that the power service is fairly stable where I live. I don’t have the spare funds for a UPS at the moment (had to spend all my spare change on new speakers - more on that in a minute), so all I’ve got in terms of power protection is a $40 surge protector. I wouldn’t be surprised if a thunderstorm knocks her out sometime in the near future, but that’s OK because 200 days was Neal Gompa’s record, and we’ve been in neck-and-neck who’s-the-better-sysadmin competition for quite a while now.

So is it really healthy to have a system up for 200 days like this? The answer to that is I don’t know. I think that powering up a server can be intense on the components, specifically the disks, but I also have to wonder if it’s good to let a server take a breather once every few months. Right now I’ve got her load (both CPU and I/O) pretty low since she’s just serving a few web pages. The RAID array, nearly a year old by now, is holding up great and seems to actually be faster than the SCSI disk.

Oh yeah, my speakers gave out on me today. All of ‘em. The 2.1 set I had in the front has been dying for years and they’re finally just not consistently working, plus now my right rear speaker started to sound insanely distorted. Serves me right for being a cheapskate about it, I picked both rear speakers and the deck up for $5 at a garage sale. Someone gave me a Pioneer VSX-5000 amp (mfg. 1986), which I doubt will be compatible with the system I just ordered based on advice from Neal. It’s not the best solution I know, but it was all that would fit within my budget. (And no, I didn’t use money donated to Enano on the speakers. Planning to put that towards a HotScripts sponsored listing when the time is right.) Those will be arriving sometime next week I suppose, so until then I’m stuck on a pair of old computer speakers I pulled out, hackishly hooked into the amp with the bass turned up insanely high. The one thing I can’t figure out is surround on this amp. I can’t seem to figure out how to get a genuine 4-channel input working, something that I’m sure is there but hidden deep within the users’ manual, something that I didn’t get a copy of. Any ideas on how that could be done guys?

Posted in Uncategorized | No Comments »

Doing crypto research? Avoid the Touch

April 8th, 2008 by Dan Fuhry

I recently tried testing my Diffie-Hellman demonstration script on Lil’ Beastie and only now have I become aware to how awful the Javascript engine on there really is.

Mozilla was wrong. The Javascript engine is not 10 times slower - it’s about 50x slower. It took my iPod Touch 88.9 seconds to calculate the Diffie-Hellman public key and shared secret, while Pelswick did it in 1.8. And Safari… returned the wrong MD5 checksum. So it’s like me in 1st grade: slow, and when you finally do get it to cooperate, it gets the wrong answer.

Apple, listen to me. Get this right. If you’re wondering I’m using Leemon Baird’s BigInt library for the complicated math stuff and my own home-baked code that’s basically a wrapper for BigInt that makes doing Diffie-Hellman math easier. It’s worked on every other platform I’ve tested it, even IE 5.5. (The rest of Enano’s JS code fires a kill switch on IE <6.) And I’m appalled that you broke it that badly while porting WebKit, which of course is the core of Konqueror, a platform I thoroughly tested on. Since Javascript is an interpreted language I think it’s fair to say that it needs to work exactly the same on the AppleMobile platform as well as on the desktop. Any takers?

Posted in Uncategorized | No Comments »

Enano and CSRF

April 2nd, 2008 by Dan Fuhry

Enano was designed from the ground up for security from forged requests, XSS, and hacking attempts. CSRF, or Cross-Site Request Forgery, is a type of attack that involves tricking a user into submitting a form on a remote site and performing an action that could be considered dangerous - for example, changing a password - without confirmation. This brings up a few questions and I wanted to go through how Enano protects against such requests.

Enano has no specific specialized CSRF-foiling system like PunBB does. In fact, the string “CSRF” never even appears in the Enano source code. So how does it protect against this type of attack? That’s something that I’ve been considering for a long time. Remember that the high-privilege session key that is used when a password is changed or the administration panel is accessed is strictly enforced - because all administration pages use the same API, that API can check for the session key, which is *always* required to be on $_GET or $_POST - never in a cookie. Since the keys are only valid for 15 minutes (but with renewal and keep-alive), and an attacker would need a session key in order to POST DATA at all to the Admin namespace, I believe that this part of Enano is fairly secure against CSRF attacks.

The potential issue comes when you get into everyday actions like saving a page and logging in or out. It is true that one could save a page with only a valid login cookie and a properly constructed JSON request. So there is a small amount of risk here. But remember that Enano logs all changes that are made to pages. If a page is deleted or otherwise changed through CSRF, the person that accidentally changed the page can restore it.

So what are the ups and downs of this? The advantage is that CSRF is almost always either reversible or results in the action being cancelled from a very low-level part of the Enano API. The carefully planned implementation saved Enano from this type of attack even though I didn’t even fully understand it when I implemented the current session management code. The downside, of course, is the ~300-byte encrypted session key you have to send on top of the URL. Can’t have everything, I guess.

Posted in Uncategorized | No Comments »