nion's blog

I just tried the new 10 beta version of opera and I have to say it feels shitty (or at least not better than older releases).
One of the new features that was announced by the opera people is a configurable speeddial. There are 3 new things I noticed. The first thing is a configuration dialog which allows you to change the number of speed dials:


While some people might find this nice it somehow sucks as the values are predefined and there is a much more flexible way of configuring that (~/.opera/speeddial.ini):

With 10 beta you can also hide the speeddial. This is really neat as this wasn't possible before from what I know and some people seem to don't like it.
The dialog also allows you to set a background image to your speeddial. WTF, this is a browser, not my desktop

Another new feature I noticed is the possibility to expand the tab listing and pull it down so they show up with included screenshots.

There is no shortcut to open/close this but you have to do this with the mouse + I think this is really annoying while browsing, it's just too big and doesn't add much information while it's open if you don't intend to change the tab.

The most positive impression is that this version finally scores 100% in the acid 3 test!

One new feature left that really bugs me: Opera Turbo (F12). With this enabled opera behaves like opera-mini meaning you are sending every HTTP request to an opera server, get it back compressed and you render the compressed version. This should be useful for people with low bandwidths. I have no idea if this is more effective than just switching of images or other parts of the content but this is really a security/privacy no-go. For mobile devices it might makes sense as the bandwidth is almost always limited (though there is a lot of change in progress) but for desktop end user browser!? At least there should be a big fat privacy notice pinned to this option and naming it Opera Proxy instead of Turbo would also be very nice!

UPDATE: another thing came to my mind, what about censorship in countries? Does the opera compression server enforce laws from countries? If not Turbo is at least a nice and end-user friendly way to avoid censorship in the www.

Its always a special moment if you learn a new parameter of a command you use for ages. In this case its the -P parameter of cd.

Imagine you have a path like /some/path/which/is/pretty/long and you have /some/path/which/is/pretty/foo.
Both are directories and you have a symlink from ~/bar to the long directory and want to access the foo directory.
Because I am lazy I tried cd bar and then cd ../foo and ran into:
cd: no such file or directory: ../foo

I really wondered about this because .. should be always a hardlink.

As cd is a shell-builtin in most cases because changing the directory in a subshell would not have any effect I looked into SUS and it turned out that there is a command line switch in cd for this:

If the -P option is in effect, the cd utility shall perform actions equivalent to the chdir() function, called with curpath as the path argument. If these actions succeed, the PWD environment variable shall be set to an absolute pathname for the current working directory and shall not contain filename components that, in the context of pathname resolution, refer to a file of type symbolic link. If there is insufficient permission on the new directory, or on any parent of that directory, to determine the current working directory, the value of the PWD environment variable is unspecified. If the actions equivalent to chdir() fail for any reason, the cd utility shall display an appropriate error message and not alter the PWD environment variable. Whether the actions equivalent to chdir() succeed or fail, no further steps shall be taken.

BTW, the csh is not susv3 complaint here it will do what I expected first without using -P.

Just stumbled upon didtheyreadit a service which claims to be able to track sent email not depending on the mail client. You just set from which address you want to send mail from and send your email to user@host.didtheyreadit.com and then you can track the email via a web interface:



I was interested in how they do it and if it really works with every mail client which I couldn't believe.
If you send your mail to .didtheyreadit.com you of course lose your privacy and they resend the mail for you to the server attaching their "tracking".

So lets have a look at the email.
All they do is converting your mail into multi-part message adding an HTML part which includes an additional:

<div><img src="http://e-mail-servers.com/SOMESESSIONIDworker.jpg" nosend="1" name="dtri" width="1" height="1">

Your email client will then make an HTTP request to the 1x1 pixel big embedded image (well at least if you use a crappy one or webmail) which causes to update the status of the mail in the webinterface. So this is really a lame way of making money and use the fact that there are still enough stupid people out there enabling reading and writing of HTML mails
The "nosend" parameter is an invention by Microsoft Outlook which causes Outlook to not rewrite image URLs (it's not included in the standard).

So this is just a trivial web bug.

Interesting is also that if you encrypt your mail and send it to .idtheyreadit.com it will get lost

Note to self: Installing build chroots on Debian quick&dirty (here testing and unstable).

Package: schroot
Description: Execute commands in a chroot environment

schroot allows users to execute commands or interactive shells
in different chroots. Any number of named chroots may be
created, and access permissions given to each, including root
access for normal users, on a per-group basis. Additionally,
schroot can switch to a different user in the chroot, using PAM
for authentication and authorisation. All operations are logged
for security.
.
Several different types of chroot are supported, including normal
directories in the filesystem, and also block devices. Sessions,
persistent chroots created on the fly from files and LVM snapshots
are also supported.
.
schroot also integrates with sbuild, to allow building packages with
all supported chroot types, including sessions.
.
schroot shares most of its options with dchroot, but offers vastly
more functionality.

$ apt-get install schroot cdebootstrap
$ mkdir -p /home/chroot/{sid,testing}
$ addgroup sbuild && adduser nion sbuild

$ cat > /etc/schroot/schroot.conf << EOF
[sid]
description=Debian sid (unstable)
location=/home/chroot/sid
priority=3
groups=sbuild
root-groups=root
aliases=unstable,default
run-exec-scripts=true
run-setup-scripts=true

[lenny]
description=Debian lenny (testing) 32-bit
location=/home/chroot/testing
priority=3
root-groups=root
groups=sbuild
aliases=testing,lenny
run-exec-scripts=true
run-setup-scripts=true
EOF

$ # the necessary setup apart from binding directories will be done by schroot now
$ # stable chroots are added in the same way

$ cat >> /etc/fstab << EOF
proc /home/chroot/sid/proc proc defaults 0 0
/home /home/chroot/sid/home none bind 0 0
proc /home/chroot/testing/proc proc defaults 0 0
/home /home/chroot/testing/home none bind 0 0
EOF

$ cdebootstrap --arch i386 testing /home/chroot/testing/ http://ftp2.de.debian.org/debian/
$ cdebootstrap --arch i386 sid /home/chroot/sid/ http://ftp2.de.debian.org/debian/
$ # you need to add (if you are not using unstable)
   Suite: lenny
   Config: sid
   to /usr/share/cdebootstrap/suites, unfortunatly it wasn't added before the etch release.

$ mount /home/chroot/sid/proc && mount /home/chroot/sid/home
$ mount /home/chroot/testing/proc && mount /home/chroot/testing/home

Et voila
$ schroot -c sid
build:~#

You don't need to be root to execute this and you have your home directory available in the chroot because of the mount bind.

The host used for bootstrapping is automatically added to your sources.list in the chroot but you need an apt-get update to install packages afterwards. Suggestions welcome.

The LSB functions in Debian can do fancy and non-fancy output. However, the output is not really fance compared to grml, gentoo and Ubuntu. They have these nice, colored ok or fail messages in brackets
If you are like me and you always want to have the coolest bling bling Try this patch:


Of course this only works for init scripts including and using the lsb functions (should be most of them).

The Googlewatchblog shows how you can use Googles password test script to find
out how secure your own password is.

To use this, go to https://www.google.com/accounts/RatePassword?Passwd=

Ok thought I try it out with the password 'hgd', the result is funny, it says 4 (0 is the lowest security, 4 the highest).

Ok lets test this.

1. #include <unistd.h>
2. #include <stdio.h>
3.  
4. int main (void){
5.     const char *pass="hgd";
6.     const char *user="foo";
7.     printf("%s:%s:2305:0:99999:7:::\n", user, crypt(pass,user));
8.     return 0;
9. }

The code produces a basic shadow(3) line like we all have on our Linux installations with the crypted value of 'hgd'.

gcc pwd.c -lcrypt; ./a.out > file; sudo john file

Loaded 1 password (Standard DES [48/64 4K])

hgd              (foo)

guesses: 1  time: 0:00:00:06 (3)  c/s: 97211  trying: w9s - szs

sudo john file  5,42s user 0,04s system 90% cpu 6,046 total

Wow thats really a secure password!!!
Tested on my 2 years old notebook.
Ok google tests it for web applications and not for login data on your operating system but
this fact makes it even easier to gain access since every basic wordfile could brute force this.

I hope noone uses this script to test his passwords...