Debian Basement
Sunday, December 30th, 2007My wife is a pretty good paintress and for Xmas painted a Debian logo at the wall of my basement terminal room. Now that’s comfy. ![]()
My wife is a pretty good paintress and for Xmas painted a Debian logo at the wall of my basement terminal room. Now that’s comfy. ![]()
Just wanted to drop a tip on you about the Firefox keyword search feature. I use it to quickly access packages.debian.org on package information or to retrieve the BTS page for a bug number. With it you can use “bts 123456″ instead of “http://bugs.debian.org/123456″. May not appear much shorter but I like it anyway. Here an example on how to add a search keyword for packages.debian.org:

So basically getting the package page for this “cream” package means pressing Ctrl-L to highlight the location bar and just enter “pdo cream” and pressing Enter.
For me that was the second most valuable tip when using Firefox. The best tip would probably be how to make that monster take less than 10 seconds to react to mouse clicks on the menus when you have 20 tabs open simultaneously and to consume less than ridiculous 500 MB RAM or freeze up every minute when you use flashy sites like youtube. I really wish 3.x will finally fix that.
P.S. I wonder why wordpress shrinks all my images. I hope you can still guess what I meant.
Now this has really been a waste of time. Months ago I convinced myself that NIS isn’t really a modern way to keep my user accounts network-wide - be it even only my home network. So I tried libnss-ldap and read wiki.debian.org on LDAP and literally found dozens of documents that describe how to do LDAP authentication for your users with NSS. Unfortunately most of them didn’t work for me. But finally I managed to get it working (after a few days) and was happy.
And then came the day that I decided to install Etch’s security updates and upgraded libnss-ldap 251-7.5 to 251-7.5etch1 in the process. Everything seemed to work well and I could log in. Just that Postfix somehow refused to deliver mails locally any more. The “local” daemon died repeatedly. After some careful Postfix debugging I found that I get a traceback that ended with “0×404841d8 in ?? () from /lib/libnss_ldap.so.2″. To cut a long story short: the upgrade set a “binddn” in the “libnss-ldap.conf” but no “bindpw”. But what really seemed to get Postfix mad was that the “libnss-ldap.conf” wasn’t readable for all any more (0600). Apparently the current libnss-ldap package in Sid sets that permissions right but on Etch that has really broken things. Recommendation from #postfix: “dont you never ever let debconf manage LDAP”. Not good.
No idea how that happened as I’m pretty new to nss and ldap but I wished I could have spent that evening differently. So in case anyone else happens to encounter “postfix/qmgr[10043]: warning: premature end-of-input on private/local socket while reading input attribute name” then try to “chmod a+r /etc/libnss-ldap.conf”. Just check that you don’t have a bind password in there.
Once I fully understand that I’ll check if I can contribute to the Debian wiki article or was just too dumb. If I were sure what’s going on I’d file a bug report, too.
Time and again I find myself in a hot discussion with others who claim that security by obscurity is a bad thing. SbO means gaining safety by hiding things. Don’t get me wrong - I love open-source software and although I have never taken a look at the Linux or Firefox source code I trust it way more than Windows and the Internet Explorer (that are even less functional). But it’s with no doubt harder to find security bugs in something that you can’t look into. Playing around with different HTML pages thus finding ways to exploit the application is surely harder with the IE than by analysing Firefox’ source code. And what about your password? You are hiding your password from me. Does it make your data safe? Or the PIN code of your credit card? Or why do people run a knockd to protect access to their servers? Those are just various degrees of security gained by keeping information to yourself. I don’t think there is much difference in whether the secret is a password or some piece of code.
In my humble opinion there are hardly any cases where security is not gained by obscurity. With PGP for example. I believe in mathematical one-way functions. My passwords are way safer in a PGP-encrypted file than by putting them into a file at /usr/lib/nobodyfindsme.so.3. And even with PGP you could argue that it’s just knowledge that someone else does not have that protects your information. But my PGP passphrase is way more complicated than my usual account password. And the private key it protects is insanely large. So I consider these to be an acceptable security measure.
The discussion arised when I received complaints that the source code of the CGIs used for mentors.debian.net was not made public. When I tidied up the code and published it finally I suddenly found a secret password in the code and quickly removed it.
mentors.debian.net hasn’t been hacked in years but now that the sources are publicly available I fear for that a tiny bit. The next projects that will be made open-source will be available publicly right from the start so that people may rather help me close security bugs. It would at least make me feel better.
There is but one argument that I would agree upon: it’s silly to rely on SbO.
I’ve been a VIM lover for at least a decade. Nothing beats it at doing complex text editing. Surely it’s not intuitive (although I frequently claim that VI stands for “very intuitive”) but no other text editor can so quickly repeat the last action or reformat a paragraph or insert text at a certain column in every line etc. I am very fast with it and happily ranted at IDEs like SPE, Eric or WingIDE for having such a bad text editor. They were more like a NOTEPAD.EXE that allowed you to navigate with the cursor keys and insert text where you are. But I have to admit that IDEs have a lot of advantages like code completion (vim doesn’t understand Python - not even with omni-completion), templates or dealing with your repository software.
I love cryptic hardcore tools because once I understand them I’m very fast in accomplishing tasks. But even after a decade of using VIM I don’t really understand its configuration or some more advanced features properly. Recently I tried to tell a Python file that I simply like the textwidth to be 100 by adding
:vim:set tw=100:
at the end of the file. No idea why that didn’t work. The command worked well when typed manually.
In addition many basic features like editing multiple files at the same time became a chaos quickly. Multiple buffers? Nah. Tabs are nice but after a certain amount of open files you have to use the arrows to find your file again. Syntax coloring is nice but customizing it is a pain. VIM is great for editing single files and I will always use it to work on DNS zone files for example. But since I develop Pylons (a Python web framework) applications I have to deal with many open files and complex Python code. I tried “pida” which is very promising but is still lacking. For example it doesn’t remember the window panes as I want to have them arranged and find myself moving around things every time I start it up.
I wouldn’t have expected to hear myself saying that vim is not good for all tasks. I had always condemned editors for not being vim and wasn’t open for all the features that I was missing out. Currently I’m trying out “kate”. I had expected it to be a stupid text editor like NOTEPAD.EXE or joe but although it looks similar it is very powerful. Some things I like about it:
Kate doesn’t do all things that vim can. But the common tasks are made simpler and more comfortable. No idea if it will be my new editor. But it appears like other text editors besides vim are also worth being tried.