Yesterday Damon wrote a great article on how to secure your system for unblock-us and I followed his lead.

My only machine runs Mac OS, so I had to do a bit of research…

Step 1: run bind

Following these instructions:


sudo -s
rndc-confgen -b 256 > /etc/rndc.conf
head -n5 /etc/rndc.conf | tail -n4 > /etc/rndc.key


Make sure the ports match.


launchctl load -w /System/Library/LaunchDaemons/org.isc.named.plist
echo "launchctl start org.isc.named" >> /etc/launchd.conf


Step 2: configure

I didn’t need any fancy setup, so I pasted everything into /etc/named.conf:


//
// Include keys file
//
include "/etc/rndc.key";

zone "hulu.com" {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};
zone "unblock-us.com" {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};


Step 3: verify

Check for typos in the configuration:

named-checkconf /etc/named.conf

and check if we get new results. Before nslookup returned:

$ nslookup hulu.com
Server: 10.255.255.4
Address: 10.255.255.4#53

Non-authoritative answer:
Name: hulu.com
Address: 63.150.131.26
Name: hulu.com
Address: 63.150.131.11


Now I get:

# nslookup hulu.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: hulu.com
Address: 184.154.113.147
Name: hulu.com
Address: 50.22.86.53
Name: hulu.com
Address: 173.208.155.19
Name: hulu.com
Address: 173.208.170.19


First, problem description.

• At home,you have a FritzBox or similar DSL router that lets you specify a dnydns server.
• For some reason, you don’t want to use one of the predefined services, e.g. dyndns.org.
• But you have a webserver somewhere in the internet with a domain and some webspace where you can run PHP scripts.
• You don’t care whether the real DNS entry (domain name service) is changed, as long as your customers or whoever gets to see the right page. So this is not going to be a real dynamic DNS entry, but just some sophisticated redirect mechanism.

My FritzBox allows to specify a user-defined server to use for DynDNS. But I didn’t know how it would notify this server about my home IP address. I couldn’t find any documentation about this anywhere. So I wrote a script to print all the information about the request into a log file. This is what I found:

• The FritzBox lets you specify username and password for the dyndns server, but neither is transmitted in the request parameters (GET or POST). This led me to think of HTTP authentication instead (authentification is needed if you want to control who can set the IP address for dyndns).
• Also, the FritzBox’s IP address is not transmitted in the request parameters, but this is superfluous as you can get it from the server parameters ($_SERVER["REMOTE_ADDR"] in PHP).

So what do you need?

First, a .htaccess file to specify authentication for the dyndns script:

# put the name of the PHP script you're about to write here:
<Files "dyndns.php">
   AuthType Basic
   AuthName "Authentication for clients that want to connect to this dyndns server."
   # the name of the password file (see below):
   # Specify the absolute path, or the path relative to the server root!
   AuthUserFile /full/path/my-passwords
   # the username of your choice:
   require user dyndnsuser
</Files>

You need to create the my-passwords file using the htpasswd utility that comes with the apache webserver installation. To create a password file called “my-passwords” with a user “dyndnsuser”, use this command on the shell command line:

htpasswd -c my-passwords dyndnsuser

It will let you type a password.

Now only clients with the correct username/password authentication will be able to call the dnydns.php script. Such as your DSL router.

Then, the script itself, here called dyndns.php:

<?php
# this include file contains some helper functions:
include("dns-functions.inc");    

if ( readIpFromFile() == getIpFromRequest()) {
  header("HTTP/1.1 304 IP address didn't change", true, 304);
  message("no change in IP, address is " . getIpFromRequest() . "\\n");
} else {
  if (writeIpToFile()){
    header("HTTP/1.0 200 OK", true, 200);
    message("change successful, new address is " . getIpFromRequest() . "\\n");
  } else {
    header("HTTP/1.0  500 Error writing file or similar", true, 500);
    message("error writing file or other.\\n");
    exit;
  }
}
?>

The dns-functions.inc include file with the helper functions:

<?php
# name of the file where the IP address will be stored:
$ip_file = "./ip";

# write debug stuff to a logfile
function message($text) {
  $file = fopen("dyndns.log", "a");
  fwrite($file, $text);
  fclose($file);
}

# get IP address from request parameter, or if none is given,
# from the REMOTE_ADDR parameter
function getIpFromRequest() {
  # just in case the IP _is_ in the request parameters, you never know:
  if (isset($_GET["ip"])) {
    return $_GET["ip"];
  }
  if (isset($_POST["ip"])) {
    return $_POST["ip"];
  }
  # if it's not, we get it from the remote address parameter:
  return $_SERVER["REMOTE_ADDR"];
}

# read the IP address from the file.
function readIpFromFile() {
  global $ip_file;
  if(file_exists($ip_file)) {
    if(filesize($ip_file)>0) {
      $file = fopen($ip_file, "r");
      $ip = fread($file, filesize($ip_file));
      fclose($file);
      return $ip;
    }
  }
}

# write the IP to the file. will return 'false' if there is a problem.
function writeIpToFile()     {
  global $ip_file;
  $file = fopen($ip_file, "w");
  $result = fwrite($file, getIpFromRequest());
  fclose($file);
  return result;
}
?>

This PHP stuff was inspired by Michi’s dyndns script.

You may want to add the following to your .htaccess file to prevent people from spying out your setup:

<Files "dns-functions.inc">
  deny from all
</Files>

<Files "ip">
  deny from all
</Files>

<Files "my-passwords">
  deny from all
</Files>

All the stuff you have written so far can be placed anywhere on your webspace, as long as you specify the complete URL path to the dyndns.php script as the “update URL” in the Fritzbox Dyndns configuration.

So now the FritzBox can pass it’s IP address to your webserver. In my FritzBox’s log file, there was no message if this process was successful, I only saw log entries if something went wrong (in which case I had to look at the dyndns.log file the script writes on the webserver to check what happened).

But what then? How do we set up the webserver to actually direct requests to the FritzBox’s IP? You will need a directory and/or a subdomain on your server which to use for the redirect, so you can type something like fritzbox.mywebserver.com or myserver.com/fritzbox to be redirected to your FritzBox.

There are several possibilites to do the redirect.

1. Return a “Location” header informing the client that the document he’s looking for is somewhere else.
to do this, you’ll have to create an index.php script in the directory or at the subdomain that looks like this:

<?php
# specify complete path to the include file if it's in another directory:
include("dns-functions.inc");
$newurl= "http://" . readIpFromFile();
header("Location: $newurl");
?>

Whenever a client goes to fritzbox.mywebserver.com, it will be redirected to your FritzBox’s current IP address (URL in the browser’s location bar will change).

2. Use a frame redirect. This is a little bit more subtle since the IP address will not show up in the browser’s location bar, but on the other hand, if the client navigates within the page, the browser’s location bar will not show that, either. It will always just show the main domain: fritzbox.mywebserver.com

In this case, the index.php needs to look like this:

<?php
include("dns-functions.inc");
$newurl="http://" . readIpFromFile();
?>
<html>
<frameset rows="100%">
  <frame src="<? echo $newurl; ?>">
</frameset>
<noframes>
  <body>Please follow <a href="<?echo $newurl; ?>">link</a>!</body>
</noframes>
</html>

3. Use Rewrite Rules. This will make the forwarding look most professional as the client/browser will only see the main domain and the redirect will happen on the webserver (like with a proxy). Drawback is that POST parameters are not passed on.

For the Rewrite Rules to work, you’ll have to adapt the dyndns.php script to make a change to the .htaccess file whenever a new IP is set. I haven’t tried this yet but I’ll let you know as soon as I figured it out

So how to get rid of this?

There is no simple solution like checking a box somewhere in the CUPS settings. But there is an easy solution nonetheless: you can define your own banner page as described in the CUPS FAQ.

Mine is now a plain text file and looks like this:

           Job Name: {?job-name}

          From User: {?job-originating-user-name}

       Printer Name: {?printer-name}

      Creation Time: {?time-at-creation}

You can also use a postscript file, though I haven’t tried how the {?parameter} thingies work there.

This file needs to go into /usr/share/cups/banner/, then you need to restart the cups-demon, and then you can select the new banner page in the CUPS settings at http://localhost:631, go to Printers->Administration->Default Settings->Banner.

This is then printed single-sided as it should be.

$ ps aux | grep randomprocessname
psycho 20429 0.0 0.0 11824 1580 pts/7 S+ 12:00 0:00 /bin/bash ./randomprocessname
psycho 20528 0.0 0.0 4188 740 pts/17 R+ 12:00 0:00 grep randomprocessname
$ pkill -9 randomprocessname
WTF? Kill that sucker!
$ pkill -9 randomprocessname
No typo... Am I crazy?
$ pgrep randomprocessname
What's wrong?
$ pgrep randomprocessna
20429
$ pkill -9 randomprocessna

For some arcane reason pgrep/pkill matches only the first 15 characters.


Name: does not matter
APN: internet.eplus.de
Proxy: <empty>
Port: <empty>
Username: eplus
Password: <empty>
Server: <empty>
MMSC: <empty>
MMS proxy: <empty>
MMC: 262
MNC: 03
APN type: <empty>


Update:

The recommended configuration is:


Name: does not matter
APN: internet.eplus.de
Proxy: <empty>
Port: <empty>
Username: simyo
Password: simyo
Server: <empty>
MMSC: <empty>
MMS proxy: <empty>
MMC: 262
MNC: 03
APN type: <empty>


After the initial success with the eplus configuration, I had some problems with it, too. But I guess these errors were internal eplus network hiccups because they were gone without me changing anything and now both configs work.

But thanks to the omniscient internet I found a solution. At the bottom of the “Keyboard & Mouse” preferences page is a setting which allows you to navigate only between text boxes or between all controls. I don’t know who came up with the great idea that the default should be “text boxes and lists only”, but I guess the mighty Steve knows what he is doing.

Rod Hilton explains it much better than I could ever do, why you should Pair-Program. But I haven’t heard about the “ping-pong pairing”:

When doing Test-Driven Development, one of the things we do is called “ping-pong pairing”. So the other developer will write a test, then make it compile but fail. Then he passes the keyboard to me. I implement the feature just enough to make the test pass, then I write another failing test and pass it back.

I have to try this on Monday…

• http://www.thingy-ma-jig.co.uk/blog/10-10-2006/mysql-drop-all-tables
• http://www.cyberciti.biz/faq/how-do-i-empty-mysql-database/
• http://knaddison.com/technology/mysql-drop-all-tables-database-using-single-command-line-command

However this does not work if there are foreign key constraints between the tables (because the tables constraining others need to be deleted first). Here’s the advanced version that solves this problem:

#!/bin/bash
USERNAME=myUser
PASSWORD=myPassword
HOSTNAME=dbHost
DATABASE=mydb
while (true) ; do
    TABLES=`mysql -h $HOSTNAME -u $USERNAME -D $DATABASE --password=$PASSWORD \
                  --batch -e "show tables" | grep -v Tables_in`
    if [ -z $TABLES ] ; then break; fi
    for i in $TABLES ; do
        mysql -h $HOSTNAME -u $USERNAME -D $DATABASE --password=$PASSWORD  -e "drop table $i"
    done
done

I agree this is not nice because it’s a brute force approach – but hey, it works! And resetting a database is most probably not a performance-critical task anyway.

Here’s what works for me:

<script type="text/javascript">
  window.onbeforeunload = function(){
    return "Did you save your stuff?"
  }
</script>

I have no idea why this behaves as it does, it must be one of those “very interesting ideas” Frank mentioned about javascript.

What it does is this: When the user presses the browser’s “x” to close the window, this dialog box is shown:

If the user presses Cancel, the box disappears and the browser window remains open, and if she presses Okay, the browser window closes (who’d have guessed). So far, so good. Unfortunately the message is displayed even if the user clicks on a link or submits a form (to do something within the webapp) .

So how do I fix this? The newsgroups said that I could add a condition to check if I really want to warn the user about closing, like this:

<script type="text/javascript">
  var hook=true;
  window.onbeforeunload = function() {
    if (hook) {
      return "Did you save your stuff?"
    }
    // no return value obviously means no dialog box.
  }
  function unhook() {
     hook=false;
  }
</script>

The default is to use the hook, and I can use the unhook() function to disable the hook. How does this help? How do I know when I want the hook disabled? Frank knew the solution, and it’s really very simple: I want to disable the hook whenever the user clicks on one of my own links or buttons within the webapp. This can be done by adding an onClick event to each link or button like this:

<a href="..." onClick="unhook()">Some link within my app</a>

At first it looks a bit cumbersome to change all the links and buttons, but in a webapp, most of the links will be written by some application code anyway so it’s not much trouble to change them all at once.

It’s a bit strange because what I’m doing here is programming some general behaviour (the hook) and then exclude all the common use-cases (internal links, by calling unhook()) because I can’t make javascript react to the few exceptions (browser close button) directly.

The final page looks something like this:

<html>
  <head>
    <script type="text/javascript">
      var hook = true;
      window.onbeforeunload = function() {
        if (hook) {
          return "Did you save your stuff?"
        }
      }
      function unhook() {
        hook=false;
      }
    </script>
  </head>
  <body>
    <!-- this will ask for confirmation: -->
    <a href="http://google.com">external link</a>

    <!-- this will go without asking: -->
    <a href="anotherPage.html" onClick="unhook()">internal link, un-hooked</a>
  </body>
</html>

Closing or re-loading the window will display the confirm box, too.

Use the following links to check that it works:
Don’t leave for Google before you leave a comment.
You shouldn’t be able to close this page without warning, either.

There’s one small problem left: if you click on the “leave a comment” link, the page will not be re-loaded because it’s just a page-internal link, and after that, the hook variable will be false and you won’t be asked for confirmation if you click on the google link again. But thankfully I don’t have these page-internal links in my webapp…

Addendum: Claus Augusti directed my attention to two official documentation sites about the onbeforeunload event. Thanks you! The documentation in the Mozilla Developer Center explains that one should not just return a string, but should assign a value to the returnValue property of the onbeforeunload event (browser-dependent), like this:

window.onbeforeunload = function (e) {
  var e = e || window.event;
  if (e) {   // For IE and Firefox
    e.returnValue = 'Any string';
  }
  return 'Any string';   // For Safari
};

This is contradictory to the example given in Microsoft’s documentation (returning a string is sufficient), and contrary to my experience with Firefox, but at least it helps to understand why this works at all.

Title: Ruby On Rails I18N Developer
Skills: I18N, Ruby on Rails, mySQL
…
Job description:
…
Chumby Industries is looking for a Ruby On Rails/I18N Contractor to deliver results for the internationalization (I18N) effort on the server.
This candidate would be responsible for externalizing all the text strings (both static and dynamically generated) that the website uses so that Chumby could later change the language of the site based on location.

Skills required:
Previous I18N efforts on browser-based platforms
Strong web-based development experience
Ruby on Rails experience
mySQL database experience
Familiarity of layout issues involved with I18N

My experience so far was great.

Step one: configure WiFi
It detected my local network without a problem. I had to enter the password and was ready to go.

Step two: activate chumby
Create an account at chumby.com and click on “activate chumby”. It shows a 4×4 matrix of dots you have to copy to your chumby to connect you account with your device. This is a nice idea. It’s very simple, easy to use but effective. And surprisingly that’s it.

Step three: add widgets
Just one click. Sometimes the widgets need a some configuration but everything is explained right there.

Minor annoyances

• only two brightness settings: high & low
• you have to press pretty hard on the touchscreen

Plans:
Find a German power supply (should be easy) and start coding a widget

We used Kara to teach them a little bit about programming. You can create finite state machines to control a bug which runs around and tries to solve different problems. The girls did much better than I expected and finished all the exercises we thought would be enough for a whole day before lunch.

Without much preparation I decided to teach them a little about “real” programming and Ruby because there is a Ruby version of Kara which lets you write Ruby code to control the bug.

The experiment was very successful. The girls solved all the problems again, this time in Ruby and from their feedback they really enjoyed it.

A couple of years ago I taught a programming course for kids at the Volkshochschule in Karlsruhe. At that time I used Perl (it was a loooong time ago and I didn’t know Ruby then) but if I ever do this again I will use RubyKara.

The changes are really simple. Here are the diffs:

--- wordpress/wp-admin/wp-admin.css 2008-03-29 08:21:12.000000000 +0100
+++ ../amazing-development.com/wp-admin/wp-admin.css        2008-03-30 16:47:22.000000000 +0200
@@ -573,8 +573,8 @@

 #wphead #viewsite {
        position: absolute;
-   margin-top: 12px;
-   margin-left: 10px;
+       margin-top: 3px;
+       margin-left: 3px;
 }
 #wphead #viewsite a {
        font: 12px "Lucida Grande", "Lucida Sans Unicode", Tahoma, Verdana, sans-serif;
@@ -590,8 +590,8 @@
 }

 #wphead h1 {
-   font: normal 36px Georgia, "Times New Roman", Times, serif;
-   padding: 11px 170px 16px 12px;
+       font: normal 18px Georgia, "Times New Roman", Times, serif;
+       padding: 11px 170px 20px 13px;
        margin: 0;
        margin-right: 15%;
 }
@@ -635,9 +635,9 @@
 }

 #adminmenu a {
-   font-size: 16px;
+       font-size: 12px;
        padding: 5px 7px;
-   line-height: 30px;
+       line-height: 20px;
 }

 #adminmenu a.current, #sidemenu a.current {
@@ -770,7 +770,7 @@
 }

 #submenu li {
-   font-size: 14px;
+       font-size: 10px;
 }

 #minisub { /* for empty submenus */
@@ -961,6 +961,14 @@
        text-decoration: underline;
 }

+#wpbody h2 {
+  font-size: 12pt;
+}
+
+#titlediv h3 {
+  display: none;
+}
+
 #poststuff h2 {
        margin-top: 20px;
        font-size: 1.5em;

One thing is for sure: as soon as these laptops become available in Germany, I will buy one.

My current favorite is the TS-409 Pro Turbo NAS. It has:

• low power consuption (ok, sleep mode: 18.8W; in operation: 44.6W)
• RAID support (way more features than I would ever need: Single disk, RAID 0 (Disk Stripping), RAID 1 (Disk Mirroring), RAID 5, RAID 5+ Hot spare, RAID 6, and JBOD (Linear Disk Volume))
• no encryption

But I couldn’t find any other NAS server with a good price (less than 500€) and this combination of features so I guess I have to live without encrypted disks. If you have any experience with this box or know about another box which has all these features, please leave a comment.

I’ve remove my caps-lock key from a couple of keyboards already. But I did not know that a campaign called anticAPSLOCK existed which tries to ban caps-lock from future keyboards. Nice idea!