Hope you’ll like it !

However, they’re starting to lack time and manpower to continue providing hosting — I guess they’re, like us, getting older and more and more busy with real life — and are in the process of shutting down hosting.

I’ve grabbed our multiple-year CVS history, and mailing-lists archives and subscribers lists from them, and after asking Yann, I’ve moved them on the same host as www.claws-mail.org.I’ve updated our CVS and Community pages to reflect the changes.

It should provide us with good quality hosting, and it also has the benefit of being free (as in beer) — thanks Yann ! Another advantage is that as Yann trusts me, I have a fair amount of control over the server, if needed.

It has only one drawback, as this server is Yann’s, and his job isn’t to provide free hosting to free software projects, that’ll add a bit of admin-load on my free time. But, mostly, it works and I won’t have a lot to do. I can also do-outsource backups, which makes me feel safer (for a little bit of time, I thought Dotsrc would leave us with no CVS history, which was a freaky thought).

Finally, I’ll be able to migrate us to Subversion or some other version-control software, if and when we agree on something, and I can get some time to do the migration and related (related is what takes some time, I’d have to change our tracker for something like Trac, change my buildbot scripts, fix the commit mail scripts, and other things I probably forget).

To this, we can add the cooling system’s consumption, which we don’t monitor but we can safely add 3 to 8 kW for the three cooling units, depending on the outside temperature. That’s what fun about datacenters, we have to burn electricity to cool down the room heated by the servers’ electricity consumption. Consider it the equivalent of putting the oven in your fridge when you bake a cake.

We’ve been trying to minimize a bit this consumption. There’s an article there that writes about shutting down servers when they’re not in use – ie, at night, or during the week-end.

Well, we thought of it first ! :-) In my opinion, it isn’t possible to shutdown every server at night : the backups run during the night, and saving its data is much more important to a company than saving electricity – sadly in some sense… So, we can’t shutdown production servers with important data on it. Luckily, where I work, a very large part of the datacenter is used for development and testing – we’re doing cluster-oriented storage, we have clusters, and about 140 out of our 160 servers are completely unused at night: developers go home.

So, one year and half ago already, I’ve implemented a way for developers to tell whether their test servers could be shutdown at night or not (in case they have long-running tests on them). It’s not a huge success, mainly because people choose 24/24 instead of 12/24 “just in case”, I think, but with approximately 30 servers down every night and during week-ends, we still spare 8 kW more than half the time. Still better than nothing…

Besides, at home, I’m now putting my laptop to sleep when I’m not in front of it. The saving’s much less and completely nullified by the server in the cupboard, but it’s still better than the days where I had three servers in the cupboard and didn’t put my laptop to sleep !

Ladies and gentlemen, I hereby present you QuitCount, a little piece of software that has no other practical value than keeping yourself motivated if you try and quit smoking, and in a second phase, impressing yourself with big numbers (I already didn’t inhale more than 12 grams of tar).

You can also use it as a start counter to see how much you smoked since you started, but don’t; that’s scary.

Translators and packagers welcomed!

Riester: “Le texte permettait déjà aux internautes de déposer un recours devant le juge. On gagne une étape, on va directement au juge. Donc le caractère dissuasif sera encore plus fort“. À part le fait que ta loi foulait la présomption d’innocence aux pieds, t’as tout compris…

Veut-il dire qu’ils auraient préféré passer une loi anticonstitutionnelle sans rien demander à personne ? Y’en a vraiment qui doutent de rien…

Enfin, je me rends compte que bien que ces gens m’indignent, j’arrive mal à expliquer pourquoi. Mon avocat préféré y arrive beaucoup mieux.

Problem is that printing it would be really painful, with about 80 posts, I didn’t want to do that manually and thought it’d be better to be able to automate that with html2ps or something like this.

html2ps having a really crappy rendering, I investigated Webkit and found it would print nicely, but it only supported printing via print dialog, which was painful too. So I dived into webkit-gtk’s code and patched it and added support for PDF export (via GTK+ print support); then proceeded to write a little app to batch-export to PDF a list of URLs.

That done, I used pdftk (the PDF ToolKit) to concatenate all these PDFs into a big one, uploaded it to lulu.com and there was the result:

Some more iterations of the webkit patch later and with the help of Gustavo Noronha of GNOME fame, an official API was defined, implemented and commited to Webkit. After reworking my app a bit to fit this API, I’ve been able to test it with the second volume of Clo’s blog (yes, she writes quite a lot, this second volume has 350 pages for little Paul’s first six monthes !), and here’s a new piece of free software born: webkit2pdf. It requires a fairly recent Webkit version; I’m not even sure they released since the patch’s in.

Il paraît que le consensus scientifique est qu’un seuil d’exposition inférieur à 0.6V/m est réputé non dangereux pour la santé, et certaines associations comme Robin des Toits militent pour atteindre un tel seuil partout sur le territoire. Le but est noble, mais le ton alarmiste et je n’aime pas le ton alarmiste, surtout que les médias relaient (héhé) bien souvent les cris Au Loup sans aucune analyse derrière.

N’étant jamais si bien servi que par moi-même, après avoir regardé sur le site de l’ANFR, Cartoradio, à combien de V/m j’étais exposé à la maison, et après avoir trouvé ces chiffres (entre 0.11 et 0.51 V/m selon la bande) très peu inquiétants, je me suis demandé si j’étais juste chanceux ou si la plupart des antennes relais arrosaient déjà relativement peu.

J’ai donc enregistré toutes les pages de mesures de l’ANFR de la numéro 1 à la numéro 16328, modulo celles qui n’existent pas, grâce à ce script ; notez bien qu’une pause de 2 secondes a été insérée entre chaque enregistrement, pour le cas improbable où j’aurai pu mettre leur serveur à genoux à moi tout seul.

Profitant du fait que chacune des pages est sur le même modèle, j’ai ensuite extrait les valeurs correspondant aux émetteurs GSM avec ce script vers ce fichier CSV, que j’ai ensuite importé dans une base MySQL (car je suis nul en tableur) afin de pouvoir manipuler toutes ces données. Pour ceux qui sont nuls en base de données, il est aussi possible de l’importer dans un tableur en utilisant le séparateur de champ “,”. Pour ceux qui ne font pas confiance au fichier CSV, mes scripts sont disponibles pour le refaire.

Voici quelques résultats. J’ai été surpris de voir le niveau moyen et médian augmenter au fil des années : j’aurais pensé que, la technologie évoluant, les émissions auraient nécessité moins de puissance. J’ai aussi été surpris de voir une médiane inférieure ou égale à 0.6V/s : suite au bourrage de crâne des médias, je supposais qu’on était assaillis d’ondes néfastes en permanence. Ceci dit, ce schéma sur la FAQ de l’ANFR a tendance à montrer qu’il faut, pour être irradié dans les règles de l’art, se mettre pile en face d’une antenne relais. En dessous, on ne risque pas grand chose.

Quant au wifi, à 0.3V/m à 40 centimètres de la borne, à mon avis, ce n’est pas vraiment la peine de flipper du hotspot de l’hôtel d’à côté. Robin des Toits mentionne aussi la dangerosité du Bluetooth (portée de 10 à 100 mètres) ou encore des tags RFID (portée de quelques centimètres dans la majorité des cas – on trouve par exemple un tag RFID dans les systèmes de déverrouillage de portes à ventouse) ; de mon côté, j’émets (huhu) quelques doutes là dessus. L’ANFR ne mesure même pas ce type d’émission.

Ceci dit, on fait dire ce qu’on veut aux statistiques, donc j’enjoins quiconque est intéressé de faire ses propres statistiques, à partir du fichier CSV, et de me prouver que mon cerveau est déjà fondu.

Quelques chiffres que j’ai trouvé intéressants :

Nombre total de mesures : 14829
Nombre de mesures avec signal <= 0.6 V/m : 9584 (64.63 % du total) (entre 0 et 0.6 V/m :9584 – 64.63 % du total)
Nombre de mesures avec signal <= 1 V/m : 11500 (77.55 % du total) (entre 0.6 et 1 V/m :1916 – 12.92 % du total)
Nombre de mesures avec signal <= 2 V/m : 13429 (90.56 % du total) (entre 1 et 2 V/m :1929 – 13.01 % du total)
Nombre de mesures avec signal <= 4 V/m : 14353 (96.79 % du total) (entre 2 et 4 V/m :924 – 6.23 % du total)
Nombre de mesures avec signal <= 10 V/m : 14780 (99.67 % du total) (entre 4 et 10 V/m :427 – 2.88 % du total)
Nombre de mesures avec signal <= 20 V/m : 14821 (99.95 % du total) (entre 10 et 20 V/m :41 – 0.28 % du total)
Nombre de mesures avec signal <= 30 V/m : 14827 (99.99 % du total) (entre 20 et 30 V/m :6 – 0.04 % du total)
Nombre de mesures avec signal <= 50 V/m : 14829 (100 % du total) (entre 30 et 50 V/m :2 – 0.01 % du total)

Nombre de mesures par puissance, de 0 à 5 V/m

Nombre de mesures par puissance, de 5 à 50 V/m

Les quatre mesures dont le signal est supérieur à 25 V/m sont : 8165, 8166 et 8181 (même endroit) et 13919. La distance de mesure est de 1, 3, 3 et 5 mètres pour chacune d’elles et la zone de mesure est interdite au public.

Moyennes :

Moyenne des 227 mesures en 2001 :0.67 V/m – médiane 0.3 V/m – distance moyenne* : 53.83 m
Moyenne des 741 mesures en 2002 :0.5 V/m – médiane 0.2 V/m – distance moyenne* : 66.68 m
Moyenne des 1632 mesures en 2003 :0.57 V/m – médiane 0.3 V/m – distance moyenne* : 80.79 m
Moyenne des 1737 mesures en 2004 :0.7 V/m – médiane 0.4 V/m – distance moyenne* : 63.71 m
Moyenne des 1941 mesures en 2005 :0.84 V/m – médiane 0.4 V/m – distance moyenne* : 72.4 m
Moyenne des 2634 mesures en 2006 :0.9 V/m – médiane 0.4 V/m – distance moyenne* : 72.29 m
Moyenne des 2380 mesures en 2007 :0.89 V/m – médiane 0.4 V/m – distance moyenne* : 62.7 m
Moyenne des 2525 mesures en 2008 :0.97 V/m – médiane 0.5 V/m – distance moyenne* : 66.5 m
Moyenne des 1007 mesures en 2009 :1.08 V/m – médiane 0.6 V/m – distance moyenne* : 81.23 m
Moyenne des 14829 mesures :0.83 V/m – médiane 0.4 V/m – distance moyenne* : 69.73 m

Moyenne et médiane des mesures, par an

*: les distances sont faussées par la présence de données vides et de données floues dans les données ANFR (’50 m – 100 m’ compte pour 50, ‘<50 m’ compte 0, par exemple).

Songez à ce que contient le disque dur de votre ordinateur. Des documents, des emails, de la musique, des photos, des films. Sur les photos, les emails, et les films, on peut retrouver des moments normaux : un pique nique, une discussion sur les horaires de train pour les vacances de 2003. On peut aussi y retrouver d’autres moments : votre mariage, préparation, photos du jour J, photos du lendemain ; votre fils à sa naissance, à 2 jours, à deux semaines ; un voyage à l’autre bout de la terre…

Voici à quoi ressemble ledit disque dur :

Le plateau tourne à 7200 tours par minute, et la tête de lecture flotte à une dizaine de microns au dessus, ce qui se représente un centième de l’épaisseur d’un cheveu.

La question n’est donc pas si, mais quand cette belle mécanique va faillir. Lorsque ce sera arrivé, tous les fichiers stockés dessus disparaîtront à jamais. Et même si vous en êtes conscients, ça vous arrivera car vous aurez repoussé et repoussé le moment de mettre une bonne sauvegarde en place, jusqu’à trop tard.

Maintenant que vous avez expérimenté la perte de quelques gigaoctets de données irremplaçables, le moment est venu de la mettre en place, cette sauvegarde. Il y a différents points à suivre :

Mauvaise sauvegarde

• Procédure manuelle (insertion d’un disque externe ou d’un DVD vierge, opérations manuelles pour copier les fichiers) : vous allez en avoir assez très vite et le problème réapparaîtra.
• Sauvegarde non testée : Une fois les fichiers sauvegardés on met tout ça dans un placard et on n’y pense plus. Tant qu’on n’a pas relu les fichiers présents sur la sauvegarde, on ne peut être sûr qu’elle est correcte.
• Sauvegarde sur un unique média : Si la panne arrive au début d’une sauvegarde, celle-ci sera vide. Il faut au moins deux médias.

Bonne sauvegarde

• Automatique : crontab sous Linux, tâches planifiées sous Windows, Time Machine sous Mac OS X.
• Sur deux médias ou plus : par exemple deux disques externes, ou une sauvegarde distante : Dropbox par exemple.
• Vérifiée à intervalles réguliers.

Oui, c’est pénible, mais ça vaut le coup. Je me suis fait avoir une fois, ma mère s’est faite avoir une fois, des milliers de gens se font avoir chaque jour et perdent les photos de leurs enfants ou les 2 ans de travail passés sur leur thèse.

I’ll stop renewing one of the domain names I have, geekounet.org, because I don’t use it enough. It expires on April 12th.

If someone there is interested by this domain name, just tell me, I’d rather transfer it to someone I appreciate than to let the domain squatters get hold of it.

Update: I’ve started the transfer procedure to Pierre, who’s going to make a much better use of the domain than these idiot professional-domain-grabbers.

We’ll start with a two-disk setup, /dev/sda and /dev/sdb, containing two arrays, /dev/md0 and /dev/md1. /dev/md0 is mounted on / and /dev/md1 is mounted on /backup. We want to grow /dev/md1 from 230GB to 898G (switching from 250GB disks to 1TB).

/dev/md0 has /dev/sda1 and /dev/sdb1, /dev/md1 has /dev/sda3 and /dev/sdb3, while swap partitions are on /dev/sda2 and /dev/sdb2.

Obligatory warning: Use your own brain when following this procedure. Don’t follow me blindly – it’s your data at stake.

Booting on degraded array: don’t shoot yourself in the foot.

When you’ll remove one of the existing disks, your computer won’t be able to boot if grub isn’t installed on the other disk’s bootsector, so make sure that grub is installed on both disks’ MBR:
#grub
grub> find /boot/grub/menu.lst
(hd0,0)
(hd1,0)
grub> root (hd0,0)
grub> setup (hd0)
grub> root(hd1,0)
grub> setup (hd1)

Shutdown the computer, remove sdb, put in one of the new 1TB disks in place, and reboot. Booting can take some time while the initrd’s mdadm tries to find the missing disk.

You’ll boot with degraded arrays, as shown there:
#cat /proc/mdstat
md0 : active raid1 sda1[0]
19534912 blocks [1/2] [U_]

md1 : active raid1 sda3[0]
223134720 blocks [1/2] [U_]

Now, we’ll dump sda’s partition table:
#sfdisk -d /dev/sda > partitions.txt

Edit the partitions.txt file to remove the size=xxxxxxx field on the sda3 line, so that the biggest possible partition size will be used. The file will look like:

# partition table of /dev/sda
unit: sectors
/dev/sda1 : start=       63, size= 39070017, Id=fd, bootable
/dev/sda2 : start= 39070080, size=  1959930, Id=82
/dev/sda3 : start= 41030010, Id=fd
/dev/sda4 : start=        0, size=        0, Id= 0

Disk initialisation

Now partition sdb using this table:
#sfdisk /dev/sdb < partitions.txt

recreate swap if needed:
#mkswap /dev/sdb2; swapon -a

Put sdb back in the arrays:
#mdadm –manage /dev/md0 –add /dev/sdb1
#mdadm –manage /dev/md1 –add /dev/sdb3

Wait until the array is resynchronised and clean. I use:
#watch cat /proc/mdstat #(quit with Ctrl-C)

Install grub on the new disk using grub, like previously (sdb is hd1 for grub), so that you’ll be able to boot from it.

Changing the second disk

Shutdown, remove sda, put the second new disk in place of it, and reboot – make sure your BIOS is configured to try and boot on both drives.

Now you’ll have degraded arrays again:
#cat /proc/mdstat
md0 : active raid1 sdb1[0]
19534912 blocks [1/2] [_U]

md1 : active raid1 sdb3[0]
223134720 blocks [1/2] [_U]

Redo the whole disk initialisation section, this time on sda instead of sdb. Don’t forget to reinstall grub on sda.

In the end you’ll get your arrays clean as they were before, but /dev/md1 will still be 230GB instead of using the whole available room on the disks’ partitions 3.

Grow the things

Let’s ask mdadm to take the whole partitions size for md1:
#mdadm –grow /dev/md1 –size=max

You’ll have to wait for synchronisation again (watch cat /proc/mdstat).

The only remaining thing is to grow the ext3 filesystem sitting on md1, and that’s where the most downtime happen (your data won’t be available unless you do a live FS resize, which I didn’t want to test); these steps took about 30 minutes to complete for me:
#umount /dev/md1
#e2fsck -f /dev/md1 #(it’s better to force a check to avoid a resize failure)
#resize2fs /dev/md1 #(this makes the filesystem the biggest possible)
#e2fsck -f /dev/md1 #(verify that everything is OK)
#mount /dev/md1 #(and you’re done, as df -h should show you):

# df -h /dev/md1
Filesystem            Size  Used Avail Use% Mounted on
/dev/md1              898G  228G  634G  27% /backup

Rambling about half-finished RAID setups

One thing you may have noticed is that I’m installing grub on both drives. This can seem evident, but most software RAID arrays I’ve seen couldn’t boot out of the second disk for lack of an MBR. It makes the RAID setup useful when your second disk fails, but if it’s the first, you’re forced to resort to a rescue CD or PXE boot to reboot your server. This makes things much harder to fix, provokes cold sweats, downtimes, and user annoyment. Install grub on both disks. Check the system boots when removing one disk, both the first or the second, before going into production. Don’t misunderstand your RAID arrays as a backup system. RAID arrays provides redundancy and eases (a LOT) recovering from a failed disk, but it doesn’t eases recovering from two failed disks; and it doesn’t recover lost data from human mistakes either. Regarding failed disks, best results are achieved by monitoring the disks – with smartd for example – and replacing suspicious disks too soon rather than too late.

There are 91 reports to look at, which I’ll start doing tomorrow evening – I’ll be alone at home this week, will use this time to bugfix!

Update: 6 reports remain, which are false positives. The fixed problems were mainly resource leaks (either fds or memory allocations), missing NULL checks when dereferencing pointers — most of them harmless but good to have fixed anyway, and uninitialized variables. No horrible bug was found by Coverity’s scanner, just corner cases. I’ve also ran some external plugins through it, and most of them are rather clean, with the exception of VCalendar, where most reports are due to libical which uses an apparently confusing memory allocation/free scheme.

**** Warning: Fonts with Subtype = /TrueType should be embedded.
The following fonts were not embedded:
OptimaLT

**** This file had errors that were repaired or ignored.
**** The file was produced by:
**** >>>> Adobe Photoshop for Windows <<<<
**** Please notify the author of the software that produced this
**** file that it does not conform to Adobe’s published PDF
**** specification.

Quite ironic :-)

mkdir /cores; chmod go+w /cores; echo “/cores/%e.%p.core” > /proc/sys/kernel/core_pattern

And voilà, you’ll find your cores easily in /cores. Much easier than find ~ -mtime 0 -name ‘core*’ !

This time, I decided to buy a Dell for a few reasons ; first, their customer support is constantly improving in my eyes (and I use it a lot : given that I maintain about hundred Dell servers and thirty Dell workstations, they have their share of hard drives, motherboard or power supply failures). Also, last year they started to offer Ubuntu on some of their computers, and I really wanted to vote with my wallet here, and avoid paying the Windows tax for the first time!

I found two little annoyances upon booting the new laptop: Dell installs the 32 bits version of Ubuntu although the platform is 64 bits; and they leave the default partition scheme, with a big root filesystem and nothing else (apart their diagnostics partition). I prefer having a separate /home, in case I have to reinstall the distribution. No showstoppers, though; it just shows me 3.5GB of memory instead of 4GB.

As expected, all the hardware bits work out of the box (this is the big advantage of buying Linux preinstalled, and not too surprising as most of the chips in there are Intel) : CPU scaling, video, wifi, bluetooth, webcam – and they all work with free software. Hibernate works out of the box, as well as suspend (to RAM). Even the little remote control they give, that one puts in the ExpressCard slot for storage, works like a breeze: it sends keycodes, and you don’t have to mess around with lirc to make it work with mplayer. Finally, no need to lift ass to hit pause on the movie :-)

Setting up the machine was pretty quick, just a matter of apt-getting the packages I use (starting with xubuntu-desktop) and migrating my 50GBs of /home data and dot-files. I now get the occasional command-not-found warning for packages I forgot to reinstall, and that’s solved in seconds.

I got the 9-cell battery to get more autonomy, and combined with good power management (it eats 15 watts when idling with the screen to the brightest and all subsystems and radios on), it gets 6 hours of battery life when idling, more than 4 with a standard workload (my standard workload being mostly typing and compiling).

Finally, the stuff seems pretty solid and doesn’t weigh too much – I have no precise number (too bad I brought back the baby scale last week ;-) but it’s easier on the shoulder than the previous 15.4″ laptops I had. Dell says the it starts at 1.8kgs, I guess mine’s 2.2kgs with the big battery.

Since then, I grumbled and grumbled each time I had to log in to their web administration interface, for domain renewal, DNS glue records updates, etc ; but out of habit, I bought two more domain names from them : my wife‘s, and a second one I had.

Finally, last week, after more failing glue records updates, I switched my domain and my wife’s domain to gandi.net. I left the third one on amen, as I don’t plan on renewing it, it’s useless for me to keep two domain names.

I knew Gandi beforehand as it’s the registrar for my work’s domain, and I’m glad I did the switch. Their interface is multiple times better, it does what it has to do and doesn’t bug out when hitting Submit with not even an error message.

They surreptitiously instill a few dangerous equations in one’s mind. Watch closely, and you’ll notice that only culprits ask for a lawyer, for example. Innocent suspects just cooperate without the slighest need of following correct police procedures, like the right to a lawyer, the right to remain silent, or the right to refuse anarchic searches.

The ones who refuse any of these are always culprits in the end. There’s a subliminal message for you, couch potatoe: why do you refuse to cooperate if you have nothing to hide? Your lack of transparency makes you look guilty.

This isn’t limited to C.S.I., other series, like N.C.I.S, even push the concept a bit further, often evoquing the Patriot Act to remember watchers that if you don’t comply, they just have two words to say to be able to disappear you to Guantanamo: “Terrorist suspect”. Say goodbye to trials, lawyers, and any sort of human justice. You’d better not get in the way and let go of your rights if you’re innocent. As an innocent, you have nothing to hide, right?

All of these examples may seem a bit US-centric, although I’m french — I don’t watch French TV series often, mainly because they’re mostly crappy rip-offs of US TV series. But from the little I watched, it seems the same applies to them — just translated to french and using (bypassing) our own laws.

I find this scary. I’ve read a few pages off the PDF of “Little Brother” by Cory Doctorow (and quickly decided to buy the printed edition, as it seems to be worth a read); it’s a fictional story of how USA could turn into a fully-feature surveillance country after a terrorist attack; and he has a good example of how idiotic this “if you’re not a criminal, you have nothing to hide” mentality is:

There’s something really liberating about having some corner of your life that’s yours, that no one gets to see except you. It’s a little like nudity or taking a dump. Everyone gets naked every once in a while. Everyone has to squat on the toilet. There’s nothing shameful, deviant or weird about either of them. But what if I decreed that from now on, every time you went to evacuate some solid waste, you’d have to do it in a glass room perched in the middle of Times Square, and you’d be buck naked?

Then I’ve started to package it and then, the problems started:

• It crashed hard on Maemo – due to the new menu code. Fixed.
• I forgot to include the new Enchant dependancy in Ubuntu packages, breaking the spellchecker. Rebuilt, fixed. Fixed?
• The MIME parts icons were invisible on Maemo, for strange Gtk widget requisitions problems. It had always worked everywhere… Fixed, anyway.
• Multiple, strange crashes happened to Ubuntu users in extra plugins – due to my rebuild of the core with spellchecker support, which changed structures sizes, and I didn’t rebuild extra plugins, making plugins look in the wrong place for preferences, for example. Fixed.
• Crashes in vCalendar, due to a “leak fix” I did which in reality introduced a double-free. Fixed. (The first one to say that gotos are evil gets my foot to the bottom – gotos aren’t evil. Programmer’s stupidity is).
• SSL handshakes failures with some IMAP servers using my Ubuntu packages. A bug I introduced in libetpan when built against GnuTLS. Fixed in libetpan, and fixed in Claws.

It now seems to be under control, but most of these problems are in the source of libetpan 0.56, Claws Mail 3.6.0 and vCalendar 2.0.1, which means that if my packages work, packages made by other people, not aware of these issues, contain this issue. So, we plan to release a 3.6.1 at the end of the week if Paul can, and Hoa plans to release libetpan 0.57, so that our lives and users’ lives are easier during the next development cycle.

And all of these problems are my own fault, which makes it very frustrating. I hate releasing crap, and all of these, apart the invisible-icon-on-Maemo bug, could have been avoided if I double-checked stuff a bit better at the time I did it.

Oh, and Mandriva packages have not been done, because their SVN is frozen for the 2009.0 release. I had been annoyed by that at first, but in the end, maybe it’s a good thing I didn’t push that into their release!

Waiting for this to happen, and given that everything’s ready towards the baby’s arrival, I tried to help make Claws Mail 3.6.0 a really good release.

After two release candidates, most of the bugs seem ironed out; I’ve prepared the most I could to be able to quickly build packages after the release, as I usually do Mandriva, Maemo and Ubuntu packages, it can take quite a bit of time and that’s if nothing fails. I often experience Murphy’s law when trying to build packages.

As if these three distribution packages weren’t enough, I started looking at the Windows issues that the Gpg4win team faced. I was tired of having a crappy broken build of 3.0.0-rc2 with no SSL and no IMAP. So the good news is that currently, the SVN version of Ggp4win builds Claws Mail 3.5.0cvs138, with the following notable changes:

• IMAP
• SSL
• NNTP
• No more leaking 50 megs when changing folders
• Various buglet fixes (crashers, annoyances)
• Better integration to the windows theme
• Notification plugin
• RSSyl plugin
• VCalendar plugin
• GtkHTML2 Viewer plugin

It’s most probably not bug free, but at least it starts to have a large enough subset of Claws’ feature not to be ashamed of it.

Users of the old windows versions are encouraged to start from scratch (by removing Claws-Mail and mailboxes from %APPDATA%).

You can get the (now current) installer here: gpg4win-light-1.9.8-svn929.exe.

Voici l’article. Ça me fait de vieux souvenirs, je l’ai écrit entre la version 1.9.14 et 1.9.15, c’est à dire début octobre 2005. Le canal IRC était #sylpheed, sur IRCNet. On avait encore le plugin ClamAV, pas encore de plugin PDF re-disparu depuis, et les plugins TNEF Parser, SpamReport, S/MIME, RSSyl, GtkHtmlViewer, AttRemover, AttachWarner et Archiver n’existaient pas encore. On a fait du chemin :-)

As you may know, dear reader, my wife (Clo) is pregnant and we’ll have a baby soon (in about 50 days !), so we’ve been preparing stuff in advance. Over the last monthes, we’ve redone the floor in the future baby’s room, created cupboards, painted things, we’ve boughtfurniture , we’ve moved our “office” in the living room, we’ve built a few things, we spent time in baby stores to make lists, see what we needed, buy a few things, etc.

Now we’re almost ready, so we’re waiting :-)

Also, there’s been a whole lot of people at home to visit us – both of my sisters, Clo’s brother, my mother, Clo’s parents, … Very nice! If only we knew we’d just have to make babies to bring them over! ;-p

Yes, I’ve been linking to Clo’s blog everywhere. Not my fault if she blogs more than me!

On the Claws Mail front, I’ve put some days off to use and, following the announce of the GTK team of GTK+3, I’ve removed every fucking deprecated line in our source code and rewrote code that worked; just because the GTK+ guys can’t be bothered with keeping deprecated code around, I’ve rewritten about 10.000 lines, I think. Thanks, dudes. We’ve also been able to fix a good number of bugs, and added support for client SSL certificates.

Maybe we’ll release soon…

The Amazon reviews are mostly hilarious. I wonder how large the target market can be for this, which is the perfect example of Snake Oil Product :-) The tags are mostly right.

Jonathan Corbet of LWN published last week a review of Claws Mail. I’m quite happy about what he says, his review is quite positive and, as I like his work a lot, I’m pleased!

# cd ; wget -q -O – http://linux.dell.com/repo/hardware/bootstrap.cgi | bash
# yum install srvadmin-hapi
# wget ftp://ftp.us.dell.com/sysman/dtk_2.5_80_Linux.iso
# mkdir dtk
# mount -o loop dtk_2.5_80_Linux.iso dtk/
# cd dtk/isolinux/
# cp  SA.2 ~/SA.2.gz
# cd; gunzip SA.2.gz
# mkdir stage2
# cd stage2
# cpio -i < ../SA.2
# cd lofs
# mkdir dell
# mount -o loop dell.cramfs dell/
# mkdir -p /usr/local/sbin ; cp dell/toolkit/bin/syscfg /usr/local/sbin/
# umount dell
# cd
# umount dtk

And voilà! You can now use syscfg:

# /usr/local/sbin/syscfg –biosver
biosver=1.5.1
# /usr/local/sbin/syscfg –virtualization=enable
virtualization=enable

I’d have preferred an easier way, but couldn’t find syscfg’s RPM.

When deploying that to a lot of nodes, you probably don’t want to go through all the associated network downloads of the first phase (wget of the yum repository, yum, and wget of the 230MB iso), so you can take shortcuts:

# for node in $(list_of_nodes); do scp /usr/local/sbin/syscfg /var/cache/yum/dell-hardware-auto/packages/srvadmin-*.rpm $node: ; ssh $node “mkdir -p /usr/local/sbin; mv syscfg /usr/local/sbin; rpm -ivh srvadmin-*.rpm”; done;

This morning I investigated in the source code of memtest+ and found out it supports output to serial consoles since recently!

A little upgrade later, I can now boot memtest+ with the console=ttyS0,57600 command line parameter and just watch my serial line output, without moving at all! Yay!

DEFAULT memtest console=ttyS0,57600

LABEL memtest

KERNEL images/tools/memtest

Viva PXE!

(Btw for those who’ll find funny to use DEFAULT memtest… PXE boot choices are updated via a cgi script called from an intranet tool, which itself is wrapped in a little GTK systray applet. This applet allows to reboot, shut down, power on, reinstall various distributions, follow serial line, open an ssh connection, on the lab’s nodes. This tool is also useable via command line for scripting power).

• Avec Firefox 3 beta 5, ça plante dès le début avec une zone d’applet grisée et “Applet signview bail” dans la barre d’état du navigateur. Qu’à celà ne tienne!
• sudo apt-get install firefox-2
• Avec Firefox 2, pas de java. Un symlink manquant: sudo ln -s /etc/alternatives/xulrunner-1.9-javaplugin.so /usr/lib/firefox/plugins/
• Ensuite, avec Firefox 2 toujours, la déclaration elle même se passe bien; le seul problème est au moment de la signature numérique: “Erreur technique (n° 100)“. Argh!

Finalement, voici comment en 2008, j’ai réussi à déclarer mes impôts avec mon ordinateur sous Linux:

Je pense que c’est de la faute de Sarko.

A user told us on the mailing list that he got a crash. It was SIGXFSZ, File size limit exceeded… Due to the protocol log file growing too much, probably 2 or 4 gigabytes…

The end of his log reads:

IMAP4< 8918737 OK Status completed.

The number at the left is the transaction id of the IMAP protocol, incremented by 1 on every command. That means almost 9 millions commands :-) Our user started Claws Mail on March 10, it crashed on April 17 only due to the log file.

Comforting to read that :-)

So I ordered just the hard disk from an Ebay seller (which I recommend if you need the same…) for only 40 dollars. I received it today, swapped the disks, and reformated the iPod following a nice howto which spared me the shame of begging a colleague for a Windows machine with iTunes installed. (Yes, it’s a geeky howto involving fdisk and dd, but I’m not scared at all by the shell, and I don’t care about whether it’s user friendly or not. It’s Colin friendly, and that’s all I want).

And now it works again just fine, and gained 10GB of capacity in the process :-)

I ordered an 1.8″ disk (for about eight times less than a new iPod, but still, it’s annoying.)

“Mais que fait la police”, vous demandez-vous… Il paraît surprenant que ce genre d’activités reste impunies. En effet ! Les responsables et bénéficiaires de ce genre d’arnaques sont en général recherchés, et parfois arrêtés. Cela reste, hélas, rare, car ils sont souvent suffisamment prudents pour éviter de laisser des traces directes les incriminant. Certains, en général les Veuves du Regretté Général Machin, utilisent des comptes emails jetables (sur hotmail, yahoo, etc) étant donné qu’ils ont besoin de correspondre ensuite avec leurs victimes pour transformer l’essai. Ils ne se connectent sur ces comptes que par des cybercafés, des proxys anonymisants, etc : jamais de leur accès internet chez eux.

Les autres, les arnaqueurs à large spectre ainsi que les spammeurs, utilisent des réseaux de machines piratées (appelés Botnets). Ces machines peuvent être des serveurs mal sécurisés, ou encore de simples ordinateurs de particuliers qui ont attrapé un virus – car maintenant, les méchants virus destructeurs de données, programmés par de petits génies de l’optimisation et de la discrétion, sont chose rare. La plupart des virus actuels se contentent de se cacher sur votre ordinateur, ne causent aucun dégât afin d’éviter d’être repérés, et transforment votre ordinateur en plaque tournante d’arnaques – c’est beaucoup plus rémunérateur à long terme. Dans votre dos, votre PC enverra donc de nombreux spams, un serveur Web y sera installé qui contiendra une copie du site de Paypal ou autre, etc.

Le mode de propagation principal de ces virus est, là aussi, l’email – provenant d’un autre PC infecté. Lorsque vous recevez un mail avec des photos d’une quelconque célébrité à poil, une vidéo marrante à regarder, ou encore un faux retour d’email avec une pièce jointe, la plupart du temps, un virus dans la pièce jointe attend sagement que votre curiosité vous pousse à l’ouvrir. Le fait que l’email en question provienne d’un inconnu ou d’un contact connu (ami, etc) n’y change rien : l’adresse d’expéditeur est fausse et trafiquée. Soyez sûr d’avoir un bon antivirus à jour.

Le moyen le plus efficace de se débarasser de ces nuisibles, puisque les arrêter est difficile, serait de rendre l’activité moins rémunatrice et plus compliquée. Certains (rares) fournisseurs d’accès Internet coupent l’accès à leurs abonnés chez lesquels ils détectent un trafic suspect (milliers d’emails envoyés, etc) jusqu’à désinfection, mais la plupart ne le fait pas, étant donné que lesdits abonnés râlent quand cela leur arrive.

In english – Sane paranoia, part IV : Why aren’t they stopped?

It sounds surprising that this kind of activities aren’t punished. Indeed! The individuals responsible for (and who benefit from) such scams are generally actively wanted by the authorities, and sometimes arrested. This is, unfortunately, rare, because they’re often cautious enough to avoid leaving directly incriminating trails. Some of them, generally the Widows of the Regretted Late General Blahblah, use throw-away email accounts (on hotmail, yahoo, …), as they’ll need to correspond with their victims in order to cash in on their scam. They only connect to these accounts from cybercafes, anonymous proxies, and so on; never from their own internet account at their place.

The others, the large spectrum scammers and the spammers, use networks of pirated computers (called Botnets). These computers can be badly securised servers, or simply private computers who got infected by a virus – these days, rare are the mean, destructive viruses that we were used to. The majority of modern viruses just hide in your computer, cause no visible harm in order to avoid being detected, and turn your computer into a so-called zombie, spewing out hundreds and thousands spams every hour, getting a web server serving a copy of Paypal’s site, and so on.

The main propagation mode of these viruses is, as usual, email – often coming from another infected computer. When you receive a message with pictures of a random celebrity naked, a funny video to watch, or sometimes, a fake email bounce with an attachment… most of the time, there’s a virus in the attachment waiting for your curiosity to make you open it. The fact that said email comes from a random stranger or a known contact (best friend, wife, boss, …) is irrelevant: the sender’s address is faked and doesn’t mean anything. Make sure you have a good, up-to-date antivirus.

The best way to get rid of these parasites, as arresting them is difficult, would be to render their activities less financially rewarding and more complicated. Some rare Internet service providers cut their subscribers’ access when they detect suspect traffic (thousands of sent emails over a short period of time, for example); but most don’t, as this process is rarely well-received by the affected people.

Les précédents comptaient bien vous avoir. Leur technique, qui fonctionne, requiert tout de même du courage. Il en faut, pour correspondre avec une centaine de pigeons en parallèle, leur extorquer le maximum par la persuasion, continuer avec la dizaine restante, les presser jusqu’à la moëlle, avant de recommencer avec de nouvelles victimes potentielles.

Ce serait quand même vachement plus pratique de n’avoir rien à faire pour arnaquer les gens, n’est ce pas. C’est la catégorie des arnaqueurs paresseux, qui a monté un autre type d’email piégé… L’email de phishing. Comme son nom l’indique, il s’agit là d’aller à la pêche, mais à la pêche à la nasse, pas question de s’enquiquiner à attendre que ça morde. (la faute d’orthographe dans phishing n’en est pas une. Elle indique la nature cybercrime de la chose).

Les emails de phishing se présentent généralement sous la forme d’alertes de sécurité, de la part de grands sites très connus où l’on peut manipuler de l’argent – Paypal, Ebay, votre banque…

Ces emails seront inquiétants :

Cher Membre PayPal,
En raison des mesures de securité que vous offre PayPal, vous êtes prié de suivre les étapes fournies et de confirmer vos informations en ligne pour la sûreté de vos comptes. Cependant, la non-comfirmation de vos informations peut avoir comme conséquence la suspension provisoire de compte.

(Fautes de français laissées intactes).Suivra un bla-bla habituel sur les procédures de sécurité :

Veillez à ne jamais communiquer votre mot de passe à des sites frauduleux. Pour accéder de manière sécurisée au site PayPal, saisissez l’URL PayPal (https://www.paypal.com/fr/) pour accéder au site authentique de PayPal.

Rassurantes, ces procédures de sécurité ! S’ils me disent tout ça, ça devrait être un vrai mail, n’est ce pas ? Un pirate ne se couperait pas l’herbe sous le pied ainsi ?

Ben si. Ça marche mieux comme ça, car, malgré les lignes précédentes, la plupart des gens cliqueront quand même là :

Vous êtes prié de suivre les étapes fournies et de confirmer vos informations en ligne pour la sûreté de vos comptes. Cliquez ici pour commencer la procedure.

Vous avez cliqué ? Ici j’ai modifié le lien pour pointer sur un site totalement différent et inoffensif ; mais le mail en question vous aurait renvoyé sur un site qui n’est pas celui de Paypal, mais qui y ressemble à s’y méprendre. Sur celui-ci, on vous aurait demandé de remplir toutes les informations demandées par Paypal (dont votre mot de passe, numéro de carte bancaire, et même parfois, code secret de carte banquaire). La page d’aide de Paypal à ce sujet détaille bien la chose.

J’ai pris Paypal comme exemple ici, mais ne vous en faites pas, vous recevrez de faux emails du même genre “de la part” de votre banque, Ebay, votre fournisseur d’accès Internet (souvent “nous avons détecté des activités illégales sur votre compte”, mais pas seulement), etc.

Ne cliquez jamais sur aucun lien, d’aucun email provenant d’un site qui gère pour vous des choses importantes, comme votre argent. En cas de doute, connectez-vous via votre raccourci enregistré, ou en tapant l’adresse à la main. Si le site avait quelque chose à vous signaler, ce sera via le site lui-même, pas via email.

Partie IV – Pourquoi les laisse-t’on faire ?

In english – Sane paranoia, part III: targeted scams

The previously mentioned scammers hoped to get you, but their method, although it works, still requires a certain amount of motivation. One needs motivation to manage corresponding with a hundred of possible targets at once, squeeze the most out of them using persuasion, continue with the remaining dozen, go as far as possible, and restart the whole process with new potential victims.

Wouldn’t it be much more practical to be able to scam large numbers of people almost automatically? It’s exactly what lazy scammers thought, and implemented in another kind of trap email: the Phishing email. As its name implies, it’s about going to fish, but using a net – no bothering and waiting for bites!

Phishing emails generally look like security alerts from big, known and trusted e-commerce websites that manipulate money – Paypal, Ebay, your bank…

These emails will be scary:

Dear PayPal customer,We recently reviewed your account, and we suspect an unauthorized transaction on your account. Protecting your account is our primary concern. As a preventive measure we have temporary limited your access to sensitive information.

These emails will usually have a few paragraph about the importance of security procedures:

Make sure you never provide your password to fraudulent websites: To safely and securely access the PayPal website or your account, be sure to verify the link found in the address bar. This must be https://www.paypal.com/.

These security procedures really are reassuring, aren’t they? If they warn me about security, that must be a real email, isn’t it? A mean bad guy wouldn’t screw himself up this way?

Well, yes, he would, because its works better like that. Just write these security procedures, and be sure that most people would still click on the link just after:

We require you to complete an account verification procedure as part of our security measure. You must click the link below to securely login and complete the process. Click here to activate your account.

Did you click? Here, I changed the link to point to a totally different and inoffensive website; but the quoted email would have sent you to a website that isn’t Paypal’s, but that looks exactly the same. On this fake website copy, you would have been asked about a lot of information (including your password, credit card number, and even, sometimes, credit card’s PIN code). Paypal’s help page about the subject explains this really well.

I used Paypal as an example here. But don’t worry! You’ll also get fake mails “from” your bank, “from” Ebay, “from” your Internet Service Provider (usually along the lines of “we detected illegal activity from your account” – but not only), and much more.

Never click any link on any email from any site handling important things like your money. If in doubt, log in via your bookmark, or type the address yourself. If the website has something to warn you about, it’ll do so via the site itself, not via email.

Part IV – Why aren’t they stopped?

Les spammeurs sont agaçants, certes, mais pas bien dangereux. Nous allons voir que l’on peut trouver bien pire qu’eux : des arnaqueurs qui en veulent à :

• votre porte-monnaie
• votre identité

Parmi ceux-ci, il y a deux types ; les arnaqueurs à large spectre sont ceux qui espèrent récupérer des informations intéressantes de vous, ainsi que de l’argent (le vôtre, hein), d’où que cela puisse provenir.

En VO, ils sont aussi appelés 419 scammers, ou encore Nigerian scammers, bien qu’ils n’aient pas souvent de relation avec le Niger.

Ils vous contacteront dans un long mail alambiqué de formules de politesses et de fautes de français (ou bien, en anglais, tout simplement) et vous expliqueront leurs malheurs…

Cher ami,

Je suis Allen Anthony, l’avocat personel de Monsieur Hughson Taylor. Le 21 avril 2007, mon client, sa femme et ses trois enfants ont été impliqués dans un accident de voiture. Hélas, tous les occupants ont été tués.

Comme c’est triste. (Vous pourrez aussi tomber sur la veuve du Regretté Général Machin, la soeur du Regretté Président Truc, etc). Vous découvrirez ensuite pourquoi vous avez été contacté, car votre aide précieuse est nécessaire !

Je vous ai contacté car j’ai besoin d’aide pour rapatrier le patrimoine de Monsieur Taylor avant qu’il ne soit confisqué par les services fiscaux, et qui sont de US $7.500.000 (sept millions cinq cent mille dollars américains). Je n’ai pu retrouver aucun héritier, je voudrais donc donner cet argent à des oeuvres de charité.

Oh là là, tout cet argent qui va être confisqué par le fisc au lieu d’être donné aux oeuvres de charité ! Mais que puis-je donc faire pour aider ce pauvre homme ! Ne vous en faites pas, vous allez le savoir très vite.

J’ai besoin de votre aide : il faut vous désigner comme son héritier, de manière à pouvoir sortir cet argent de la banque. En remerciement de votre aide, je me propose de vous laisser 10% de cet argent, soit US $ 750.000 (sept cent cinquante mille dollars).

Tout ça pour moi ! Où-est-ce que je signe !?

OK, sauf que non. Répondez à cet email, et vous mettrez le doigt dans un engrenage dangereux. Tout d’abord il faudra fournir un certain nombre de renseignements à Monsieur Allen Anthony, afin qu’il puisse préparer les papiers nécessaires : nom, prénom, date de naissance, lieu de naissance, photo récente, photocopie de carte d’identité.

Et voilà, ça, c’est fait, votre identité peut maintenant être utilisée par n’importe quel escroc à travers la planète.

Ensuite, bien sûr, pour récupérer cet argent, il faudra avancer quelques frais, rien de bien important en comparaison de ces sept cent cinquante mille dollars qui vous attendent: 50 euros par ci pour que la banque fasse le nécessaire, 100 euros par là, etc. Une comptable US a un jour coulé la PME pour laquelle elle travaillait, à force d’avances. En théorie, la plupart des êtres humains ont de plus en plus de mal à arrêter les frais lorsqu’ils ont l’impression que la récompense est proche.

Enfin, à un moment ou un autre, il faudra communiquer votre numéro de compte en banque, bien sûr, pour pouvoir recevoir cet argent. Et là, …

En résumé : Non, vous n’avez pas une chance monstre d’avoir été choisi pour cette mission. Vous êtes en train de contempler un hameçon jeté sous vos yeux par un escroc.

Le même processus existe avec des variantes :

The WEST CLIFF CASINO BOARD International promotion UNITED KINGDOM program is proud to inform you that you have just won Two Million British Pounds (£2.000, 000, 00).

Non plus. Ici aussi, râtissage de compte bancaire doublé d’un vol d’identité en vue.

NOTICE…Winner Of £1,000,000.00 Pounds ! We wish to congratulate and inform you on the selection of your email coupon number [...]

VERIFICATION AND FUNDS RELEASE FORM
1.FULL NAMES:_________________________________
2.ADDRESS:__________________________________________
3.SEX:___________
4.AGE:_______
5.MARITAL STATUS:__________________
6.OCCUPATION:___________________
7.E-MAIL ADDRESS:_____________________________
8.TELEPHONE NUMBER:_____________________
9.AMOUNTWON:____________________________
10.STATE:__________________________________
11. COUNTRY________________________________
12. NEXT OFKIN:_____________________________
13. ZIP CODE:_______________
14:NATIONALITY:___________________________

Ben tiens !

(Tous les exemples sont tirés de mon dossier Courrier Indésirable, que j’avais vidé il y a moins de 48 heures. Depuis, j’ai gagné six millions à la loterie (en quatre mails), et suis en mesure d’aider trois personnes proches d’un riche décédé).

Partie III – les arnaques ciblées

In english – Sane paranoia, part II : large spectrum scammers

Spammers are annoying, but not very dangerous. We’ll see that we can find much worse than them: scammers, that have evil plans concerning:

• your wallet
• your identity

Among them are two types ; the large spectrum scammers are those that hope to get interesting informations out of you, as well as your money, wherever it is.

They’re also called 419 scammers, or Nigerian scammers, although they don’t often are in relation with Nigeria.

They’ll contact you in a long mail full of polite formulas and typographic errors, and will explain the awful difficulties they face…

Dear Friend,

I am Barrister. Allen Anthony, a personal Attorney to Mr. Hughson Taylor. On the 21st of April 2006, my client, his wife and their three children were involved in a car accident along Udonthani express Way. All occupants of the vehicle unfortunately lost their lives.

How sad. I’m deeply moved. (You’ll probably also get emails from the widow of the Regretted Late General Blah, or the sister of the Regretted Deceased President Blahblah, and so on). You’ll then find out why you’ve been contacted, because your precious help is necessary!

I contacted you to assist in repatriating the money and properties left behind by my client before they get confiscated or declared Unserviceable by the bank where he has deposits particularly the Citizens Bank where the deceased had an account valued at about US$7.500.000 dollars. (Seven million and five hundred thousand dollars).

Oh, all of that money going to be confiscated! But what can I do to help this poor fellow!? Don’t worry, you’ll know that real quick.

Since I have been unsuccessful in locating the relatives for over 2 years now, I seek your consent to present you as the next of kin of the deceased since you have the same last name so that the proceeds of this account valued at US$7.500,000 dollars can be paid to you and then you and we can decide what to do with the money and others vital asset of his.

All of this money for me! Yeah! Where do I sign up!

Well, yes, but no. Reply to this email, and you’ll put the finger in a dangerous place. First you’ll have to provide Mr Allen Anthony with a number of informative items about you to Mister Allen Anthony, so that he can prepare the necessary paperwork: name, surname, date of birth, place of birth, recent photograph, photocopy of your ID card or driver’s license.

Voilà, that’s done, your identity can now be used by any crook in the world.

Then, of course, in order to get all these millions back from the bank, you’ll have to advance certains fees, fifty dollars there, hundred here, and so on. An american accountant once led his business file for bankruptcy due to all these fees. In theory, most of the human beings we are have a really hard time realizing they’re being abused and stop before it’s too late, when each time it seems the reward is closer.

Finally, at some point, you’ll have to communicate your bank account information, of course, in order to be able to get all this money. And then…

To make the long story short: No, you’re not really lucky to have been chosen for this mission. Rather, you’re contemplating a big hook dropped under your eyes by a crook.

The same process exists with some variants:

The WEST CLIFF CASINO BOARD International promotion UNITED KINGDOM program is proud to inform you that you have just won Two Million British Pounds (£2.000, 000, 00).

Not so. Exactly the same things will happen.

NOTICE…Winner Of £1,000,000.00 Pounds ! We wish to congratulate and inform you on the selection of your email coupon number [...]
VERIFICATION AND FUNDS RELEASE FORM
1.FULL NAMES:_________________________________
2.ADDRESS:__________________________________________
3.SEX:___________
4.AGE:_______
5.MARITAL STATUS:__________________
6.OCCUPATION:___________________
7.E-MAIL ADDRESS:_____________________________
8.TELEPHONE NUMBER:_____________________
9.AMOUNTWON:____________________________
10.STATE:__________________________________
11. COUNTRY________________________________
12. NEXT OFKIN:_____________________________
13. ZIP CODE:_______________
14:NATIONALITY:___________________________

Sure!

(All of the examples there are from my Spam folder, which I had emptied less than 48 hours ago. Since then, I won six millions at the lottery (in four emails), and am able to help three persons looking for a recipient to a rich deceased’s millions).

Part III – targeted scams

Je le répète à beaucoup de gens, spécifiquement les nouveaux internautes autour de moi : Internet, c’est sympa, plein de ressources intéressantes, on y découvre des communautés de gens sympathiques, etc. Mais très vite, on y découvre des tas de pièges, placés là par des gens mal intentionnés. Il suffit de le savoir, et d’y prêter attention, mais hélas il suffit de baisser sa garde une fois pour que des désagréments fâcheux commencent à arriver.

La plupart de ces dangers arrivent sous formes d’emails.

Peu de temps après avoir commencé à utiliser une adresse email, pas mal de monde va commencer à essayer de vous vendre diverses choses – les respectables magasins en ligne, d’une part, dont on peut assez facilement se débarrasser, et les spammeurs, d’autre part. Ceux-ci ne respectent pas les lois en vigueur et l’on ne peut pas s’en débarrasser. Vous pourrez leur acheter très facilement diverses choses:

• des pilules magiques telles que Viagra, Cialys, etc
• des herbes magiques qui vous feront une bite de Rocco Sifredi en un mois
• des fausses Rolex, et autres articles luxueux du genre
• des faux diplômes, papiers, etc

Dans chacune de ces catégories, vous vous feriez arnaquer. Quoi que vous achetiez, vous recevrez au mieux, des placebos, ou simplement rien. Pensez-vous vraiment pouvoir confier votre numéro de carte bleue en ligne à ce genre de vendeurs?

Au final, cette catégorie d’indélicats est assez facile à ignorer ; avec les filtres anti-spams actuels, dits adaptatifs ou encore bayésiens, il suffira d’en marquer quelques uns comme spam pour ne (presque) plus en voir.

Partie II – Les arnaqueurs à large spectre

In english – Sane paranoia, part I: spammers

I keep repeating it to a lot of people, specifically new Internet users around me : Internet is nice, fun, big, full of interesting resources, one can discover lots of communities about various subjects, and so on. But quite soon, a lot of traps surface, placed there by malicious people. Avoiding them isn’t too difficult, once you know about them and pay attention; but one time is enough to get some serious annoyances.

Most of these dangers come to you via email.

Not long after starting to use an email address, a lot of people will start trying to sell you various things – normal e-commerce website, on one hand, which you can easily get rid of, and spammers, on the other hand. Spammers don’t abide by the laws, and you can’t get rid of them. You’ll be able to buy a lot from them:

• magical pills, like Viagra, Cialys, and so on
• magical herbs that’ll miraculously provide you with a penis bigger than Rocco Sifredi’s
• fake Rolex watches, and other fake “big brands” stuff
• fake diplomas, papers, and so on

In each of these categories, you’d get owned. Whatever you’d buy, you’d get at best placebos, or just nothing. Do you really think you can trust such senders with your credit card number?

In the end, this category of scumbags is quite easy to ignore ; with the current anti-spam filtering techniques, bayesian filtering, you’ll only have to mark a few of these emails as Spam and (almost) never see one again.

Part II – Large spectrum scammers

At first, I didn’t even knew gdb, and debugged with printf()s. Totally impractical, slow, prone to error (as it moves corruptions to other places or even completely hide them), requires recompilation and a new run each time one needs more info.

Then I learnt about gdb and how to use it. Once I could reproduce a bug, finding its root cause became much easier. Mid-2002, a crash handler was added to Claws Mail, which automatically attached gdb to a crashed process and got a backtrace. That increased the quality of our crasher bug reports, when Claws Mail was compiled with debug symbols. Distributions were more and more shipping with bug-buddy or equivalents, that did the same thing. It was still rather useless without debug symbols, but better than nothing…

Then Valgrind came around, and that gem made tracking down corruptions, double-frees, unitialized pointers, dangling pointers, etc, much easier. I remember tracking one of these in IMAP code for days, and Valgrind would have made it clear in a matter of minutes. Valgrind is the debugging tool that gives me the most “oh damn, how did I not notice!” moments.

As if it wasn’t enough, the glibc developers started integrating basic handling of memory allocations errors, basically making the program dump core right on such an error, instead of silently corrupting things and continuing to run for a few seconds/minutes. And now, the glibc itself is able to produce crude stacktraces when crashing on these conditions!

Finally, distributions developers start to get tired of crash dumps with no debug symbols, and some services appear that automatically re-trace crashes with debug symbols: Launchpad.net, for example, gets bugreports with stacktraces from Ubuntu’s apport. Then a bot automatically retraces with debug symbols, and we get a really nice report.

All of these really help, and kids these days have it easy!

He then tried to open it with Claws Mail, which succeeded at the second attempt (a wifi disconnect ruining it at 70% the first time – and the 200 MBs of downloaded data got leaked in libetpan, bad).

The second time, the folder opened:

As you can see, the folder is big. We discovered an overflow in the size handling in the process: the mailbox was bigger than 1GB… Claws consumed 670MB of memory with that folder open, but it handled it.

When trying to empty it, we noticed that setting \Deleted flags was really slow, and the server process was using 99.9% CPU on the server. We ended up destroying the mbox on the server.

Poll is here!

I hope you will like it!

Edit: By the way, most of the GUI code of that calendar comes from the excellent XFCE Orage clock and calendar application. Thanks to Juha!

Two weeks later. Buy a 42U rack, and eight 1U servers, all of these from the same $supplier, and at the same time. Receive your rack and 8 servers, without rails. Inquire by email: “No, servers don’t come automatically with rails, you didn’t ask for them”.

Thanks, Dell. It’s always a pleasure.

of course, it works.

(via Planète Béranger, photo Kathryn Yu)

#available storage
[root@sam119 ~]# df -h /data
Filesystem Size Used Avail Use% Mounted on
/dev/sdb1 6.3T 941M 6.0T 1% /data

#write test
[root@sam119 ~]# dd if=/dev/zero of=/data/toto.txt bs=4096 count=2621440
2621440+0 records in
2621440+0 records out
10737418240 bytes (11 GB) copied, 38.8372 seconds, 276 MB/s

#read test
[root@sam119 ~]# dd if=/data/toto.txt of=/dev/null
20971520+0 records in
20971520+0 records out
10737418240 bytes (11 GB) copied, 31.7011 seconds, 339 MB/s

(See also the previous Geek pr0n entry, complete with JPEGs!)

• biloba.desktop:

Exec=/usr/bin/biloba.sh
StartupWMClass=biloba

• /usr/bin/biloba.sh:

#!/bin/sh
export SDL_VIDEO_X11_WMCLASS=biloba
/usr/bin/biloba

Then, the window will probably appear as unnamed in the task list if the application is full-screen, in which case forcing the WM_NAME helps.

I just finished the porting of that game to Nokia’s Internet Tablets (770, n800, n810). Get it here while it’s fresh!

It seems the missing quotes issue in STATUS replies has been fixed:

4 STATUS “[Gmail]/All Mail” (MESSAGES UIDNEXT UIDVALIDITY UNSEEN)
* STATUS “[Gmail]/All Mail” (MESSAGES 18740 UIDNEXT 19300 UIDVALIDITY 1 UNSEEN 4210)

Nice to see them react!

You suck.

11 STATUS “[Gmail]/Sent Mail” (MESSAGES UIDNEXT UIDVALIDITY UNSEEN)
* STATUS [Gmail]/Sent Mail (MESSAGES 35 UIDNEXT 36 UIDVALIDITY 4 UNSEEN 1)

Please quote folder names containing spaces in your replies.

[root@sam70 ~]# rpmbuild –rebuild xen-3.1.0-10.fc8.src.rpm
Installing xen-3.1.0-10.fc8.src.rpm
error: Failed build dependencies:
transfig is needed by xen-3.1.0-10.x86_64
libidn-devel is needed by xen-3.1.0-10.x86_64
texi2html is needed by xen-3.1.0-10.x86_64
SDL-devel is needed by xen-3.1.0-10.x86_64
curl-devel is needed by xen-3.1.0-10.x86_64
libX11-devel is needed by xen-3.1.0-10.x86_64
python-devel is needed by xen-3.1.0-10.x86_64
ghostscript is needed by xen-3.1.0-10.x86_64
tetex-latex is needed by xen-3.1.0-10.x86_64
gtk2-devel is needed by xen-3.1.0-10.x86_64
libaio-devel is needed by xen-3.1.0-10.x86_64
/usr/include/gnu/stubs-32.h is needed by xen-3.1.0-10.x86_64
dev86 is needed by xen-3.1.0-10.x86_64
gnutls-devel is needed by xen-3.1.0-10.x86_64
openssl-devel is needed by xen-3.1.0-10.x86_64

Picking only one example from this list: why on earth does xen need gtk2-devel?

Let’s just grin, and do as requested, after all, it’s not as if I had a choice. After figuring out that /usr/include/gnu/stubs-32.h is actually provided by glibc-devel (and the src.rpm building machine didn’t know it…)

[root@sam70 ~]# yum install transfig libidn-devel texi2html SDL-devel curl-devel libX11-devel python-devel ghostscript tetex-latex gtk2-devel libaio-devel glibc-devel dev86 gnutls-devel openssl-devel
Loading “installonlyn” plugin
Setting up Install Process
Setting up repositories
base 100% |=========================| 1.1 kB 00:00
updates 100% |=========================| 951 B 00:00
addons 100% |=========================| 951 B 00:00
extras 100% |=========================| 1.1 kB 00:00
Reading repository metadata in from local files
primary.xml.gz 100% |=========================| 341 kB 00:01
updates : ################################################## 817/817
Added 12 new packages, deleted 0 old in 1.03 seconds
[...]

Transaction Summary
=============================================================================
Install 76 Package(s)
Update 0 Package(s)
Remove 0 Package(s)

Total download size: 116 M
Is this ok [y/N]: y

Now everything’s downloaded…

Transaction Check Error:
file /usr/share/man/man1/asn1parse.1ssl.gz from install of openssl-0.9.8b-8.3.el5 conflicts with file from package openssl-0.9.8b-8.3.el5
file /usr/share/man/man1/nseq.1ssl.gz from install of openssl-0.9.8b-8.3.el5 conflicts with file from package openssl-0.9.8b-8.3.el5
file /usr/share/man/man1/ocsp.1ssl.gz from install of openssl-0.9.8b-8.3.el5 conflicts with file from package openssl-0.9.8b-8.3.el5
file /usr/share/man/man1/smime.1ssl.gz from install of openssl-0.9.8b-8.3.el5 conflicts with file from package openssl-0.9.8b-8.3.el5

That’s actually due to openssl-devel package pulling in i386 and x86_64 versions of the openssl package, which happily conflict due to both of them shipping… the same manpages! I wonder how they manage to get automated builds working. (Solving that: rpm -ivh –force –nodeps /var/cache/yum/base/packages/openssl-* . Doesn’t look like chainsaw work at all…)

As a bonus, note how the error message doesn’t indicate at all that the two conflicting packages, even if they’re named the same, are not actually the same, given both of them are for different architectures.

Sigh. Thanks, RedHat.

I wish them good luck for the future.

Anyway, we now had the possibility to remove this dependancy without removing the feature, as the GTK developers added a new API, GtkPrintOperation, to do printing. This is available with GTK+ 2.10 or greater.

We’ve waited a few monthes before implementing that, because their API is quite generic, and they didn’t provide a way for application developers to easily print a GtkTextBuffer — the GTK widget used texts spanning multiple lines. We thought it would be nice for a lot of application developers to be able to do that easily, and that it would spare them reimplementing the same thing again and again, in every app wanting print support.

I submitted the idea on their Bugzilla, but almost six monthes later with no activity at all on the bug, it’s quite clear that they don’t care.
So, Holger Berndt, one of our developers – author of the Notification plugin, the Perl plugin and the Synce plugin – decided to stop waiting, and implemented text printing of emails via GtkPrintOperation. His patch went into CVS, and the next day I added support for image printing, and a crappy preview. The next day again, Holger rewrote my preview code and turned it into a really nice preview. (Yes, one has to write the preview code, because the GTK developers decided it was better, by default, to do previews using “print-to-pdf-file and run Evince”, thus forcing a runtime dependancy on Evince.

Here’s the mandatory screenshot of the new preview:

So, I must say that even if GtkPrintOperation works fine, it feels half-done. The GTK developers did the bare minimum, in my opinion, to help application developers. We had to write 994 lines of code to implement that, and other people will write other 1000 lines of code to do the same thing…

• Notification icon – Trayicon since March 2003, plus the Notification plugin since March 2006
• Missing attachment warning – Since Attachwarner, November 2006
• “Magic Space Bar” – ! … Since the start of the project :)
• Sort by thread date – Since two monthes ;)
• Finding the timezone without asking – Since the start of the project
• Actually learn spams to SpamAssassin – Since February 2006

Evolution seems to get better !