Posted on
Who’s for an OpenPF?

Things are very quiet this week; I’ve had nothing to post for some days – DragonFly or even for other BSDs.  The end of the year has most people distracted, I think.  This makes it a good time to bring up something that’s been bothering me: the state of software firewalls in BSD.  The pf utility is a BSD advantage; I’ve heard people say “I used iptables on Linux and pf is a much better alternative.”  I know that’s anecdotal, but there it is.  Here’s the question, and the reason I’m writing this: which pf?

DragonFly has a version of pf equivalent to what was shipped in OpenBSD 4.4.  FreeBSD has a version equivalent, I think, to OpenBSD 3.8 4.5’s pf, and it has been further modified.  NetBSD has a similar, older pf, but there’s people working on a NetBSD-specific version called npf, which isn’t yet ready.  And of course, OpenBSD has its version of pf.  If you feel good about these different alternatives, you call it divergence.  If you don’t feel good about it, you call it fragmentation.

Compare this to OpenSSH – it works the same on each platform.  There’s no confusion on how to configure it, or interoperability problems.  It would be wonderful to have the equivalent for pf, where other BSD platforms would import a portable version.  This software firewall is a strength, and it’s much easier to tout it when there’s only one.

I doubt there’s a way to bring it all back to one source tree.  There’s a lot vested in the different forks out there.  You know what would take a lot less effort: a compatibility test suite.  Agreeing on a common syntax and set of functions would make life easier for every end user.  It would incidentally make vendors a lot happier, too.  Even if a user or vendor wasn’t hoping to move between BSD flavors, a test suite would still guarantee a certain known level of functionality for any BSD release.

How likely is this?  I don’t know.  But I want to bring up the notion before it gets missed.  Now is a good time, with each pf version still being relatively close to one another.

Update/note: Henning Brauer is willing to help.

Posted on
In Other BSDs for 2013/12/07

Happy birthday to me!

Posted on
Lazy Reading for 2013/11/17

It’s been snowing this week in the northeast US, which makes me happy.

  • Unix: sending signals to processes.  Signals have always struck me as a somewhat byzantine messaging system that everyone uses for the equivalent of Ctrl-C.
  • Unix: Debugging your scripts.  This will be useful if it’s not already familiar to you.
  • Compatibility is Hard.  Contrary to popular belief, Microsoft Word documents are not backward or forward compatible, from release to release.
  • From that previous link: Why Microsoft Word Must Die.  The worst problems to troubleshoot are when someone says “Word/Excel is acting funny”.  There’s so many intermediate layers of software in those programs that it’s difficult to find the actual data and the actions being performed on it, much less troubleshoot any process.
  • SparkFun.com moved from MySQL/MariaDB to Postgres.  I agree with the sentiments in the article, but I want to know the technical reasons that made Postgres the choice for scaling.  (via)
  • Apple ][ DOS source code.  I don’t have anything I can actually do with the source, but there’s a 1977 price list pictured in the the article that shows some interesting numbers: A 4Kb RAM system costs about $1300, and the prices just go up from there.

Your unrelated comics link of the week: the first four pages of Necropolis.  This comic looks to be fun.

Posted on
Book review: Sudo Mastery

If you’ve seen my previous two reviews of Michael W. Lucas’s ‘Mastery’ books – DNSSEC Mastery and SSH Mastery – then you can guess what this will be: his newest book, focusing on a single software topic.  This time it’s sudo.

sudomastery-cover

The one downside of reading this book: I now am aware I’m using sudo wrong.  Perhaps not wrong, but not anywhere near its potential.  Sudo – and I’m not the only person who has experienced this – is used as a “Let’s install sudo so we don’t have to tell anyone the root password”.  Sudo works for that sort of thing, but there’s a lot more possibilities.

Sudo is designed to be deployable across multiple systems, as part of a security policy.  It’s an easy way to create purpose-shaped roles with different users, especially with users that have specialized skills and tasks, like database maintenance.

Obviously I think better of sudo after reading the book; there’s a lot of program capabilities of which I was unaware, but it’s the book that sells them.  Michael W. Lucas’s humor is on display again, to break up some very technical material.  Here’s some bits, pulled out.

Remember that “syntactically valid” is not the same as “does what you want.”

Pressing Q tells visudo to break sudo until you log in as root and fix it. Do not press this button. You won’t like it.

Here I create the TAPEMONKEYS alias for the people who manage backups.

And if Carl tries to configure Oracle on the PostgreSQL server, senior sysadmin Thea needs to have sharp words with him. Probably involving a tire iron.

The book is in-depth enough to cover more complex topics like using sudo and Active Directory, and sudo as an intrusion detection tool, of all things.

The usual reasons to buy a Mastery book are all still there: it specifically mentions working on BSD systems instead of pretending Linux is the only system out there.  It’s available through a DRM-free seller (Smashwords) in addition to Amazon.  It’s a self-published effort, not shovelware.  It’s available now as an ebook, and in physical form soon.  Lucas talks about it on BSDNow 010, too.

I have one last nontechnical note.  Since these Mastery books are working into a series, I’d like to see a whole printed run of visually matching books.  Something with the equivalent of the O’Reilly animals or the Pelican or even Little Blue Books common look and feel.

You know the look even if you don't know the publisher

The takeaway: You should be reading this book if you plan to use sudo in any sort of multiuser environment.  It’s available as an e-book direct from the author, via Amazon, via Smashwords, and possibly Barnes & Noble at some point in the near future.  Physical books are available, and you can buy both forms together, apparently.

And of course this sudo joke.

Posted on
Lazy Reading for 2013/11/10

I spent this entire week saying things like “Wait, today’s Tuesday?” and “I thought this was Wednesday, not Thursday.”

  • Welcome to my GUI Gallery, a whole lot of different GUI screenshots.  This mention of the “Salto” Alto emulator brought me there, and there’s some material I’ve never seen before.  Also, there’s Bob.  Not “Bob” the prophet, but Bob, the computer mistake.  Speaking of problematic designs, see the Windows 8 page.
  • 5 Cool UNIX Hacks.  Sounds linkbaity, but it’s useful.  I didn’t realize that CTRL-a is the non-destructive version of CTRL-u.  (via)
  • This seems strange, but I never heard of PLATO, even though it seems to be the precursor to so much.  (via)
  • “Goodbye Google“, in terms of switching to your own platform, seems to be a new trend.
  • arkOS, a similar idea.
  • Finding Files Your Way.  I can never remember all the arguments to ‘find’.
  • Google has a Shell Style Guide.  Which equates to a Bash Style Guide, but that’s OK.  Shell scripts are sometimes considered the most disposable form of programming, so it’s good to see a full guide.  (via)

Your unrelated animation of the week: late for meeting.  A followup to going to the store, which I think I posted here years ago.

Posted on
In Other BSDs for 2013/11/02

There’s a surprisingly large list this week.

Posted on
Lazy Reading for 2013/09/15

I think I’m finally catching up on the backlog.

Your unrelated link of the week: The Alan Lomax recordings.

Posted on
Lazy Reading for 2013/09/01

Another week of links completed early.  And there’s a lot, so get clicking!

Your unrelated link of the week: The remix of this 1997 Kid’s Guide to the Internet – somewhat NSFW, and has all the best moments.  More from EVERYTHING IS TERRIBLE.

Posted on
Lazy Reading for 2013/08/11

Again, lots of links.  Some of these are overflow from previous weeks where I just said “That’s enough; let’s work on the next Lazy Reading.”

Your unrelated link of the week: Mighty Taco radio ads.  Mighty Taco is a Mexican fast food place from Buffalo, New York, USA.  It’s about as authentically Mexican as fast food from a city on the edge of Canada can be, which is ‘not much’.  I’ve always loved the food, though, and the commercials are just the right mix of amateur joke and commercial advertising.

Bonus unrelated: If you enjoy imgur/fukung but it’s not youtubey enough, hit ‘Random’ on IWantMoar.com a few times.  You may want to turn down your volume.

Posted on
Lazy Reading for 2013/07/21

Last week was relatively light, but somehow this week I read a zillion interesting things.  It’s been too dang hot to do much else, other than flop in a chair and point a fan at my head.

Your unrelated link of the week: Bones Don’t Lie.  An anthropologist who blogs about various discoveries of human remains.  I really enjoy blogs where someone is talking about a subject they care about – not to sell a product, not to be paid (directly), but just because they like the topic and they want to share it with others.  Of course I would think that, wouldn’t I?

Posted on
PRISM, privacy, and what you make yourself

If you’ve been reading the Digest for a while, you’ve seen me talk about the value of hosting or running your own services.  It’s not too much of a surprise in my case; if you are working on an open-source operating system, you want to run it.  It’s good to get the experience, and you can run programs the way you want, instead of picking from whatever vendors happen to sell you.

The PRISM disclosure, which I am going to assume everyone is familiar with at this point, is another facet.  Every time you use another company for your email, your entertainment, your software, and so on, their information on you can be accessed.    This isn’t a problem that can be fixed by going from one webmail provider to another.  You can shop around, but notice that the author in that link effectively throws his or her hands in the air and says, “there’s no way out” by the end of the article.  This is because corporations work as collecting agents for the government, even if they don’t plan to do so.

That sounds drastic, but there’s legal frameworks in every country for governments to require companies to give up data on any person, on request.  It happens.  I’ve seen it myself; I worked for Time Warner for several years, tracking down cable modem user information and handing it over as compelled by law.  I know the lawyers at TW Corporate didn’t like doing it, but they didn’t have a choice.  (I have some horrifying stories about what people would do to themselves and each other.)

Companies are increasingly working to create services to sell, not products to buy.  A service never stops being consumed, so it forms an ongoing revenue stream.  I’m not saying this is bad; I firmly believe that a financial incentive to be paid improves services.  However, as only a consumer, you can end up not owning what you use.  Other people have pointed this out, and I don’t want to sound like a frothing crazy person… but it is relevant, though not necessarily as catastrophic as some people pronounce.

What I’m working towards here is a reminder that you should run your own software, and running it on DragonFly is the best way.  (Or some other operating system, I guess.  If you have to.)  Instead of trying to figure out what the least-bad commercial option can be, run it yourself.  Good for privacy, good for learning.  I know that’s not an option for everyone; fighting with Sendmail (for instance) is not an activity that many people pick voluntarily.  But, if you’ve been thinking of setting up a replacement for Google Reader, or hosting your own mail, or own blog, etc… there’s never a better time than now.

(Follow all those links for some good information; consider it an early Lazy Reading post)