The ergonomy of the Mac has also made its way into how shortcuts are defined. The Command key, positioned where Alt is on PC keyboards, is definitely better positioned when it comes to using that key as your main modifier for shortcuts. Call it the power of habit, but every time I switch to a PC I find myself pressing the Alt key instead of Control. And that’s because Alt is in a handier position.

A few weeks ago I bought a CODE ten-keyless mechanical keyboard. One of the nifty features (and there are plenty) is the ability to change the layout of your keyboard with a combination of DIP switches located on the back. Obviously, it can be configured to a Mac layout. But what do you do when you want to use the same keyboard on your Linux box, from time to time? I mean you’re mostly using Command for your shortcuts. Remapping the shortcuts in your head to Control is not that easy at first.

XKB

Luckily Ubuntu, like many other Linux distros, comes with xkb - the X KeyBoard extension. This extension is responsible for mapping the physical keys of your keyboard to their designed function. xkb symbol files can be found in /usr/share/X11/xkb/symbols and it’s good to know that they’re localised, in case you need to add some language-specific mappings. However, in my case, I need to remap some of the modifier keys.

The modifier keys are mapped in /usr/share/X11/xkb/symbols/pc, a file which is inherited by all other configurations. Since I just want to replace Super with Control, the changes are minimal:

1
2
3
4

key <LCTL> {    [ Super_L       ]   };
key <LWIN> {    [ Control_L     ]   };
key <RCTL> {    [ Super_R       ]   };
key <RWIN> {    [ Control_R     ]   };

In order to apply the new mappings you need to clear out xkb’s cache from /var/lib/xkb:

1

rm -rf /var/lib/xkb/*

Afterwards just restart your X session and you’re good to go. Even though this small change doesn’t make all shortcuts to work like on a Mac it’s still a lot better than without it.

One of the solutions I’ve come across recently is to colorize the log output according to the log entries’ severity.

GUI half-baked options

On GNOME-based Linux distributions there’s GNOME System Log Viewer, a GUI application that can be used to monitor logs in real-time. One nice functionality that it provides are filters which can be configured to match an expression or a regular expression; the filters allow colorizing the output according to what they match. +1 for Linux.

On Mac OS X Console.app, although is able to filter information faster and easier than GNOME System Log Viewer, is not able to highlight the lines of interest using colours. Which is a shame, given the fact that more and more developers are migrating to Macs.

tail and the power of Bash

Every Unix/Linux user has used tail at least once (though I have my doubts regarding some of the Mac users :P). The advantage of tail is that it allows piping its output to whatever program able to consume information from stdin.

Enter awk

awk is an interpreted programming language perfect for extracting data from text files. Given the fact that awk can read from stdin, it’s quite trivial to pipe data to it from which to extract more meaningful information. Combine this with a little Bash scripting (needs Bash 4 due to associative arrays) and we have a nice and easy way to analyze logs in real-time using colour-coded output.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

#!/usr/local/bin/bash
TAIL=`which tail`
AWK=`which awk`
if [[ -z $TAIL ]]; then
    echo -e "Cannot find tail executable.\n"
    exit 1
fi
if [[ -z $AWK ]]; then
    echo -e "Cannot find awk executable.\n"
    exit 1
fi

CWD=`dirname $0`

declare -A log
log["INFO"]="BWhite"
log["ERROR"]="BRed"
log["WARN"]="BYellow"
log["DEBUG"]="BGreen"

if [[ -f "$CWD/ctail.config" ]]; then
    source "$CWD/ctail.config"
fi

declare -A colours
# Regular
colours["Black"]="\033[0;30m"
colours["Red"]="\033[0;31m"
colours["Green"]="\033[0;32m"
colours["Yellow"]="\033[0;33m"
colours["Blue"]="\033[0;34m"
colours["Purple"]="\033[0;35m"
colours["Cyan"]="\033[0;36m"
colours["White"]="\033[0;37m"
#Bold
colours["BBlack"]="\033[1;30m"
colours["BRed"]="\033[1;31m"
colours["BGreen"]="\033[1;32m"
colours["BYellow"]="\033[1;33m"
colours["BBlue"]="\033[1;34m"
colours["BPurple"]="\033[1;35m"
colours["BCyan"]="\033[1;36m"
colours["BWhite"]="\033[1;37m"
# High Intensity
colours["IBlack"]="\033[0;90m"
colours["IRed"]="\033[0;91m"
colours["IGreen"]="\033[0;92m"
colours["IYellow"]="\033[0;93m"
colours["IBlue"]="\033[0;94m"
colours["IPurple"]="\033[0;95m"
colours["ICyan"]="\033[0;96m"
colours["IWhite"]="\033[0;97m"
# Bold High Intensity
colours["BIBlack"]="\033[1;90m"
colours["BIRed"]="\033[1;91m"
colours["BIGreen"]="\033[1;92m"
colours["BIYellow"]="\033[1;93m"
colours["BIBlue"]="\033[1;94m"
colours["BIPurple"]="\033[1;95m"
colours["BICyan"]="\033[1;96m"
colours["BIWhite"]="\033[1;97m"

AWK_EXPRESSION=""
for i in "${!log[@]}"; do
    AWK_EXPRESSION="/$i/ {print \"${colours[${log[$i]}]}\" \$0 \"\033[39m\"} $AWK_EXPRESSION"
done

$TAIL "$@" | $AWK "$AWK_EXPRESSION"

A ctail.config file can be created in the same folder with ctail to override the default colours and log levels associations.

The advantage of using awk is that it’s present on most of the available Linux distributions and UNIX flavours and that it’s reasonably fast.

Option no. 2: ack

Another tool used for filtering information is ack, a tool “designed as a replacement for 99% of the uses of grep”. A similar colorized tail script can be written like:

1
2
3
4
5
6
7
8

#!/bin/bash

tail "$@" \
| ack --flush --passthru --color --color-match=red    "^.*\*ERROR\*.*" \
| ack --flush --passthru --color --color-match=yellow "^.*\*WARN\*.*" \
| ack --flush --passthru --color --color-match=green  "^.*\*INFO\*.*" \
| ack --flush --passthru --color --color-match=white  "^.*\*DEBUG\*.*" \
| ack --flush --passthru --color --color-match=white  "^.*\*TRACE\*.*"

Credits for this solution go to Alex Klimetschek, one of my colleagues from Adobe. ack does not come standard on most Linux distributions, nor on Mac OS X; however, installing it is usually a few commands away with your favourite package manager.

In the end

Being an avid terminal user, I find the ctail script (in any of its variations) a better tool than its half-baked GUI alternatives. Furthermore, ctail can also be used on servers with very little setup.

Do you know of any other interesting ways for highlighting log messages?

Input handling

99.9% of the code written on this planet deals in some way or the other with user input. The User is not necessary a good person. A paranoid engineer (all engineers should be paranoid; if you’re an engineer but don’t feel paranoid just quit your job!) would actually say that The User is a terrible person whose only role is to create problems that the engineer has to solve. Since The User is such a terrible person nothing coming from them should be trusted. This is why everything that doesn’t come from a safe source (are there any safe sources for data input?!) must be validated.

For example:

1
2
3
4
5
6
7

public String reverse(String input) {
    final StringBuilder sb = new StringBuilder();
    for (int i = input.length() - 1; i >= 0; i--) {
        sb.append(input.charAt(i));
    }
    return sb.toString();
}

What would happen on line 3 if The User submitted null for the input string? That’s right. The assumption that your user is a nice person just earned you a NullPointerException. Now assume that your unvalidated code was delivered as part of some bigger project which accidentally calls your wonderful method. Oh yeah, the NPE now hogs in their code…

This could have easily been avoided by:

1
2
3
4
5
6
7
8
9
10
11

public String reverse(String input) {
    String result = null;
    if (input != null) {
        final StringBuilder sb = new StringBuilder();
        for (int i = input.length() - 1; i >= 0; i--) {
            sb.append(input.charAt(i));
        }
        result = sb.toString();
    }
    return result;
}

However, if the logic in your method is not as simple as that, always inform the caller of the consequences of calling your code with invalid parameters - whether you explicitly throw an Exception (which is documented), or you just provide a default return value.

Useful logging

Every engineer should use a logging mechanism through which meaningful and important information is… Well, logged. Probably the most useful information is the one which is logged in the case of an error. Assuming your logger supports a Throwable object as a parameter in its error method, never ever do this:

1
2
3
4
5

try {
    // code that throws a random exception
} catch (Exception e) {
    log.error("Bla bla bla" + e.getMessage());
}

It’s not gonna help anyone. Moreover it’s going to annoy the person who encounters the error because they won’t know the exact cause. Always log your errors like:

1

log.error("Meaningful error message", e);

Java is not C++ C89/ANSI C

Seriously! Repeat after me: “Java is not C++ C89/ANSI C!” You don’t need to declare your loop variable outside of the loop, like you used to do back in the old C. Nor do you have to declare and initialise a variable at the beginning of a method and then change its value on the next line. What’s the point?!

1
2
3
4
5
6
7
8
9
10
11
12
13

// int i = 0; BAD!
for (int i = 0; i < 10; i++) { /* GOOD! */
    //do something here
}

// hilarious
int index = -1;
index = "random_not_null_string".indexOf("!");
if (index == -1) {

} else {

}

Learn how to correctly concatenate Strings

Strings are immutable! Stop concatenating more than two of them with + if they are not constants. Every time you use + for something like

1
2

// assume we're in a loop
result += a + " bla bla " + b + " bla bla";

a kitten dies in terrible pain. Not only that your code is slow, it’s also occupying more memory than it should. Use one of the convenient classes for building strings, like StringBuilder or StringBuffer, the latter one being thread safe.

In case you need to write JSON

Don’t! Seriously. Just don’t. And not because I don’t like JSON, but because you’re probably going to do something wrong. Always use a class that can write JSON for you. Yes, it’s another dependency to your project. However the chances are that it’s been tested by more developers than just one. Code is one of those things where “the more, the merrier” expression just fits in without sounding awkward. Whether you use Json.simple or Gson, it’s up to you.

As a conclusion

Don’t be ashamed to ask for a code review from one of your colleagues. Nobody’s perfect, but the code you deliver should work no matter what data it’s fed through it. Write your application as if you’re building a tank. Make it handle abuse and misuse. And don’t forget to be paranoid. It helps.

(Many thanks to fellow Redditers who provided me with valuable feedback for two things that I haven’t double checked: the String concatenation example didn’t specify that + should be avoided in loops, although that was the intended case; the C++ standard allows variable declarations anywhere.)

• improved IO performance (encryption comes with a cost - I really wouldn’t like to use it on a mechanical drive)

• reduced power consumption

• reduced operation noise (only the fans and the optical unit contain moving parts)

• less dissipated heat

Because I was in hurry to get the new machine set-up I decided to install the new SSD by myself. After all, it wasn’t the first time I tore a computer apart. Big mistake…

Apparently Apple uses the tiniest screws available. Most of the guides and forum posts on the subject mention that the only tools you need to access the user-replaceable components (the hard-drive and the RAM DIMMs) are a PH#00 and a T6 screwdriver. For n00bs, that’s a Phillips 00 screwdriver (+ shaped) and a Torx 0.6 (* shaped). Wrong!

It seems that the recommended PH#00 screwdriver is too big to safely remove the screws that keep the back lid attached to the body. Using a bigger screwdriver might end up in deforming the screws’ heads. However the Phillips PH#000 is a perfect match. If you’re looking to buy these two screwdrivers - the PH#000 and the T6 - I suggest you visit your local DIY store and look for precision screwdrivers. Try to buy a set that’s made from high carbon steel if you want to use them for a longer time.

A very good guide for changing your Mac’s hard-drive can be found here. Keep in mind, though, that you need a PH#000 screwdriver.

After 10 days of using only the MacBook as my main computer (even at home), I can’t say that I really miss using Ubuntu.

Sure, there are some things that aren’t as nice on a Mac:

• the lack of a decent package manager - MacPorts, although usable, can’t compare with apt-get;

• the lack of a good default text editing application - TextEdit sucks compared to gedit; however I have discovered Sublime Text 2 aka vim on steroids with a GUI;

• the window management system - although I’ve come to understand why there’s no need to maximize a window (hence why the third window management button is called “zoom”), I really don’t like the fact that if you “hide” a window (minimize it in plain English), you have to right-click on its icon from the dock to restore it;

• Terminal is not that smart by default - more info here; also, because I often perform tasks from the terminal I needed a way to make the app on the Mac behave more like Yakuake and that’s how I found out about TotalTerminal;

• Finder, the file browser on the Mac, is not really worthy of “the world’s most advanced desktop operating system”; it lacks tabs, the cut function is not enabled (although it is available) and if you enable it anything you “cut” will make it to Trash.

I had no problems configuring the system and this was probably helped by the changes that were made in Ubuntu in this direction over the previous years. An Ubuntu user would have no problems at all adjusting to the Mac; and the other way around. This was a bold decision - to use the Mac as the source of inspiration for Ubuntu - and I really appreciate Mark Shuttleworth’s leadership in the project. Although I really like the idea of freedom that the Linux ecosystem promotes, I do agree that having some restrictions in place - some would call it direction - helps in delivering a product with a superior quality.

There are a lot of things that I like about the Mac:

• the hardware is superior to everything else on the market and by superior I don’t mean necessarily performance-wise; everything fits together so good that nothing seems out of place; the attention to details was paramount; the fact that the body is made from Aluminum helps a lot for the overall system cooling - the fan rarely can be heard and that’s only when the CPU is very busy;

• having an illuminated keyboard is really useful when using the laptop in dim light or when you want to work during the night - such a simple and efficient idea;

• the battery life is very good - if you don’t use Skype or the GoogleVoiceAndVideo plug-in; you can easily squeeze 4 - 5 hours if you’re not performing rocket science; I managed to reach 3.5 hours while coding with Java on top of a web application that ran continuously in a Servlets container;

• the gestures and the track-pad really increase productivity;

• the GUI - this is where the Mac was, is and will be ahead of the other OSs;

• using a secondary display is as easy as connecting it to the Mini DisplayPort; no other settings have to be made;

• it’s a widely (?!) supported Unix or it has better support than any Linux distribution anyway;

• the display (even the one with the 1440x900 resolution) looks sharp from any angle without any colour bleeding.

If I’d run Mac OS X on any other hardware probably I wouldn’t be so amazed (yes, I know about the license). But combine the OS with the hardware and you get a killer combination that’s easy to accept as the norm. It slowly gets you and it becomes harder and harder to go back to what you were using before. Yes, I have become a ”mactard”.

Because the price / GB of the classic mechanical hard-disk was so low (as low as US$0.05 per GB for 3.5 inch drives and US$0.10 per GB for 2.5 inch drives), producers started to offer larger drives for the same money. Unfortunately SSD technologies cannot and probably will not evolve the same way due to memory degradations once the chip size decreases. In particular this led to higher prices for the same disk size, making SSDs more attractive for boot / OS drives instead of plain storage ones.

Migrating a current OS installation usually has to take into consideration that the SSD destination disk might not be able to fully accommodate the previously stored data. The following paragraphs will describe what solutions can be employed in order to successfully migrate an Ubuntu installation (or any other Linux distribution) to a SSD drive.

How To

Depending on the available storage space of the SSD, there are two available solutions:

1. the destination drive is just as big as the source drive, or larger – ddrescue

2. the destination drive is smaller than the source drive – rsync, gparted, boot-repair

Tools needed for both solutions:

1. an Ubuntu live CD / live USB stick from which to boot and perform the migration;

2. at least two SATA drives, one for the source and one for the destination disk;

3. at least two SATA data cables and two SATA power cables if you’re using a desktop machine to perform the migration, or a SATA to USB adaptor if you’re using a laptop;

4. a Philips screwdriver to mount / un-mount the hard drives and possibly the 3.5” adaptor.

It’s time to connect the hard drives to your machine.

1. Same size or larger SSD

If the SSD you have installed on your machine is the same size or larger than your current mechanical drive it means that you’re rich. Furthermore, the work you have to do to migrate your system to the new drive does not require too much effort. ddrescue is a great tool for restoring information from failing drives but it can also be used to perform bitwise clones.

To start migrating your system from one drive to the other, perform the following steps:

1. boot your machine using the live CD / USB stick;

2. enable the “universe” repositories on Ubuntu and install gddrescue:

    sudo apt-get update && sudo apt-get install gddrescue
   

3. use gddrescue to clone your drive:

    sudo ddrescue -v --force /dev/sda /dev/sdb
   

   where /dev/sda is your source drive and /dev/sdb is your destination drive

4. have patience; depending on your disk size and your machine’s performance this might take a while.

At the end you should be able to seamlessly replace the old spinning drive with the SSD and just enjoy the snappiness of your system.

2. Smaller SSD - the usual compromise

Trying to clone a larger disk to a smaller one using ddrescue is not trivial, even if the total used storage space would be less than the SSD’s storage capacity. In this case three software tools of the *nix Swiss Army knife have to be used:

1. gparted – for setting out the partitioning layout;

2. rsync – for selectively synchronising the needed data (you can easily decide what to exclude using patterns);

3. boot-repair – to fix your Grub2 setup.

Partitioning with gparted

Boot your system using your live Ubuntu image. Using gparted (it is included on the live image) create the desired partitions on your SSD. Currently only 2 Linux file systems properly support SSDs (making use of native TRIM): btrfs and ext4. Out of these two, only ext4 is considered mature enough to be used on production-ready systems, due to its mass-adoption in the Linux world.

In order to align your partitions with the drive’s sectors (for optimal performance and longevity) make sure to leave the first MiB of storage unallocated and to align your partitions to MiB, not cylinders. This is fairly intuitive with gparted.

Remember to add the boot flag to the partition where your /boot folder will be stored.

Syncing with rsync

Once your SSD drive is partitioned, mount the source and destination partitions. This can easily be done from Nautilus, the default file browser from Ubuntu. Just open the home folder and on the left sidebar you can see the unmounted file systems. Click on them to let the system mount them automatically. I strongly recommend to mount them two by two (1 source, 1 destination) in order to avoid any complications. Using rsync selectively sync your partitions:

    sudo rsync -a -v --exclude "excluded_folder_name_or_pattern" /media/<source_uuid>/ /media/<destination_uuid>

Restoring grub

Unfortunately rsync will not be able to handle grub, thus you will not be able to boot your system. Restoring grub is very straight-forward. Again you will need the live CD / live USB stick to boot up your machine. After Ubuntu is up and running from the installation medium, you just need to install and use Boot-Repair. A very good guide is available here.

Specific mount options for SSD

Because of the way SSD drives work, some mount options need to be specified in your /etc/fstab file:

• discard – this enables TRIM;
• noatime – this disables pointless writes to disk to store the last accessed time for a read file

Your fstab file should look more or less like this:

1
2
3
4
5
6
7
8
9
10

# /etc/fstab: static file system information.
#
# Use 'blkid -o value -s UUID' to print the universally unique identifier
# for a device; this may be used with UUID= as a more robust way to name
# devices that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
proc            /proc           proc    nodev,noexec,nosuid 0       0
UUID=0765430a-83ae-4530-b1b1-a976cd72ce16 /               ext4    discard,noatime,errors=remount-ro             0 1
UUID=263bba00-32f4-4bea-966b-ab7ae1fc3e8b /home           ext4    discard,noatime,errors=remount-ro,user_xattr  0 2

Conclusions

Migrating from your slow mechanical hard drive was easy. I am pretty sure that if you have not used a SSD drive until now you will definitely question yourself why it took you so long to switch - I know I do. Sometimes we fail to remember that the hard-disk is still the slowest component in a computing system. A SSD might be the solution to speed up your machine instead of buying the newest and coolest CPU and it’s definitely cheaper as long as you can accommodate with less storage space for the drive that should store your OS and applications (and maybe your media workspace).

1
2
3
4
5

radu@riker:~$ cat testFile
a
b c
d
e f

What I’d like to do is to extract the strings from each line and assign them to some parameters; obviously the second parameter can be null. To do this with cut you’d have to use two different call types, one for each parameter:

1
2
3
4
5
6
7
8

radu@riker:~$ cat testFile | cut -d" " -f1
a
b
d
e
radu@riker:~$ cat testFile | cut -d" " -f2 -s
c
f

Notice the -s option in the second call. This tells cut not to print lines not containing delimiters. If by mistake you’d forget to add that flag to the options list, the output would be this:

1
2
3
4
5

radu@riker:~$ cat testFile | cut -d" " -f2
a
c
d
f

which includes the values for the first parameter too. Not good.

Now let’s share some awk love:

1
2
3
4
5
6
7
8
9
10

radu@riker:~$ cat testFile | awk '{print $1}'
a
b
d
e
radu@riker:~$ cat testFile | awk '{print $2}'

c

f

Of course, if your restrictions aren’t like mine you can as well use cut. However, you’d be safer with awk.

Happy Bash parsing!

The process of removing the unused images requires a few keystrokes and some user input, needing a great deal of attention not to remove the currently running kernel or - in case you are extremely inattentive - all the kernel images from your system. To semi-automate this task, you can use the following Bash one-liner:

1

sudo apt-get purge $(dpkg -l | grep "^ii" | awk '{print $2}' | egrep -e "^linux-headers-[0-9]|^linux-image-[0-9]" | egrep -v `uname -r | cut -d"-" -f1,2`)

Run this line only after you have booted into your new kernel, otherwise you’ll remove the upgrade.

The resolution is pretty Voodoo or, how Vlad described it, the error needs a Microsoft-type fix. Apparently if you are logged in on Facebook using your email address instead of the user name, the XMPP protocol might not authenticate you. Therefore, if you’d like to use Facebook’s chat on third-party clients while you’re still logged on in a browser, make sure you always log in using your user name instead of your email address on Facebook’s site. Trying to use your email address in Pidgin for the user name field results in an error, as email addresses are not valid XMPP user names.

Weird!

I am running a survey for my dissertation project to collect some useful data that might help me shape the application that I am going to build. If you have previously used Ubuntu your input will be much appreciated. It shouldn’t take you more than 5 - 10 minutes to complete the form.

Thank you very much for your kind help!

• VMware has declared VMware Server End Of Availability on January 2010 with the actual support ending on June 30th, 2011. More details can be read here. Furthermore, VMware Server is not officially supported on Ubuntu releases greater than 8.04.

• The VMware Server console plug-in won’t work on Firefox versions older than 3.6 (I have found no viable solution for this problem).

The needed instructions for the installation can be found here. For comments related to the installation on machines running the 2.6.38 kernel version please post here.

A little bit of history (and personal experience)

Only when it reached version 10 Adobe managed to issue a native 64-bit version of their Flash plug-in for Linux, but it was a Labs attempt and therefore not considered a stable release. Still, it was the best way to enjoy Flash content on a 64-bit platform, even though there wasn’t a nice and easy way to install it (get an archive from Adobe, extract the .so file from it, and then using sudo move it to the proper location using the terminal). Nevertheless, everything worked smoothly, even 1080p videos in full screen, as long as you had a decent machine. Yeah, Flash is power hungry (not quite news…).

It didn’t last long until Adobe found out that version 10.0 had a major security bug, which led to the release of version 10.1. But because Linux users were (and probably still are) a negligible quantity, version 10.1 didn’t contain a 64-bit release for this platform. The “official” reasons were that Adobe wanted to work on version 10.2 which unified several technologies and therefore did not have to time to work on a Linux release. And then again, in order to avoid the security bugs, Linux users had to use the 32-bit Flash player wrapped with 32-bit compatible libraries on their 64-bit systems. And hell broke loose ever since because running Flash videos in fullscreen was a matter of luck, randomness and Adobe’s willingness to test video cards drivers.

Although Riker has pretty powerful hardware components, a Flash video in fullscreen made it look ridiculous. Flash 10.2 (this time a native 64-bit release) didn’t seem to handle the problem better. Annoyed by such a trivial thing, I have started to look for a fix. It was weird that things were working with 10.0 and then degraded with newer releases. I know that my video driver hasn’t been updated since then, which clearly meant that the problem was on Adobe’s side.

The fix

Apparently, on UNIX (and consequently Linux) machines, the Flash player can read settings from two files:

• mm.cfg - a file residing in each user’s home directory with per user settings

• mms.cfg - a file residing in /etc/adobe which sets things for the whole machine

Because Flash uses its own mechanism to check for video card compatibility and then runs animations according to it, on some drivers it might fail to read properly the OpenGL specs of the card, which in turn leads to crappy performance in fullscreen (lags, unresponsiveness, browser crashes, etc.). To override the internal compatibility check (which Adobe says that might lead to crashes; ironic, isn’t it?!), one has to add a setting in the mms.cfg file:

1

OverrideGPUValidation=true

Once this is done, simply restart your browser and check how things are working. You might have a nice surprise. It’s amazing though how until 10.1 things were working as they should have without this override.

If by any chance that file, or even the adobe folder, is missing, use these commands:

1
2

sudo mkdir /etc/adobe #in case the folder is missing
echo "OverrideGPUValidation=true" | sudo tee /etc/adobe/mms.cfg

Let’s hope though that 10.3 won’t require something more esoteric.

Source: Secrets of The mms.cfg File

If your SSH server (generally OpenSSH) is compiled to use TCP Wrapper you can use DenyHosts to protect yourself against the annoying attempts to hack the server. However, if you don’t have the option to use a TCP Wrapper aware SSH server (which happens to be the case on almost all Linux distributions made to operate home-class routers), you’re pretty much on your own. Unless you’d like to use another script I wrote while I was bored.

The script analyses your SSH daemon’s log, identifies IPs from which there are unauthorized access attempts (the attackers usually try to login using a multitude of user/password combinations - brute-force attacks) and then denies all traffic from those IPs. Also it keeps a list of all those pesky “hackers” for times when you reboot (the part where you re-add those IPs to your iptables configuration is left as an exercise to you). The cherry on top of the cake is that for every bad IP the script tries to mail the ISP with the relevant parts from your log (in case you have configured sendmail or another MTA with a sendmail interface).

As usual, you can find the script in one of my GitHUB repos with a nice README file giving you all the juicy configuration details.

If you can improve the script to do even more, please fork the repo. Also, if you find any bugs please let me know.

TIP: if your kernel can use the recent module, you can add some rules like these:

1
2
3

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j LOG --log-prefix "SSH_brute_force "
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP

This would assure that a user cannot open more than 8 connections in 60 seconds to your server on port 22. Of course, if the user tries to open a ninth connection, iptables will block the access for 60 seconds. This is just an extra measure to protect your server in addition to the script.

Don’t let the “hackers” win!

The basic authentication is a trivial way of authenticating HTTP requests directly by the web server, without any added effort for the developer. Since REST isn’t very pretentious (it uses the well known HTTP methods for accessing resources), leaving the authentication to the web server is a natural thing to do. Still, this doesn’t mean that your REST API is secure. You merely separate users that should have access to your API from users that should be denied access. Enabling HTTPS on the server is the next step that needs to be followed, so that all the requests are secured. This avoids the classical man-in-the-middle attack and also assures that the credentials sent by the users aren’t visible to the whole world (although they are BASE64 encoded by the basic authentication mechanism, decoding them is a child’s play).

A practical example

For the next paragraphs, I will be very specific (the title should have already told you this). To add something more, let’s assume you use Maven (because you’re a real developer) and Jetty (only for testing - I assume that for production you use a proper server, like Tomcat). Enabling HTTPS on any other server shouldn’t be much different.

pom.xml

To enable HTTPS and basic user authentication on Jetty by using Maven, you would have to use an additional plug-in for generating keystores, unless you already have a keystore that you would like to use, in which case you should not keep it in the target folder of your project. The following section of pom.xml should do the trick:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

<plugin>
  <groupId>org.codehaus.mojo</groupId>
  <artifactId>keytool-maven-plugin</artifactId>
  <executions>
      <execution>
          <phase>generate-resources</phase>
          <id>clean</id>
          <goals>
              <goal>clean</goal>
          </goals>
      </execution>
      <execution>
          <phase>generate-resources</phase>
          <id>genkey</id>
          <goals>
              <goal>genkey</goal>
          </goals>
      </execution>
  </executions>
  <configuration>
      <keystore>${project.build.directory}/jetty-ssl.keystore</keystore>
      <dname>cn=server_host_name</dname>
      <keypass>jetty6</keypass>
      <storepass>jetty6</storepass>
      <alias>jetty6</alias>
      <keyalg>RSA</keyalg>
  </configuration>
</plugin>
  <!-- Jetty support for testing -->
<plugin>
  <groupId>org.mortbay.jetty</groupId>
  <artifactId>maven-jetty-plugin</artifactId>
  <executions>
      <execution>
          <id>start-jetty</id>
          <phase>pre-integration-test</phase>
          <goals>
              <goal>run</goal>
          </goals>
          <configuration>
              <scanIntervalSeconds>0</scanIntervalSeconds>
              <daemon>true</daemon>
          </configuration>
      </execution>
      <execution>
          <id>stop-jetty</id>
          <phase>post-integration-test</phase>
          <goals>
              <goal>stop</goal>
          </goals>
      </execution>
  </executions>
  <configuration>
      <stopKey>foo</stopKey>
      <stopPort>9999</stopPort>
      <scanIntervalSeconds>2</scanIntervalSeconds>
      <contextPath>/restws</contextPath>
      <userRealms>
          <userRealm implementation="org.mortbay.jetty.security.HashUserRealm">
              <name>name_of_realm</name>
              <config>src/main/resources/sec.properties</config>
          </userRealm>
      </userRealms>
      <connectors>
          <connector implementation="org.mortbay.jetty.nio.SelectChannelConnector">
              <port>8080</port>
              <maxIdleTime>60000</maxIdleTime>
          </connector>
          <connector implementation="org.mortbay.jetty.security.SslSocketConnector">
              <port>8443</port>
              <maxIdleTime>60000</maxIdleTime>
              <keystore>${project.build.directory}/jetty-ssl.keystore</keystore>
              <password>jetty6</password>
              <keyPassword>jetty6</keyPassword>
          </connector>
      </connectors>
  </configuration>
</plugin>

The highlighted lines indicate the user realm. This is a file which describes to the server who are your users and what roles are they assigned. The specified file contains records of this form:

user: password,role

web.xml

Now you must configure your web application to accept HTTPS encrypted content. This is done in the web.xml file, by adding the following lines of code:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

<security-constraint>
  <web-resource-collection>
      <web-resource-name>application_name</web-resource-name>
  <!-- all URLs are protected -->
      <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
      <role-name>user</role-name>
  </auth-constraint>
  <user-data-constraint>
      <!-- redirect all requests to HTTPS -->
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>
<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>name_of_realm</realm-name>
</login-config>

REST web services and Apache CXF

So, everything is set up and working. Well, almost. If your REST web services also include some client code, you might encounter an exception with the following message:

1

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

The exception is thrown because the certificate your server uses is not from a known Certificate Authority. If you have studied the POM example, you’d see that the certificate is generated at every execution of the install goal. Moreover, the certificate is self-signed. From here we have two solutions:

1. try to create a single key store and save it in the src folder, configuring the server to use the file from this location; then start the server and use the program written by Andreas Sterbenz which you can find here; grab the certificate and move the resulted file into the security folder of your JRE (on Linux this should be /usr/lib/jvm/java-6-sun/jre/lib/security/); although this will work okay on your machine, if your project should be accessed by multiple developers, each member of the team has to add that certificate to his/hers JVM (which is not quite nice);

2. create an alternative TrustStore used only by your application; this is by far the most elegant solution, which adds some more code to the application but doesn’t force your team members to add dummy certificates to their JVM.

Implementing the TrustStore

The class implementing the X509TrustManager is trivial:

1
2
3
4
5
6
7
8
9
10
11

public class FakeTrustManager implements javax.net.ssl.X509TrustManager {
  public java.security.cert.X509Certificate[] getAcceptedIssuers() {
      return null;
  }
  public void checkClientTrusted(java.security.cert.X509Certificate[] certs,
          String authType) {
  }
  public void checkServerTrusted(java.security.cert.X509Certificate[] certs,
          String authType) {
  }
}

To make all your Apache CXF REST clients use the new trust store, it is necessary to create a static method in an utility class that sets everything up for the clients:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

public static void setClientAuthentication(Object client) {
  Properties p = PropertiesLoader
          .getPropertiesFromFile("config.properties");
  ClientConfiguration config = WebClient.getConfig(client);
  HTTPConduit httpConduit = (HTTPConduit) config.getConduit();
  if (p.getProperty("user.name") != null
          && p.getProperty("user.password") != null) {
      AuthorizationPolicy authorization = new AuthorizationPolicy();
      authorization.setUserName(p.getProperty("user.name"));
      authorization.setPassword(p.getProperty("user.password"));
      httpConduit.setAuthorization(authorization);
  }
  TLSClientParameters tlsParams = new TLSClientParameters();
  TrustManager[] trustAllCerts = new TrustManager[] { new FakeTrustManager() };
  tlsParams.setTrustManagers(trustAllCerts);
  // disables verification of the common name (the host for which the certificate has been issued)
  tlsParams.setDisableCNCheck(true);
  httpConduit.setTlsClientParameters(tlsParams);
}

The properties file you see loaded in the previous code output contains the username and password for authentication, but it’s different from the realm. This is because the realm would be harder to parse, although the information is still plain text. Although it might seem redundant to have the username and password in two files, the realm can actually hold users belonging to different roles - therefore the parsing effort.

The PropertiesLoader class is not standard, but again it’s something trivial:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

import java.net.URL;
import java.util.Properties;
public class PropertiesLoader {
  public static Properties getPropertiesFromFile(String propertiesFile) {
      Properties p = new Properties();
      ClassLoader loader = PropertiesLoader.class.getClassLoader();
      if (loader == null) {
          loader = ClassLoader.getSystemClassLoader();
      }
      URL url = loader.getResource(propertiesFile);
      try {
          p.load(url.openStream());
      } catch (Exception e) {
          System.err.println("Could not load configuration file: "
                  + propertiesFile);
      }
      return p;
  }
}

Having done all this, your clients should now work as expected. Just remember that the FakeTrustStore is to be used only for testing purposes.

• an Ethernet card (NIC) connected to a network (LAN) with Internet access

• a wireless network interface card (WNIC) used to share the Internet connection

Setting up ICS on an Ubuntu machine is a very straight-forward process:

1. Click on the Network Manager icon and select the Create New Wireless Network… menu entry

2. Enter the details you want for this new “ad-hoc” network. WPA is not supported, so your only options for “Wireless Security” are “None” (although I wouldn’t call this security) or the WEP settings (not a secure algorithm, but hopefully your neighbours don’t use WireShark to crack your network). For the WEP 40/128-bit Key option, you key has to be exactly 5/10/13 characters long. If you want to be able to connect Windows clients to your network, the only option that worked for me is WEP 40/128-bit Key with a 13 characters key. An Ubuntu machine won’t have any problems with either options. Click on Create. Network Manager will automatically connect to this new network you have just created.

3. After your PC has connected (self-connected) to the “ad-hoc” network, you have to make sure that this connection is shared to other computers and devices (clients). Right click on the Network Manager icon and select Edit Connections… Select the Wireless tab, select your recently created connection and click on Edit. Make sure that the Connect automatically check-box is selected and on the IPv4 Settings tab male sure that the Method option is set to Shared to other computers.

4. Ensure that you do have the dnsmasq-base package installed (you can check usiny Synaptic). This is a DNS / DHCP server which will not run as a daemon, but as a background program, launched by the Network Manager.

5. To be sure that your clients will receive an IP check that your firewall allows connections from and to the new network you have just created. Given the following command, you should see a similar output:

1
2
3
4
5
6

radu@riker:~$ sudo iptables -L
[sudo] password for radu:
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             10.42.43.0/24       state RELATED,ESTABLISHED
ACCEPT     all  --  10.42.43.0/24        anywhere

Enjoy browsing! I told you this was simple.

P.S. I would like to thank Vlad for helping me correct the information provided about clients’ IPs and the fact that the gateway will provide the necessary data through DHCP.

The (now famous) script I wrote a year ago (when Ubuntu 9.10 was released) had to be modified just a bit in order to support the 2.6.35 kernel. The change that affected the compilation of the VMware kernel modules was the change of location for two header files which were expected to be in a certain folder. Thanks to symbolic links, this is now handled without any major efforts. All the needed instructions can be found here. For comments related to the way VMware works on the 2.6.35 kernels please use the comment form from this post.

A thing to know before installing VMware Server on your machines is that VMware has declared the product End Of Availability on January 2010 with the actual support ending on June 30th, 2011. More details can be read here. Furthermore, VMware Server is not officially supported on Ubuntu releases greater than 8.04.

Installing a 32-bit JVM on a machine that already has a 64-bit JVM installed will change the default JVM to be the last one installed. Since all of my Java programs and application were made for 64-bit, it was a mayhem on my machine. The solution is rather simple (but, oh, so uncomfortable). You would have to change the default JVM back to the 64-bit one and build some wrapper scripts for all the 32-bit apps to use the correct JVM for them.

Changing the defaults is done in this way:

1
2

sudo update-alternatives --install "/usr/bin/java" "java" "/usr/lib/jvm/java-6-sun/bin/java" 1
sudo update-alternatives --set java /usr/lib/jvm/java-6-sun/bin/java

The first line will instruct your system that there’s another Java version available (the old one) while the second line will make it the default version of JVM.

For Rodin, the wrapper script is pretty trivial, since it’s nothing more than a modified Eclipse IDE:

1
2
3

#!/bin/bash
WHERE=`dirname $0`
$WHERE/rodin -vm /usr/lib/jvm/ia32-java-6-sun/bin/java

Everything should be working okay now but don’t forget to instruct the 32-bit apps to use their dedicated JVM. Anyway, keep in mind that this is an ugly hack. If you’re a developer you should better package your apps for all the available architectures and not force your user-base to do this kind of hacks. Don’t forget though that this happens only when some system dependent libraries are used (as is the case for Rodin).

The installation process went fine (it’s just point and click) and I do like the new wizard’s screens. Usually the next step for any virtual machine would be to install VirtualBox Guest Additions in order to be able to use higher resolutions, mouse integration, seamless integration and all the other geeky goodies. From my previous experiences, to install the Guest Additions into a virtual guest, one was supposed to click on Devices » Install Guest Additions… in VirtualBox’s guest window and then to launch the autorun script from the virtual CD. Well, that used to work until now.

For Ubuntu 10.10 the process has to be slightly altered for a successful installation of the additions. This means that once you install Ubuntu in your VM you have to make sure that two other packages are installed in your guest before you use the instructions provided in the previous paragraph. The packages are build-essential and the linux headers for your running kernel. To install these two packages the quickest way would be to open a terminal (the GUI alternatives would be Ubuntu Software Centre and Synaptic Package Manager, but it will take you longer) and issue the following commands:

1
2

sudo apt-get update
sudo apt-get install build-essential linux-headers-`uname -r`

Remember that these two packages have to be installed in your guest. Afterwards you proceed with the usual way of installing the additions.

Have fun!

A feature that I would really like to see implemented on all HTML forms is the ability to submit the form by using the Return key as well. I am sure that there are a lot of users who really like to keep their hands on the keyboard as much as possible, without using the mouse just to click a button or without hitting the TAB key in order to focus on the submit button after which to press Return. Some of the particularities of my project are the fact that it uses Struts2 and the Struts2 jQuery plugin. This plugin allows developers either to use the .jar embedded JavaScript libraries or to automatically get the required files from Google’s servers (CDN). In July, when my project was using Oracle 11G and TopLink everything worked okay. Now, after I have migrated the project to open-source solutions (MySQL and EclipseLink) I have noticed that whenever I tried to create a new account into the application I would get 2 submits for one action. At first I thought that this had something to do with EclipseLink. After some debugging I actually found out that it was a JavaScript issue (it is possible that now I’m using another jQuery UI release).

The problem

The code responsible for the issue is the following:

1
2
3
4
5
6
7
8
9
10
11
12
13

$('#newProfileForm input:submit').button().click(function(e) {
    if(checkInputs()) {
        $('#newProfileForm form').submit();
    }
});
$('#newProfileForm input').keyup(function(e) {
    var code = (e.keyCode ? e.keyCode : e.which);
    if(code == 13) {
        if(checkInputs()) {
            $('#newProfileForm').submit();
        }
   }
});

What I have discovered is that the .click() handler actually binds itself to keyboard events too, not only mouse events. This means that if the user presses the Return button the event will be identified with a click event.

The solution

Even though if the behaviour mentioned previously is unexpected (who would have thought that a click event would be triggered by the keyboard even if the focus is not set on the submit button?!), there are two ways of avoiding it in the code above:

1. eliminate the .keyup() handler because pressing on the Return button will be considered a click event;

2. alter the first bind for the .click() handler like this:

1
2
3
4
5
6

$('#newProfileForm input:submit').button().click(function(e) {
    e.preventDefault(); // stop the browser's default behaviour
    if(checkInputs()) {
        $('#newProfileForm form').submit();
    }
});

Have you ever had similar problems?

Since a web feed is usually a standard feature for any web site that displays articles (by which we understand blog posts, news, press releases, etc.), the number of clients (software programmes) for this job has experienced a constant growth. From web applications, such as Google Reader, to desktop dedicated programs, such as Liferea, or Internet browsers, we have a multitude of ways for accessing web feeds. Because the primary function of the feed is to inform of the new content, the important attributes (sections) of the feed should be the title of the article in question, the author, date of publishing and the full text or the summarized one.

“To summarize or not to summarize? That is the question.”

What is more important for you and your readers: to serve them the full content (with the risk of them not being necessarily interested) or to give them just a hint of what you’ve published and let them to decide if they want to read it or not?

The advantage of offering the full content in the web feed is given by the fact that from a user’s standpoint the only action that he (or she) should perform is to open the reader and select your feed. Unfortunately this is also a disadvantage. Why? Because some of the content might be extending on a number of pages and some of the readers (the people) might not be interested in it, although the article’s category might be of interest. This leads to a cancelling of the benefits a feed might offer. I am sure that there are a lot of users who only read a small portion of the syndicated articles, which means that they have to get past the articles which are of no interest. This usually means scrolling over various amounts of content to select only the articles which are to be read in full.

Summarized feeds though offer only an introductory paragraph from the content itself. Sure, if the user needs to read more he (or she) has to access the source directly. But since the act of subscribing and receiving a feed’s content implies having access to the bid bag Internet, one more click for an interesting topic is just a small price to pay (both in effort and in time lost with the action). After all, your website has a nice theme for attracting readers (and probably you have invested time, money and energy on the user interface aspect of your site - web designers, CSS code, JS for user interaction, etc.). By not inviting the user to browse your website you loose not only traffic (although in recent times feeds are counted as an important communication channel with easy to follow traffic indicators), but the purpose of the shiny user interface. If all of your content is available through a web feed, why should we mind to visit it?

Personal experience

After several months of using a dedicated desktop application for syndicating the feeds I read I’ve switched to Google Reader. I won’t discuss here the advantages or disadvantages of one over the other. The end result in my case are 14 feeds under 5 categories (from geek stuff to more down to earth information). Out of the hundreds of articles which are published on a daily basis, I probably read about a quarter (maximum). This means that about 75% of the content to which I have access to I choose to skip over: either I am not interested (in which case I skip the content almost without retaining the title for more than 2 seconds) or I don’t think that the topic deserves more attention that what a short glimpse at one of its paragraphs might offer me. Imagine now the time lost with scrolling over full content from 75% of about 300 articles. Is it nice? NO! Is it reader-friendly? NO! This is why I prefer summarized feeds: I read the title to decide if the content is relevant and if so I don’t mind browsing to the source to read it all. I mean if I have the time to check what’s been published I am sure that I will make some time to read what’s interesting.

In conclusion…

Think of your users before putting the full content of your next article in the feed. There are chances that not all of your articles really hit the spot. By using summarized feeds you’ll more often than not win loyal and constant readers. Let them choose what they like from you instead of filling their screens with nonsense. Sure, they still have to click on the title to reach to your website. However, if your content is good, the readers will come by themselves.

SUMMARIZE YOUR FEEDS, PLEASE!