Blog

Posted on

another brush with glory

One of my friends, SF writer Colin Harvey, just had his second mass market paperback hit the shelves.  Damage Time is a post-peak-oil police novel set in New York City.  The chilling bit is how he successfully combines the ideas of memory extraction with social networking.  And murder, of course.  (Where you have police, you get murder. Without police, people just get killed.)

If you look in the acknowledgments, you’ll find the line “and Michael Lucas hunted cliches relentlessly…”  That’s me.  I’ve got my name on another book!  Well, okay, in another book.  Close enough.  Sort of.  And apparently I’m relentless, too.  Maybe that’ll encourage me to get out of bed in the morning.

If you read SF, I highly recommend Damage Time.  Exciting, gritty, stolen memories, appalling and believable.

Posted on

I will be at BSDCan

Apparently my NYCBSDCon presentation, BSD Needs Books, went over well.  I was just invited to reprise it at BSDCan on 13-14 May 2011.

So, what’s the critical difference between NYCBSDCon and BSDCan?  Both have great people.  Both have great presentations.  But there’s one critical point in NYC’s favor.

It’s 0.95km between the U of O Residences at BSDCan to the gelato shop. From the St. Marks Hotel in NYC to the gelato shop is less than 50 meters.  BSDCan has clearly fallen behind in the critical factor in North American BSD conferences.  I’m confident Dan (Mr. BSDCan) can figure out some way to shift the balance back to Ottawa, though.

Posted on

mod_security on FreeBSD

The constant stream of referrer spam isn’t sufficiently annoying; no, now worms constantly nibble at my WordPress install.  I could avoid worrying about this by, say, having a third party host my content and control my work, but if I did that I’d get a punch on both my geek card and my writer card.  And I still wouldn’t know who is linking to me.  Some of the referral spam I get hits 10-15 times a day, flooding actual links.

Fortunately, Apache’s mod_security can help lock down my server.  While you’ll find tutorials on using mod_security to stop referrer spam, mod_security can do much more.  Here I’m installing mod_security on my FreeBSD server running Apache 2.2.

# cd /usr/ports/www/mod_security
# make all install clean

Look in /usr/local/etc/apache22/Includes afterwards.  You’ll find the file mod_security2.conf and the directory mod_security2.  Initially, mod_security is loaded into Apache but doesn’t block anything.  Go into the mod_security2 directory and edit the main config file, modsecurity_crs_10_config.conf.  Change the SecRuleEngine to On, and create a SecDataDir, like so:

SecRuleEngine On
SecDataDir /var/run/modsecurity

You’ll need to create the security data directory and make it writable by Apache.  Then restart Apache.

# mkdir /var/run/modsecurity
# chown www:www /var/run/modsecurity
# apachectl restart

Now test your Web server, and verify that it still functions.  Bad Web applications can trip over mod_security2.  If your Web app fails, I’d suggest talking to the vendor about why your application doesn’t work securely.

If your site still works with mod_security2, you can start to block referrers that bug you.  In the mod_security2 directory, create the file referer.conf for rules to block bogus referrers.  The rule has this general syntax:

SecRule REQUEST_HEADERS:REFERER “REGEX” deny,log,status:500

mod_security will evaluate each incoming request by its header.  If the referrer matches the regular expression in quotes, the browser will return a 500 error.  The sample rules below show a small slice of the things I’m blocking.

…
SecRule REQUEST_HEADERS:REFERER “write\-a\-resume” deny,log,status:500
SecRule REQUEST_HEADERS:REFERER “wigmall” deny,log,status:500
SecRule REQUEST_HEADERS:REFERER “windowsphone” deny,log,status:500
SecRule REQUEST_HEADERS:REFERER “windows\-phone” deny,log,status:500
SecRule REQUEST_HEADERS:REFERER “zune” deny,log,status:500

It’s possible that this would block legitimate traffic, but I have a hard time imagining being linked from a weight loss or Windows Phone site.  It’ll take a while to accumulate a list of suitable regexes for my site.  And it’s a limited technique — I’m enumerating badness. But mod_security also protects me against the various WordPress worms, and it can also block traffic from addresses on an RBL. I’ll do that at a later date.

UPDATE: Your SecRule should not include the “log” keyword. See the later posting here.

UPDATE2: more here.

Posted on

Things I Learned at NYCBSDCon, day 2

Isilon is clever.  And they really want to give lots of their code back to the FreeBSD community.

New York Internet donated space, cooling, and power for an East Coast FreeBSD mirror.  Companies like Juniper and NetApp are donating hardware.  We will soon have an East Coast mirror of the West Coast datacenter, including package building facilities.  This will be cool.

Databases suck.  SQL is an abomination.  I knew this already, but it’s nice to have that opinion reinforced.  We could really use a data query language based on relational algebra.

George Rosamond put con finances on display during lunch.  NYCBSDCon made money this year.  The leftovers will be cut in four and split between OpenBSD, NetBSD, FreeBSD, and DragonFly.

pfSense rocks.  Once the next release is out, the team will turn its attention to IPv6.

And I’ve got to up and give my talk in a few minutes.  Those of you at the conference might as well go home now.

Posted on

Things I Learned at NYCBSDCon, Day 1

A few quick random things I picked up at day 1 of NYCBSDCon:

  • Scheduled IPv4 depletion date:  119 days.  That’s when the last /8 is issued to a regional NICs.  Many of the remaining IPv4 /8 blocks are “poisoned,” and receive garbage traffic immediately upon announcement.
  • Hudson River Trading is hiring FreeBSD folks.  They gave away 1GB USB key/bottle openers, so they clearly understand the sysadmin mentality.
  • You want to take the BSD Associate Cert as soon as possible.
  • Don’t confuse George with George.  George doesn’t like that.  Fortunately, George doesn’t care, so you’ll only have to worry about George.
  • The “Quest for the Next Generation FreeBSD Installer” is about to claim more developers.  You’d think people would learn.  (Don’t get me wrong, I wish them luck and I hope they succeed, but nobody’s ever had dinner after betting the grocery budget on a new FreeBSD installer.)
  • Jeremy Reed is digging through the original BSD tapes and contacting every person named in the original source code to assemble a comprehensive BSD history.  BSD claims a long history, but Jeremy’s actually trying to document it while the original folks are still with us.  It will eventually be available as a book.  This is probably the most exciting thing I heard today, but then, I’m an academic at heart.
  • And if any BSD folks live near Jason Dixon, he <i>really</i> needs to be dragged out of management.  Forcibly if necessary.  Possibly with methods involving tranquilizer darts, nets, and some sort of radio tags.  If you do this, be sure to post the video footage for the rest of us.

You can get here for tomorrow.  I know you can.

Posted on

NYCBSDCon is at our throats

NYCBSDCon is this next Friday, Saturday, and Sunday, 12-14 November 2010.  If you’re anywhere near NYC, you need to attend.  If you’re not anywhere near NYC, you need to get to somewhere near NYC, and then attend.

I’ll be speaking on Sunday.  This talk could be subtitled “How I Reduce Suckage in My Books.”  Writing decent tech books is a skill you can learn.  I can honestly say that the slides are done, but in truth is that I still need to reduce slide suckage.  I’ll be reducing suckage up until the moment I present.

Posted on

fixing ESXi “failed with error N7Vmacore15SystemExceptionE”

An ESXi server failed this morning.  As there’s a couple critical services on this piece of hardware, the power in the new data center isn’t up to where we want it yet, and the radio said it was snowing near the office, I drove in expecting to find some unspeakable power situation.  The power was fine, but the ESXi server was sitting at a panic screen.  Power cycle the machine.  It comes up, but none of the VMs start.  The vSphere client won’t connect.  The server Web page is blank.

Fortunately, tech support mode works.  Hit alt-F1, type unsupported, and enter the root password when asked.  Whenever I tried to connect to the server with vSphere, my “tail -f /var/log/messages” said something like:

Nov  4 23:35:09 Hostd: [2010-11-04 23:35:09.117 25233B90 warning 'Proxysvc Req00011'] 
Error reading from client while waiting for header: 
N7Vmacore15SystemExceptionE(Connection reset by peer)

This is not good.  No, not good at all.  I wanted to spend the day converting a machine from OpenSolaris to FreeBSD and installing my router for my new bandwidth.  Instead Fate has decreed today Wedgie Day.

Mailing list archives and forum posts showed that many people have had this problem.  Lots of the forums end with “did anyone ever solve this?”  A few people reinstalled ESXi to solve the problem.  A couple folks claimed it was a DNS issue.

Our DNS setup hadn’t changed, but I followed the advice and made the following changes.

  • In /etc/hosts, remove the real address for the machine and replace it with 127.0.0.1
  • Remove all DNS servers from /etc/resolv.conf

I rebooted.  The machine came up, and the VMs started.  Everything seems fine, but we’ll have to see what happens later.

I have no idea why this worked.  Three cheers for “occult IT”!  Sigh.

Posted on

inspiration and winning awards

One of my Clarion classmates, Lucy Snyder, won the 2009 Stoker Award for her poetry collection Chimeric Machines.  I ran into Lucy at World Fantasy 2010, where she told me that one of the poems in this collection was inspired by my short story Opening the Eye in Horror Library volume 2.  (For those of you with a calendar, Lucy saw this story well before it appeared in HLv2.)

I haven’t read poetry since I seriously overdosed in university, but I had to check out CM.  I expected only a tangential similarity, but no… the poem Trepanation clearly included echoes of my story without being in any way derivative.  And the rest of the book is creepy as hell.

My work is not merely inspirational; it inspires people to win awards.  Yes, my inspiration was a tiny tiny sliver of the inspiration in Chimeric Machines, but it’s the closest brush I’ve had with Literary Fame. I’m tickled blue.

So, if you have any flicker of interest in poetry, read Chimeric Machines.  You can get a free sample at Lucy’s CM page.  The sample covers the section “Technica,” wherein she illuminates the appalling aspects of technology.  By happy coincidence, this section includes Trepanation, but I think Tech Support will resonate with a lot of you.  Heck, just read the whole thing, and buy the book.

(PS: I have at least one blog reader who cannot tolerate horror.  You know who you are.  And you’re not permitted to click on ANY of the links in this post.  Thank you.)

Posted on

asking me for opinions on your writing

Occasionally someone will ask me to read their work and either comment or tell them where they should submit it. Some of these folks I know, some I don’t. It’s flattering to be asked, but my answer is: no.  I could describe my reasoning in great detail, but the inimitable John Scalzi has a far better article than I do.

On rare occasion, I make the mistake of saying “yes, I’ll look at your work.”  One of the following will result.

  1. I will give you my honest opinion of your first page.  You will respond by dedicating the rest of your life to making me miserable.
  2. I will give you the metaphorical equivalent of a pat on the head.
  3. I will say you lack the fire.
  4. I will tell you that publishers require sentence to have both a noun and a verb, and that you cannot use emoticons in published work.
  5. I will “accidentally” erase your manuscript, your email, and my hard drive, so that I can honestly claim that losing your work was part of a much larger accident.
  6. I will put off looking at your work in favor of paying work or spending time with my family.  I will feel increasingly guilty about this.  I will begin avoiding you.  The importance and difficulty of evaluating your work will grow in my mind until it assumes unbearable proportions.  I will take a week out of my life to evaluate your work thoroughly.  By this time you will have married your third spouse, adopted four feral children and a platypus, and moved to Aruba to fulfill your lifelong dream of being a beachcomber.

Note that none of these result in you getting anything you want.

If you really want to get my opinion, I suggest you either pick a response you like, or roll a die.