Some brief information about a local spam incident

Today, we discovered that we were being exploited to send out a batch ofspam. I decided to write up some information about the incident, partlybecause I don't think I've seen this done very much and who knows, itmight be useful to other people. Much of this information is (very)preliminary, since this just happened and it's the weekend so we haven'tdone any deep investigation yet.

(As peculiar as it may seem for sysadmins, around here we try


Some odd behavior from blog comment spammers

As I've written about before WanderingThoughts has always gotten a certain amount of (more or lessautomated) comment spam attempts, all of which has bounced off myanti-comment-spam precautions. There has never been very many of these;I would guess less than fifty a day. It was still enough to irritate me,so earlier this year I added some features to make blocking IP addresseseasier (including letting me block IPs only from commenting) and thenstarted blocking various frequent sources of comment spam attempts


The theoretical right way to check if an account is in a Unix group

If you are checking once to see if an account is in a group, there is asimple and obvious approach (omitting some details):

grp = getgrnam(GRPNAME);getgrouplist(pwent->pw_name, pwent->pw_gid, &groups, &ngroups);for (i = 0; i < ngroups; i++) {  if (groups[i] == grp->gr_gid)    return 1;}

There is just one problem with this:


Illustrating the Ubuntu clown car, AccountsService edition

AccountsService is afreedesktop.org thing to let other programs get (and set, withappropriate magic PolicyKit permissions) various information aboutuser accounts over DBus (because everything has to go over DBusthese days). The package's major component is accounts-daemon ,which implements said DBus service. Ubuntu 12.04 ships with amodified version of accountsservice 0.6.15.

(By the way, it also theoretically lets other programs create, delete,and modify system properties of logins.


My view on the understandability of language idioms

In my entry on the periodic strangeness of idiomatic Python I noted that I found the C version of the'repeat N times' loop much more immediately understandable than thePython version. In response, a commentator wrote:

I don't find this: "for (i = 0; i < times; i++) { .... }" idiomatic atall ... unless you are familiar with a language that writes its loopsthat way. [...]

Looking at my entry


Another problem with how Debian builds from source packages

When I wrote my first entry on this Ididn't realize one more significant problem with the way Debian buildspackages from source (because I hadn't run into it my own packagebuilding). This is that Debian builds binary packages in the sourcepackage working area .

It's easy to see how this came about. Since the unpacked, working formof a Debian source package is a directory tree with the source codeand some extra information, doing an in-place build when compiling andbuilding binary


Sysadmins hate updates (more or less)

In the middle of Everybody hates Firefox updates is the following (about Firefox updates specifically):

Only after I heard from dozens of different users that the rapidrelease process had ruined Firefox did I finally get it through mythick skull: releasing an update is practically an act of aggression against your users. The developer perspective is "You guys are goingto love this new update we've been working on!" The user perspectiveis "Oh god here comes another update, is there any way I can postponethe


Why I don't like the Debian source package format

I'm about to start modifying an Ubuntu package to build a modifiedversion, so I've been reminded of all of the reasons that I don't reallylike the way Debian source packages work (Ubuntu uses the Debian packageformat). To explain why, I need to start with a brief description of howDebian source packages are put together.

Like all source package formats, Debian source packages need to contain the four essential things ,but they do it in an odd way. Source packages generally come


What everyone needs in source packages

If you have a packaging system for open source programs (and who doesn'tthese days) and you have the concept of 'source packages' as distinctfrom the compiled binary packages (which you probably do), there arefour things that source packages need:

  • metadata about the package (or packages), such as the versionand description.

  • the original 'upstream' source code (or some proxy for it).

  • whatever changes and additions you make to the upstream sourcecode, if there are any (

How Firefox performs (and doesn't) for me

In response to my disenchantment with Firefox and especially my performance problems, a number of commentators talkedabout how Firefox performs for them. As a result I want to cover myFirefox performance stuff in more detail; since my Firefox setup and theresulting performance I get is a bit odd, this is an entry instead of acomment.

To start with, I keep Firefox running all of the time because of my Firefox remote control . Myrunning Firefox has an essentially constant set of iconified basewindows (in theory they are