More on the Solaris ssh stuff (part 2)

As an update on the Solaris ssh stuff :

Sun has just today released version 08 of patch 114356, which fixes the 'xmalloc: zero size' problem (charmingly describedin the patch README as 'New ssh in Sol. 9 exits if the key fingerprintcannot be found in the known_host files'), but not the problemswith mech_krb5.so and the GSS stuff.

This is a good step forward, and it fixes the most important issue,since


Microsoft has a problem

It's not the carefully spun death of WinFS ,or even ( as Cringley put it ) that Microsofthas spent five years and five billion dollars not shipping WindowsVista.

Microsoft's problem is that ordinary people can't keep Windows machinessecured. Spyware and other malware is rampant, compromised Windows boxesare perhaps the single largest source of spam email on the Internet,and anti-virus and anti-spyware software is now considered a basicrequirement on machines.

( Anecdotally , it'salready to the


WSGI versus asynchronous servers

Asynchronous servers and frameworks are a popular way to create highlyscalable systems. Although WSGI isn't explicitlydesigned to support them, putting a WSGI application in an asynchronousserver isn't totally foolish: many WSGI applications won't be doinganything that can block.

(Technically disk IO can block, but Python on Unix doesn't have any wayto do asynchronous disk IO without using threads.)

However, there is one serious fly in the ointment: the WSGI specrequires a synchronous interface for reading the


How not to report spam (part 1)

For my sins, I am on one of the aliases here that gets a certain amountof reports of spamming theoretically committed by UofT IP addresses. (Iam not one of the people who has to deal with them, fortunately; it isa thankless job). This exposes me to a certain amount of good examplesof how not to report spam.

Today's example comes to us from an official government organizationin a large Southern American country. All the information they gaveus was:

  • the date (with

Weekly spam summary on June 24th, 2006

This week, we:

  • got 13,681 messages from 253 different IP addresses.
  • handled 18,870 sessions from 835 different IP addresses.
  • received 303,478 connections from at least 47,309 different IPaddresses.
  • hit a highwater of 7 connections being checked at once.

Connection volume is majorly up from last week ; other numbers are up slightly,except the highwater (which is down). The per day table:

Day

A problem with signals in Python

As a followup to what I wrote yesterday about prompt signal handlingin programs , it's worthwhile to pointout a little problem in Python with signal handling.

As I've noted before , Python normally turnsmany signals into exceptions. It turns out that this has an importantconsequence: it delays processing of signals , because Python onlyprocesses signal exceptions in the interpreter, ie when you're runningPython bytecodes.

(Contrary to the documentation, sys.setcheckinterval does not appearto control how often signal handlers are


Respecting Unix signals

There is a certain class of program that decides it knows better thanyou about when you should be able to stop its operation. The mostirritating way to do this is to catch ^C (and even ^\); such programswin a modest prize from me, usually awarded with 'kill -9'.

Yes, some operations are dangerous if interrupted half-way through andprograms need to protect themselves against them. Short operations. Itis very rare that a program needs to block signals for very long


An extreme example of C preprocessor (ab)use

A while back, thedailywtf.com ran this entry onC preprocessor abuse. Unfortunately (and in fact as noted in thecomments), this is nothing to the true devotee of turning C into adifferent language.

This preprocessor trail was blazed early on, in the V7 Bourne shell,written by Steve Bourne. The story goes that Bourne didn't really likeC all that much, and instead much preferred Algol. Armed with the newC preprocessor he saw the opportunity to fix this problem and createdwhat


A year (and a bit) of WanderingThoughts

I'm bad with anniversaries and at making blog entries come out on time,so it was a year and nine days ago that I wrote the very firstWanderingThoughts entry , not a pleasingly exactyear. There's probably a lesson in this.

(Or a year and eight days, depending on how I count it; while I wrotethe first two entries on June 11th, I only made the decision to keepwriting at the pace of an entry a day on the 12th, when


More on the Solaris ssh stuff

I discovered today that the unpatched Solaris ssh program doesn'tunderstand the 'GSSAPIKeyExchange' and 'GSSAPIAuthentication'configuration options that are necessary to fix the problem on the patched ssh. (I had them in a $HOME/.ssh/config file that was shared between a patched system and anunpatched system.)

So what appears to have happened is that Sun developed a new version ofssh that implements the GSS stuff, and as a result requires it and theKerberos stuff to be installed and configured and so