Tuesday, May 24, 2011

Setup RSA SecurID VPN on Nokia N900

This post will highlight the configuration required to setup RSA SecurID software on nokia N900 and use vpnc to authenticate.

Install Java on N900
http://wiki.maemo.org/Java
Java for N900 is available as IcedTea6 in extras or extras-testing.

Install micro-emulator
http://www.nokian900applications.com/install-java-on-nokia-n900/
Install micro-emulator as per above link

Download Microemulator.
Unzip microemulator as root in /opt/: unzip microemulator-2.0.4.zip -d /opt/microemulator/

Install RSA SecurID
http://codehunk.wordpress.com/2010/05/11/rsa-securid-token-on-gnulinux/


$ wget ftp://ftp.rsa.com/pub/agents/j2me/JME23.zip
$ wget ftp://ftp.rsasecurity.com/pub/agents/TokenConverter.tar.gz
$ mkdir securId

$ unzip JME23.zip -d securId/
$ tar -C securId -zxvf TokenConverter.tar.gz
$ cd securId
# Convert your RSA token into required format
$ cp some_directory/token_file.sdtid .
$ chmod +x TokenConverter
$ ./TokenConverter token_file.sdtid -p 'password_you_got_from_admin' -o num_out
$ cat num_out | rev | sed -e :a -e 's/\(.*[0-9]\)\([0-9]\{5\}\)/\1-\2/;ta' | rev
21111-12593-96653-61657-73256-55655-33735-53711-52131-25113-57215-55172-12151-26371-12716-73632-5
# Edit SecurId.jad and add the following lines
X-NumericInput: 21111-12593-96653-61657-73256-55655-33735-53711-52131-25113-57215-55172-12151-26371-12716-73632-5
X-AllowNumericInput: No
$ java -cp /opt/microemulator/microemulator.jar:SecurID.jar org.microemu.app.Main com.rsa.swtoken.j2me.client.SecurID

Enter your PIN and you should get a 8-digit passcode which can be used with vpnc

vpnc can be setup the same as done for desktop linux as in
http://bashingbaru.blogspot.com/2011/05/setup-vpn-using-rsa-securid-software.html
 


Monday, May 23, 2011

Ted Talk: Why work doesn't happen at work

Clearly summarises the problem at work places

Saturday, May 21, 2011

rpcbind and portmap on SLES11

SLES11 includes 2 programs, rpcbind and portmap which both provide portmapper functionality. SLES11 contains rpcbind-0.1.6+git20080930-6.15.x86_64.rpm portmap-6.0+git20070716-31.16.x86_64.rpm packages which are supposed to provide portmapper functionality. But while using portmap for portmapper functionality mountd fails to start.


root@sles11sp1-XXX:~# rpm -qa | grep portmap
portmap-6.0+git20070716-31.16
root@sles11sp1-XXX:~ # cat /etc/SuSE-release
SUSE Linux Enterprise Server 11 (x86_64)
VERSION = 11
PATCHLEVEL = 1

When you start you might see an error, that mound failed to start. If you look at /var/log/messages, you could be seeing

May 20 05:15:18 sles11sp1-XXX mountd[5703]: unable to register (mountd, 1, udp).
May 20 05:15:53 sles11sp1-XXX mountd[5711]: unable to register (mountd, 1, udp).
May 20 05:15:55 sles11sp1-XXX mountd[5713]: unable to register (mountd, 1, udp).

This is because mountd expects to work with rpcbind in SLES11SP1, mountd sees a service on port 111, but cannot register with portmap. It can only register with rpcbind service.

root@sles11sp1-XXX:~ # rpm -qa | grep rpcbind
rpcbind-0.1.6+git20080930-6.15
root@sles11sp1-XXX:~ # rpm -qa | grep portmap
root@sles11sp1-XXX:~ #

Once you remove portmap and install rpcbind, you should be able to start mountd and nfs using /etc/init.d/nfsserver start

Setup VPN using RSA SecurID software Token On Ubuntu

This post will help in configuring RSA SecurID Software Token for use on linux with Cisco VPN client on Ubuntu 10.04

Installing RSA securID software

You should already be having RSA SecurID software Token software and your key file with you.

Install wine on ubuntu if you don't have it yet as
sudo aptitude install wine

Once you have wine installed, you need to configure wine by running
winecfg

Create a new Drive Z: to provide access to either your home directory or to the whole filesystem

Now Install RSA SecurID Software in wine as
wine ./RSA_SecurID_Software_Token_3.0.5.exe

This should install the software, and add a menu item in 'Applications->Wine->Programs'. Run the RSA SecurID software from the menu and import the key.

Installing VPNC 

vpnc can be installed from repositories
sudo aptitude install vpnc

If you have your VPN server info as a pcf file, then it needs to be converted into a vpnc format


mkdir vpnclient
cd vpnclient
wget http://www.unix-ag.uni-kl.de/~massar/soft/cisco-decrypt.c
sudo apt-get install libgcrypt11-dev
gcc -Wall -o cisco-decrypt cisco-decrypt.c $(libgcrypt-config --libs --cflags)
chmod +x cisco-decrypt
sudo cp cisco-decrypt /usr/bin
wget http://svn.unix-ag.uni-kl.de/vpnc/trunk/pcf2vpnc
sudo cp pcf2vpnc /usr/bin
pcf2vpnc XXX.pcf > XXX.conf

sudo cp XXX.conf  /etc/vpnc/

The above steps would convert the pcf into vpnc format and get it ready for use

Using RSA TokenCode/PassCode with vpnc

Now we need to get vpnc use the token generated by RSA SecurID for authentication. Along with the software token, there is a PIN associated with. Switch RSA to 'Advanced View' and enter PIN and enter PIN there, you should have


When you run vpnc from command line, you need to use 'Current PASSCODE' as your password. It might prompt you for Next passcode in which use the 'Next PASSCODE' as displayed in above image

root@XXX:/etc/vpnc# vpnc --xauth-inter XXX
Enter Username and Password.
Passcode for VPN XXX@XXX.XXX.XXX.XXX:
Enter Next PASSCODE:
Passcode for VPN XXX@XXX.XXX.XXX.XXX:
VPNC started in background (pid: 26055)...
root@XXX:/etc/vpnc#


References
http://www.ubuntugeek.com/how-to-setup-cisco-vpn-using-vpnc-ubuntu-jaunty-9-04.html
http://lists.unix-ag.uni-kl.de/pipermail/vpnc-devel/2009-April/003023.html
http://codehunk.wordpress.com/2010/05/11/rsa-securid-token-on-gnulinux/

Wednesday, May 18, 2011

How linux mount uses /etc/mtab

From linux man page
The programs mount and umount maintain a list of currently mounted filesystems in the file /etc/mtab.  If no arguments are given to mount, this list is printed.
When  the  proc  filesystem  is  mounted (say at /proc), the files /etc/mtab and /proc/mounts have very similar contents. The former has somewhat more information, such as the mount options used, but is not necessarily up-to-date (cf. the -n option below). It is possible to replace /etc/mtab by a symbolic link to /proc/mounts, and especially when you have very large numbers of mounts things will be much faster with that symlink, but some information is lost that way, and in particular using the "user" option will fail.

To know how mount command uses mtab file can be found by tracing the calls of mount

XXX:~ # strace mount -o loop ubuntu-10.04.2-desktop-amd64.iso temp_mount 
 
would generate output of the all system calls that the mount command made
stat("ubuntu-10.04.2-desktop-amd64.iso", {st_mode=S_IFREG|0644, st_size=721129472, ...}) = 0 
getcwd("/home/XXX", 4095)          = 15
readlink("/home/XXX/ubuntu-10.04.2-desktop-amd64.iso", 0x7fff11803d10, 4096) = -1 EINVAL (Invalid argument)
getcwd("/home/XXX", 4095)          = 10
readlink("/home/XXX/temp_mount", 0x7fff11803a40, 4096) = -1 EINVAL (Invalid argument)
Checks if the given path is a softlink, then does verification from mtab if a mount has been done already. 


stat("/sbin/mount.iso9660", 0x7fff118048c0) = -1 ENOENT (No such file or directory)
mount("/dev/loop0", "temp_mount", "iso9660", MS_MGC_VAL, NULL) = 0
readlink("/dev", 0x7fff11803a40, 4096)  = -1 EINVAL (Invalid argument)
readlink("/dev/loop0", 0x7fff11803a40, 4096) = -1 EINVAL (Invalid argument)
getcwd("/home/XXX", 4095)          = 10
readlink("/home/XXX/temp_mount", 0x7fff11803a40, 4096) = -1 EINVAL (Invalid argument)
lstat("/etc/mtab", {st_mode=S_IFREG|0644, st_size=795, ...}) = 0
read_link("/home/XXX/temp_mount", 0x7fff11803a40, 4096) = -1 EINVAL (Invalid argument)
Checks the filesystem type and gets ready to call the corresponding filesystem mount command


getpid()                                = 1052
open("/etc/mtab~1052", O_WRONLY|O_CREAT, 0600) = 3
close(3)                                = 0
link("/etc/mtab~1052", "/etc/mtab~")    = 0
open("/etc/mtab~", O_WRONLY)            = 3
fcntl(3, F_SETLK, {type=F_WRLCK, whence=SEEK_SET, start=0, len=0}) = 0
unlink("/etc/mtab~1052")                = 0
umask(077)                              = 022
open("/etc/mtab", O_RDWR|O_CREAT|O_APPEND, 0666) = 5
umask(022)                              = 077

Finds the current PID, then creates a /etc/mtab~ file. Since there shouldn't be two process with same pid, this should be open the only process which has this file open and even if this process dies and a new mount process is run with the same pid, the new process would be able to use the old file as the 'open' is not called with O_EXCL is not used. Once it ensures that /etc/mtab~1052 has been created using 'open' it goes ahead with set /etc/mtab~ and /etc/mtab~1052 as hard link. 

A crash here after creating hard link before 'unlink' of /etc/mtab~ creates problems with mount or umount commands. If a programs dies after creating the file /etc/mtab~, any new mount/umount operations would try to call 'link' which would fail as there is an already /etc/mtab~ file and would assume that somebody is trying to write to the /etc/mtab file.

Rest of the trace for the mount command is

open("/etc/mtab", O_RDWR|O_CREAT|O_APPEND, 0666) = 5
umask(022)                              = 077
fstat(5, {st_mode=S_IFREG|0644, st_size=795, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7a6819a000
fstat(5, {st_mode=S_IFREG|0644, st_size=795, ...}) = 0
lseek(5, 0, SEEK_SET)                   = 0
read(5, "/dev/sda6 / ext3 rw,errors=remou"..., 795) = 795
write(5, "/dev/loop0 /home/XXX/temp_m"..., 52) = 52
close(5)                                = 0
munmap(0x7f7a6819a000, 4096)            = 0
close(3)                                = 0
unlink("/etc/mtab~")                    = 0

mount will the open the /etc/mtab and append the new mounted filesystem. Removes /etc/mtab~ before exiting.

Tuesday, May 17, 2011

Build a single kernel module form source tree

make -C /lib/modules/$(KVERSION)/build M=$(PWD) modules

Thursday, May 12, 2011

Tivoization


Tivoization refers to the configuring by the manufacturer or vendor of a digital electronic product that uses free software so that the product will operate only with a specific version of such software. Although the concept can initially seem very simple and innocuous, a closer look shows that it could have important implications for the future of free software and for the computer industry as a whole.

http://www.linfo.org/tivoization.html

Tuesday, May 10, 2011

rpcbind port conflict with statd no SLES 11

In sles11 portmap has been replaced with rpcbind, which provides additional features like IPv6 and nfsv4 support. By default like portmap, rpcbind listens on port 111. But rpcbind also uses an additional UDP port that it always keeps open and blocked.

Output for portmap on older SLES version

XXX:~ # lsof -p 4046
COMMAND  PID   USER   FD   TYPE DEVICE    SIZE    NODE NAME
portmap 4046 nobody  cwd    DIR    8,1   24576       2 /
portmap 4046 nobody  rtd    DIR    8,1   24576       2 /
portmap 4046 nobody  txt    REG    8,1   17568  687066 /sbin/portmap
portmap 4046 nobody  mem    REG    8,1  132847 1733314 /lib64/ld-2.4.so
portmap 4046 nobody  mem    REG    8,1   36736 1733389 /lib64/libwrap.so.0.7.6
portmap 4046 nobody  mem    REG    8,1   14646 1733355 /lib64/libutil-2.4.so
portmap 4046 nobody  mem    REG    8,1 1570331 1733321 /lib64/libc-2.4.so
portmap 4046 nobody  mem    REG    0,0               0 [heap] (stat: No such file or directory)
portmap 4046 nobody    0u   CHR    1,3            3763 /dev/null
portmap 4046 nobody    1u   CHR    1,3            3763 /dev/null
portmap 4046 nobody    2u   CHR    1,3            3763 /dev/null
portmap 4046 nobody    3u  IPv4  13208             UDP *:sunrpc 
portmap 4046 nobody    4u  IPv4  13220             TCP *:sunrpc (LISTEN)
XXX:~ # 

Output for rpcbind on SLES11

XXX:~ # lsof -p 9909
COMMAND  PID USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
rpcbind 9909 root  cwd    DIR                8,1     4096       2 /
rpcbind 9909 root  rtd    DIR                8,1     4096       2 /
rpcbind 9909 root  txt    REG                8,1    56536 6185085 /sbin/rpcbind
rpcbind 9909 root  mem    REG                8,1    61467 7405594 /lib64/libnss_files-2.11.1.so
rpcbind 9909 root  mem    REG                8,1    19114 7405583 /lib64/libdl-2.11.1.so
rpcbind 9909 root  mem    REG                8,1    39712 7405649 /lib64/libgssglue.so.1.0.0
rpcbind 9909 root  mem    REG                8,1   108213 7405588 /lib64/libnsl-2.11.1.so
rpcbind 9909 root  mem    REG                8,1  1661454 7405577 /lib64/libc-2.11.1.so
rpcbind 9909 root  mem    REG                8,1   135646 7405603 /lib64/libpthread-2.11.1.so
rpcbind 9909 root  mem    REG                8,1   160248 7405669 /lib64/libtirpc.so.1.0.10
rpcbind 9909 root  mem    REG                8,1    42016 7405618 /lib64/libwrap.so.0.7.6
rpcbind 9909 root  mem    REG                8,1   149797 7405570 /lib64/ld-2.11.1.so
rpcbind 9909 root    0u   CHR                1,3      0t0    2376 /dev/null
rpcbind 9909 root    1u   CHR                1,3      0t0    2376 /dev/null
rpcbind 9909 root    2u   CHR                1,3      0t0    2376 /dev/null
rpcbind 9909 root    3r   REG                8,6        0  563076 /var/run/rpcbind.lock
rpcbind 9909 root    4u  sock                0,6      0t0   18570 can't identify protocol
rpcbind 9909 root    5u  unix 0xffff88042b8b63c0      0t0   18543 /var/run/rpcbind.sock
rpcbind 9909 root    6u  IPv4              18545      0t0     UDP *:sunrpc 
rpcbind 9909 root    7u  IPv4              18549      0t0     UDP *:690 
rpcbind 9909 root    8u  IPv4              18550      0t0     TCP *:sunrpc (LISTEN)
rpcbind 9909 root    9u  IPv6              18552      0t0     UDP *:sunrpc 
rpcbind 9909 root   10u  IPv6              18554      0t0     UDP *:690 
rpcbind 9909 root   11u  IPv6              18555      0t0     TCP *:sunrpc (LISTEN)
XXX:~ # 

rpcbind uses an additional UDP port, in this case it is port 690. Unfortunately there is no way to control on which port rpcbind will get when it requests a free UDP port.

On a typical NFS server mountd/nfsd/statd are configured to start on specified ports, this is to assist in configuring the firewall. On our machines, statd was configured to start on port 690, but as rpcbind was started before statd, statd could not start with error 'address already in use'

XXX:~ # grep statd /var/log/messages | tail -10
2011 May 10 11:45:38 XXX_01 rpc.statd[27766]: Version 1.2.1 Starting
2011 May 10 11:45:38 XXX_01 rpc.statd[27766]: Could not bind name to socket: Address already in use


This happens occasionally during reboots, when rpcbind acquires the same port on which statd was configured to start. Since this is a UDP port, it does not show up in 'netstat' and will only show up in lsof

XXX:~ # netstat -atn | grep 690
XXX:~ #

Friday, May 6, 2011

Mplayer shortcuts on nokia N900

Nokia N900 has limited of keys in its keyboard. Some of the special characters like '[' and ']' are missing from the keyboard. While using mplayer '[' and ']' are used to increase/decrease the speed of the video.

As these keys are missing from the keyboard, you can re-map increase/decrease speed functionality to other keys by having a custom input.conf file. A sample input.conf to re-map increase/decrease speed to '(' and ')'
( speed_mult 0.9091    # scale playback speed
) speed_mult 1.1

Tuesday, April 12, 2011

Accessing VMware Server 2 using VMware vSphere client

Though vmware does not support accessing vmware server using VI client, it does work with some limitations. I like vmware server, so i don't have dedicate the server ESXi, this lets you the server for other tasks. Unfortunately the vmware server will run out of support, and it is unlikely that vmware would spend resources to try to make the vmware server GUI any better. Here is how to access to vmware server using vSphere client

Note: You will not able to edit settings of a VM from VI client, you would able to view the VM, do poweron/off operations and view the guest Console.

1. Download VMware vSphere client from vmware site. The version of the software that was tried out is VMware-viclient-all-4-1.0-258902

2. Install the vSphere client on a windows machine


3. Run the vSphere client, and specify IP as full http URL that is used to access vmware server web console like, https://10.209.106.15:8333 and username and password for vmware server access
4. You should see a installer prompt to install compatible client support clients, run the installer, which will restart the vSphere client
5. After vSphere client restarts, enter the vmware server name again and accept the security warning

 6. You should now be able to see the vmware server host in vSphere client. You can do poweron/off operations on any of the virtual machines, but you might not be able to edit settings of the virtual machines. VMware should complain about incompatible version. You will able to see the guest console by going to the 'Console' tab. http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1008180 provides vmware comment on this issue

Thursday, April 7, 2011

Ethereal cooked capture

Cooked capture when capture is done over '-i any' device.

http://www.ethereal.com/lists/ethereal-users/200412/msg00314.html

On Linux, packet capturing is done by opening a socket. In systems with a 2.2 or later kernel, the socket is a PF_PACKET socket, either of type SOCK_RAW or SOCK_DGRAM.

A SOCK_RAW socket supplies the packet data including what the driver specified, when constructing the socket buffer (skbuff) holding the packet, to be the packet's link-layer header; a SOCK_DGRAM packet supplies only data above what was specified by the driver to be the link-layer header.

For the purposes of libpcap, which is the library used by programs such as tcpdump, Ethereal/Tethereal, snort, etc. to capture network traffic, a SOCK_RAW socket is usually the appropriate type of socket on which to capture, and is what's used.

Unfortunately, the purported link-layer header might be missing (as is the case for some PPP interfaces), or might contain random unpredictable amounts of data (as is the case for at least some interfaces using ISDN), or might not contain enough data to determine the type of the packet (as is the case with at least some ATM interfaces), so capturing with a SOCK_RAW socket doesn't always work well.

For interfaces of those types - and for interfaces of a type that libpcap currently doesn't have code to support - libpcap uses a SOCK_DGRAM socket, and constructs a fake link-layer header from the address supplied by a "recvfrom()" on that socket.

A "Linux cooked capture" is one done with libpcap using a SOCK_DGRAM socket.

Saturday, April 2, 2011

Remote desktop shortcut for shadow/console session

The microsoft KB article suggests a way to connect to the console session http://support.microsoft.com/kb/278845. So even if you are disconnected or you want to connect to the active physical desktop session, then you can do so by specifying '/console' option to mstsc. Unfortunately there is no check box or any other way from mstsc GUI to specify to connect to a console session. A simple workaround is to change/create a shortcut for mstsc by adding '/console' as arguments to mstsc.exe in the 'Target' field.

Tuesday, March 29, 2011

Daily dilbert on firefox 4

The extension i missed the most after upgrading to firefox 4 is daily dilbert. This extension has not been updated for quite sometime, so i decided to give it a try by forcing it to install of 4.0. One way is to disable compatibility checking in firefox, but i decided to modify the extension to claim as supporting firefox 4.0. Below are the steps for linux

  • Download daily dilbert extension for 3.6 (using older firefox or any other browser like chrome/opera)
  • From terminal execute the following steps
  • mkdir daily.dilbert
  • cp daily_dilbert-2.6-fx.xpi daily.dilbert
  • cd daily.dilbert
  • unzip daily_dilbert-2.6-fx.xpi
  • Use vim or any other editor to edit install.rdf and change 3.6.* to 4.0.*
  • zip daily_dilbert-2.6-fx.xpi install.rdf  # this will update the zip file with new install.rdf
  • Install the xpi in firefox
I have used it a few times and have not faced any problems

Monday, March 28, 2011

Add/remove programs windows is blank/waiting

I have had problem of Add/remove programs being stuck, in creating list of applications. After searching through microsoft site none of the solutions offered fixed the problem

Finally a solution on tom's hardware had the fix, which is was due to invalid path of java

http://www.tomshardware.com/forum/85414-45-remove-programs-program-open

The exact key may be different, but in HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/Current Version/Uninstall there should a key for java which has '\\' instead of a single slash. Once this has been changed add/remove dialog opens fine.

Install GPG key on ubuntu bypassing firewall

If you are seeing error while adding a repo to ubuntu, because you are behind some stupid firewall which is not allowing accessing port 11371

sudo add-apt-repository ppa:ubuntu-mozilla-daily/ppa
Executing: gpg --ignore-time-conflict --no-options --no-default-keyring --secret-keyring /etc/apt/secring.gpg --trustdb-name /etc/apt/trustdb.gpg --keyring /etc/apt/trusted.gpg --primary-keyring /etc/apt/trusted.gpg --keyserver keyserver.ubuntu.com --recv B34505EA326FEAEA07E3618DEF4186FE247510BE
gpg: requesting key 247510BE from hkp server keyserver.ubuntu.com
gpgkeys: HTTP fetch error 7: couldn't connect to host
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

then you download the key manually from the website and add it to ubuntu. Go to anonymouse.org and visit http://keyserver.ubuntu.com:11371 through the proxy site

Search for the corresponding key on the server as 0x247510BE and download the key, and save it to a text file on local system

Key should be something like below 


-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: SKS 1.0.10

mI0ESYo68wEEAKSgKJImCQIcSP/b+24TS0NYzxpf5Y34WOfQBaGpTVhkSXx2TCcF+kC0P3zz
wAsrvL8AULpr2Ww33ahnQ7Cg3kzBxTneo6jdvQOBwshSHMey/PhBAu0ew9zrt/OuKToMJY2h
0TRA2EG6OfcTA8LOm1wkWWadTUG+fqduKKeHDmjdABEBAAG0MUxhdW5jaHBhZCBQUEEgZm9y
IFVidW50dSBNb3ppbGxhIERhaWx5IEJ1aWxkIFRlYW2IXgQQEQgABgUCTSOx/wAKCRD8kg8z
/8ZzxIhpAP9ECWs+m6W/QRysu9APd93yPic08GnN82XFZ/6Zf8oXrgEAruIdOrqeWzvqv1OT
pFo/9ApgjkG98wSSk5AsL5RDHvKItgQTAQIAIAUCSYo68wIbAwYLCQgHAwIEFQIIAwQWAgMB
Ah4BAheAAAoJEO9Bhv4kdRC+2KED/3F9TudOsjvGfeIevqUsOXocd3CQTGJMGu3YevuiBk+l
rGj0EHi9MZ7yq3vi4ZVFoFairUhedQ6iuLrug301CkVNKSYwhwQzQRVkG0b8XqIAqg2UKlPe
JD6nYoEncZNZkD0RHLDAM3Ii/PN1znMKyRZfWKI7MY1IPbECFXFQTv6I
=exAf
-----END PGP PUBLIC KEY BLOCK-----
Then add the key to ubuntu using 'sudo apt-key add ' and then run 'sudo apt-get update' to update the repository which should accept the key

Sunday, March 27, 2011

ubuntu in.archive.ubuntu.com server slow

Its been an problem for a long time, every time i run apt-get update, updating from in.archive.ubuntu.com takes a very long time sometimes it even fails. Even though it is the closest mirror it doesn't seem to be having the requiring bandwidth, so i switch to using jp.archive.ubuntu.com. Now its pretty good.

Graeme smith : Interview after loss in 2011 World cup

Resume broken downloads in firefox

After scourging through to resume a broken (downloaded 200MB of 800MB, and desperate not to download from beginning), found a very useful technique at

http://www.moddb.com/forum/thread/broken-download-solution-for-firefox-users

The idea is simple

1- you have two files on the destination folder. One with the original name and one with an extra ".PART" extension. Move both of these files to some other folder (Move! not copy)
2- Start your download again from the beginning (you have access to the download link, don't you?)
3- Let it download a few bytes, just to have those two files created again, with the exact same name. Now PAUSE this download.
4- Go to the folder where you backed up those old files. Copy both of these files to your download folder and replace the new created files when asked.
5- Now go to Firefox's Downloads form and resume the download.

SA vs Australia 434 vs 438 match

Searched for some time to find the full match video, but everywhere there just seem to be highlights. None of these highlights reflect the real match tension we had watching it live in college. It was incredible, the all action game.
The best copy i could find on the net is at http://www.desipad.com/odi-one-day-innings-videos/87799-south-africa-vs-australia-2005-06-5th-odi-434-438-match.html

http://www.megaupload.com/?d=M9P949Z0 (australia innings) (1:30 min)
http://www.megaupload.com/?d=ANAF5GC5 (SA innings)

Friday, December 18, 2009

comments on slashdot by IgnoramusMaximus (692000)

by IgnoramusMaximus (692000) on Thursday December 17, @12:55PM (#30475942)

Your first mistake is assuming that operations against Al Qaeda in Afghanistan started in 2001. The rest of your argument is rendered moot by that mistake. The US has been operating in Afghanistan since the 90's, as a response to earlier Al Qaeda attacks. The 2001 invasion was just the final commitment in a much longer campaign.

Oh I see, so in addition to being the chief sugar-daddy and arms supplier to Al Qaeda throughout 1980s, the USA then proceeded to meddle directly and covertly in Afghanistan as soon as their "allies" won and the USSR withdrew, showing itself utterly duplicitous and untrustworthy to the locals ... and this is improving your case how exactly?

That, of course, hinges on how you define "victory". If all we care about is maintaining majority control over the country and preventing it from being used as a staging area for further attacks against the west, then we've already won.

By that token the Nazis "won" WWII in 1942 ... I mean they occupied and held a lot of territory at the time, "preventing it from being used as a staging area by the Allies", no?

Under any other reasonable definition we ... we haven't achieved all of the goals we've set for ourselves, but the odds of eventually meeting them are pretty much 100%.

Yes, the time-honoured way of getting your ass handed to you: "fail to declare coherent, logical and testable goals, bloviate endlessly about 'progress' and 'democracy' and whatever other abstract and nebulous feel-good concept you can come up with, declare 'victory' and skedaddle home holding your bruised posterior, having met 'your goals' 110%! - whatever those 'goals' morphed into in the end in order to be met 110%". You did not seriously think you are the first would-be conqueror to come up with this?

The opposite forces have no chance of achieving a military victory - the best that they can hope for is that we get bored and go home.

You have an interesting way of defining "boredom", apparently measured in trillions of dollars, thousands of wounded, dead and maimed on your side and many more on theirs...

And yes, all the defenders have to do is to do what they always have done ... to outlast the latest Empire until it crawls back whence it came from. They have an ample precedent for that, although you are of course the Super-extra-specially-exceptional Empire, the American One, so everything will be oh-so-super-specially-extra-exceptionally different for you, despite no substantial changes in the general conditions of the whole affair. Just because America is oh-so-Speeeecial!

As long as we're willing to stay, we can't lose

Which is pretty much a guaranteed loss for the USA as the "will to stay" (translated to real-life measurements of mayhem and treasury) is far, far, lower than "their" will to outlast you - they are after all fighting for their homes, their "way of life" (as they see it) and their religion (and "zealot" is too kind a word to describe most of them) - and all that on top of their vastly disproportionately lower cost of warfare!

Unfortunately, it seems likely that we will decide to leave, largely due to opinions such as yours.

No, you will leave because that is the only thing you can do. The alternative is "total war" and utter bankruptcy of the US Empire. None of the previous empires left because of nay-sayers either, they left because staying further meant Imperial Collapse (and some, like the USSR, waited a tad too long). No amount of Rah-Rah cheer leading will change basic realities of Afghanistan and the logistics of foreign conquests.

I find that truly depressing. Seems like people didn't learn a damn thing from the American mistakes in the 80's.

What is truly depressing is that Americans didn't learn a damn thing from their own mistakes in the 1950s, 1960s, 1970s, 1980s, 1990s and 2000s and the mistakes of all the Empires past: that the by-necessity belligerent Imperial foreign policy doctrine never ends well in the final tally for the Empire. You seem to forget that all of your troubles with Al Qaeda are the result of your own short-sighted, arrogant meddling in the affairs of others! You yourself created most of your own enemies, by steadfastly applying double-standards to your allies-of-the-moment, backing vicious tyrants then taking them down when they upset you, backing some belligerent bullies while condemning others, etc etc etc, whenever and however suited you, all the while braying about "rule of law" (which of course does not apply to the "oh-so-special" you) and "democracy" (which you immediately disregard if the "wrong" sort of people get elected). In some future editions of English dictionaries when one looks up "hypocritical", "duplicitous" or "self-serving", it will have "American" as a synonym.

Comments in slashdot by IgnoramusMaximus (692000)

If your friend shoots one of my family members and then goes and hides in your house, I'm not picking a fight with you when I come to drag him out. If you decide to get in my way, that's your problem.

Well, its a fine demagoguery you got there, but the actual reality was that the Taliban demanded to see evidence of Bin Laden's responsibility before handing him over (remember that Bin Laden is just a "spiritual leader" - read: "pontificating bore that talks hell of a lot but hasn't actually done much directly" as opposed to other, more hands-on operatives who worked out of Pakistan, Saudi Arabia and, in the case of the 9/11 crew, Germany) and the USA flatly refused. Following which the USA invaded declaring any and all comers as "unlawful combatants" with no rights of any kind.

So to keep your analogy straight, you have a case of my friend showing up at my house saying that you are gunning for him, following which you show up with a box of explosives and demand that I hand him over or else "because he did me wrong!". And when I say "hold on for a sec, what proof exactly do you have?" you say "I don't have to explain myself to a non-human like you, far beneath my superior Manifest Destiny self! What I say goes or else! You got 10 minutes to comply!" and then set the bomb off 5 minutes later, killing my wife and maiming my kids, following which you get the biker gang down the street to help you rummage through and "govern" the wreckage. And so now you have two mortal enemies instead of one and not exactly what could be called a "moral high ground".

This is how the Afghanistan mis-adventure is seen by "the other side" and it is of little wonder that the fight will likely go on indefinitely, Taliban having quite a bit (and growing by many accounts) of local support and very able to present itself as the victims of a belligerent, arrogant, foreign, religiously-motivated, supremacist aggressor, victims who will defend their ancestral homeland, their religion and their "way of life" against that aggressor to the bitter end.

I'd say the odds of "victory" in Afghanistan for the USA are pretty much on the same level as those of all the previous Empires ... not entirely zero but any Vegas slot machine looks like a guaranteed retirement plan by comparison.

Wednesday, April 22, 2009

Tension with India disturbing Pak's focus on war on terror: US

http://www.thehindu.com/holnus/001200904221521.htm

That was a good laugh. Pakistan focussing on war on terror ? they must be joking.

Pakistan never focussed on war on terror, even though it affects pakistan too. The government has no control over extremists. All the funds US is providing to Pakistan are only being used for further sponsorship of extremism. How do these idiots even come upto a stage where their comments are published in papers ?

Friday, April 17, 2009

Repost of slashdot comment

I see your problem. You think managers are logical and considerate. You are wrong, sadly.

I worked for the state of Georgia a few years back, during my time there our group cut our districts IT costs essentially in half, not my doing or anything but it happened either way.

At the end of the year we had a large amount of cash left over in our budget because of the ways we came up with to save during the year.

You know what happened? We spent almost every dime we had left over doing stupid training for things we were perfectly qualified to manage already because our next years budget would be based on what we spent the previous year.

So ... rather than doing our jobs well and being rewarded by getting a little more consideration when we actually NEEDED the money in the future, we had to waste it to ensure that we'd get the funds next time around, even though we knew we wouldn't need them unless something unforeseen happened or that we'd need the money in a couple years when the next round of upgrades/replacement needed to occur. You simply can't budget properly in that state because once you've given some money back, getting an increase later is next to impossible, you have to ramp up over several years in order to get some extra for upgrades/replacements of major systems.

It was worse than just that however, not only did we have a surplus that we wasted, we had other groups in our district that had surpluses as well, which rather than losing the funding the following year they would figure out ways to funnel the money to us (legitimately) so we could spend it on new equipment to justify their budget.

The other groups had extra money because they would get grants and federal funding to do projects, but the funding wouldn't be around the following year, so to continue those public health projects in the future, they really needed to keep their allotment for the next year high enough to pay for everthing.

I write this comment and still think it was absolutely retarded, but those poor bastards that were actually doing the work couldn't do 'the right thing' because it would only screw them within a couple of years because managers and politicians up stream are so broken and stupid that they reward wastefulness and punish efficiency.

There really is no reason that your typical government worker wants to be efficient, they just get punished for it later. Try to remember that next time you go to the health department, DMV or whatever government office and you see them doing something that seems like a complete and utter waste of resources. They probably are fully aware of it, but have to do it anyway so they don't get fucked later and end up with too little money and some stupid politician asking them why they ran out.


Another one


I worked as head of Critical Factilities Engineering for a major financial services provider with a 1 MM sq ft campus. There were just over 4000 employees on the campus, each one with at least 1 computer at his/her office/cube. After having a very expensive energy audit performed, a potential savings was (big surprise) shutting down PCs.

Despite calculating that the organization could save $75K annually (this was a conservative estimate), their marketing department put a stop to the idea. Why marketing? Because the company had just gone through a "rebranding" and the marketing department had designed a new screensaver for all workstations with the new logo/slogan. None of these computers were in client facing positions, so effectively, they were insistent on wasting energy to advertise....to themselves!

No, I'm not kidding.

Monday, April 13, 2009

repost of slashdot comment

By definition the world is mostly made up of average people. For those of us that were products of public schools and other institutions that accepted everyone regardless of their abilities or backgrounds we can probably think back on groups that showed exactly what "average" means.

This combines with the most common failure of unfettered democracy, the tyranny of the loud (and perhaps underemployed/bored/obsessed), to create a perfect storm of vitriol, ignorance, and selfishness in places like an open forum online.

Quite simply, people without knowledge or experience in a field deserve less speaking time than those with knowledge and experience. If those people that are excluded from a discussion because they are ignorant or inexperienced want to participate than they should take the time to become knowledgeable and experienced in the field.

I always like to see open discussions but I also like to see comments rated and organized so that I can sift through the crap to get to the gold, something that guyminuslife mentions is missing from the Post's website system.


and some more

The BBC has it's own reader's comments section called "Have Your Say". It's moderated by a BBC team and it's notorious for censoring completely valid and non-abusive opinion. For example, when they had a topic on Google's participation in censorship in China, some posters pointed out that the BBC also censors things. The BBC responded to this by removing their posts (the topic that day had pre-moderation switched off, something that virtually never happens now). This prompted other people to point out the irony of the BBC removing posted about BBC censorship on a topic about censorship. The BBC then quickly pulled those posts. This prompted more similar responses and eventually the BBC gave up.

Thursday, April 9, 2009

Police chief quits over blunder


http://news.bbc.co.uk/2/hi/uk_news/7991307.stm

secret documents should only be opened in closed containers. Not glassed rooms, or even inside your own vehicle, anyone could use a very high resolution camera to take a picture from far enough and zoom enough to read the text, no wonder there is quite a lot of demand for suitcases

Germany launches Hypo Real Estate takeover bid

http://finance.yahoo.com/news/Germany-launches-Hypo-Real-apf-14889108.html

The government's bank rescue fund said it would offer euro1.39 per share of the commercial property lender.

Even germany realises that companies should not be given cash but should be bought to make the right reforms, but US would never realise it.

Japan seeks NKorea debris

http://www.google.com/hostednews/ap/article/ALeqM5g5bCbd3G8qFoX7H4TvQbUWvBQ08QD97ESFDG1

When i read the title i just felt japan is seeking for NKorea to be reduced to debris, but soon came to senses and reaslised they just want NKorea rocket launch debris.

Why does McCain's statement come into picture here ? He is not president of foreign affairs minister, why does his statement get attached to the title ?

He said, however, that technical difficulties and concerns about cost may make it difficult to renew the search.
It is obvious that searching for debris in oceans are costly, otherwise it would have been already done by curious US or south korea

Tuesday, April 7, 2009

iF TV science was more like real science

India woman 'divorce scam' arrest

http://news.bbc.co.uk/2/hi/south_asia/7986229.stm

seen it movies but never read a article about it.

a 26-year-old woman arrested
His lawyer said the complainant was the woman's ninth husband
wow... that is fast