JuanJo's BLOG [ AKA jjo ]

#TEDxPdeMulas: vibrante, mucha adrenalina, y toda la pila

2011-12-02T15:22:00.001-03:00

Muy groso el evento http://tedxplazademulas.org/ #TEDxPdeMulas, l@s chic@s de la organización se pasaron, pusieron y dejaron todo - y se notó: los oradores, el público ... con toooda la pila.

Yo lo disfruté muchísimo especialmente por la diversidad de gente y afinidades, con la satisfacción adicional de poder llegar con mis ideas a un público más amplio (algo que en realidad no había explorado antes).

Algunas re/percusiones de mi charla en twitter, mdzol.

Pronto (ojalá!) estarán subidos los videos de nuestras charlas.

i Salud ! o/"

nos vemos en TEDx Plaza de Mulas ...

2011-10-21T12:35:00.000-03:00

... el 25 de Noviembre de 2011.
Y bueh ... tendrán que bancarme. Again :)
http://tedxplazademulas.org/2011/10/21/juan-jose-ciarlante-con-permiso-para-hackear/

openvpn over ipv6 patch

2009-09-17T17:58:00.007-03:00

It's baaaack. :)

Thanks to the support from my employer as 20% project, I'm (back) working on openvpn support for ipv6 endpoints (aka udp6, tcp6).

You can find the initial re-release, over openvpn-2.1_rc19

(latest as of Sep'09) at:

http://github.com/jjo/openvpn-ipv6

, obviously available as a git repository but also as a patch

snapshots at:

http://github.com/jjo/openvpn-ipv6/downloads

I'm pretty happy with this release, it has passed my unittests for {loopback,remote}{udp,tcp}{4,6} and also -it's valgrind friendly ;)

Enjoy it ! ... I'll post it to openvpn-devel ~soon.

* UPDATE(27-Sep-09): Posted to openvpn-devel mlist at http://sourceforge.net/mailarchive/message.php?msg_name=7bb795fd0909251436v2369d6d5q674e63e0621fcd56@mail.gmail.com

--Juanjo ; echo jAjo@goMoSgleP.com | sed 's/[SPAM]//g'

before renewing your cellphone ...

2009-08-05T07:05:00.003-03:00

... fancy gadget or alike: please think twice.

Being a somewhat tech-savvy guy I am, I was scared to become aware of this _that_ late, evidently media companies are doing a very good job here also :P.

The mineral (Tantalum) inside the small capacitors used in these tiny electronic devices is fueling the worst contemporary humanitarian crisis in the world, with about 5.4 millon deaths so far.

No further presentation needed since you already have it in your pocket, meet "Coltan".

"En los países en serio ... ¡ Se fusila !"

2009-07-15T07:42:00.009-03:00

¡ Quién puede ser sino el maeeeessstrooo Capusotto ! :)

Bastante tarde lo encontré, por cierto ... el loco tiene un programa de radio en Rock&Pop: "Lucy en el cielo con Capusottos".

Afortunadamente para los que no podemos escucharlo en vivo (zona horaria, en mi caso), un ilustre compatriota ha ido guardando los programas :)

Que lo disfruten ... , en mi caso tuve que parar el play, para contener el ataque de risa :-O

PD: el siguiente script resulta útil para taggear los archivos, de manera que queden amigables para tu PMP.

id3v2-lucy_con_capus.sh:


# ./id3v2-lucy_con_capus.sh:
#  aplica id3v2 tag a todos los Lucy*.mp3 del directorio actual. 
# ej: 
#  Lucy_en_el_cielo_con_Capusottos_1er_Programa_by_vamosmillo2.mp3 
# , tomara el primer "conjunto" de numeros para usarlo como nro de track
album="Lucy en el cielo con Capusottos"
for i in Lucy*.mp3;do
  track="$(echo "$i" | sed -n -r 's/^[^0-9]+([0-9]+).*/\1/p')"
  track=$(printf "%02d" $track)
  title="${i%%by*}"
  title="${title/?con?Capusottos/...}"
  title="${title//_/ }"
  (set -x
    id3v2 -y 2009 -t "$title" -A "$album" -a Capusotto -T $track "$i"
  )
done

select chromium, chrome else firefox as default browser

2009-06-05T08:13:00.011-03:00

Now that google-chrome requete-alpha build is published by Google [1], I have this
handy script as my default browser "selector":


#!/bin/bash
#
# $HOME/bin/browser.sh
# Author: JuanJo ( juanjosec O gmail o com  )
#
#   if running, try: chromium-browser, google-chrome
#   else:            firefox
#
case "$(ps -oargs= -C chrome)" in
 /usr/lib/chromium-browser*)
   exec /usr/bin/chromium-browser "$@";;
 /opt/google/chrome*)
   exec /opt/google/chrome/chrome "$@";;
esac
exec /usr/bin/firefox "$@"
exit $?

# Point2 me with the output from:
for p in /desktop/gnome/{applications/browser/exec,url-handlers/http{,s}/command}; do
 echo gconftool-2 -s $p -t string "$HOME/bin/browser.sh \"%s\""
done

In a related note, you can see current milestone (LinuxDev [2]) and what to expect for the next one (LinuxBeta[3]).

[1] Danger: Mac and Linux builds available
[2] Chromium LinuxDev milestone
[3] Chromium LinuxBeta milestone

ads blocking in chromium-browser

2009-06-01T07:16:00.008-03:00

ads blocking in chromium-browser

One key missing functionality in chromium is extensibility via browser extensions or user scripts, damn useful in particular for blocking ads.
Although the support is there in the dev channel, it had been not available in the ppa binary debs for a while, but about ~2days ago user scripts started working ... yAY!! \o/

To the point:


dpkg -l chromium-browser # version: 3.0.183.0~svn200905 Chromium browser
mkdir $HOME/.config/chromium/Default/User\ Scripts  # yep, nasty white space :P
cd $HOME/.config/chromium/Default/User\ Scripts
wget http://www.adsweep.org/AdSweep.user.js  # ala adblock

# ... and then start chromium as:
chromium-browser --enable-user-scripts

To confirm you have it enabled, visit http://www.adsweep.org/ && you'll see a red status line, up-right, with the adsweep script version.

chromium-browser with bookmark keywords

2009-05-29T03:22:00.008-03:00

I've been enjoooying chromium-browser on */Linux since last ~3weeks, you'll find lotsa references out there on howto install it, in my ubuntu it boils down to:


echo deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu hardy main > /etc/apt/sources.list.d/chromium.list
#echo "Acquire::http::Proxy::ppa.launchpad.net DIRECT;" > /etc/apt/apt.conf.d/85launchpad
apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 4E5E17B5
apt-get update
apt-get install chromium-browser

One important functionality I was missing was the ability to create "%s" bookmarks (ala firefox), the nice thing is that it's actually support, tho not "fancy" at the moment because of laking bookmark editor (May/09).
Good news is that you can actually ride it via sql:


#!/bin/bash
# Author: JuanJo
# License: GPLv2+
# Usage: (chromium-browser must not be running)
#   ./chromium-browser_keywords.sh ## *see* it, then:
#   ./chromium-browser_keywords.sh | sqlite3 $HOME/.config/chromium/Default/Web?Data
# Goodies:
# at the address bar type eg:
#   yh tate
#   wa theta
#   rae teta
#   bspot juanjosec

KEYWORDS="
yh http://search.yahoo.com/search?p=%s
wa http://www.wolframalpha.com/input/?i=%s
rae http://buscon.rae.es/draeI/SrvltConsulta?TIPO_BUS=3&LEMA=%s
bspot http://%s.blogspot.com
#foo http://%s.foo.com/
"
while read k url;do
  case "$k" in ""|\#*) continue;;esac
  echo -n "INSERT INTO keywords (short_name, keyword, favicon_url, url) "
  echo "VALUES ('$k','$k','about:blank','$url');"
done < <(echo "$KEYWORDS"| sed 's/%s/{searchTerms}/')

Incidentally nuff, I'm now at a roaming session I need to last +4hs, so I closed my ff-3.1b3 cpu toaster and left riding entirely on chrome-browser (who needs flash after all ?).

Copying isn't theft ...

2009-03-19T15:11:00.002-03:00

Nina Paley, the talented cartoonist, sings the copyright song.

Hear it ... it's refreshing, and full of truth :-

Nina Sings "Copying Isn't Theft" from Reel 13 on Vimeo.

clapClapClapp....

conference: Security Clouds in the Horizons --by Adi Shamir

2009-02-16T21:19:00.005-03:00

I had the invaluable chance to attend Adi Shamir [1]'s conference "Security Clouds in the Horizons" or "Why I'm skeptical about Cloud Computing", given at Google's offices.

Below are my ~raw notes (taken with Freemind[2], then exported to HTML), meaning: a GiAnT disclaimer about the possible inaccuracy of these, YHBW.

Cloud Computing
- [def] from wikipedia (~fine)
  - dynamically scalable virtualised resources
  - as a service
  - over the Internet
- "... not new to me" [sic]
  - 1960 -> John McCarthy : cimputation may someday be organized as a public utility
    eg. municipality -> computaion bureau
  - 1960: small number of large service centers
  - 1980: small companies with self managed DC (data center)

Q: Which type of system should be more secure in principle: Cloud or Self-managed ?

Cloud:
- more experienced companies
- -> more secure systems
- -> BUT more attractive TARGETS for attacks
Computer insecurity
- old problem, 1st recorded incident: RFC 602 (at ARPANET, aprox 100 computers)

Safety vs security [definition]
- Safety
  - "YOU vs NATURE"
    - reliability issues, etc
  - difficult to achieve
    - eg. building a car which is perfectly safe to drive
      - very complicated
      - very expensive
      - very slow and cautious
- Security
  - _MALICIOUS_
    - ++harder to deal
      - they know your defensive measures
      - they know your weaknesses
    - eg. design a car that resist eg
      - dropping sugar in the gas tank
      - putting explosives near the engine
Q: Is cloud computing more secure than company-centric computing?
- 1: remote data storage
  - privacy
    - no problem iff KEY is *local* (send/store only encripted data)
  - reliability
    - much better for the cloud
- 2: remote code execution
  - security of the data IN the hands of the provider (!)
  - diff. types of threats [classif]:
    - dishonest employees
      - a single "bad apple" can cause a LOT of damage
    - amateur hackers (script kiddies)
      - motivation proportional to SIZE
      - for recognition/ego
    - professional hackers (data thieves)
      - make money, spionage, etc
      - they carefully choose their target,
        they spend time and money for the attack, etc
      - ++attractive to break bigger systems
      - ++motivation: *high* reward/effort ratio
    - cyber terrorists using sophisticated cross border attacks
      - motivation: create *PANIC*
        economic damage
        make ppl to not trust
        banks, govt, etc
    - discreet govt intervention
      - terrified by being discovered
        (political fallout of public disclosure)
        ++risk if cloud (vs small DCs)
      - they ARE applying pressure (no doubt!)
  - Can cryptography solve the security issue ?
    - theoretical solutions
      - multiparty computation protocols
      - totally UNREALISTIC
      - VERY difficult
- How do you BREAK the security of cloud computing ?
  - side channel attacks
    - use phyisics to overcome math
    - cryptanalytic attack: "cache attacks"
      - pure software attack
      - very efficient
      - full 128bit AES key extraction from Linux encrypted file system in 65ms
        require only the ability to run code in parallel on the target physical location
      - can compromise eg VPN/aes =)
      - can be used to attack any Virtualization technique
        (jail, Xen, UML, Virtual PC , VMware)
      - very hard to protect against WITHOUT a major performance penalty
      - solution? turn off caching when encrypting ?
        problem: @BIOS setup
        speed (!)
      - HOW is the attack done:
        look for the time delay in accessing mainmem vs cache while accessing the idx in the 1st table lookup, because:
        for AES: finding the KEY == finding the INDEX of the 1st lookup table for a known plaintext *and* you can force the plaintext (eg encrypted harddisk, vpn).
    - another example: normal PC "noise"
      - signal processing of that noise, correlated to diff CPU ops, using FFT: patterns clearly shown, eg:
        RSA key generation
        HLT, MUL, ADD, etc
        found: 2nd power supply capacitors
  - big problem with "virtualization":
    - the UNDERLYING physical CPU *is* the same
      - by stressing the "common" underlying resource
        another process @another VM can "discover"
        this sharing
    - using birthday paradox, you can reasonably "discover":
      - aprox number of physical processors in the network
      - aprox number of VMs
      - Virt-to-Phy processor allocation "spread" (eg for loadbalancing load/resources)

[1] http://en.wikipedia.org/wiki/Adi_Shamir
[2] http://freemind.sourceforge.net/

geeks in (work)space

2009-02-16T13:24:00.002-03:00

It's cool to be surrounded by freaking geeks at work, better yet when this geekiness becomes visible ;)

http://www.google.com/logos/unix1234567890.gif

my green alix 2c3 box

2009-01-18T16:18:00.009-03:00

This is my beloved fanless 24x7 box: Alix 2c3 board, consisting of:

CPU: AMD Geode x86 500MHz, 256MB RAM, 2x USB2.0, 3x LAN 100Mb, 1xMiniPCI
(from http://pcengines.ch/)
CardFlash 4GB (as root filesystem)
WD Passport 500Mb (USB 2.0), using board's power via USB
Power supply: DC 12V 20W :-D

I tried several x86 OSes on it:

OpenBSD 4.4: by far the easiest and +straightforward installation via PXE
Debian stable: all Debian versatility thru your serial console installation :)
Voyage Linux: 1-shot copy-to-CF (no PXE needed) && boot'it && apt-get'em =)

After some back&forth, I finally kept Voyage Linux, mostly because of

debian versatility
apt-get install screen ;)
fully tuned for flash => root filesystem is booted readonly, with all the writable noise kept in memory by using aufs (union fs) and tmpfs
smaaaaall (merely less than ~150Mb after install)
openssl/OCF by default
hardware watchdog, rng, aes support by default

Hardware info:

/proc/cpuinfo

processor       : 0
vendor_id       : AuthenticAMD
cpu family      : 5
model           : 10
model name      : Geode(TM) Integrated Processor by AMD PCS
stepping        : 2
cpu MHz         : 498.056
cache size      : 128 KB
fdiv_bug        : no
hlt_bug         : no
f00f_bug        : no
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu de pse tsc msr cx8 sep pge cmov clflush mmx mmxext 3dnowext 3dnow
bogomips        : 997.25
clflush size    : 32
power management:

lspci

00:01.0 Host bridge: Advanced Micro Devices [AMD] CS5536 [Geode companion] Host Bridge (rev 33)
00:01.2 Entertainment encryption device: Advanced Micro Devices [AMD] Geode LX AES Security Block
00:09.0 Ethernet controller: VIA Technologies, Inc. VT6105M [Rhine-III] (rev 96)
00:0a.0 Ethernet controller: VIA Technologies, Inc. VT6105M [Rhine-III] (rev 96)
00:0b.0 Ethernet controller: VIA Technologies, Inc. VT6105M [Rhine-III] (rev 96)
00:0f.0 ISA bridge: Advanced Micro Devices [AMD] CS5536 [Geode companion] ISA (rev 03)
00:0f.2 IDE interface: Advanced Micro Devices [AMD] CS5536 [Geode companion] IDE (rev 01)
00:0f.4 USB Controller: Advanced Micro Devices [AMD] CS5536 [Geode companion] OHC (rev 02)
00:0f.5 USB Controller: Advanced Micro Devices [AMD] CS5536 [Geode companion] EHC (rev 02)

lsusb

Bus 002 Device 002: ID 1058:0704 Western Digital Technologies, Inc.
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub

lsmod | egrep geode (special hardware)

geodewdt                4500  2             ## watchdog
geode_rng               1920  0             ## random number generator
rng_core                3716  1 geode_rng
geode_aes               5508  0             ## aes cipher

Some measurements/stats:

HDD /USB 2.0 throughput:

jjolix:~# hdparm  -t /dev/sda

/dev/sda:
Timing buffered disk reads:   56 MB in  3.04 seconds =  18.40 MB/sec

The CPU/chipset/RAM/netw are nice enough to run things like rtorrent/mlnet and serve NFS.
This is top output at the alix box whilst doing a tar cf - /mnt/Fotos/ > /dev/null (~2K photos, ~3MB each) from a LAN NFS client:

top - 20:51:47 up 18 days, 22:41,  1 user,  load average: 5.65, 2.39, 0.90
Tasks:  60 total,   1 running,  58 sleeping,   0 stopped,   1 zombie
Cpu(s):  4.0%us, 23.1%sy,  0.0%ni,  8.9%id, 31.7%wa, 21.5%hi, 10.9%si,  0.0%st
Mem:    256860k total,   252860k used,     4000k free,      604k buffers
Swap:        0k total,        0k used,        0k free,   197128k cached

PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                     
30635 p2p       20   0 57232  36m 5196 S  9.2 14.4   3:00.93 mlnet                       
11028 root      20   0     0    0    0 S  4.0  0.0   0:06.09 nfsd                        
11030 root      20   0     0    0    0 S  4.0  0.0   0:08.98 nfsd                        
11024 root      20   0     0    0    0 D  3.6  0.0   0:06.20 nfsd                        
11025 root      20   0     0    0    0 S  3.6  0.0   0:06.21 nfsd                        
11027 root      20   0     0    0    0 S  3.6  0.0   0:06.16 nfsd                        
11026 root      20   0     0    0    0 D  3.3  0.0   0:06.06 nfsd                        
11029 root      20   0     0    0    0 S  3.3  0.0   0:06.11 nfsd                        
11031 root      20   0     0    0    0 D  3.3  0.0   0:06.84 nfsd                        
30349 root      15  -5     0    0    0 D  2.6  0.0   0:05.58 usb-storage                 
3 root      15  -5     0    0    0 S  1.6  0.0   3:44.10 ksoftirqd/0                 
88 root      15  -5     0    0    0 S  1.0  0.0   2:55.14 kswapd0

for above, iftop shows >70Mbit/s, ++enough to do a remote DVD toasting session :)
a full-steam-ahead rtorrent download at 1.5MBytes/sec makes it use ~25% CPU.

Previously I had a conventional , fanfull, noisy, old desktop (P4 1.5Ghz) for doing 24x7 stuff @home, as you can imagine it won't be missed =)

e2fsprogs utils for Android (EABI ARM)

2009-01-12T11:57:00.006-03:00

I've been playing around with my brand new Android (cool Christmas gift from my employer ;).
Because of the security model by default you cannot store apps into /sdcard (only at /data/apps, which is mounted from the internal MTD device), and this is something you'll eagerly want for freakin'ly installing bunch of cool applications.

After some hacking around I could get it to like /data/app as a loop-mount:


/ # df
Filesystem           1k-blocks      Used Available Use% Mounted on
tmpfs                    49564         0     49564   0% /dev
tmpfs                     4096         0      4096   0% /sqlite_stmt_journals
/dev/block/mtdblock3     69120     57248     11872  83% /system
/dev/block/mtdblock5     76544     58596     17948  77% /data
/dev/block/mtdblock4     69120      1256     67864   2% /cache
/dev/block/mmcblk0p1    991488    950448     41040  96% /sdcard
/dev/block/loop0        128949     19098    103186  16% /data/app

, where /dev/block/loop0 is actually a loop mount on /sdcard/data-extra.img ext2 image file.

I will post a more detailed mini-howto about this hack, but the 1st thing you'll need (and I couldn't find out there before) are the e2fsprogs utils built for Android.
So I went ahead, changed some e2fsprogs src bits and compiled with my android sdk arm gcc toolchain (built @my workstation from the Android git repo).

You can find them at:
http://sites.google.com/site/juanjosec/android , namely:
e2fsprogs-android.diff, e2fsprogs-base_arm-eabi.tar.gz, e2fsprogs-xtra_arm-eabi.tar.gz.

15 years have passed since I first touched my 1st Linux, 13 so far since I hacked the Linux kernel for ip aliasing support ... been a long trip, and now I can finally carry it in my pocket ;-)

nos vemos en una semana ;-)

2008-10-07T14:47:00.003-03:00

La semana que viene voy a andar por Mendoza, y por supuesto ... aprovechar para dar un par de clases en mis cátedras de la Universidad de Mendoza (como en los buenos viejos tiempos ;), y de paso ofrecer una charla contando algunas cosas interesantes (eso espero :P) que he aprendido en este año de trabajo.

La conferencia es el Martes 14 de Oct, 18:30hs en el Aula Magna de la Facultad de Medicina, así que nos vemos allí :-D

making a 3G Huawei 220 USB modem work in Linux 2.6

2008-09-21T15:36:00.008-03:00

Context: just received a Huawei 220 3G USB modem [1] (HSDPA/UMTS/EDGE/GPRS/GSM, HSDPA <= 3.6Mbps ), have to make it work in my Linux thinkpad X60 w/ Linux 2.6.20+ , for accessing the Swisscom HSDPA service.

It didn't work out of the box, mainly because of the device's CD emulation storage (windoze drivers :P) interfering with its comm device.

First searches return pointers to a "vodafone-mobile-connect-card-driver-for-linux" [2] package, which is absolute crap: a heavy weight GUI interface that doesn't even work (at least for me).

Hey ... I just want to have my /dev/ttyUSB0 to be able to configure a pppd on it, I found a true, low level solution [3] that manages to make the device behave like the very thing it was born for :)

Here is an excerpt of the mininum required configs to make it work

/etc/udev/rules.d/99-huawei.rules


## /etc/udev/rules.d/99-huawei.rules
##
## to enable it, run: udevcontrol reload_rules
##
#
# udev rule for HUAWEI E220 3G HSDPA Modem
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# (c)opyleft   OOZIE < oozie@poczta.fm > 
#
# This file prevents the pseudo scsi cdrom device from enabling, 
# thus providing a workaround for kernel versions < 2.6.20
# 
# Minor edition by JuanJo Ciarlante
##

SUBSYSTEM=="block", \
ACTION=="add", \
SYSFS{idVendor}=="12d1", \
SYSFS{idProduct}=="1003", \
RUN="/sbin/modprobe usbserial vendor=0x12d1 product=0x1003", \
OPTIONS="ignore_device"

/etc/ppp/peers/3g


# /etc/ppp/peers/3g
# pppd call 3g nodetach
# (using Huawei e220 USB modem)
/dev/ttyUSB0
#3600000 #irrelevant
noipdefault
defaultroute
user gprs
password gprs
#persist
lock
noauth
nodetach
usepeerdns
nodeflate
nobsdcomp
nopcomp
noaccomp
novj
novjccomp
nomagic
#asyncmap 0
#lcp-echo-failure 10000
#lcp-echo-interval 1000
lcp-echo-failure  10
lcp-echo-interval 30
connect '/usr/sbin/chat -v -f /etc/ppp/peers/3g.chat'
debug
idle 180
holdoff 10

/etc/ppp/peers/3g.chat


# /etc/ppp/peers/3g.chat
TIMEOUT 3
ABORT BUSY
ABORT 'NO CARRIER'
ABORT VOICE
ABORT 'NO DIALTONE'
ABORT 'NO DIAL TONE'
ABORT 'NO ANSWER'
ABORT DELAYED
"" ATZ
OK ATQ0V1E1S0=0&C1&D2
OK AT+CGDCONT=1,"IP","gprs.swisscom.ch","0.0.0.0",0,0
OK ATDT*99#
CONNECT ""

@Kirk McKursick's FreeBSD Internals course

2008-09-19T11:53:00.009-03:00

I had the fortunate pleasure to attend Kirk McKursick's FreeBSD internals course, kindly $upported by Google Switzerland, my employer =).

May the source be with you ... `:-)

One interesting discussion I had with Kirk was about the behavior of zombie processes with respect to opened sockets and TCP data lingering: he stated that a process could be in zombie state while pushing the data ashes thru an already opened TCP socket ... something that I couldn't agree with, mainly because this would imply a high wait() "latency" in under a pkt loss/congestion scenario.

Linux even has a tcp_max_orphans sysctl explicitly there for this (man 7 tcp), anyhow I wanted to be sure about the behavior of Linux and xBSD, so I coded a quick&dirty test, see zocket.c and Makefile below.

Result: as expected, the sockets were orphaned after the process became zombie, and remained as is (FIN_WAIT1) independently from the process path to death =) (tested on Linux, FreeBSd and OpenBSD).

As a side note, was interesting to find that in Linux you can push a BPF down to filter the very data stream, but in FreeBSD you can only hook at the accept() syscall with another mechanism (man 9 accept_filter), this is somewhat 2-sided for Linux: cool that you can arbitrary filter the data stream, notso-cool that you can easily create a local DoS with this power :)

make && make test ## should do the magic:

zocket.c

/*
 *  zocket.c: connect a socket, block its data stream, write data @children:
 *            show zombie and socket lifetime afterwards
 *
 *  Author: JuanJo: jjo () google com
 *  License: GPLv2+
 */
#include <stdio.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/wait.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <assert.h>
#if __linux__
#include <linux/filter.h>
#endif

/* quickie wrapper over syscall error checking */
#define ERR_IF(cond) do { if(cond) { perror( #cond ); abort(); } } while (0)

static int block_fromto(int sockfd, const struct sockaddr_in *sp, 
                const struct sockaddr_in *dp) {
#ifdef __linux__
        /* 
         * Push a BPF into _this_ socket only, interesting enough
         * this seems to be a linux-only feature, BSD has this available
         * only at accept().
         */
        struct sock_filter bpf_blockme[]= { 
                BPF_STMT(BPF_RET+BPF_K, 0), /* just accept 0 bytes ;) */
        };                            
        struct sock_fprog filter = {
                sizeof(bpf_blockme)/sizeof(*bpf_blockme), bpf_blockme,
        };

        ERR_IF(setsockopt(sockfd, SOL_SOCKET, SO_ATTACH_FILTER, 
                                &filter, sizeof(filter))<0);
#else /* assuming BSD: block at PF level */
        char cmd[1024];
        cmd[sizeof cmd-1]=0;
        snprintf(cmd, sizeof cmd-1,
                "echo block drop out inet proto tcp "
                "from %s port %d to %s port %d| pfctl -f-",
                        /* leaking but effective ... */
                        strdup(inet_ntoa(sp->sin_addr)), htons(sp->sin_port),
                        strdup(inet_ntoa(dp->sin_addr)), htons(dp->sin_port));
        printf("====== configuring pf:\n+ %s\n", cmd);
        ERR_IF(system(cmd)<0);
#endif
        return 0;
}
int main(int argc, const char *argv[]) {
        int sock;
        int pid;
        int syncpipe[2];
        unsigned n;
        char cmd[2048];
        struct sockaddr_in dest,me;

#ifndef __linux__
        /* need to use /sbin/pfctl for blocking pkt stream if !linux */
        assert(getuid()==0);
#endif
        if (argc != 3) { 
                fprintf(stderr, "ERROR: Usage: %s <ip> <port>\n", argv[0]);
                exit(255);
        }
        dest.sin_family = AF_INET;
        ERR_IF( inet_aton(argv[1], &dest.sin_addr) == 0);
        dest.sin_port=htons(atoi(argv[2]));

        sock = socket(AF_INET, SOCK_STREAM, 0);
        ERR_IF(sock <0);
        ERR_IF(connect (sock, (struct sockaddr *)&dest, sizeof dest) < 0);
        n=sizeof me;
        getsockname(sock, (struct sockaddr *)&me, &n);

        /* unbuffer stdout */
        setbuf(stdout, NULL);
        /* block (output) data stream */
        block_fromto(sock, &me, &dest);
        pipe(syncpipe);
        for(n=3;n;n--) {
                switch(pid=fork()) {
                        case 0:
                                close(syncpipe[0]);
                                write(sock, "1234567890", 10);
                                _exit(0);
                        case -1: ERR_IF(1);
                }
        }
        close(sock);
        /* sync to children death */
        read(syncpipe[0], NULL, 0);
        cmd[sizeof cmd -1]=0;
        snprintf(cmd, sizeof cmd -1, 
                        "ps -o pid,ppid,stat,command|egrep [z]ocket;"
                        "netstat -tn|egrep '[.:]%d .*[.:]%d'",
                        ntohs(me.sin_port), ntohs(dest.sin_port));
        /* this will show the zombies and the socket send-q (as netstat -tn) */
        printf("====== BEFORE wait() ======\n+ %s\n", cmd); system(cmd);
        while(wait(NULL)>0);
        /* obviously the zombies are gone, what about the (orphaned) socket ?*/
        printf("====== AFTER  wait() ======\n+ %s\n", cmd); system(cmd);
        return 0;
}

Makefile

## Makefile for zocket.c
## Tested on: Linux 2.6, FreeBSD 6.x(dragonfly), OpenBSD 4.3
CFLAGS=-Wall -g
T=zocket.bin.$(OS)
DEST=10.255.255.1 111

## No portable (GNU,BSD) way of doing VAR=<output_from_shellcmd>, wrap
## them by invoking make again
all:
        make OS=`uname -s` all_os
test:
        make OS=`uname -s` test_os
        
all_os: $(T)

setup_pf:
        ## FreeBSD: dynload PF module
        -@test -x /sbin/kldload && \
                { /sbin/kldstat | egrep pf.ko || { kldload pf; sleep 1;};}
        ## Enable PF
        -@test -x /sbin/pfctl && \
                sudo /sbin/pfctl -e -f- </dev/null 2>/dev/null;exit 0

test_os: all_os setup_pf
        @ulimit -c 0; [ $(OS) != Linux -a -x /usr/bin/sudo ] && SUDO=sudo;\
                exec $$SUDO ./$(T) $(DEST) | tee test.out.$(OS)

$(T): zocket.c
        $(CC) $(CFLAGS) -o $(@) $(?)

clean:
        rm -fv zocket.bin.*

%.html: %
        c2html -s $(^)

LHC

2008-09-11T07:33:00.006-03:00

Unless you've been living under a rock [*], you've surely read ad-nauseum about the
Large Hadron Collider ... having moved to Switzerland about a year ago, it seems not to be a very bold move to become a blackhole neighbor ... we'll see (well ... actually the oppositte ;)

Cool that we have the chance to watch their live webcam:
http://lhc.web.cern.ch/lhc/webcam.html

[*] living under a rock won't save you either...

yeah ... debugging sucks, testing rocks, but ...

2008-07-11T18:17:00.005-03:00

I'm by no means a software engineer (well ... neither an electronic engineer nowadays, as my title says :-/ ).

Anyway, the fact is that I usually do some hacking around source code, without a formal approach ... that is: hands on to solve some specific problem and/or implement a new feature and have fun.

To the point: I was touching some code related to the frontend serving infrastructure in my work, it took me ~a couple of hours come up with a src change I could be proud of :) ... just to find out that the respective unit testing additions for this new functionality will end toasting almost twenty hours from me to stabilize (yup ... 10x), and several round trips with the main devel team.

Pheeeeuuuu... testing rocks, but it can be a rock itself, heh ...

cmdline, online google shell :)

2008-06-03T06:46:00.002-03:00

Nowadays, few times you find yourself staring at a site with a big "woooOOOWWW!!"

Just extremely cool (-:
http://www.goosh.org/

Eat that egg, Steve !

2008-05-19T15:16:00.003-03:00

Ohhhh... divine justice! ... deep thanks unnamed Hungarian guy,
Heroe of the f*cked citizens whose government plays bed-games with M$
Enjoy. Plenty.
http://fakesteve.blogspot.com/2008/05/ballmer-egg-attack-video-is-here.html

debian openssl bug

2008-05-16T03:21:00.007-03:00

It has been blogged everywhere ... but the problem it's not the bug itself , "errare humanum est " ... and that's ~fair enough.

What's irritating --AGAIN!-- is Debian attitude of not feeding patches back upstream, specially when messing with such security sensitive packages, doing this would have effectively caught the bug and --albeit some deserved flame-- would have void the current situation.

By this arrogant attitude, they break the very power of FLOSS: collaboration, cross-fertilization, moooore eyes on your source.

Another thing to note: let's push against monocultures, that is: the more different distros and FLOSS OSes ... the better!

And now: something [not] completely different ...

img source: kriptopolis.org

Remotely loadable NIC firmware, what a good idea! ...

2008-05-15T14:09:00.004-03:00

, for remotely creating an ad-hoc hardware-level firewall.

Ohh ... wait! now there are two firewalls (?), guess which will win =)
http://www.links.org/?p=330

Behind The Scenes of Google Scalability

2008-04-24T07:34:00.002-03:00

Cool tech details about the approach and tools
used at Google for handling such beastie amount of workload:

http://highscalability.com/behind-scenes-google-scalability

[en] when privacy concerns ... US doesn't differ from China

2007-12-31T11:18:00.000-02:00

We all know how US sucks, specially when it comes to privacy (I wonder how much time will they be able to keep the hypocrisy of their freedom respect), and it's good to see it confirmed with actual metrics.

The bad news is that the planet if decaying altogether ... the good news is that my country is not so bad :-D (aguante, Argentina!).

From http://www.privacyinternational.org/ via
boingboing: Privacy State of The Planet:

Using mutt for gmail via IMAP

2007-11-18T17:07:00.000-03:00

You use mutt, you love it. You hate the user interface "latency" of every other MUA, and the fact that no other MUA has "got" how to handle mail threading as mutt does.
BUT also you, a true road warrior, want mail(box) availabilty and plenty of storage.
Well, recently gmail added IMAP support, with a very good support of the standard AND a well thought mapping between gmail labels and IMAP folders ( "virtual" folders).

The good news is that you can link your beloved mutt to gmail, use IMAP folders and also use SMTP TLS authentication via smtp.gmail.com

Here is a copy of my .mutt/muttrc (obviously must change "username" and other stuff):


## ~/.mutt/muttrc
set from=username@gmail.com
set realname="JuanJo seC"
set reverse_name=yes
set reverse_realname=no
set imap_user = 'username@gmail.com'
set spoolfile = imaps://imap.gmail.com:993/INBOX
#set sendmail="/usr/sbin/ssmtp -C$HOME/.mutt/ssmtp.conf"
set smtp_url="smtp://username@smtp.gmail.com:587/"
set folder = "imaps://imap.gmail.com:993"
#set record=+sent-mail-`date +%Y`
set record="+[Gmail]/Sent Mail"
set postponed="+[Gmail]/Drafts"
# previously do:  mkdir -p ~/.mutt/cache/{headers,bodies}
set header_cache="~/.mutt/cache/headers"
set message_cachedir="~/.mutt/cache/bodies"
set certificate_file=~/.mutt/certificates 
set move=no
set delete=yes 
set edit_hdrs
set include
set reply_to
set abort_nosubject=no
alternates '(username|altusername)([-+].*)?@.*'
set hdr_format="%4C %Z %{%m/%d} %-15.15F (%4c) %s" # format of the index

hdr_order From: Date: User-Agent: X-Mailer To: Cc: Reply-To: Subject:
ignore *
unignore From: Date: User-Agent: X-Mailer To: Cc: Reply-To: Subject:
my_hdr Reply-To:

# setup gmail filters to apply the corresp. labels:
mailboxes ! =ml-lug-list =ml-lug-org =[Gmail]/Drafts "=[Gmail]/All Mail"

set editor="jed %s -l ~/.mutt/jed.mutt.sl"
set alias_file=~/.mutt/mail_aliases
source ~/.mutt/mail_aliases

send-hook . 'set realname="JuanJo seC"'
## hack to make  $reverse_name and 'my_hdr From:' work ok (eg mlists)
send-hook . 'set from=username@gmail.com'
send-hook . 'unmy_hdr From:'
###
send-hook . 'set signature=~/.signature'

#send-hook lug-list 'set record=+sent-lug-list'
send-hook lug-.+@lugmen.org.ar 'my_hdr From: JuanJo seC <username+mlist@gmail.com>
subscribe lug-.+@lugmen.org.ar

Very cool to experiment folder switching in mutt using:
'c' ("Open Mailbox")
TAB (will show all IMAP folders)
TAB (again: will show only the 'mailboxes' mutt var)

And here is my jed rc:


% ~/.mutt/jed.mutt.sl
% emacs keybinding for jed:
() = evalfile("emacs");  
% Find signature begin, position cursor there:
if (re_fsearch("^--")) {
 call("previous_line_cmd");
} else {
 % else search headers end
 re_fsearch("^$");
 call("next_line_cmd");
}
push_mark();

Yeahh... finally I can read mailing lists with an interface that doesn't suck! 8)
Enjoy!

for next I-Monday :-P

2007-10-28T09:23:00.000-03:00

Damn ... it gonna be a boring Monday with all these Steven Jobs'
bedpartern-wannabes bragging around with their blackbox OS.

Let's have some I-mmunization fun:

Enjoy :-D

encontré yerba mate en Suiza!

2007-10-02T08:09:00.003-03:00

Mi alma de verdes regresó al cuerpo :-D
Seehhhh!! ... llamé a la embajada argentina @Suiza, y no podía creer que cuando les
pregunté por yerba en estos lares, además de una risa cómplice obtuve una url:
http://www.productosargentinos.ch/ donde efectivamente podré comprar yerba.

Compra online, remota, desde tu consola gráfica Linux doble LCD 24" übergeek ?
Nahhh... es una excelente excusa para darse una vueltita por Lucerna ;)

[ UPDATE - Mar/2011 ]
Aquí va un resumen de los lugares donde conseguir yerba mate en Zurich y cercanías

http://www.elmaiz.ch

Josefstr. 23
8005 Zürich
TE: 044 440 5840
Nota: Rosamonte y otras, dulce de leche!, en general un poco más baratos que el resto, cerca de la ZHB
http://www.sabor-tropical.ch

Ackerstrasse 1
8005 Zürich
TE: 044 440 5455
Nota: Rosamonte, cerca de la ZHB
http://www.mitierra.ch

Seestrasse 195
CH - 8712 Stäfa
TE: 044 926 7060
Nota: no he ido aún, tienen dulce de leche también.
http://www.productosargentinos.ch/

Luzernerstrasse 105
6014 Littau/Luzern
TE: 041 250 8040
Nota: en Lucerna, opción piola via Posta

24h open store just by
Langstrasse 193
8005 Zürich
Thanks Ben (bhk@) for the tip! :)

El hippismo - Detección y Procedimiento

2007-09-28T02:11:00.000-03:00

Maeeestro Capusotto !! y no te digo si estás lejos como para no podeer sintonizarlo en el éter...

, éste es tan sólo uno de los tantos de Septiembre.
Prepará los pañuelos y/o pañales por que vas a morirte de risa =)

e-voto: porque no queremos ser menos, señores!

2007-09-04T02:13:00.000-03:00

Sip ... no queremos ser menos e-stúpidos que en otras latitudes, como siempre, bombos y platillos ignorando plenamente todas las recomendaciones al contrario desde organismos independientes [1] y los incidentes concretos que han ocurrido. Entre los más interesantes está la decisión de California (EEUU) de invalidar todas las máquinas de e-voto [2] por razones de seguridad y falta de confianza.

Los chicos de Vía Libre se adelantaron y ya montaron http://www.votoelectronico.org.ar/ ( graaande x haber "mordido" ese nombre de dominio! ) donde hay análisis y referencias para entender más a fondo las implicancias, no sólo desde el dominio técnico, sino también de la ligereza con que se pretende tomar semejante decisión.

Por cierto, yo tuve la oportunidad de oler de cerca cómo se cuecen estas cosas en ámbitos políticos ... generalmente termina tratándose de "muchachos ... armemoo un proieto de ley de lo-que-sea como para mostrar que laburamo' " , a lo cual agrego: y se es fashion , meejoooor! :-P

[1] http://www.verifiedvotingfoundation.org/article.php?id=6426
[2] http://www.wired.com/politics/security/news/2004/04/63298 , notar la fecha (!)

tu apoyo para la ley de bosques ...

2007-08-29T09:01:00.001-03:00

Greenpeace Argentina está haciendo una campaña para juntar 1MiF para entonces así presionar
al Senado para que se promulgue la Ley de Bosques (actualmente tiene media sanción).

Esta Ley, que ya tiene media sanción del Congreso Nacional, establece una moratoria de los desmontes hasta tanto las Provincias realicen un Ordenamiento Territorial de los bosques nativos para planificar de manera participativa su uso sustentable. El Senado está demorando su aprobación.

Ayudanos a salvar nuestros bosques.
Votá vos también por la Ley de Bosques

Más info , y link para apoyo++ : http://www.greenpeace.org.ar/cyberacciones/bosques.html

Gracias =)

wait no more! ... IT Crowd S02E01 :-)

2007-08-25T05:30:00.000-03:00

UPDATE: ya están los subtítulos en Español disponibles :-D http://www.opensubtitles.org/en/subtitles/3143490/the-it-crowd-es
, seeeeeeehhhh ...
--

(Noticia vieja, por cierto ... intenté publicarlo hace 3 días, pero mi blog había sido taggeado como SPAM for un infame robot , ironías del destino =)

A torrentear bits que se vino la segunda temporada de The It Crowd: http://www.mininova.org/tor/855151

Para mi sorpresa, he conocido geek-wannabes que no han visto la 1era temporada,
por su integridad moral (y por no abusar del espacio de publicación :-P ) no los
menciono aquí :-S

Enjoy ... a LOT!

PD: No, no he desaparecido ... tan sólo que esta condición de "expat" provoca mucha fiaca para postear :-D

iPhone: defective by design

2007-06-29T15:56:00.000-03:00

El iPhone de Apple sólo puede ser usado con AT&T ... misma sh*t con distinto --muy estético y acabado-- olor, link .
El DRM apesta ... por más bonito que se vea :-P

Migrating XEN installation from fc5 to centos5

2007-06-08T13:25:00.000-03:00

Scenario

Deployment: several XEN guests running Debian 3.1 (Sarge) over a Fedora Core 5 (fc5) host. Host & guests installed with distro-provided packages.
Goal: migrate host from fc5 to centos5 (held migration until centos5 got released)
Difficulty: a lot. :-S

UPDATE 11-Jun-2007: See 2.c: /dev/xvc0 instead of /dev/console in guest
UPDATE 13-Jun-2007: See 2.d: oneliner for easy fixed guest MAC generation

Migration

It was faaaaar... more complex than we originally thought.

1. XEN host stuff

1.a. Just one kernel-xen package

FC5 came with two kernel-xen flavor: kernel-xen0 for the Dom0 guest and kernel-xenU for the other unprivileged guests.
Centos5 (and FC6) comes with just one kernel-xen package, this is quite annoying at first (this "mix" of true hardware drivers and virt. guest ones), but it starts to make sense once you ride the wave :)
You can see it with ("front" ones are for the guests , "back" for the host):

host# rpm -ql kernel-xen | egrep /xen

1.b. XEN guest kernel doesn't have the virtual block driver

That is: the guest will plainly PANIC if used without an initrd, so now you do have to make an explicit initrd.guest.img (whatever name you'd like) and add a ramdisk= option to the xen guest config file.
That is:

host# mkinitrd --preload=xenblk --preload=xennet -f -v /boot/initrd-2.6.18-8.1.4.el5xen.guest.img 2.6.18-8.1.4.el5xen
host# vim /etc/xen/xm-guest1 ### add: ramdisk=/boot/initrd.guest.img ### see below
host# restorecon -v /boot/initrd*

The last line (restorecon ... ) is needed because xend is _correctly_ running confined by "targeted" SELinux, and mkinitrd doesn't relabel the initrd file under /boot to allow xend access.
BTW, we prefer to have a "visible" and stable guest file configuration, so we did

host# cd /boot
host# ln -sf initrd-2.6.18-8.1.4.el5xen.guest.img initrd-guest.img
host# ln -sf vmlinuz-2.6.18-8.1.4.el5xen vmlinuz-guest

1.c. [UPDATE] that nasty "4gb seg fixup, process ..." (@host)

From XenFAQ and elsewhere:

host# echo 'hwcap 0 nosegneg' > /etc/ld.so.conf.d/libc6-xen.conf

host# ldconfig -v

2. XEN guest stuff

2.a. udevd inside guests

Debian 3.1 Sarge is installed on our guest images.
Now with Centos5 XEN we do need udevd running inside guests (to correctly setup /dev), that is:

guest# apt-get install udev ### installs udev and hotplug packages

2.b. the return of the "4gb seg fixup" (guest)

That comes from the way Xen uses the CPU segmentation; for newer distros it may be solved with echo 'hwcap 0 nosegneg' > /etc/ld.so.conf.d/libc6-xen.conf , but Debian 3.1 doesn't come with this feature, so we had to:

guest# mv /lib/tls /lib/tls.DISABLED

"Offline'ing" TLS glibc implementation solved the problem, beware that you'll need to redo this everytime libc6 package is upgraded (trivially solved by a rcS script).

2.c. getty /dev/tty1 -> getty /dev/xvc0

UPDATE: /dev/console _seemed_ to work, but it lacked tty' normal signal handling such as Ctrl-C (?), putting /dev/xvc0 solved the problem.

For whatever reason (?), /dev/tty1 was working nicely as Xen guest console (xm console ), but now you should use /dev/xvc0.
That is:

guest# vim /etc/inittab ### check that following line is present:

x0:2345:respawn:/sbin/getty 38400 xvc0

guest# echo xvc0 >> /etc/securetty

2.d. [UPDATE] Debian 4.0 and network device naming

After upgrading guests from Debian 3.1 (Sarge) to 4.0 (Etch) a "nice touch" appeared: AFAICS Debian udev infrastructure tries to keep netdev naming "constant" based on device's MAC address (no, thanks |-[ ).
Given that Xen generates a non-constant MAC address each time it boots a guest, this makes each Debian 4.0 guest boot to have an increasing ethN device.

Two possible solutions:

Fix MAC address in Xen guest vm config, you could use the following oneliner that uses the first 6 hexdigits from the md5 over the (unique) guestname. This 6 hexdigits are appended to the XenSource reserved MAC prefix 00:16:3E .

guest# echo -n guestname.FQDN | md5sum | sed -r 's/(..)(..)(..).*/00:16:3E:\1:\2:\3/'

... or ...
Just disable the correspondent udev rules by renaming:

guest# mv /etc/udev/rules.d/{,.}z25_persistent-net.rules

... pheeuuu ... 'nuff written.

Por fin entendí porqué SVN siempre apestó para mí.

2007-06-06T09:38:00.001-03:00

... entonces ya puedo redimir mi pecado de no haber aprendido nunca SVN habiendo escapado directamente de CVS a GIT ;-)

Linux Torvalds no sólo habla sobre GIT, sino también sobre conceptos de SCM distribuídos & alike.
Imperdible.

Jugando con IPv6 (apto para todo IPv4-público ;)

2007-05-17T11:24:00.000-03:00

Dale ... festejemos el día de Internet usando lo que es y será su pegamento futuro: IPv6.
Ingredientes: tan sólo 1 IP pública
Resultado: estemmm ... exactamente 1208925819614629174706176 (2^80 ;) direcciones IPv6, las cuales han estado ahí desde hace tiempo esperándote :-P
Para saborear más aún: end-to-end para las máquinas que quieras ... como en los buenos viejos tiempos, por ej. podrás hacer desde "afuera":
ssh -6 flamanteIPv6_de_esa_PC_que_no_tiene_IP_publica

El mecanismo se llama tunneling 6to4, está descripto por doquier, en particular yo escribí un mini artículo para el seminario de IPv6 que dimos en el 2005 en la UM.

Podés probar usando mi script: ipv6-setup6to4.sh , el cual sólo muestra los comandos necesarios (es decir: inofensivo :-), por ejemplo con una dir. IPv4= 65.1.2.3 da como salida:


bash$ ./ipv6-setup6to4.sh
IP4_ADDR=65.1.2.3
IP6TO4_PREF=2002:4101:203
#check you allow ipv6 encap: iptables -I INPUT -p 41 -d 65.1.2.3
ip tunnel add tun6to4 mode sit remote any local 65.1.2.3 ttl 64
ip addr flush dev tun6to4 2>/dev/null
ip link set dev tun6to4 up
ip addr add 2002:4101:203::1/16 dev tun6to4
ip route add ::/96 dev tun6to4
ip route add 2000::/3 via ::192.88.99.1 dev tun6to4 metric 1
#you may do something like:  ip -6 addr add 2002:4101:203:0001::1/64 dev eth0

#NOTHING done, use me as: ./ipv6/ipv6-setup6to4.sh   |sudo sh -x

Que lo disfrutes!

Juguemos en el bosque ... mientras los lobos no están :-S

2007-05-17T10:35:00.000-03:00

Hoy 17 de mayo se festeja el día de "Internet" [1], veremos cuántos años más podremos hacerlo ... al menos con "la" Internet que conocemos y disfrutamos hoy.

Por si no lo sabías, los elefantes de siempre (media/content corps & alike) quieren "otra" Internet, más acorde a sus mecanismos feudales de poder [2].

Seguramente ya nos caerá el regalito a estas pampas, por ahora lo mejor que podemos hacer es tomar y hacer tomar conciencia.

Salud! y que sea por muuucho tiempo más ...

[1] http://www.itu.int/wisd/2007/index.html
[2] http://www.savetheinternet.com/

[en] From my recruiter: Job opportunities @Google

2007-05-08T13:44:00.000-03:00

My name is Sripriya. I am part of the recruiting team for Google.com (SRE) Group.

We currently have positions available at Google that may be a good match for you. If you are open to exploring these opportunities further, please send an updated version of your resume in Word, HTML, or PDF to JuanJo's email with "Subject: job opportunity @Google: " as soon as possible

***We have multiple openings located in Dublin - Ireland and Zurich - Switzerland)***

All positions involve working in our infrastructure team, known as Google.com Engineering. Our Google.com engineers hold the beating heart of Google and are very well respected. They are responsible for keeping the google.com website up and running as well as building new automation infrastructure. We are seeking extraordinary Developers, UNIX (Linux) System Administrators, and Managers/Directors to add to our exciting team and growing organization.

If this prospect is of interest to you, please get in touch with me as I will like to share your resume with the hiring engineers to see if there is match. You may also know engineers with this skill set who are looking for fresh challenges; I will appreciate it if you will pass my contact information to them.

Please note that in addition to these positions, we also have openings as a Systems Deployment Engineer, Launch Coordination Engineer, and Engineering Project Manager.

For more information, go to:

Zurich positions:
http://www.google.ch/support/jobs/bin/topic.py?dep_id=1058&loc_id=1115

Dublin - Ireland positions:
http://www.google.ie/support/jobs/bin/topic.py?dep_id=1058&loc_id=1110

Thank you and hope to hear from you soon.

Thanks & Best Regards,
Sripriya
--
Sripriya Sampath
Technical Recruiter
Google Inc

[en] preparing yourself for the technical interview (cont'd)

2007-05-02T09:44:00.000-03:00

Cool ... so you're already enjoying answering those tricky tech and puzzle questions from my previous post.

Time for more formal lectures, here is a list of helpful textbooks you should study before the technical interview (again, based on my profile, see my previous post).

Networking

Internet Core Protocols: The Definitive Guide
E Hall - 2000 - O'Reilly & Associates.
Great book on TCP/IP network and transport protocols, very comprehensive yet easy reading (BTW do trash the CD contents, just use wireshark )

POSIX & BSD sockets API

Our beloved APUE: Advanced Programming in the Unix Environment
R. Stevens, S. Rago - 2004 - A. Wesley.
From our great all-time teacher, Richard Stevens, impressive as all his books.
Unix Network Programming
WR Stevens, B Fenner, AM Rudoff - 2004 - A. Wesley.
THE reference book for IPC & network programming
POSIX.4: Programming for the Real World
Bill 0. Gallmeister - 1995 - O'Reilly.
Great book about multithreading POSIX API

Linux sysadmin and alike: there are actually a LOT of books, but nothing can compare with a good expertise ;), so ...

LPI Linux Certification in a Nutshell, 2nd Edition
J. Dean, B. Gomes Pessanha ... - 2006 - O'Reilly.
Nice book for autotesting your already learned sysadm knowledge & skills

Unix/Linux internals

Understanding the Linux Kernel, 3rd Edition
D. P. Bovet, M. Cesati - 2005 - O'Reilly
Too detailed, try to "grep" for concepts and graphs

'nuff written ... now enjoy the cool reading 8^)

[en] preparing yourself for the technical interview

2007-05-01T20:02:00.000-03:00

So you've followed my suggestion, made your shinning resumè ... so the call from your future job recruiters may come in any moment.

Time to get() ready for the technical interview!

Here are some useful links I've collected while preparing my interviews, obviously considering my profile: networking, Linux/UN*X sysadm & trou, low level programming in C and shell scripting, kernel internals.

Cool univ. courses podcasts, they even do help us non-English speakers to exercise our brain translator neurons :-):

MIT Open CourseWare: 6.046J / 18.410J Introduction to Algorithms (SMA 5503), Fall 2005
http://ocw.mit.edu/OcwWeb/Electrical-Engineering-and-Computer-Science/6-046JFall-2005/CourseHome/index.htm
UC Berkley: CS 162 Operating Systems and System Programming
http://webcast.berkeley.edu/course_details.php?seriesid=1906978416

lang.shell:

The OMNI cool Advanced Bash-Scripting Guide
http://tldp.org/LDP/abs/html/

lang.C:

Advanced Test in C: The 0x10 Best Questions for C Programmers
http://www.programmersheaven.com/articles/pathak/article2.htm

Tech questions, puzzles and such (lot of FUN, take it!)

Technical Interview Resources
http://technical-interview.com/default.aspx

UPDATED: Another similar site (thanks Nikita for the suggestion)
http://technical-interviews.com/

Enjoy!
I assure you will ... else ask the mirror if you could be called a true geek ;-)

[en] your CV is useless

2007-04-26T09:04:00.001-03:00

You (may) use to maintain a pretty precise Curriculum Vitae (CV) with every bit of your professional activities.
Bad news: it's useless (well, to be honest, it's perfect for filling paper files =)

At least this happened to me while applying for working at google.com , I needed to rush and write a "Resumè" , which is a sort of resumed-CV but focused on your profile, strengths, etc.

These are some useful links I've collected that helped me writing the "Resumè" (of course you could just search for "resume tips" and such, but there are plenty of results and much noise around):

Don't rush when forced, do it now (it happend to be of some fun ;)

BTW Here is my Resumè: https://sites.google.com/site/juanjosec/curriculum/Resume-JuanJoseCiarlante-en.2011oct12.pdf

[UPDATED 2010-05-27: new resume url]
[UPDATED 2011-10-12: updated my resume, add link#5. ]

Un cordobés @Mendoza ... hacia Google Zurich

2007-04-25T16:30:00.001-03:00

Gracias a todos mis amigos por su buena onda ... no hay palabras para contar la emoción que siento :~)
--jjo

Sipp ... me voy a trabajar a Google Zurich, obbbbviamente familia included.

La historia es larga en anécdotas, pero vertiginosamente corta en tiempo: hace NADA MÁS que 2 meses y medio me llegó un mail @google.com invitándome a realizar el proceso de entrevistas técnicas para ver si calificaba.

Y así fue ... aprobé las entrevistas telefónicas --hardcore-- y una onsite en las oficinas de Google Zurich --que constó de varias entrevistas muy hardcore-- ... todo el proceso fascinante y muy desafiante.

Y bueh, acatamo' ... tratando de (no)entender cómo se dan las cosas en la vida, sino de just disfrutarlas =)

Instalando Debian 4.0 a ver q'onda...

2007-04-12T11:20:00.000-03:00

Standard disclaimer

Ésto no pretende ser un review ni nada que se le acerque, simplemente un "dump" de las cosas que me gustaron y no luego de probar una instalación de la flamante Debian-4.0. Please dont troll.

Metodología

Nah... meramente un toque virtual usando qemu:


  $ sudo /sbin/modprobe kqemu
  $ qemu-img create -f qcow2 debian4.qcow2.img 4G
  $ qemu -cdrom /path/to/debian-40r0-i386-CD-1.iso -hda debian4.qcow2.img  -boot d
  (instalación...)
  $ qemu -cdrom /path/to/debian-40r0-i386-CD-1.iso -hda debian4.qcow2.img  -boot c
  (booteo...)

Instalador

verso: "instalador gráfico": en momento de booteo es posible seleccionar el "instalador gráfico" tipeando installgui. No es un instalador gráfico, es meramente un gui-ficador de la interfaz de texto. Recomendación: usá el de modo texto, más rápido y no tiene menos funcionalidad (excepto seleccionar con el mouse las opciones :-P ).

groso: como siempre, el control full y la capacidad de tener el "estado" de instalador en cualquier momento, y poder ir y volver de cada paso.

groSísimo: la posibilidad de particionado clásico, LVM y LVM+cifrado.

flojo: es demasiado burocrático para particionar "a gusto" (del experto) comparado con otras distros (Fedora por ej.); _entiendo_ que la funcionalidad "modo texto" no permite mucho juego aquí, pero lo mismo creo que se podría achicar la cantidad de "Enter"s necesarios para hacerlo.

Primer booteo

groso: booteo limpito en modo texto (bien!)

groso: apenas unos 300Mb luego de instalado (!). Ok, sin entorno gráfico, ni de devel, etc; pero bien sabemos que Debian permite una GRAN versatilidad/disponibilidad en la instalación posterior de paquetes.

pateticamente-insoportable-as-always: la falta de los siguientes comandos por default:

less: sin comentarios :-P
ip (pkg iproute): agaaain, la única distro que conozco que no lo instala (!), pero eso sí ... tengo ipmaddr, iptunnel (cuaK?!)

Conclusión

Ninguna :-) --no era el objetivo--, probala vos mismo.

Boing Boing: Stop-motion Space Invaders using human pixels

2007-04-05T12:44:00.000-03:00

Probablemente para los más "nostálgicos" (aka dinosaurios):

Boing Boing: Stop-motion Space Invaders using human pixels

Impecablemente molidos del mate :)

roameando más libremente en otras plataformas

2007-04-05T11:20:00.000-03:00

Seguro te ha pasado.

Sos tan adicto al software libre como yo, pero te has visto obligado a sentarte en un típico winpork de cyber ú hotel para leer mail y/o hacer algo de IM, o peor, echarle mano a un putty.exe para alguna emergencia (o meramente para leer mail con mutt ;).

Dado que internet exploder ES insoportablemente inusable y tanto éste como la plataforma es comprobadamente amigable al spyware y otros bichos, resulta imposible usarlos tal como vienen.

Solución (parcial): PortableApps : contiene, entre otros: PortableFirefox, PortableGaim y PortablePutty.

Instalé estos tres en mi pen-drive, arranqué PortableFirefox y le instalé mis extensiones preferidas: Mouse Gestures, AdBlockPlus y TabMix Plus --ésta última útil para almacenar correctamente la última sesión--.

Luego arranqué PortableFirefox (desde el pendrive, obviamente), entré a gmail (claro que el password no lo tipeé, sino que tipeé una cantidad de (human-non)random text en un "Nuevo archivo de Texto" tal que contuviera los caracteres de mi password, los cuales copié y pegué uno a uno); lo bueno de ésto es que el contexto de Firefox (cookies, etc) queda almacenado en el pen-drive, con lo cual la próxima vez que arranques, por ej gmail, no requerirá reingresar el password; asimismo quedarán los tabs, bookmarks, etc de la última sesión.

Algo similar hice con PortableGaim; y para PortablePutty usé el agente "pageant.exe" para cargar mi privatekey de ssh que llevo siempre en el pendrive (ésto anula un ataque de keylogging al logueo vía ssh porque no es replicable sin la privatekey).

Enjoy! ... más que recomendable para llevarlo encima (estos tres en total unos 80Mb).

Confirmado: uno vé @hotmail y piensa....

2007-03-28T17:36:00.000-03:00

... lo mismo que esta empresa de recursos humanos al momento de contratar especialistas de Internet y afines:

Link: Catorze.blog - Blog Archive - El criterio Hotmail

Así que ya sabés: no pongas ese @hotmail en tu Currículum :-P

[en] powerful arrays in bash

2007-03-04T13:07:00.001-03:00

Doing some experiments with advanced bash array features. I created a bash implementation of insertion sort algorithm.

UPDATE: This example is already part of the great Advanced Shell Scripting Guide :)

Enjoy :-D



#!/bin/bash
# insertion-sort.bash.sh: Insertion sort implementation in bash
#                         Heavy use of bash array features: slicing, merging, etc
# URL: http://www.lugmen.org.ar/~jjo/jjotip/insertion-sort.bash.d/insertion-sort.bash.sh
#
# Author: JuanJo Ciarlante  jjo \O/ irrigacion gov ar
# License: GPLv2
#
# Test with:   ./insertion-sort.bash.sh -t
#

: ${DEBUG:=1}  # debug, override with:  DEBUG=1 ./scriptname ..

# Global array: "list"
typeset -a list
# Load whitespace separated numbers from just stdin 1st line
if [ "$1" = "-t" ];then
     read -a list < <(od -An -w32 -t u2 /dev/urandom )
else
     read -a list
fi
numelem=${#list[*]}

# Shows the list, marking the element whose index es $1 by surrounding it with
# the two chars passed as $2; whole line prefixed with $3
showlist() { echo "$3"${list[@]:0:$1} ${2:0:1}${list[$1]}${2:1:1} ${list[@]:$1+1}; }

# loop "pivot" from 2nd elem, to end of list
for((i=1;i<numelem;i++))do
     ((DEBUG))&&showlist i "[]" " "
     # From current "pivot", back to 1st elem
     for((j=i;j;j--))do
             # search for the 1st elem less than current "pivot" ...
             [[ "${list[j-1]}" -le "${list[i]}" ]] && break
     done
     ((i==j)) && continue ## no insertion was needed for this element
     # ... move list[i] (pivot) to the left of list[j]:
     list=(${list[@]:0:j} ${list[i]} ${list[j]} ${list[@]:j+1:i-(j+1)} ${list[@]:i+1})
     #         {0,j-1}       {i}       {j}        {j+1,i-1}              {i+1,last}
     ((DEBUG))&amp;amp;amp;&showlist j "<>" "*"
done
echo $'Result:\n'${list[@]}

sistemas criticos funcionando con sistemas operativos de juguete (?)

2007-02-16T15:39:00.000-03:00

Si sirve de consuelo ... ver que no solamente en estos lares abunda la mediocridad en quienes toman decisiones de IT.

"Quebec health officials are battling a fast-spreading virus that struck its entire computer network system late Tuesday." link

Lisp? nahh...

2007-02-16T11:47:00.000-03:00

M'rd Donalds ... por qué lo amaré tanto ?

2007-02-02T17:49:00.000-03:00

Si un día viendo tele sentís un deseo irresistible de transarte al "payasito" de M'rd Donalds quizás sea por algo como ésto (T=00:35).

Quién te dice ... por ahí terminás siendo un existoso manager, así que podés ir entrenando

Enjoy :-P

[en] Throughput tests WRTSL54GS v1.1 vs WRT54GS v3.0

2007-01-10T08:42:00.000-03:00

Throughput tests WRTSL54GS v1.1 vs WRT54GS v3.0

The goal of this test is to measure and compare the NAT'ing/routing/switching behavior of these two WRT54G's [1] running OpenWRT Whiterussian RC6 [5]:

model	s/n	CPU	flash/RAM	eth switch
WRTSL54GS v1.1 [2]	CJK11xxxxxxx	Broadcomm 4704rev9 266Mhz	8/32MB	inCPU
WRT54GS v3.0 [3]	CGN5xxxxxxx	Broadcomm 5352 200Mhz	8/32MB	BCM5325

IMPORTANT: nbd ( openwrt developer) pointed a problem with "entropy gathering which fills /dev/random from wifi" in WR rc6 and suggested me trying a newer build (09test); I'll try it an repost the results (specially the wifi ones)
--jjo; Jan 10, 2007.

Testbed, methodology

Topology

                       --------> iperf test connection------>
 WIFI-NATed    [CLIENT]+)) wifi (( +[ WRT ]+=== wan ===+[SERVER]   (iptables MASQUERADE'd)
 LAN-NATed     [CLIENT]+=== lan ===+[ WRT ]+=== wan ===+[SERVER]   (iptables MASQUERADE'd)
 LAN-routed    [CLIENT]+=== lan ===+[ WRT ]+=== wan ===+[SERVER]   (plain routing)
 LAN-switched  [CLIENT]+=== lan ===+[ WRT ]+=== lan ===+[SERVER]   (hardware switching)
           
 "lan": any LAN (1of4) port
 "wan": WAN port
 "wifi": 802.11g link at 54Mbps (aprox 2mts distance between antennas)
 iptables MASQUERADE'd: default whiterussian setup (masquerade both wifi,lan to wan)
 plain routing: accomplished with iptables full "flushing" + server route to client via WRT

Hardware
- client: IBM Thinkpad T42, lan: e1000 (10/100/1000), wifi: ipw2200
- server: generic PC sempron 2200+, lan: 8139too
- routers: (stated above)

Software
- client, server: iperf [4] (-c, -s) on linux-2.6, glibc-2.3+.
- routers: OpenWRT WhiteRussian RC6 [5].

Results

Throughput values in megabits per second taken from iperf's output. Please note that measured rates by iperf correspond to _application_, ie: they don't consider protocol headers, etc.

CPU usage % shown by top for ksoft_IRQd from a ssh logged session, this "top" session was not considered for throughput values (separately taken) to avoid "measuring load influence": 100% CPU usage was aprox= 90% ksoft_IRQd + 8% dropbear + 2% top.

Throughput (CPU usage %)
model	WIFI-NATed	LAN-NATed	LAN-routed	LAN-switched
WRTSL54GS	23.5mbit/s (65%)	47.5mbit/s (90%+)	55.8mbit/s (90%+)	93.7mbit/s (0%)
WRT54GS	10.5mbit/s (14%)	34.2mbit/s (90%+)	40.4mbit/s (90%+)	93.8mbit/s (0%)

Analisys

WRTSL54GS

WIFI-NATed at 23.5 mbits (802.11g @54Mbps) with ~65% CPU usage denotes "reasonable" CPU availability for this 802.11g saturated link.

LAN-NATed at 47.5 mbits shows the CPU bottleneck when routing+MASQUERADING, considering that ip_conntrack table has just a few entries this is a VERY optimistic max.

LAN-routed at 55.8 mbits is pretty poor, I think that ip_conntrack processing is ALSO affecting this scenario (if loaded it gets called even for non-nated streams); it would be veryVERY useful to have ip_conntrack optionally loaded by openwrt (currently static).

LAN-switched at 93.8 mbits is expectable given that hardware only switching is involved.

WRT54GS

LAN-NATed and LAN-routed values give about 75% when compared to its newer cousin, 75% is roughly 200/266, respective CPU clocks [MHz] (this confirms CPU saturation).

WIFI-NATed at 10.5 mbits (dbl-confirmed 802.11g @54Mbps) is a bad smelling frog, I double checked openwrt setup... nothing strange found; about 1mo ago I was running RC5 getting ~20mbits+ rates (informal, from rsync/ftp rates), so it maybe something with RC6 wifi in this hardware, dunno(?).

As expected, LAN-switched gave same results.

Conclusions

Both WRT's seem reasonable for 802.11g @54Mbps even when NAT'ing traffic (common usage), obviously depending on traffic patterns, how many clients, etc ... given the constrained RAM (and CPU) for NAT+conntracking ... NOT tested here.

On the contrast, their CPU is not powerful enough to saturate _both_ (LAN+WAN) 100mbps links simultaneously, even when "only" routing (55mbit/s max on WRTSL54GS); this could be enhanced by having ip_conntrack optionally (not)loaded by openwrt.

Out of band disclaimer

Ok ... I know, you agree: blogger sucks for writing technical reports .. sheesshhhh :-P

References

[1]http://en.wikipedia.org/wiki/WRT54G
[2]http://wiki.openwrt.org/OpenWrtDocs/Hardware/Linksys/WRTSL54GS
[3]http://wiki.openwrt.org/OpenWrtDocs/Hardware/Linksys/WRT54GS
[4]Iperf bandwidth measurement tool: http://dast.nlanr.net/Projects/Iperf/
[5]http://downloads.openwrt.org/whiterussian/rc6/

This thread at openwrt forums talks about openwrt experiences on Linksys WRTSL54GS model, and was the starting point to encourage loading openwrt on WRTSL54GS v1.1 model.

[devel] multi process posix mutex

2006-12-20T10:13:00.000-03:00

Jugando con la posibilidad de usar los mecanismos de sincronización de POSIX para threads (pthread_mutex_t, sem_t, pthread_cond_t , etc) llegué a una mini aplicación que es capaz de crear un MUTEX multiproceso de "larga vida" mediante el uso de memoria compartida:


    ./mproc-mutex estelock i  #init
    ./mproc-mutex estelock l  #lock
    ./mproc-mutex estelock l  #lock again: will wait until unlock or signal (eg: Ctrl-C)
    ./mproc-mutex estelock u  #unlock

La clave del fuente está en las sig. líneas:


   int fd; char *p;
   fd=shm_open(argv[1], O_RDWR|O_CREAT, 0666);
   ftruncate(fd, sizeof(pthread_mutex_t));
   :
   p=mmap(NULL, sizeof(pthread_mutex_t), PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
   :
   pthread_mutex_init(p, NULL) ;

Más explicaciones en el src: http://www.lugmen.org.ar/~jjo/jjotip/jjotip-mproc-mutex/mproc-mutex.c

el sueño del (wifi) pibe

2006-11-28T15:04:00.000-03:00

Mesh, wifi, corre Linux, chiquito, acce$ible:
http://www.meraki.net/mini.html
Sumándole solar-power es posible llegar a cosas como ésta:
http://www.phaster.com/golden_hill_free_web/#solar_meraki

De sueño a realidad ? ... desde mendoza-wireless lo intentaremos :-D

algunos costos de "la diaria" en Europa (desde ojos argentinos)

2006-11-17T15:30:00.000-03:00

Anduvimos por EU con mi 1/2naranja :-D
Sana recomendación MUY importante: NO vayas haciendo la conversión a pesos (que en nuestro caso actualmente es 4x!) cada vez que gastás y/o masticás un bocado :), ahorrá y disponé de un monto diario... y listo.

Según pude comprobar (sin contar alojamiento) podés comer+andar con
~eu$ 15 (minimorum, de supermercado) hasta eu$35 (almuerzo y cena en bar/rest. "normales").

A modo de referencia, aquí van algunos costos & tips:
(costos tomados en Madrid , agregar ~20% para Paris, Venecia).

@Supermercado
En la mayoría venden unos sandwiches ya armaditos de lo más variados, alcanzan perfectamente para un almuerzo liviano, con lo cual para dos personas un almuerzo/cena alike no baja de aprox eu$7.-:

sandwich: eu$ 2.50
gaseosa 1.5lt/ jugo natural 1lt: eu$2.0
pan en rodajas: eu$2.0
queso en fetas (~10): eu$2.0
bandeja de ensalada fresca: eu$2.5
yogurt bebible 1lt.: eu$2.0

@Restaurant
Restaurant simple (obvio):

Una pizza compartida para dos + dos jugos/gaseosa: eu$20
Un par de platos de spaguetti + jugo/gaseosa: eu$22

@FastFood
Ref: fastfood del Louvre (onda patio de comidas):

comida ppal (varias opciones)+postre(tarta)+gaseosa 1/2lt: eu$11,90
un helado mediano: eu$ 3

@Alojamiento
Hoteles ~3 estrellas:

single: eu$ 65-80, sumar eu$10-15 por cada persona adicional

@Transporte
El transporte público es muy bueno y --según dicen-- seguro (Madrid, Barcelona, Paris).
TIP: en Barcelona comprá un boleto "T10" que trae 10 pasaje pero cuesta ~6 nomás *Y* te sirve para
usarlo en metro+bus+tranvía el MISMO pasaje (dentro de 1:15hr del primer uso);
además no es personal (varios pueden usar el mismo T10).

metro(subte): eu$ 1.0
tren cercanía (depende de distancia): eu$ 1.2 para arriba
bus (1hr. de viaje , 40km): eu$ 3.0

@Museos
TIP: Algo que tienen muy piola es que podés salir/entrar durante el día con la sola entrada,
así que te conviene ir a la mañana temprano así te queda +tiempo.

del Prado: eu$6, GRATIS LOS DOMINGOS
Louvre: eu$8.5
Versalles: eu$6. GRATIS EL 1er DOMINGO de c/mes

@Auto
A pesar que no anduvimos en auto, anoté algunos precios:

nafta: eu$1.2 aprox
peajes: CARISIMOS, según me dijeron en gral costo peaje iguala al del combustible.

Paseando por SIMO

2006-11-11T09:13:00.000-03:00

En este momento estoy en SIMO , en el stand de gnuLinEx, felizmente tipeando desde una Linux BOX :-).

Impresionante lo de la gente de la Junta de Extremadura ... se respira y vive software libre aquí, han puesto alrededor de unas 80 Linux BOXes instaladas con las distintas flavors de linex (estación de juegos, oficina, pymes) + conferencias
técnicas (en este momento está hablando la gente de MozillaES).

Por supuesto ... M$ tiene un pabellón completo para sí mismo... pero "no os asustéis" ... muchas boludeces y poco core.

--JuanJo (como pez en H2O)

M$@USA, tu privacidad y que siga el baile :-P

2006-10-22T13:04:00.000-03:00

Si sos un cachiche de M$ deberías URGENTE registrar tus datos!.
Rápido y simple ... usá Internet Exploder 7:

http://www.dailycupoftech.com/is-internet-explorer-7-spying-on-me/

Top 11 Reasons to Become a Visual Basic Programmer

2006-09-30T09:34:00.000-03:00

No se puede luchar contra la corriente todo el tiempo ... creo que voy a tener que rever mis argumentos (y mis cátedras) :-S ... Link .

openswan 2.4.6 ESP_NULL support

2006-09-21T22:37:00.000-03:00

De viaje por BAires durante esta semana, dió la "coincidencia" que don Dax y Roldyx estaban necesitando una mano quirúrgica para hacer andar ESP_NULL sobre openswan-2.4.6, el resultado es este parche que estoy mandando a openswan-dev@ con prácticamente cero probabilidad de ser aceptado por la nulidad del cifrado, jeh... :-P.

Interesante el escenario del problema: tratar de minimizar al máximo el consumo ancho de banda para VoIP porque tienen contratado un "CIR" muy ajustado, y la diferencia de tamaño de paquete para los ALGOs AES, 3DES es del orden de ~12bytes (debido al IV del CBC y al padding promedio ) sobre un tamaño típico de 100bytes.

El resultado de usar ESP_NULL de esta manera es efectivamente usar ESP meramente para autenticación... pero entonces:
Porqué no usar AH?
* porque no está bien documentado en openswan cómo usar AH solamente
* porque no soporta NAT-Traversal (siendo ésto último _tajante_).

El parche contiene un one-line-fix para permitir usar pluto con ESP_NULL sobre kernel-2.6 y el módulo (no)criptográfico de null-cipher para KLIPS (kernel-2.4).

Ahora ... lo más cool de todo: pasar una siesta geek entre amigos, como si estuviera @home :-D

si la web 2.0 te tiene los 2 web*s rotooos ...

2006-08-23T15:36:00.000-03:00

.. te podés divertir un rato :-)
(o quizás generar un negocio :oP )

También en estos ciber-temas tenemos que adiestrar a nuestros hijos :-)

2006-07-17T15:23:00.000-03:00

El blog de Emiliano (15) con sus impresionantes dibujos (a la derecha su regalo de Casamiento para mi hermano)
... y los delirios corralito dejavú de M0n04uRaL (10)

Test psicológico: Which File Extension Are You?

2006-07-06T13:09:00.000-03:00

Claro que debería ser "Which mime-type are you? ", aunque no
tendría el "punch" del título actual ...

BBspot - Which File Extension Are You?

Parece bastante preciso, a mí me dió .cgi! 8-)

babeándose en ThinkGeek ...

2006-03-31T13:47:00.000-03:00

El sueño del (nuevo) pibe: un fierro multimedia totaallllll! (hasta para los nostálgicos del vinilo)

Link: ThinkGeek :: iZilla Media Monster

OJO: la oferta vence muy pronto.

NMRLP al Celular (!)

2006-02-04T11:51:00.000-03:00

No, no es un nuevo protocolo terminado en 'P' .

Es un "No Me Rompan Las Pel*tas al Celular"; bandera política más que defendida por mi sangre tana.

Posiblemente debería cambiarlo por NMCocinenLP, tal como demuestran estos muchachos, es posible cocer un huevo con un par de celulares transmitiendo (jeh, caaarita esta cocina en Argentina 8-).

Link: Wymsey Weekend: A Guide to Mobile Cooking

Los buenos, viejos tiempos de BBS ... (arte)

2006-01-28T09:39:00.000-03:00

Estos sí que son artistas sin pinceles ...

http://mbox.bz/slurp/ascii/bbsads/

Thumnails de google:
http://images.google.com/images?q=mbox.bz%2Fslurp%2Fascii%2Fbbsads%2F

A no ponerse nostálgicos, eh!

SOCK_DGRAM + BPF

2005-12-27T13:45:00.000-03:00

Gracias a las inquietudes de Luca, me puse a juguetear un poco con
BPF, _pero_ a nivel de transporte (SOCK_DGRAM) y salió ésto:

http://www.lugmen.org.ar/~jjo/jjotip/jjotip-socket-bpf/

GIT repo de mis jjotip's:

http://www.lugmen.org.ar/~jjo/jjotip/.git/

Enjoy :-D