I’ve just installed the oneiric release candidate. And I like the changes. And I like that with a little tweaking, my eToken still works!

I did a bare-metal install, as I’ve now upgraded to SSD. So, I’ve updated my tutorial to match.

1. Install 11.10 amd64. Now, even though SAC amd64 is supposed to be amd64, they lied, and it ships with i386 binaries that just happen to work on amd64. So you’ll need to prep your x86_64 system with i386 goodness, by using:

   sudo apt-get install ia32-libs libhal1 opensc pcscd

   • Note that I said libhal1, in DIRECT CONTRADICTION to SafeNet’s user guide. if you don’t, you’ll see things pop up in /var/log/syslog like

     pcscd: dyn_unix.c:37:DYN_LoadLibrary() /usr/lib/pcsc/drivers/aks-ifdh.bundle/Contents/Linux/libAksIfdh.so: libhal.so.1: cannot open shared object file: No such file or directory

2. You’ll need the 32-bit libpcsclite1 and libhal1. Simply run:

   wget http://archive.ubuntu.com/ubuntu/pool/main/p/pcsc-lite/libpcsclite1_1.7.2-2ubuntu2_i386.deb
   wget http://archive.ubuntu.com/ubuntu/pool/main/h/hal/libhal1_0.5.14-0ubuntu6_i386.deb
   dpkg -x libpcsclite1_1.7.2-2ubuntu2_i386.deb libpcsclite1-i386
   dpkg -x libhal1_0.5.14-0ubuntu6_i386.deb libhal1-i386
   sudo cp libpcsclite1-i386/lib/libpcsclite.so.1.0.0 /lib32
   sudo cp libhal1-i386/usr/lib/libhal.so.1.0.0 /usr/lib32
   sudo ln -s /usr/lib32/libhal.so.1.0.0 /usr/lib32/libhal.so.1
   sudo ln -s /lib32/libpcsclite.so.1.0.0 /lib32/libpcsclite.so.1
   

3. Download the SafeNet Authentication Client for Linux 8.0. In theory you should have a support agreement with SafeNet to download this, but you CAN find it on Google, including from SafeNet themselves (hint: try SAC instead of the full spelling). Install it with

   dpkg -i SafenetAuthenticationClient-8.0.5-0_amd64.deb

Note: if you’ve got this working before, you’ll notice that in 11.10 they’ve moved from /usr/lib being a link of /usr/lib64 to being it’s own directory; the result being the new location of /usr/lib64/libeTPkcs11.so for your PKCS11 applications.

So there you go. If you add the /usr/lib64/libeTPkcs11.so to Firefox and Thunderbird, you should see your certificates. If you run PKIMonitor, you should be able to modify your eToken.

For a quick verification, run

pkcs11-tool --module /usr/lib64/libeTPkcs11.so -L

, and you should see your eToken.

This is more complicated than it should be, for no real reason. I like my eToken, and have been trying for a good year to get it working on 64-bit Linux. Today, I sat down, started from scratch, and nutted it out. The following 3-step procedure should be all that’s needed to get it working.

1. Install 11.04 amd64. Now, even though SAC amd64 is supposed to be amd64, they lied, and it ships with i386 binaries that just happen to work on amd64. So you’ll need to prep your x86_64 system with i386 goodness, by using:

   sudo apt-get install ia32-libs libhal1 opensc pcscd

   • Note that I said libhal1, in DIRECT CONTRADICTION to SafeNet’s user guide. if you don’t, you’ll see things pop up in /var/log/syslog like

     pcscd: dyn_unix.c:37:DYN_LoadLibrary() /usr/lib/pcsc/drivers/aks-ifdh.bundle/Contents/Linux/libAksIfdh.so: libhal.so.1: cannot open shared object file: No such file or directory

2. Download the SafeNet Authentication Client for Linux 8.0. In theory you should have a support agreement with SafeNet to download this, but you CAN find it on Google, including from SafeNet themselves (hint: try SAC instead of the full spelling). Install it with

   dpkg -i SafenetAuthenticationClient-8.0.5-0_amd64.deb

3. Finally, you’ll need the 32-bit libpcsclite1. Simply run:

   wget http://archive.ubuntu.com/ubuntu/pool/main/p/pcsc-lite/libpcsclite1_1.7.2-2ubuntu2_i386.deb
   dpkg -x libpcsclite1_1.7.2-2ubuntu2_i386.deb libpcsclite1-i386
   sudo cp libpcsclite1-i386/lib/* /lib32
   

So there you go. If you add the /usr/lib/libeTPkcs11.so to Firefox and Thunderbird, you should see your certificates. If you run PKIMonitor, you should be able to modify your eToken.

For a quick verification, run

pkcs11-tool --module /usr/lib/libeTPkcs11.so -L

, and you should see your eToken.

Also, good-bye Windows XP. This was the last thing preventing me from using Ubuntu on a daily basis, and now you’ve been completely replaced.

screen /dev/pts/1 > /dev/tty9 < /dev/tty9 &

Add that to /etc/rc.d/rc.local to start on system startup (hopefully after the VM has started), and I'm all set!

1. Install VirtualBox. Windows Virtual PC doesn’t support starting machines as services, and I never really liked VMWare Server due to it’s high overhead.
2. Created a virtual machine and install pfSense 1.2.3. Accept VirtualBox’s default FreeBSD settings, except create 2 network cards (pfSense won’t work without at least 2), both bridged to the physical network interface. Remember that the modem will run on a different IP address range (10.0.0.138), and so while using VLANs and actually separating the networks is an option, having everything on the same network won’t do anything bad.
3. Now that pfSense is running, setup the Thomson ST536v6 to act as a PPTP server. This is so that pfSense will get the real, public internet connection with real-world IP address. Much nicer than having to use NAT or DMZ, and the Thomson does a nice job of this. Telnet into the modem (remember the default username is Administrator and password is blank) and run the following commands (which WILL destroy your current config). Note: this forum post is mostly correct, but I kept getting an “Invalid phonebook destination name, phonebook is in use.” error when trying to flush the ATM interface without first detaching it.

   :system reset
   :ppp relay flush
   :eth flush
   :atm ifdetach intf=atm_0_100
   :atm flush
   :ppp flush
   :atm phonebook flush
   :saveall
   :atm phonebook add name=BrPPPoE_ph addr=0.100
   :service system modify name=PPTP state=enabled
   :saveall
   :system reboot

4. After power cycling the modem, time to configure pfSense. Bind LAN to em0 and WAN to em1 (or vice-versa, doesn’t matter). pfSense will take forever bringing up the WAN interface, because it’s expecting a DHCP lease which isn’t available. The LAN interface will start acting as a DHCP server, which is good, given you’ve just told your modem to stop doing that.
5. Login to the pfSense web UI. Under Interfaces, select WAN. Change the Type to PPTP. The Username and Password won’t have any effect for Telecom ADSL connections (user@xtrabb.co.nz and telecom work fine), but for UBS or LLU connections you’ll need to use something specific. Set the Local IP address to 10.0.0.139/24 and the Remote IP address to 10.0.0.138 (which the modem should be listening on, as well as 192.168.1.254).
6. Not quite sure what causes the PPTP connection to stand up (I think I just waited and it came up automatically), but at this point you could probably power cycle the virtual pfSense and it should all liven up. If you’ve done it right, you should have an internet connection on your clients (you may need to refresh the DHCP lease). Step one complete!
7. Now for tunnelled IPv6, to go http://tunnelbroker.net and sign up for a tunnel. Don’t forget to tick the IPv6 enable box (under Advanced in pfSense’s System menu)
8. There’s a great shell script here which takes care of creating the tunnel on pfSense. You’ll need to run this on each restart, but each time you restart your public IP address is likely to change anyway. I may get bored and update the script to handle this automatically at some point…
9. Anyway, if you can get to http://ipv6.google.com, step two complete!

$(this).data('qtip').current = $(this).data('qtip').interfaces.length

Thankfully the intertubes had a very helpful post; changing line 134:

if(typeof $(this).data('qtip') == 'object')

to:

if(typeof $(this).data('qtip') == 'object' && $(this).data('qtip') !== null)

made it all happy. Good coding practice FTW…

While helping my lovely wife and my grandfather-in-law get their blogs online, I realised I’ve mostly neglected mine. It’s not because I don’t love you, sweet internets, but because I’ve found that the free time I once had for ranting online has almost vanished. It’s honours project time, my final year of uni, my victory lap. Although I don’t have exams, it feels like I’m being tested every day. It feels like it’s no longer fun whimsical nonsense, at uni and at work. And as much as I thought it never would, I want it to be over quickly.

I gave up writing for Nexus; not because I didn’t enjoy it, but because I felt my writing was getting to the stage of interestingness. Throughout all the articles of The Nerdery, you’ll notice a certain “shit, gotta get this done before Monday” feel to them. They were forced. And then, something happened at the start of the year; I felt like I had something to say. I felt like I had to educate the masses. Unfortunately, this came at a time where the new editor felt that Nexus had evolved too much over Josh’s tenure, and decided to take it back a notch. I felt like I no longer belonged.

It’s the sort of feeling I’m starting to find from places where I thought I had permanent membership.

Anywho, that’s enough emo for one night.

Why did this take all day to find? Why can’t common things like this be explained in the Twisted documentation, the book, or even linked as example code? Something has to really frustrate me to make me want to use Java…

It started randomly (haven’t made major changes in the last few days), so I assumed it was something corrupted. The only hint was that after Safari, Mail, iTunes or Adium crashed, PubSubAgent would use 100% CPU time. So, I fire up Instruments and look at the trace for PubSubAgent. It seems to be calling CFHTTPCookieStorageFlushCookieStores many times, which is odd, because a quick Google doesn’t return anything useful about this system call, obviously related to CFHTTP.

Fast forward 4 hours later when I’ve cleared caches, nuked my Safari config, tried removing PubSubAgent (which just made it worse). The fix? Removing ~/Library/Cookies/Cookies.plist. Oddly enough, it has a companion – ~/Library/Cookies/Cookies.plist – corrupt.

So, just a recap; somewhere the system knew my Cookies file was corrupted. But instead of spitting this out to the Console, throwing a Dialog, or ANY form of useful information, I had to trudge through my Library looking for something which could be causing the problem, and manually removing it. It was by chance that I noticed the Cookies folder, which is strangely not in the Safari folder where one would normally expect it.

And just to make matters worse; Safari’s “Reset Safari” did nothing to solve the problem. That’s right, checking the “Remove all cookies” checkbox did NOT remove the cookies!

Good user interaction FTW!

So, I have a custom backup script (mostly because I know I can do it better for my workflow than some off the shelf solution). It uses tar’s listed-incremental function to do, as you can guess, incremental backups over a monthly cycle. It’s been working well since I made it on Tiger, except today, the first time I’ve tried to take a backup since upgrading to Snow Leopard. It straight off failed, claiming it doesn’t understand listed-incrementals.

I’m scratching my head as to why (it’s really not a complex script), before I realise it’s using an older version of tar than what shipped with Tiger and Leopard (or it’s using BSD tar as opposed to GNU tar… but I can’t verify what Tiger/Leopard had, all I know is it worked previously). Hmmm… ok. So I open Macports, install the latest version of gnutar, removed the crappy Snow Leopard tar and all keps going happily… except I now have a wiggling suspicion in the back of my mind that there is another disturbance in the force…

I dig a little, and it’s not long before I discover that Apple also decided to ship bzip2 1.0.4, which has a security exploit that was fixed 1 year 6 months before 10.6 was released…

WTF Apple? Is anyone paying attention to software releases over there? It makes me wonder, what other outdated, exploitable software is installed on my laptop?

We collect the free coffee cards, and enjoy it. Except this morning, we notice that they’re phasing out the paper system in favor for a keyfob barcode. It’s ok though, if you register your keyfob online, you still get 6 for the price of 5, contradictory to the way Subway did it when they introduced their Subcard, when Subway sneakily increased the cost of a free lunch.

But the BP offer isn’t without a catch. To get the 6 for the price of 5 deal, you have to not only give them your email address, but also opt-in to their… well, it doesn’t actually say what I’m opting-into. For all I know I’m opting into daily advertising, or perhaps a free coffee on my birthday, or perhaps they’ll forget about it entirely and we’ll all just go about our days.

Will people accept Spam for slightly cheaper Coffee? It’s an interesting concept, I wonder how effective it will be…

However, do not loose faith, it is happening. Unfortunately we just couldn’t do it in the first week back.

Watch this space!

Instantly I turn to an old favorite; Soundflower, which provides virtual inputs and outputs for MacOS. Except, it stopped working in Snow Leopard, the dialog: System extension cannot be used The system extension “/System/Library/Extensions/Soundflower.kext” was installed improperly and cannot be used. appears. Thankfully, it’s actually a simple problem and a simpler fix.

If you go:

$ sudo kextutil /System/Library/Extensions/Soundflower.kext
/System/Library/Extensions/Soundflower.kext has problems:
Authentication Failures:
    File owner/permissions are incorrect (must be root:wheel, nonwritable by group/other):
        /System/Library/Extensions/Soundflower.kext/Contents/Info.plist
        /System/Library/Extensions/Soundflower.kext/Contents/MacOS/Soundflower
       /System/Library/Extensions/Soundflower.kext/Contents/Resources/Soundflower.xcconfig

See, simple permissions problem! Running chown and chgrp cleans it up nicely. I’ve submitted the fix in the bug report, and hopefully soon a fix will be officially released.

Now, back to streaming my music…

For those lucky enough not to experience slack WiFi, the problem is that is some applications are completely unusable. Using the http://i.dslr.net/tinyspeedtest.html website, my iPhone (on good days) gets ~4000ms pings and I~50kbps. But there should be no reason for this; The speedtest.net app works fine, showing speeds of ~14Mbps… Curious…

So, I did some packet captures (the capture point being on wired ethernet, directly after the AP); the iPhone takes seconds to ACK the TCP packets when running Mail or Safari (didn’t bother testing any other applications).

My logic may be failed, but if I run the test and get 256ms and 3500kbps on my MacBook, there should be no reason why this isn’t possible on my iPhone. My MacBook uses .11a, while the iPhone 3GS seems to only use .11b/g (which is very odd, because the chipset is there to support 802.11a), so each device isn’t sharing radio space with the other.

So I tried screwing with the settings, and the thing which had the most profound effect was the Beacon Interval. By changing it from 4000 Kusec to 40 Kusec, instantly I went from having ~4000ms pings to ~330ms pings, and a usable data rate of 864kbps! I then lowered it to the absolutely lowest time possible, 20 Kusec, and now have ~285ms pings and ~1500kbps to http://i.dslr.net/tinyspeedtest.html.

This does, however, bring one very pressing question; Why does this only affect my 3GS? Beverley’s original iPhone worked fine before changing the settings, as well as our 2 laptops, and various visitor’s laptops. In fact, I used this and 4 other identical APs at the NZ WCG, providing internets to ~25 different laptops and PDAs of various descriptions, all roaming around the event, with the exact same configuration I started with, and not a single complaint. It obviously can’t be the fault of the AP… can it?

So, I bought an iThing 3GS. I went app crazy, and found out about the WordPress app. I realised I hadnt posted to my blog in months, mostly because theres too much work involved in posting. So, I decided it was time for a freshup.

So, bye bye custom CodeIgniter blog engine, hello (again) WordPress (and all the other social media integrations I have to integrate).

I strongly recommend the course to anyone who wants to take the exam; there are things in the exam that you simply won’t have experienced. If you do the course, provided you pay attention and complete all the lab work, there should be no reason why you can’t pass the exam. Which is important, if your employer is paying a lot of money to fly you from New Zealand to Australia, and repeating the journey might take a bit of convincing.

Just on a side note, when did the Australian government start requiring ID to purchase prepaid SIM cards? The form I had to sign appeared more concerned with how many prepaid services I already had, and not at all with the actual phone number (I could have missed something though).

I’ve come to the conclusion that Australians, at least [Melbourneites,Melbourneians]? are the worst drivers in the world. They drive recklessly and never slow down, I swear most would rather crash then give you a break. I compare them to driving in Auckland, which is reality is pseudo-chaotic. Everyone thinks it’s this giant disorganised mess, but in reality, if you have confidence driving you’ll love Auckland drivers. They will hold up 3 lanes of rush-hour traffic just to let you turn right down a small side street! In can even compare them to Seoul drivers, who are far more reckless, but everyone will let everyone in and will slow down when necessary.

Rant out of the way, I’ve finally bitten the bullet and bought an Elgato eyeTV DTT. After purchasing it I immediately tried it out in the car, and it picked up SBS no problem. However, reception in the suburb I’m staying in is very poor; at most I’ve been able to get 40% signal strength with a proper UHF antenna, although the small one that comes with it isn’t far off. Once back in NZ, I plan to get myself a Mac Mini (preferably a used one off TradeMe) and set up a recording system / file share / backup server.

On a final note, don’t forget to check out Global Game Jam, which will be happening all over the world (and in particular at Waikato University) very shortly. The idea? 48 hours to create a game based on a predefined theme. I’m not talking super 3d immersive graphics level, just something fun and playable.

Now, being the geek I am, before we left I upgraded my Okta Touch to Windows Mobile 6.1, and hence unlocked the GPS. I then proceeded to load it with some software, and a map of Australia. This is probably the best thing I brought on holiday. Unless you’ve had a GPS, you hae no idea just how much stress it alleviates. When Telecom turns off it’s CDMA network or I get an iPhone (whichever comes first), I plan to mount it in my car for those times that I can’t avoid Auckland.

Sorry, between work, sleep and play, I forget to update things on the internets, such as my blog, Facebook etc. Anyway, I’m in Melbourne on holiday from the 5th till the 13th (next Saturday)!

Myself, Beverley and her family are visiting Beverley’s brother Sam. Beverley’s parents Bill and Louise are attending a conference in Cairns on Tuesday, and so will be leaving for that early. Beverley’s sisters Jenny and Nicky have things on, and so will be joining us Monday.

Pacific Blue is a really good airline. Sure, you don’t get any of the niceties that Air New Zealand gives you like… … a blanket. It is a nice, cheap flight, and the cabin crew is friendly and energetic. Kinda reminds me of Mile High. The only thing that concerns me was the lack of water handouts. Yes, they offered for you to buy some, but I thought they were required by some air safety something?

Landed in Melbourne safely, where we encountered new ePassport booths, a “quicker” way of clearing customs. Being the digital natives we are, we had to try them. Insert your passport and answer 4 questions; have you had tuberculosis, are you a criminal, have you been to a place with yellow fever, and have you lied. Afterwards, it prints out a little ticket. You then take this ticket to a gate, look into a camera (facial recognition stuff), and proceed. Now that we know what we’re doing (it took a second to figure out the order of operations), I reckon it’ll be much quicker. One disadvantage though:

I don’t have an Australian stamp in my passport!

Upon leaving the airport, the heat struck us. Not as bad as entering Seoul, but still very noticeable. Also, Australians seem to have an interesting sense of art, as the “artworks” along the motorway just seemed to be rectangular pillars arranged in some weird fashion. Except the huge concrete ones on the bridge, which didn’t actually support the bridge…

Was mostly uninteresting after that. Went to TGI Fridays, went to Borders, went home and slept. More as I encounter it.

For example, you can now see my latest Twitter up at the top of the main page. Nifty eh? Next up, I’m almost done my admin interface, so I’ll be able to tell if people are writing comments, and actually respond to them in a reasonable timeframe. You know, like I should have done in the first place, instead of relying on phpMyAdmin.

Watch this space.

Before you start thinking it, no, this post doesn’t just exist to boost my ego (I already know I rock). As I keep telling the masses; everyone needs backups. Drives are cheap these days. Storage on Amazon S3 is dirt cheap. Whatever solution floats your boat, make sure you’re taking regular dumps of your data.

A month ago I noticed Yahoo was increasing their renewal price to $34.95. I had already planned to move to Godaddy this year due to their sponsorship of Diggnation (go Diggnation!), so while being a little more motivated because of the price difference, I thought little of it. I switched, and have had no problems. I clicked all the buttons I could find in Yahoo, and thought it was all done, as I had no more correspondence from them.

Until I check my credit card bill today, and notice a nice $50 NZD charge attributed to my domain. WTF!?!?!?! Yahoo still wants money for a service I’m not using!!!

Yahoo has really screwed up this past year, and I can only hope the next .com burst will finally pop the bubble on the company that really doesn’t care about customers.

For those not in the know, I’m the network admin for the biggest LAN party in NZ, The World Cyber Games NZ Qualifier. It’s a big job that involves lots of sleep depravation, but it’s fun in a sick way. It started at 12:30 on Friday (today), and will go till Sunday. Here are a bunch of photos, and maybe tomorrow I’ll post some more…

It’s been a hectic few days. To start of this picture trail of some of my experience, I think the most fitting is an image of how my flat looked the night before setup day. In this picture you should see a switch, my laptop, my server, my HP 90/700 terminal, 4x Cisco switches resting on a firewall, 1 massive switch, another terminal, and Jono (aka Sheep) on my laptop configuring the switch.

Next up is two photos of the WCG banner and TelstraClear Pacific banner. Just to prove we made it.

And the communications room at TelstraClear Pacific stadium, the place where we ran our 100m ethernet internet link out of, as well as patch to the rest of the building…

My laptops and Jono…

My 42″ plasma, which displays a graph of the internet usage, as well as a warning to n00bs…

The lights of a switch.

Endless rows of people… (760 total really)

So ya, thats what I’m up to this weekend. Don’t blame me if I don’t text back, I’m busy blocking network ports.

Regular phone calls to the butler to get him to check on the sports car collection? … And to call people to get them to Google stuff for you cause you blew your cap in the first hour.

That said, it doesn’t bother me at all. I’m happy with my mac laptop and Windows Mobile phone, and who knows, in a few months when Telecom rolls out their GSM network (and I know for a fact they’re keeping to schedule), they’ll lay the smackdown on Vodafone, and all will be happy.

Back to networking… Pictures coming soon.