Socialist social justice is no justice at all

Recently the SABC spent many a monopoly buck on advertising their coverage of the “Mandela” speech of the “Librarian of Alexandria”. This is smells of political influence peddling, since that is what the SABC does these days, and the library of Alexandria was burned to ashes by Julius Caesar in a few years BC. They advertised this event so widely that I even knew about it beforehand — it was advertised on multiple radio stations, and broadcast in 3 different media. It is almost as if they are trying to change people’s mind about some fundamental stuff. It’s like an attempt to establish some strange religion.

I happened to hear the tail end of it, and heard the man wax lyrical about “social justice”, to loud applause from the audience when he said something that boiled down to “we need socialism”. He effectively told them they can call crazy socialism lite schemes “social justice” and do whatever they like until they get to the socialism that will allow them to take people’s stuff and lead us to that socialist heaven on earth also known as famine. Actually, he didn’t go that far, but that’s what they heard.

Right now he’s complaining about people leaving “mainstream media” toward unbalanced internet media — oh wait, he’s done. What a relief.

Now this thing really gets my goat, which is interesting, because I didn’t have a goat, so I can’t share it in the interest of social justice.

The notion of social justice seems to be distinct from the notion of justice, something like this:

  • Justice: to do what is right
  • Social justice: to do what is right unless doing what is wrong is socially expedient, in which case to do what is wrong, but maybe not, if society still retains some non-social justice. See also injustice.

Social justice for socialists is the tyranny of society riding roughshod over justice for the individual, and (in the case of South Africa), perverting justice for the greater good. Instead of “let us do evil that good may result”, they say “let us do social justice that good may result”.

If it seems just to society to take away your worldly goods, children, wife, livelihood and life for some social cause, then they will do it. They might, for example, claim that you have too much stuff, so you should be forced to share it, in the interests of social justice. They might claim that you do not employ the right people, and must do so, in the interests of social justice. They may claim that you force people that work for you to work, which you must stop, in the interest of social justice, while continuing to pay their wages, please, in the interest of social justice. In the interest of social justice, you might be found to be a person who causes disturbance and should be silenced — for the greater good of society, who prefer to live without the voice of those who speak up against injustice (or stupidity, or whatever it is).

The basis of justice, and the only basis of justice, is not the marxist notion of the class struggle (which the man referred to). Neither is it the right of bare force. It is the right of God, who alone determines what is right and good. He determines right and goodness by reason of being the creator. Simple. In the Bible there is a detailed exposition of the kind of law he considers justice. Nothing less than his justice is actually just. When the socialists appropriate for themselves the property entrusted to others by God, and deprive others of their God-given liberty through the kind of regulation they so love, they trample the law of God.

They trample God’s law at their peril. God will neither reward nor ignore their willful insolence: he will repay their social engineering “justice” with justice of his own. The socialists of the world have recognised that secret counter-revolutionary forces are at work against them. They blame everyone: the west, the capitalists, agents provocateurs, right wingers, trade unionists, and, in the case of Africa, former colonial powers. They do not see the finger of God, which rebukes them for their many injustices and their never ending thefts.

Posted in Stuff | Tagged , , , | Comments Off on Socialist social justice is no justice at all

Unicast flooding meets promiscuous routing

To make a disaster, you need a perfect storm of mistakes. A single mistake is insufficient, but a stack of sub-obtimal configuration choices stacked together will give you rampant failure and poor network quality. For today’s mistake we have massive and erratic packet duplication leading to random drops. We checked for STP loops, but eventually found it was caused by a combination of:

  • A large VLAN in a data center with different IP ranges on the same physical subnet. Not a problem, you would think.
  • Unicast flooding in the switch: a design feature.
  • Packet forwarding of a single machine (acting as a router). Also a feature.
  • Packet bridging on that same machine (acting as a bridge). Also a feature.

When a switch wants to send a packet, it sends it to the port where the MAC address was last seen from. If the MAC address has not recently been seen, or has just timed out of the CAM table (which maps MAC addresses to ports), then it has two choices:

  • Drop the packet
  • Broadcast the packet

Broadcasting is the smart choice, and is known as unicast flooding. Generally the packet solicits a reply, so the flooding is temporary.

In today’s disaster, the packet bridging implementation seems to rely on switching the network card into promiscuous mode. Now what happens when a unicast flooding packet is received for a subnet that the machine does not know about:

  • Because the network interface card is in promiscuous mode to pick up bridged traffic, the packet is not dropped.
  • Since the destination of the packet is not local, it is considered for routing.
  • The machine happens to have a route to the destination so it retransmits the packet to the gateway – the switch again.
  • The packet is received by the switch for routing, and it figures out that it must send it to a particular MAC address … for which it still does not have an entry in its CAM table.
  • The switch does unicast flooding in the hope of getting the packet to its destination.
  • After about 20 retransmissions, a packet is dropped, and things go quiet. If you’re lucky (ha ha) the recipient machine manages to transmit a reply, and the CAM table is updated. Unicast flooding stops, and the duplication stops, until the next crazy packet hits the system.

The “router” system which delivered this kind of behaviour to us is some kind of Microsoft windows box running some kind of virtualisation software – maybe hyper-v or worse. It has been unplugged, and will return with a firewall protecting it from the big nasty switch, or with some other fixes.

To detect this condition, you need to look for an abundance of unicast packets. You can do the following on an otherwise quiet box (that’s what the “port not 22” is about) and look for duplicates:

# tcpdump -i eth0 port not 22 and not multicast -c 100 -en
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
10:10:00.990296 1c:17:d3:xx:xx:c2 > 00:21:5e:xx:xx:e5, 
ethertype IPv4 (0x0800), length 98: xxx.xx.xx7.118 > xxx.xx.x0.40: 
ICMP echo reply, id 40490, seq 8510, length 64
10:10:00.990573 1c:17:d3:xx:xx:c2 > 00:21:5e:xx:xx:e5, 
ethertype IPv4 (0x0800), length 98: xxx.xx.xx7.118 > xxx.xx.x0.40: 
ICMP echo reply, id 40490, seq 8510, length 64
...and a lot more duplicates than that...

Fixing it was a matter of removing the most culpable element of the chain (anything running Microsoft).

Posted in Stuff | Tagged , , , , | Comments Off on Unicast flooding meets promiscuous routing

When Daddy comes driving home again

I needed to sing something (the internet was down, thanks Telkom, for your speedy attention to this problem). I thought I’d sing “When Johnny comes marching home again”, but couldn’t remember the words. So this is what it came to:When daddy comes driving home again.mp3. Some days it really is like this, except the dog does not bark. He’s been trained. I think we might have overdone it with the dog.

              Em
When Daddy comes driving home again
   Bm    
Hoorah! hoorah!
     Em 
When Daddy comes driving home again
   G    B7
Hoorah! Hoorah!
    Em  
The dog will bark
        B7
and the kids will shout
        Em                B7
they'll open the door and all run out
         Em  Am Em    B7
and they all go wild 'cause 
Em
Daddy is coming home!
Posted in Songs, Stuff | Tagged , , , | Comments Off on When Daddy comes driving home again

Silly songs with Audacity

And now it’s time for silly songs with Audacity: that part of the show where Audacity comes out and plays, a silly song. So it turns out that if you have a high tolerance for background noise and a poor quality microphone, you too can be a one-man close (or not so close) harmony group. Unfortunately it does sound a bit as if it was recorded next to a busy highway. This is sad, but sometimes, if you want to get something sung, you have to sing it yourself.

The way it is done is you record the backing track, and then while you listen to that on earphones, you sing each voice to the microphone. Once you’re done, you set some stereo effects to have your virtual clones standing left and right of center, convert to MP3, upload and – voila! – instant fame.

I recorded the bum cream songs (each kid has one):

  • Bum bum cream – the famous nappy changing song popularised by Rupert the Bear. (It’s also available in a lower key, where the harmony also went a little weird, but it sounds more manly).
  • Time to change your nappy (not to say goodbye)
  • Zap a nappy on the kid – the song for the third kid, who sometimes just doesn’t get bum cream. Poor kid.

There are more family songs:

And I recorded a few songs that I like too (although my nose was blocked at the time, so really quite bad at places). Unfortunately my “studio” and “voice talents” could not do any more justice to these serious words:

For good measure, it was late, and I was tired, and my judgement was impaired, so I added this for the road:

Maybe I’ll put them up with the words one day. Probably not.

Update:

  • My mom would always warn us against, well, stuff, with the words “woebetide you if you don’t do it”. Well, that’s what we thought. Wobeytide, verb, transitive: bad stuff happens. Wobey? Tide? Well, it turns out she meant “Woe betide you”, which is a more subtle concept with less nautical imagery. Of course, if the tide was involved, it would be by the woebetide
Posted in Songs, Stuff | Tagged , , , | Comments Off on Silly songs with Audacity

WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

If you use ssh for a while, you are sure to get this message sooner or later: WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. This means more or less what it says – the machine formerly known as somemachine suddenly smells different. The possible reasons are:

  • It’s a new machine using the name, or the IP address (you would know)
  • You regenerated the ssh keys (you would know).
  • You are not talking to the machine you think you are (e.g. a dynamic IP address that points somewhere else).
  • There’s a man in the middle. This is bad (very bad, in fact).

If you are using key based authentication, you’ll still get in if it is your machine. The hypothetical or real man in the middle gets to pass your traffic or block it, but cannot read the text. To check that there is no man in the middle, you should examine the host key with

ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key

That key should match what your ssh client reported as the server identity:

$ ssh -p24 root@somemachine
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
4d:16:9d:69:a0:f5:a9:ae:bc:96:f5:0b:ba:e0:ae:94.
Please contact your system administrator.
Add correct host key in /home/stuff/.ssh/known_hosts to get rid of this message.
Offending key in /home/stuff/.ssh/known_hosts:38
Password authentication is disabled to avoid man-in-the-middle attacks.
Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.
Port forwarding is disabled to avoid man-in-the-middle attacks.
Last login: Wed Jun  7 08:01:30 2011 from 192.168.0.55
[root@localhost ~]# ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key
2048 4d:16:9d:69:a0:f5:a9:ae:bc:96:f5:0b:ba:e0:ae:94 /etc/ssh/ssh_host_rsa_key.pub

They match. That machine was reinstalled, so it’s a new operating system and a new identity. It was fine. Finding out how to make the warning/error go away is left as an exercise to the reader.

Posted in Stuff | Tagged , , | Comments Off on WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!

A slip betwixt $HTTP_RAW_POST_DATA and $_POST

The curious case of the missing post: An interesting bug came across my desk today. We have some hacky PHP code that receives data from cpanel, which is written in Perl. The bug came out after an update to cpanel. Suddenly we started getting blank requests: PHP’s $_REQUEST variable was blank. A good deal of (unnecessary?) debugging showed that the $_POST variable was just as blank. Eventually, when printing out the entire $GLOBALS array, I found the data hiding away in $HTTP_RAW_POST_DATA. Yay! Now, why was it there?

Time to check stuff: did something update PHP on this box to some other version?

$ php -r 'phpinfo();' | grep -i version | head
PHP Version => 5.1.8

Well, not, but wow! That’s rather old. Is there a bug in this version that will cause it not to populate $_POST from the posted data? Googled it. Nope. Oh wait. Maybe I should yahoo it! Still nope. There was a bug in php 4.2, but it was fixed. So what’s up?

I never looked at the actual request, since this thing is over SSL and I didn’t feel like setting up a man in the middle, but here’s what it seems to be going on: the cpanel perl client side is not sending a valid Content-Type header. Something like this:

POST /scripts2/synczones_local HTTP/1.0
User-Agent: Cpanel::PublicAPI (perl) 1.1\
Content-Type: application/x-www-form-urlencoded

zone=mcgill.org.za&zonedata=...

By parsing $HTTP_RAW_POST_DATA, we get the bits we were missing, and voila it works:

if (isset($GLOBALS['HTTP_RAW_POST_DATA'])) {
    parse_str($GLOBALS['HTTP_RAW_POST_DATA'], $postdatawithbadheaders);
    foreach($postdatawithbadheaders as $k=>$v) {
        if (!isset($_REQUEST[$k])) { 
            $_POST[$k]=$v;
            $_REQUEST[$k]=$v;
        }
    }
}

Posted in Stuff | Tagged , , | Comments Off on A slip betwixt $HTTP_RAW_POST_DATA and $_POST

PHP deobfuscation

One of the things that you see with depressing regularity when hosting crummy PHP scripts for others is this:

eval&28;base64_decode&28;'aWYgKCFlbXB0eSgkX1JFUVVFU1RbInRoZW

What’s that? Well it says to decode that gobbledegook into a binary stream (the base64_decode part), and then interpret whatever it turns out to be as PHP code (the eval)

Now, if you have the time, you can decode this kind of thing yourself, and maybe find out whether it is evil or not. This takes some time (which is why you need to have the time). If you install the php xdebug extension, then you can hack in a bit of code to trace the execution of the process, and print out what it is that is being eval’d and see what it is. That’s the right way to do it. Alternatively you can do a crude search and replace and a few other hacks, and end up with the following abominable PHP code that decodes a stack of php obfuscation. It’s time to tell the world:
Here’s the code: deobfuscate.php (this is new as of today – get your copy while it’s hot).

One of the less evil reasons that PHP code may be obfuscated is that the writer of the code is trying to extract payment. This usually means that they have embedded obnoxious advertising in the code (such as for gambling, drugs, SEO and other social ills). Frequently they also add toothless legal threats against removing their obnoxious advertising.

This one of today takes the cake. It combines all of that good stuff, like putting the copyright notice in the “uncopyable part”, a standard legal threat, but it adds that little something extra:

<?php
eval(base64_decode('ZnVuY3Rpb24gZ2V0X2hlYWRzKCkgeyBpZiAoIWZpbGVf
ZXhpc3RzKGRpcm5hbWUoX19maWxlX18pIC4gIi9mdW5jdGlvbnMucGhwIikgfHwg

IWZ1bmN0aW9uX2V4aXN0cygidGhlbWVfdXNhZ2VfbWVzc2FnZSIpICkgeyBlY2hv
ICgiVGhpcyB0aGVtZSBpcyBsaWNlbnNlZCB1bmRlciBDQzMuMCwgeW91IGFyZSBu
b3QgYWxsb3dlZCB0byBtb2RpZnkvcmVtb3ZlIG91ciBsaW5rIHdpdGhvdXQgcGVy
bWlzc2lvbi4gPGJyIC8+VGhhbmsgeW91IGZvciBzdXBwb3J0aW5nIHVzIG1ha2lu
ZyBtb3JlIEZSRUUgY3JlYXRpdmUgdGhlbWVzLiIpOyBkaWU7IH0gfQ=='));

What does it mean, do I hear you ask? Well, it decodes to this:

<?php function get_heads() { if (!file_exists(dirname(__file__) .
"/functions.php") || !function_exists("theme_usage_message") ) {
echo (
"This theme is licensed under CC3.0, you are not allowed
to modify/remove our link without permission. <br />Thank you
for supporting us making more FREE creative themes."
); die; } }

Yep. That’s right. It checks that functions.php is still around. It had better be. It also checks whether there is a function theme_usage_message defined. You must not take out the link. (What link?) And it you don’t like that, then die.

Posted in Stuff | Tagged , , , , , | Comments Off on PHP deobfuscation

Oops, Google went evil – again

On 22 April 2011, Good Friday, we remember that Jesus was crucified and buried. On this very day, Google.com displayed a feature for the day: a picture of some kind of garden in place of their regular logo. Perhaps the garden of Gethsemane where Jesus prayed, and was betrayed and arrested? Perhaps this is the garden of the tomb where they buried Jesus before sunset? No, actually, the roll-over informs us it is “Earth Day”. The UN calls it “International Mother Earth Day.” What a load of rot!

Again, Google has taken sides. When the state of California voted on Proposition 8, to define marriage as a man and a woman, they broke their policy of neutrality on social issues, and said (in effect) that California should make every effort to allow a man to “marry” a man, or a woman to “marry” a woman. It’s on their blog.

Today, choosing between the Son of God, crucified, and the “Mother Earth”, they chose fiction over history, false religion over true religion. They didn’t choose to say nothing, but they chose to say something: they say that corporately they prefer neo-paganism to Christ. Well, they didn’t say that, but the evidence is accumulating. Perhaps they were ignorant that today is Good Friday.

The words of Jesus:

Whoever is not with me is against me, and whoever does not gather with me scatters.

Where is Google?

Posted in Stuff | Tagged , , , | Comments Off on Oops, Google went evil – again

Please note, the idiom

So, “please note”. It’s about taking note, but is it really a plea? One thing it is not, is it is not the polite form of “Note”. It is a strangely forced form of politeness. “Please note that the train does not stop at Blackpool” is almost the same as “Note that this train does not stop at Blackpool,” but it includes the insinuation that the person being told does not care for being told where the train will stop. No, they are so high and mighty, that simply giving them the vital information is insufficient. If you just tell them to note it, they will flatly ignore you and get on the train anyway, and blame you for not trying hard enough to get information into their thick skulls. So, to accommodate this kind of idiocy, you beg and plead. You say “please”. Instead of just “note that,” you say “Please note that this train does not stop at Blackpool.” Now you’ve not only told them something they desperately wanted to know, but you have begged for their reluctant permission to hear it and actually note it. Of course, if they had no intention to stop at Blackpool, you just added a “please” to a note that had no interest to them. You have told them that they are being rude for not caring about stopping at Blackpool.

So what is “please note?” It’s more like a veiled threat than anything else. You can usually prefix it with “for your own good” or “if you want to live”, or “if you care about your family and your unborn children then you will….”.

“Please note” is for when you have said something, or something has been discussed already, and a minor adjustment is in order, such as:

  • A clarification (something needs to be made clear)
  • A correction (you made an error)
  • A warning (you might not have realised something)

So, after the whatever, if you want to add a correction, a warning or a clarification, you say, “please note”.

  • A clarification: “Thank you for buying this paddling pool. Please note that we cannot be held responsible for injury or death resulting from the use of this device, especially when it is filled with water.”
  • A correction: “You thanked us for our quote of R5011.00 including tax. Please note that this price excludes tax.”
  • A warning: “Your letter refers. Please note that we have reported your statements to the police.”

“Please note” is the heavy weaponry of idiomatic language. Where ever you see “…please note that…” you can fairly safely substitute something that lacks the pretense of politeness:

  • “…You had better listen up here:…” (e.g. before you get on this train, please note that it does not stop at Blackpool)
  • “…contrary to what you might think…” (e.g. please note that we are closed on Sundays)
  • “…you better watch out because…” (e.g. please note that Santa Claus is coming to town)

Uncle G. Oogle does not seem to know what the idiom “please note” means. Actually, it seems like it is abused as much as the Latin “Nota Bene”, “Note well”. Oh well.

One last thing: Please note that “please note” needs something to attach the note to. You cannot add a note in isolation. “Dear Sir, please note that this is my first e-mail to you…” That just doesn’t work for 419 reasons.

Posted in Stuff | Tagged , , | Comments Off on Please note, the idiom

Floating to 0.999 on the MySQL cloud

This code:
REPLACE INTO loadtable (`hostname`,`load`) VALUES ('server1',2.093);
didn’t work. It worked in my testing from my local machine, but I ended up with this when I ran it from a real machine:

load host
0.309 desktop1
0.201 desktop2
0.172 desktop3
0.999 server1
0.999 server2
0.999 server3

No matter what the actual load on the machine was, the value recorded was set to 0.999. This was really distressing: I was using the load (a moving average) to adjust a moving average (to get a longer term moving average). What happens when you try to move a moving average and it doesn’t? It made me emotional: it was moving.

This is how the table was created:
CREATE TABLE `domain_loadaverage` (
`hostname` varchar(48) NOT NULL COMMENT 'Name of host',
`load` float(3,3) default NULL COMMENT 'load average for the period',
PRIMARY KEY (`hostname`)
) ENGINE=InnoDB DEFAULT CHARSET=latin

And that’s wrong. Float(3,3) means you get 3 significant digits, and they are all after the decimal point. Changing that to Float(7,3) makes it work a bit better (well, until the system load goes above 9999).

So now it looks like this, and the data isn’t truncated:
CREATE TABLE `domain_loadaverage` (
`hostname` varchar(48) NOT NULL COMMENT 'Name of host',
`load` float(7,3) default NULL COMMENT 'load average for the period',
PRIMARY KEY (`hostname`)
) ENGINE=InnoDB DEFAULT CHARSET=latin

I suppose it’s in the documentation somewhere.

Posted in Stuff | Tagged , , | Comments Off on Floating to 0.999 on the MySQL cloud