zsh

+ Some zsh resources:
- The Intro
- Shell differences (nice table...)
- From Bash to Z Shell: Conquering the Command Line (book)
- oh-my-zsh
- zsh ref card

wget Magic

Tip of the day: wget -r can be used to recursively download urls that are linked to the html page.

Example: $ wget -r -l 1 -A pdf http://somelink/

SourceForge Attacked

Received these two emails:

On Jan 28 2011:

Hello,

We recently experienced a directed attack on SourceForge infrastructure (http://sourceforge.net/blog/sourceforge-net-attack/) and so we are resetting all passwords in the sf.net database -- just in case. We're e-mailing all sf.net registered account holders to let you know about this change to your account.

Our investigation uncovered evidence of password sniffing attempts. We have no evidence to suggest that your password has been compromised. But, what we definitely don't want is to find out in 2 months that passwords were compromised and we didn't take action.

So, as a proactive measure we've invalidated your SourceForge.net account password. To access the site again, you'll need to go through the email recovery process and choose a shiny new password:

https://sourceforge.net/account/registration/recover.php

If you need help with this, feel free to e-mail us:

sfnet_ops@geek.net

We appreciate your patience with us as we work to respond to this attack. We'll be working through the weekend to get things back to normal as quickly as possible.

Watch for updates on the service outages on our blog:

http://sourceforge.net/blog/

Thank you,

The SourceForge Team

And Feb 1 2011:

Hello,

Please review this notice and contact us at sfnet_ops@geek.net with any concerns.

There was recently an attack on SourceForge systems as detailed here:
http://sourceforge.net/blog/sourceforge-attack-full-report

As a SourceForge user, you should already have received notice of our password reset event, also noted on the sourceforge.net login page.

As part of our response we examined account risks. User SSH key data may have been exposed during this incident. This is generally of limited concern since users post only the public key portion of their key pair.

In reviewing the SSH key data you uploaded for your account, we found one or more rows of data that did not appear to be a SSH public key. This could be junk text, private key data, or other data we can't programmatically identify.

As a precautionary measure have taken the step of clearing the SSH key data we have on file for your account. Please generate a new SSH key, login to sourceforge.net and upload a new public key. Instructions on SSH key generation may be found in our site docs at: http://sourceforge.net/apps/trac/sourceforge/wiki/SSH%20keys

If you have concerns or require assistance in generating/uploading a new SSH public key, please contact us at sfnet_ops@geek.net

Thank you,

SourceForge.net staff

And now the interesting bits from the full report:

Password invalidation

Our analysis uncovered (among other things) a hacked SSH daemon, which was modified to do password capture. We don’t have reason to the attacker was successful in collecting passwords. But, the presence of this daemon and server level access to one-way hashed, and encrypted, password data led us to take the precautionary measure of invalidating all SourceForge user account passwords. Users have been asked to recover account access by email.

SSH Escape Sequences

To show the escape sequences, hit shift + ` + ?

[someuser@hanworks ~]$ ~?
Supported escape sequences:
~. - terminate connection (and any multiplexed sessions)
~B - send a BREAK to the remote system
~C - open a command line
~R - Request rekey (SSH protocol 2 only)
~^Z - suspend ssh
~# - list forwarded connections
~& - background ssh (when waiting for connections to terminate)
~? - this message
~~ - send the escape character by typing it twice
(Note that escapes are only recognized immediately after newline.)

XML and Lisp

Just digging up the old debate on XML being a form of Lisp...

alloca

alloca (in C) allows you to dynamically allocate memory on the stack!

Here is a example:



Note that using this function isn't really good practice. If there is a stack overflow, the behavour is undefined. But there are advantages of using alloca as well.

Further reading: an alternative to alloca: obstacks

/dev/urandom

Again, random titbits:

1. PAE allows a 32-bit OS to use up to 64 GB of RAM. To utilize this, make sure your cpu supports PAE, and you have to install a PAE-aware kernel.
But there is a possible performance hit (that may not be significant)?

What is the overhead, in terms of space and time, of using a PAE enabled kernel as compared to an SMP kernel?

PAE doubles the size of page table entries from 32 bits to 64 bits, as well as adding a small third level to the page tables. This means the maximum amount of kernel memory consumed by page tables per process is doubled to slightly more than 6MB. In the 2.4.18 kernels shipped by Red Hat, this memory comes out of the ~700MB of available memory in the normal kernel zone. In the Red Hat Linux Advanced Server series of kernels, page tables can be located anywhere in physical memory.

The performance impact is highly workload dependent, but on a fairly typical kernel compile, the PAE penalty works out to be around a 1% performance hit on Red Hat’s test boxes. Testing with various other workload mixes has given performance hits ranging from 0% to 10%.

Source: Redhat white paper

2. top has these shortcut keys: shift-A (to see all fields) and shift-G (to see field groups)
3. pinfo is a nice tool if you don't like info
4. My emacs and vim config files (a follow up from here)
5. Restoring a single file in hg: $ hg cat somefile.c > somefile.c
6. indent is a nice tool... but be careful what you do with it.
Sample usage: $ indent -kr -nut somefile.c
You can also put your settings in a .indent.pro file in the directory of your source code.

Random Again

I think that one day, this blog will have the ability to generate random bits of goodies...

1. Hacking your sleep
2. Ok... it's called REPL: Read-eval-print loop
3. "Kick Ass" JS Game
4. D0z.me DDoS fun
5. Essays by Paul Graham
6. Dropbox's application to Y Combinator
7. Jeff Dean's Keynote: Designs, Lessons and Advice from Building Large Distributed Systems
8. Superstition in the pigeon
9. Understanding Node.js (tutorial)
10. JSLint, and lint in general

The Full-Stack Programmer

Old idea formalized in a catchy new term: read more about The Full-Stack Programmer.
It will be interesting if this idea gains traction.

An algorithm for finding cut vertices

Related Readings: Biconnected Component
Note: kind of similar to finding strongly connected components

Special thanks to JJ & Brent for this!