Posts for August 2012

2012-08-05: Omnibus haul

This has been a weird year for keeping to any sort of consistent schedule. Too much different stuff has been going on, and of course right now I'm completely distracted by the Olympics and doing very little other than watching. But I had a handful of new books that sounded really interesting in my pending list and then found that they're reprinting the Darkover novels (which I've always wanted to read but whose sequence is hard to figure out). Hence, a book order.

Stephen Baxter — Xeelee: An Omnibus (sff)
Marion Zimmer Bradley — The Ages of Chaos (sff)
Marion Zimmer Bradley — Heritage and Exile (sff)
Marion Zimmer Bradley — The Saga of the Renunciates (sff)
Samar Habib — Rughum & Najda (historical)
Andrea Hairston — Redwood and Wildfire (sff)
George R.R. Martin — A Storm of Swords (sff)
George R.R. Martin — A Feast of Crows (sff)
Mary Renault — The King Must Die (historical)
G. Willow Wilson — Alif the Unseen (sff)

The Baxter combines all four books of the Xeelee series, which I've wanted to read since it seems like the Baxter I'm the most likely to enjoy (and since I already have a short story collection in the same universe that I grabbed because it won a different award), but which is difficult to find in the US. When I found out there was a reasonably-priced omnibus published in the UK, I just got it from an Amazon seller in the UK.

I've already read both of the Martins, but I kind of want to re-read (or at least try to re-read) the whole Song of Ice and Fire series before reading A Dance of Dragons and I originally read borrowed copies. So I grabbed used copies, since that was cheaper than Kindle versions.

2012-08-05 16:41 — Permanent link

2012-08-06: WebAuth 4.3.0

The primary purpose of this release from a Stanford perspective is to add a way for the user information service to reject a login. We're going to use this to restrict users to only be able to go to a particular set of sites until they've completed security training, and to prevent them from going to other sites until they've finished prerequisites. This means changes to the protocol between the WebKDC and WebLogin server and between the user information service and the WebKDC, as well as new support in the templates for expressing the error.

The most user-visible change is that mod_webauth and WebLogin both set the HttpOnly flag on cookies by default. mod_webauth has a new directive to turn this off if one has to.

The biggest change in the package is that I've continued my library refactoring and rewritten the Kerberos functions to use APR. They also take a WebAuth context and do proper error handling, rather than just using com_err, which should radically increase the quality of the errors. I took advantage of the opportunity to finish the OO conversion of the WebAuth Perl API and to remove and combine various Kerberos functions that weren't being used. While cleaning up the Kerberos API, I fixed a few small bugs.

You can get the latest release from the official WebAuth distribution site or from my WebAuth distribution pages.

2012-08-06 21:40 — Permanent link

2012-08-08: WebAuth 4.3.1

This is another quick bug-fix release after a major change, but I was able to sneak in various other improvements and fixes that have been pending for a while.

The bugs are an invalid free in webauth_webkdc_login that affected the WebKDC if permitted realms were configured, a missing replacement for krb5_cc_get_full_name for older versions of Kerberos, and some incorrect Perl module includes in pwchange.fcgi that had been broken since the 4.2.0 release.

For additional fixes, I enabled WebAuthDoLogout in .htaccess files, which makes configuring some per-user CGI programs that want logout to be easier, and added an overloaded cmp operator to WebAuth::Exception to make testing easier. I also clarified the documentation for WebAuthLdapKeytab, which otherwise implied that you could have separate configurations per virtual host. There are also some internal improvements to the code.

You can get the latest release from the official WebAuth distribution site or from my WebAuth distribution pages.

2012-08-08 20:52 — Permanent link