2012-09-01: Episodic reset
So, hi!
As you have probably noticed, actual posts here have been few and far
between, and have mostly been software releases. This has something to do
with the fact that my life since last April has been kind of insane in
terms of both disruption and stress. It's not all been bad (in fact,
parts of it were awesome), but it has been highly distracting and chaotic.
Right now, I'm rather far behind on nearly everything that I normally try
to keep up with.
But it's the start of a new month, and the beginning of every new month is
a wonderful opportunity granted by human psychology and its reactions to
beginnings of things to do a reset. No guilt about things that didn't
happen, no left-overs from the last few months, just a fresh start at a
normal schedule, less stress, and a little bit more order.
So, that's the plan. Hopefully that will also mean more postings here.
We'll see how it goes!
2012-09-04: Reacting to excitement
I've been slowly noticing, over a number of years now, a place where I
don't react to other people the way that I want to. I've been stumbling
over defensive reactions that I didn't realize I had. These are a few
rules of thumb that I'm formulating for myself to try to improve that, and
I thought it might help to write them down. And maybe they'll be
meaningful for someone else.
Things people are excited about are probably exciting. If I
don't find them exciting, that's probably because I don't know enough
about them to understand why they're exciting. Or perhaps I have a
different mindset, and therefore the exciting parts don't connect with
me.
Both of those are okay! There are way more things to learn about than
I will ever possibly have time to learn, and I don't have to get
excited about everything other people are excited about. But,
equally, just because I'm not excited doesn't mean that the thing is
not exciting.
My misplaced sense of obligation should not be someone else's
buzzkill.
This requires a bit of unpacking, since I only intermittantly realize
that I'm doing this. But (partly for cultural reasons, partly due to
natural inclinations) I've always felt a strong sense of obligation to
"keep up" with things. To know a lot about a lot of topics. And one
of the things I've realized is that my brain occasionally twists an
interest in knowing lots about the world into a sense of obligation to
"stay current" and know something about everything important, at least
within my vague field of expertise. And usually that part of my brain
has a very expansive notion of field of expertise; all of software
development, for example, which is, when I pull it out into the light,
ridiculously broad.
This then sparks one of the standard failure modes of human cognition.
I have an unrealistic expectation of myself. I fail to meet that
expectation. This makes me feel guilty and stressed. At that point,
my brain starts trying to find targets for me to displace negative
feelings onto, and that generally ends up being the next person who is
excited about something new that I don't know anything about but feel
like I should.
This is all very interesting psychologically, in the abstract.
However, the concrete result is that I sometimes get all snarky and
negative about something that someone else is excited about because it
happens to be the moment I hit overload, or because I didn't want to
hear about another thing that I feel like I should know more about.
And that, in turn, can be either confrontational or discouraging to
someone who is legitimately excited (and may rarely get the chance to
be excited). And that's not the person I want to be.
It's okay not to have an opinion. Seriously, it's okay. The
world is full of stuff, far more stuff than any one person can know
anything about. It's okay not to go read about everything people say
is exciting. It's okay not to know about something new. It's okay to
focus on the things I'm already doing. Really.
What's not okay is to make up an opinion about something I know
nothing about just so that I can feel better about myself by having an
opinion. Particularly since that opinion formed under those
circumstances tends to be negative, despite the fact that I have no
actual basis for having any opinion at all.
I need to practice just quietly not having an opinion. No one else
needs to know about my lack of opinion.
Before bristling at imposition, be sure someone is actually
imposing. I frequently leap to the conclusion that, when someone
raises a topic, they want me to do something about it. It's a gut
emotional reaction, I think in part because the emotional part of my
brain likes to make everything about me. Intellectually, if I can
engage that part of my brain, it's often obvious that it's not about
me, or that they're not asking me to do anything.
Often, when someone brings something up, they just want to tell
someone else about it, or make me aware of it. If I've listened to,
or read, all the sentences and understood then, then congratulations!
I've done everything that I needed to do and was expected to do and
need not feel any further obligation. Even if something further needs
to be done, it doesn't necessarily need to be done by me.
I'm very protective of my time and available resources because I
almost always feel overwhelmed by all the things that I want to work
on. This does not entitle me to snap at random people who are being
excited around me on the grounds that they're trying to put more
obligations on me. They're probably not. If it becomes clear that
they really want me to do something I don't have time to do, I can
politely decline, but if I just shut up and listen for longer, usually
that's not the case at all.
(Please note that this is not prompted by any current discussion happening
anywhere, and paticularly not by anything in Debian. Insofar as it was
prompted by anything, it was by a throwaway comment in an unrelated
private discussion. It's just something that gelled enough to write down
while I was walking home from work.)
2012-09-06: Web and Debian slides
In writing a note to someone today, I realized that I had never put up on
my web site the slides for my presentation to the 2011 AFS and Kerberos
Best Practices workshop. Those are now available from my
Kerberos notes page. Entitled "The Murky
Tangle of Web Authentication," they're about what we've done recently with
our site-wide web authentication system.
Both of the major efforts discussed there (multifactor and proactive user
account abuse detection) are deployed in production, although the latter
is only deployed in a fairly light-weight and minimal way pending further
time to refine and improve it.
The multifactor support in WebAuth has been available since version 4.0.0,
but it currently relies on a user information service, which right now you
have to write. I want to polish and release ours as open source, but it's
going to require some dedicated hours that I've not yet been able to find.
Similarly, I hope to release as open source the proactive account abuse
detection system, but there haven't been enough hours yet.
I also noticed that my 2010 Debconf slides on using Debian in the
enterprise weren't up on my web site (although they've been available from
the Debconf site), so those have been added to my
Debian notes page.
2012-09-17: rra-c-util 4.6
It's been a while (almost four months) since I've made a release of my
utility library, in large part because most of my development time has
been going into WebAuth. I took some time off from that last week, though
— admittedly, mostly to attend meetings, but inbetween meetings I got some
stuff done on other packages and have some accumulated changes.
The primary change is that concat and concatpath have been dropped. The
former is entirely inferior to xasprintf now that I provide a portable
version of that. concatpath has some special handling for file paths that
should be relative to some other path unless they're already an absolute
path, but that's currently only used in INN, so I'm going to drop it too
until I have some need for it in other packages.
xasprintf, xvasprintf, basprintf, and bvasprintf now all return void and
are guaranteed to either succeed or abort the program. Previously, memory
allocation failures were checked, but other failures besides memory
allocation were returned to the caller. This represents a source bug
(such as a bad format) and is extremely rare, but it meant adding that
checking code everywhere anyway, significantly reducing the benefit of
those functions. Now, that failure will be handled just like a memory
allocation failure, which is not entirely correct but which should be
close enough for practical purposes and significantly simplifies code.
There are also a few more minor fixes: a compilation failure in kafs for
Solaris 11 and later, and some additional support and fixes for
determining Apache compilation flags and headers.
Finally, I've started writing POD documentation for the APIs provided in
the util library. So far, there's only documentation for xmalloc,
xcalloc, and xrealloc. More of that documentation will be fleshed out in
future releases.
You can get the latest release from the rra-c-util distribution page.
2012-09-18: krb5-sync 2.3
The primary change in this release is a serious bug fix for MIT Kerberos.
When a new principal is created with addprinc -randkey, the password
parameter is NULL, which caused a segfault inside the plugin. Silently
ignore that case, since this module can only synchronize passwords and
can't do anything with a key randomization.
The plugin is now installed in a kadm5_hook subdirectory, matching the
layout expected by MIT Kerberos.
krb5-sync-backend, when running in silent mode, now ignores "Operation not
permitted" errors from krb5_set_password. Heimdal 1.5.2 returns this
error from Active Directory if the account doesn't exist.
There are also multiple fixes to the build system and portability layer,
bring it up to date with the latest rra-c-util release.
You can get the latest version from the krb5-sync distribution page.
2012-09-18: Debian Policy 3.9.4.0
I just uploaded Debian Policy 3.9.4.0, which includes the implementation
of the Technical Committee decision to make build-arch and build-indep
mandatory targets and which significantly reworks the section on shared
libraries.
Nothing here is release-critical for wheezy, and uploads targeted for
wheezy should not attempt to update packaging for a new version of
Policy. I went into some more detail on debian-devel-announce.
The version number probably should have been 3.10.0.0 given the
build-arch and build-indep changes and the work on symbols files. Ah
well.
Here's the upgrading checklist:
- 2.4
New tasks archive section.
- 4.9
build-arch and build-indep are now mandatory targets in
debian/rules.
- 5.6.26
New section documenting the Vcs-* fields, which are already in
widespread use. Note the mechanism for specifying the Git branch used
for packaging in the Vcs-Git field.
- 7.1
The deprecated relations < and > now must not be used.
- 7.8
New Built-Using field, which must be used to document the
source packages for any binaries that are incorporated into this
package at build time. This is used to ensure that the archive meets
license requirements for providing source for all binaries.
- 8.6
Policy for dependencies between shared libraries and other packages
has been largely rewritten to document the symbols system and
more clearly document handling of shared library ABI changes.
symbols files are now recommended over shlibs files in
most situations. All maintainers of shared library packages should
review the entirety of this section.
- 9.1.1
Packages must not assume the /run directory exists or is usable
without a dependency on initscripts (>= 2.88dsf-13.3) until the
stable release of Debian supports /run.
- 9.7
Packages including MIME configuration can now rely on triggers and do
not need to call update-mime.
- 9.11
New section documenting general requirements for alternate init
systems and specific requirements for integrating with upstart.
- 12.5
All copyright files must be encoded in UTF-8.
2012-09-21: lbcd 3.4.0
The first new release in six years!
I inherited this package from a former co-worker and had made some minor
fixes over the years, but my C packaging standards and utility libraries
have evolved drastically since I started working on it. In 2009, I
started bringing the coding style and code layout up to date, but then
never finished. I finally took the time this week to mostly complete that
work and get a new release out the door.
This release also includes various improvements contributed in the past
six years, including a port to Mac OS X by Clif Redding (who has probably
been waiting patiently since 2007 for it to show up in a release) and
fixes to the LDAP local probe from Quanah Gibson-Mount. While I was
cleaning things up, I also fixed the HTTP check to really check the status
code from the server and fixed a memory overwrite if there are more than
512 unique local users.
This release drops support for NeXTSTEP, ULTRIX, and SunOS. It's unlikely
that lbcd would actually compile on those platforms. I did keep the other
platform support, although some of those are dubious at this point and I
can no longer test on most of them.
I only managed the tip of the iceberg in terms of cleanup, and this
release doesn't have IPv6 support yet and still uses rather awkward ways
of passing data around between components. It also doesn't do all the
logging that it should have. Hopefully now that I've broken the ice with
a new version, I'll find time to make further improvements on a faster
time scale.
You can get the latest release from the lbcd
distribution page.
2012-09-25: remctl 3.3
After some changes to our internal account creation system, which uses
Java with a connection pool and reuses an open remctld connection, we
uncovered a file descriptor leak in remctld. You'll only see this with
clients that hold a connection open for long periods, which is why we
never saw it before.
This release fixes that issue, plus I set up valgrind testing to look for
any other leaks and fixed a variety of relatively minor memory leaks.
These are mostly small leaks in infrequent operations, such as error
handling cases or when re-reading the remctld server configuration.
While doing valgrind testing, I noticed that remctld would write its PID
file some time before the network setup was complete. This was mostly
only noticable with valgrind, which slows the process down considerably,
but it's a theoretical problem at any time. That's also fixed in this
release.
Other changes in this release include removing prototypes from the Perl
remctl() function so that its arguments can come in the form of an array
and fixing some build dependency and compiler flag issues when building
the language bindings.
You can get the latest release from the remctl distribution page.
2012-09-27: WebAuth 4.3.2
WebAuth versions starting from 4.3.0 have a memory pool allocation error
that affects attempts by mod_webauth to obtain a service ticket from a
WebKDC. Occasionally, with the right alignment of memory pools, the
Kerberos authenticator included in the service token request will be
corrupted, and the WebKDC will reject it with an ASN.1 error. This only
affects the mod_webauth module, not the WebLogin server or WebKDC.
This release fixes only that (fairly serious) bug. All users of WebAuth
4.3.0 or WebAuth 4.3.1 should upgrade their mod_webauth to this release.
You can get the latest release from the official WebAuth distribution site
or from my WebAuth distribution pages.
All posts