Posts for September 2012

2012-09-01: Episodic reset

So, hi!

As you have probably noticed, actual posts here have been few and far between, and have mostly been software releases. This has something to do with the fact that my life since last April has been kind of insane in terms of both disruption and stress. It's not all been bad (in fact, parts of it were awesome), but it has been highly distracting and chaotic. Right now, I'm rather far behind on nearly everything that I normally try to keep up with.

But it's the start of a new month, and the beginning of every new month is a wonderful opportunity granted by human psychology and its reactions to beginnings of things to do a reset. No guilt about things that didn't happen, no left-overs from the last few months, just a fresh start at a normal schedule, less stress, and a little bit more order.

So, that's the plan. Hopefully that will also mean more postings here. We'll see how it goes!

2012-09-04: Reacting to excitement

I've been slowly noticing, over a number of years now, a place where I don't react to other people the way that I want to. I've been stumbling over defensive reactions that I didn't realize I had. These are a few rules of thumb that I'm formulating for myself to try to improve that, and I thought it might help to write them down. And maybe they'll be meaningful for someone else.

  1. Things people are excited about are probably exciting. If I don't find them exciting, that's probably because I don't know enough about them to understand why they're exciting. Or perhaps I have a different mindset, and therefore the exciting parts don't connect with me.

    Both of those are okay! There are way more things to learn about than I will ever possibly have time to learn, and I don't have to get excited about everything other people are excited about. But, equally, just because I'm not excited doesn't mean that the thing is not exciting.

  2. My misplaced sense of obligation should not be someone else's buzzkill.

    This requires a bit of unpacking, since I only intermittantly realize that I'm doing this. But (partly for cultural reasons, partly due to natural inclinations) I've always felt a strong sense of obligation to "keep up" with things. To know a lot about a lot of topics. And one of the things I've realized is that my brain occasionally twists an interest in knowing lots about the world into a sense of obligation to "stay current" and know something about everything important, at least within my vague field of expertise. And usually that part of my brain has a very expansive notion of field of expertise; all of software development, for example, which is, when I pull it out into the light, ridiculously broad.

    This then sparks one of the standard failure modes of human cognition. I have an unrealistic expectation of myself. I fail to meet that expectation. This makes me feel guilty and stressed. At that point, my brain starts trying to find targets for me to displace negative feelings onto, and that generally ends up being the next person who is excited about something new that I don't know anything about but feel like I should.

    This is all very interesting psychologically, in the abstract. However, the concrete result is that I sometimes get all snarky and negative about something that someone else is excited about because it happens to be the moment I hit overload, or because I didn't want to hear about another thing that I feel like I should know more about. And that, in turn, can be either confrontational or discouraging to someone who is legitimately excited (and may rarely get the chance to be excited). And that's not the person I want to be.

  3. It's okay not to have an opinion. Seriously, it's okay. The world is full of stuff, far more stuff than any one person can know anything about. It's okay not to go read about everything people say is exciting. It's okay not to know about something new. It's okay to focus on the things I'm already doing. Really.

    What's not okay is to make up an opinion about something I know nothing about just so that I can feel better about myself by having an opinion. Particularly since that opinion formed under those circumstances tends to be negative, despite the fact that I have no actual basis for having any opinion at all.

    I need to practice just quietly not having an opinion. No one else needs to know about my lack of opinion.

  4. Before bristling at imposition, be sure someone is actually imposing. I frequently leap to the conclusion that, when someone raises a topic, they want me to do something about it. It's a gut emotional reaction, I think in part because the emotional part of my brain likes to make everything about me. Intellectually, if I can engage that part of my brain, it's often obvious that it's not about me, or that they're not asking me to do anything.

    Often, when someone brings something up, they just want to tell someone else about it, or make me aware of it. If I've listened to, or read, all the sentences and understood then, then congratulations! I've done everything that I needed to do and was expected to do and need not feel any further obligation. Even if something further needs to be done, it doesn't necessarily need to be done by me.

    I'm very protective of my time and available resources because I almost always feel overwhelmed by all the things that I want to work on. This does not entitle me to snap at random people who are being excited around me on the grounds that they're trying to put more obligations on me. They're probably not. If it becomes clear that they really want me to do something I don't have time to do, I can politely decline, but if I just shut up and listen for longer, usually that's not the case at all.

(Please note that this is not prompted by any current discussion happening anywhere, and paticularly not by anything in Debian. Insofar as it was prompted by anything, it was by a throwaway comment in an unrelated private discussion. It's just something that gelled enough to write down while I was walking home from work.)

2012-09-06: Web and Debian slides

In writing a note to someone today, I realized that I had never put up on my web site the slides for my presentation to the 2011 AFS and Kerberos Best Practices workshop. Those are now available from my Kerberos notes page. Entitled "The Murky Tangle of Web Authentication," they're about what we've done recently with our site-wide web authentication system.

Both of the major efforts discussed there (multifactor and proactive user account abuse detection) are deployed in production, although the latter is only deployed in a fairly light-weight and minimal way pending further time to refine and improve it.

The multifactor support in WebAuth has been available since version 4.0.0, but it currently relies on a user information service, which right now you have to write. I want to polish and release ours as open source, but it's going to require some dedicated hours that I've not yet been able to find. Similarly, I hope to release as open source the proactive account abuse detection system, but there haven't been enough hours yet.

I also noticed that my 2010 Debconf slides on using Debian in the enterprise weren't up on my web site (although they've been available from the Debconf site), so those have been added to my Debian notes page.

2012-09-17: rra-c-util 4.6

It's been a while (almost four months) since I've made a release of my utility library, in large part because most of my development time has been going into WebAuth. I took some time off from that last week, though — admittedly, mostly to attend meetings, but inbetween meetings I got some stuff done on other packages and have some accumulated changes.

The primary change is that concat and concatpath have been dropped. The former is entirely inferior to xasprintf now that I provide a portable version of that. concatpath has some special handling for file paths that should be relative to some other path unless they're already an absolute path, but that's currently only used in INN, so I'm going to drop it too until I have some need for it in other packages.

xasprintf, xvasprintf, basprintf, and bvasprintf now all return void and are guaranteed to either succeed or abort the program. Previously, memory allocation failures were checked, but other failures besides memory allocation were returned to the caller. This represents a source bug (such as a bad format) and is extremely rare, but it meant adding that checking code everywhere anyway, significantly reducing the benefit of those functions. Now, that failure will be handled just like a memory allocation failure, which is not entirely correct but which should be close enough for practical purposes and significantly simplifies code.

There are also a few more minor fixes: a compilation failure in kafs for Solaris 11 and later, and some additional support and fixes for determining Apache compilation flags and headers.

Finally, I've started writing POD documentation for the APIs provided in the util library. So far, there's only documentation for xmalloc, xcalloc, and xrealloc. More of that documentation will be fleshed out in future releases.

You can get the latest release from the rra-c-util distribution page.

2012-09-18: krb5-sync 2.3

The primary change in this release is a serious bug fix for MIT Kerberos. When a new principal is created with addprinc -randkey, the password parameter is NULL, which caused a segfault inside the plugin. Silently ignore that case, since this module can only synchronize passwords and can't do anything with a key randomization.

The plugin is now installed in a kadm5_hook subdirectory, matching the layout expected by MIT Kerberos.

krb5-sync-backend, when running in silent mode, now ignores "Operation not permitted" errors from krb5_set_password. Heimdal 1.5.2 returns this error from Active Directory if the account doesn't exist.

There are also multiple fixes to the build system and portability layer, bring it up to date with the latest rra-c-util release.

You can get the latest version from the krb5-sync distribution page.

2012-09-18: Debian Policy

I just uploaded Debian Policy, which includes the implementation of the Technical Committee decision to make build-arch and build-indep mandatory targets and which significantly reworks the section on shared libraries.

Nothing here is release-critical for wheezy, and uploads targeted for wheezy should not attempt to update packaging for a new version of Policy. I went into some more detail on debian-devel-announce.

The version number probably should have been given the build-arch and build-indep changes and the work on symbols files. Ah well.

Here's the upgrading checklist:


New tasks archive section.


build-arch and build-indep are now mandatory targets in debian/rules.


New section documenting the Vcs-* fields, which are already in widespread use. Note the mechanism for specifying the Git branch used for packaging in the Vcs-Git field.


The deprecated relations < and > now must not be used.


New Built-Using field, which must be used to document the source packages for any binaries that are incorporated into this package at build time. This is used to ensure that the archive meets license requirements for providing source for all binaries.


Policy for dependencies between shared libraries and other packages has been largely rewritten to document the symbols system and more clearly document handling of shared library ABI changes. symbols files are now recommended over shlibs files in most situations. All maintainers of shared library packages should review the entirety of this section.


Packages must not assume the /run directory exists or is usable without a dependency on initscripts (>= 2.88dsf-13.3) until the stable release of Debian supports /run.


Packages including MIME configuration can now rely on triggers and do not need to call update-mime.


New section documenting general requirements for alternate init systems and specific requirements for integrating with upstart.


All copyright files must be encoded in UTF-8.

2012-09-21: lbcd 3.4.0

The first new release in six years!

I inherited this package from a former co-worker and had made some minor fixes over the years, but my C packaging standards and utility libraries have evolved drastically since I started working on it. In 2009, I started bringing the coding style and code layout up to date, but then never finished. I finally took the time this week to mostly complete that work and get a new release out the door.

This release also includes various improvements contributed in the past six years, including a port to Mac OS X by Clif Redding (who has probably been waiting patiently since 2007 for it to show up in a release) and fixes to the LDAP local probe from Quanah Gibson-Mount. While I was cleaning things up, I also fixed the HTTP check to really check the status code from the server and fixed a memory overwrite if there are more than 512 unique local users.

This release drops support for NeXTSTEP, ULTRIX, and SunOS. It's unlikely that lbcd would actually compile on those platforms. I did keep the other platform support, although some of those are dubious at this point and I can no longer test on most of them.

I only managed the tip of the iceberg in terms of cleanup, and this release doesn't have IPv6 support yet and still uses rather awkward ways of passing data around between components. It also doesn't do all the logging that it should have. Hopefully now that I've broken the ice with a new version, I'll find time to make further improvements on a faster time scale.

You can get the latest release from the lbcd distribution page.

2012-09-25: remctl 3.3

After some changes to our internal account creation system, which uses Java with a connection pool and reuses an open remctld connection, we uncovered a file descriptor leak in remctld. You'll only see this with clients that hold a connection open for long periods, which is why we never saw it before.

This release fixes that issue, plus I set up valgrind testing to look for any other leaks and fixed a variety of relatively minor memory leaks. These are mostly small leaks in infrequent operations, such as error handling cases or when re-reading the remctld server configuration.

While doing valgrind testing, I noticed that remctld would write its PID file some time before the network setup was complete. This was mostly only noticable with valgrind, which slows the process down considerably, but it's a theoretical problem at any time. That's also fixed in this release.

Other changes in this release include removing prototypes from the Perl remctl() function so that its arguments can come in the form of an array and fixing some build dependency and compiler flag issues when building the language bindings.

You can get the latest release from the remctl distribution page.

2012-09-27: WebAuth 4.3.2

WebAuth versions starting from 4.3.0 have a memory pool allocation error that affects attempts by mod_webauth to obtain a service ticket from a WebKDC. Occasionally, with the right alignment of memory pools, the Kerberos authenticator included in the service token request will be corrupted, and the WebKDC will reject it with an ASN.1 error. This only affects the mod_webauth module, not the WebLogin server or WebKDC.

This release fixes only that (fairly serious) bug. All users of WebAuth 4.3.0 or WebAuth 4.3.1 should upgrade their mod_webauth to this release.

You can get the latest release from the official WebAuth distribution site or from my WebAuth distribution pages.

Last modified and spun 2017-03-25