Thu, 27 Oct 2005
Using a Verisign SSL Certificate with mod-ssl
I received a Verisign-signed SSL certificate today. When trying to install it under Apache/mod-ssl, I got the following errors:[Thu Oct 27 12:18:26 2005] [error] mod_ssl: Init: Unable to read server certificate from file /www/.../www.example.com.crt (OpenSSL library error follows)
[Thu Oct 27 12:18:26 2005] [error] OpenSSL: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag
[Thu Oct 27 12:18:26 2005] [error] OpenSSL: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error
I got a similar error when trying to inspect the certificate using openssl directly:$ openssl x509 -in www.example.com.crt -noout -text
unable to load certificate
32741:error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag:tasn_dec.c:946:
32741:error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error:tasn_dec.c:304:Type=X509_CINF
32741:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_D2I:nested asn1 error:tasn_dec.c:566:Field=cert_info, Type=X509
32741:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:82:
Thanks to Dr.
Henson on the OpenSSL mailing list, I discovered the the certificate was
packed in the PKCS#7 format.
So, after converting the certificate using the following command, openssl was
able to read the certificate:openssl pkcs7 -in www.example.com.crt -print_certs -out www.example.com.crt.new
Sat, 08 Oct 2005
Oracle Buys Innobase
Oracle announced yesterday that they've purchased Innobase. There aren't too many details yet.
Innobase is the Finnish company which developed the InnoDB engine for MySQL. InnoDB brought MySQL many of the features necessary for deployment in non-trivial installations, including support for transactions, row-level locking, and foreign key constraints. These are some of the features that would allow MySQL to be used in place of a commercial database such as Oracle. With the imminent release of MySQL 5.0, which includes support for stored procedures, triggers, and views, even more applications could be built on MySQL.
One of the main features in which Oracle beats out MySQL is in clustering. MySQL's clustering, the NDB engine is stil rather immature, and from what I understand, not having ever used Oracle, it has some nifty clustering. I'm sure that it has some other cool features that I've heard of. So, are we likely to see some Oracle technology make it's way into MySQL? Or more pressure to purchase licenses where they aren't needed?
Thu, 06 Oct 2005
Blackberry 7290
The BlackBerry service frequently logs into my IMAP server and delivers new messages to the handheld (RIM lingo for their phone/PDA devices). Deleting a message on the handheld can optionally delete it on the IMAP server. So far, I've had one incident in which the BlackBerry pulled in a few old messages as new. I'm not sure how it decided to pull in these three or four messages from my inbox of 8900 messages (yeah, I'm do for a cleaning). The BlackBerry mail software is not a full-fledged IMAP client. It's not possible to retrieve mail from folders other than the INBOX, nor even get to old messages already in the INBOX. I may look for a better third-party IMAP client.
Getting an SSH client to work on the BlackBerry was much more frustrating. It supports MIDP, which allows small Java applications to be installed. So immediately after getting the device, I installed midpssh, an open source SSH client. It was unable to connect to any ssh servers, though. Digging through the BlackBerry forums, I tried changing my APN settings, using different gateways and experimenting with entering my username and password vs leaving it blank. Nothing worked. I spent about five hours over the course of four days on the phone with T-Mobile support. I tried using Idokorro SSH, a commercial SSH client, with the same results. I was pretty sure that either something was wrong with my handheld or that my account hadn't been provisioned properly.
T-Mobile won't provide support for third-party applications, even ones provided on their co-branded Handango site, but the third or fourth BlackBerry support guy I talked to suggested that I could set up my BlackBerry as a modem to verify that it is working properly, and that they would be able to help troubleshoot if it wasn't.
So I set up the device as a modem in Windows within VMWare since there's absolutely no support for BlackBerrys under Linux, and I had the same problems. I was able to authenticate and bring up a PPP connection, but any type of network connections other than DNS queries failed. After another hour or so on the phone with T-Mobile, I was told someone would call me back on the next business day. Waiting for the call back, I tried once again to use the device as a modem, and what do you know, it worked. I started up midpssh, and it worked too. I'm sure my account just hadn't been set up properly despite having asked T-Mobile repeatedly to verify that it had been.
It's definitely not speedy to work in an interactive session over GPRS, but it'll do in a pinch.
The BlackBerry comes with a well-featured web browser. It's a full HTML browser which supports JavaScript and CSS. It even supports flash and svg, though I have those disabled.
Another great third-party application is Google's Local for mobile, which provides access to Google Maps (aka Google Local) from a custom J2ME application. I went to visit a friend in Santa Barbara last weekend and I didn't have to print out a Google Map like I usually do. You just step through each turn on the handheld. I used to use Google SMS from my old phone to find a nearby book store or the phone number of a restaurant, but this is much more useful.
I was actually planning on getting the 7105t, which has a normal phone form factor, but having tried to type on the 7105t's 20-key keypad, I'm glad I went for the full keyboard.
Data URL's
You learn something new every day. Jeremy's linkblog include a link to a data: URL image encoder. I'd never even heard of the data scheme.
The data: scheme allows data to be embedded within an HTML page (or other
document that supports URLs).
For example, take a look at the source of this image:
Neat, huh?
It's not very efficient since the embedded data can't be cached separately from the page, but it's still kind of cool.
Sun, 02 Oct 2005
The Economist Subscription Discount
The Economist is offering its subscribers discounts on gift subscriptions. The first gift (or personal renewel) is $98, and additional subscriptions are only $69. Unlike most magazines, it's pretty much impossible to find discounts on subscriptions to The Economist. Amazon sells subscriptions at the normal rate of $129.
The Economist is the only magazine I read now. I cancelled my subscription to Time after I started reading The Economist. It's great for keeping up on what's going on in the world without having to read a broadsheet, the format of which I hate.
If you're interested in a subscription, let me know, and we can split the difference between the gift price and my renewel, making each $83.50. The subscription would start at the end of December with the double issue.
Sun, 11 Sep 2005
Monitoring MySQL Replication Slaves
Drawing inspiration from the replication chapter of Jeremy and Derek's MySQL book, I recently set up monitoring to measure how far a MySQL slave is behind the master.
I created a simple table to store a timestamp.
CREATE TABLE `heartbeat` ( `timestamp` datetime NOT NULL default '0000-00-00 00:00:00' ); INSERT INTO heartbeat SET timestamp = NOW();
Master
The master updates the timestamp every second using a simple PHP script called
write_mysql_heartbeat.php.
<?php
$dbHost = 'dbhost';
$dbUser = 'mysql_admin';
$dbPass = 'PASSWORD';
$dbName = 'mysql_admin';
$conn = mysql_connect($dbHost, $dbUser, $dbPass) or die('Failed to connect to database');
mysql_select_db($dbName) or die('Failed to select database: ' . $dbName);
define_syslog_variables();
openlog('mysql_heartbeat', LOG_PERROR | LOG_PID, LOG_DAEMON);
$sql = 'UPDATE heartbeat SET timestamp = now()';
while (true) {
while (mysql_ping($conn) === false) {
syslog(LOG_WARNING, 'Lost connection to database. Will retry in 30 seconds.');
sleep(30);
}
if (! mysql_query($sql, $conn)) {
syslog(LOG_ERR, 'Failed to insert record: ' . mysql_error());
die();
}
sleep(1);
}
I have restartd make
sure that write_mysql_heartbeat.php keeps running with the following entry in
/etc/restartd.conf:write_mysql_heartbeat write_mysql_heartbeat "php4 -q /usr/local/bin/write_mysql_heartbeat.php"
Slave
On the slave side, I wrote a simple munin plugin to check how far the slave is behind the master. Munin is also configured to send alerts through nagios if the slave gets too far behind.
Here's /etc/munin/plugins/mysql_slave_delay:
#!/usr/bin/php4
<?php
$dbHost = 'slave-1';
$dbUser = 'mysql_admin';
$dbPass = 'PASSWORD';
$dbName = 'mysql_admin';
if ($argv[1] == 'config') {
# The host name this plugin is for. (Can be overridden to have
# one machine answer for several)
# The title of the graph
echo "graph_title MySQL Slave Delay\n";
# Arguments to "rrdtool graph". In this case, tell it that the
# lower limit of the graph is '0', and that 1k=1000 (not 1024)
echo "graph_args --base 1000 -l 0\n";
# The Y-axis label
echo "graph_vlabel seconds\n";
# We want Cur/Min/Avg/Max unscaled (i.e. 0.42 seconds instead of
# 420 milliseconds)
echo "graph_scale no\n";
# Graph category. Defaults to 'other'
echo "graph_category mysql\n";
# The fields. "label" is used in the legend. "label" is the only
# required subfield.
echo "seconds.label seconds\n";
# These two are optional. They are only used if you have
# configured your munin to tell a Nagios-server about any
# problems
echo "seconds.warning 30\n";
echo "seconds.critical 120\n";
# This one is purely to add an explanation to the web page. The first
# one is for the graph itself, while the second one is for the field
# "seconds".
echo "graph_info This graph shows how many seconds this MySQL slave is behind the master\n";
echo "seconds.info Number of seconds behind master\n";
# Last, if run with the "config"-parameter, quit here (don't
# display any data)
exit;
}
$conn = mysql_connect($dbHost, $dbUser, $dbPass) or die('Failed to connect to database');
mysql_select_db($dbName) or die('Failed to select database: ' . $dbName);
define_syslog_variables();
openlog('mysql_heartbeat', LOG_PERROR | LOG_PID, LOG_DAEMON);
$sql = 'SELECT UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP(timestamp) from heartbeat';
if (false === ($result = mysql_query($sql, $conn))) {
syslog(LOG_ERR, 'Failed to get record: ' . mysql_error());
die();
}
if (mysql_num_rows($result) != 1) {
syslog(LOG_ERR, 'Failed to find record for heartbeat: ' . $hostname);
die();
}
list($delay) = mysql_fetch_array($result);
echo "seconds.value $delay\n";
Output
The slave is falling behind while backups are running. I still need to do
something about that.
Pentax S5i
I bought my first digital camera last week. It's a Pentax S5i. I got it at Costco for $300, plus $90 for the 1GB SD card.
I wanted a camera that was small enough to carry around easily, but that takes great-looking pictures. The Pentax fits the bill. It has a ton of features that I haven't figured out how to use properly yet. I'll need to get a book on photography to learn when to adjust the white balance or exposure. Out of the box, it takes very pretty pictures though.
The macro mode allows me to take pictures very close-up.
I'm also enjoying the black-and-white filter and sunset mode.
Works with Linux
The camera plays nicely with Linux. It came with a USB cable, and upon plugging it in, it is detected as a scsi device using the usb-storage module, just like the iPod Shuffle.
Mon, 29 Aug 2005
Housing Bubble Fun
I spent way too much time figuring out how to use ImageMagick for that last
post to let it go to waste.
Right Now Pricing
There's a Jiffy Lube around the corner from my apartment. Sometimes when I walk to lunch in the afternoon, the mechanics are standing outside on the street with signs advertising their oil change service to passing cars. I think that's a good idea; rather than just hanging out waiting for customers, they're out touting.
But I didn't realize something even more interesting about their sales technique until yesterday. A few days ago, I pulled into the Jiffy Lube to ask how much an oil change was; it was $29.95 or $29.99. That seemed a bit expensive so I passed.
Yesterday, while I was walking home from Starbuck's after enjoying my free
latte from Insider Pages, I read the signs that the mechanics were holding.
They read:
Right Now
$19.95
Oil Change
When they don't have any customers, they cut the price by $10 bucks. That seems pretty smart. Other companies might want to try that. What other errands would you take care of at the vendor's convenience for a hefty discount?
I was at Chicago For Ribs last week with Denisa. It was about 2 or 3 in the afternoon, and there were 4 or 5 tables of customers. On staff were two servers and a bus boy. I wouldn't have thought anything of it, but Denisa pointed out that the management should send home the bus boy and one of the waiters. She briefly worked in the Chicago For Ribs in Santa Monica. That one was always over-staffed, and closed a few months after opening. (They also had a problem in that they gave away buy-one-get-one-free certificates on Third Street Promenade every day so every customer came in with a coupon.)
If they didn't want to send some of the extra staff home, why not have them stand outside with a sign advertising a Full Rack of Baby Backs for $10 Right Now?
Mon, 22 Aug 2005
How Spaghetti Breaks
Some researchers in France figured out why, when a piece of spaghetti is bent, it breaks into multiple pieces, rather than just breaking in half. They have a number of videos of their experiments. They found that even releasing one end of a bent piece of spaghetti can cause it to break.
The multiple breaking of bent rods, like dry spaghetti pasta, can then be understood as a cascade of releases (loss of cohesion upon breakings) followed by stress increases leading to new cracks.
