Development, Network, Security, Ideas & Opinions
As I was searching again for this (I once knew it, but I keep forgetting it), I will simply write it down here: if you want to see all the unattached devices in the device manager, you have to set the environment variable devmgr_show_nonpresent_devices to value 1. If you then start the device manager, you have to also check “Show hidden devices“.
This is documented in Microsoft KB315539.
So the mentioned MOD for prevention of posting URLs in phpBB2+ has now been deployed in the tag2find forum for one week. What can I say? ZERO SPAM postings within this period. I had hoped it would reduce it a little bit, I didn’t expect it to eliminate the SPAM problem at all. I just hope it is not preventing “ordinary” users from posting.
Next step in this experiment will be to disable the CAPTCHA image for anonymous posting, just keep it for signing up. I am really looking forward how this works out. The CAPTCHA has kept a lot of posters from posting, so I’d be very happy if I can disable it for posting.
At tag2find, we are using phpBB2+ for our forum. This forum unfortunately is continuously being spammed by bots, despite the active CAPTCHA. Even at the strongest setting of the CAPTCHA, SPAM postings were coming through, but the CAPTCHA drove off a lot of potential forum posters which could not get past it.
Therefore I wanted to implement the approach I took for our blog: disable the possibility to submit postings containing links. Unfortunately phpBB out of the box does not permit this. After searching a while I found a promising MOD which I now added to the forum. Its not directly preventing posting links, but is more or less a RegEx-based blacklist of words which must not be used by users who are not registered for a certain number of days and have not yet posted a certain number of posts. The regular expressions supplied aim at preventing posting links, but I had to modify them, as they also contain “.net” which we must allow since our application is written in the Microsoft .NET Framework, so this term is going to turn up legitimately.
Let’s see if this measure will actually change the amount of SPAM being posted to the forum.
As I am one of the developers of tag2find, I am also writing in the tag2find developer blog from time to time. This blog is a WordPress blog. One of our main problems there is fighting SPAM. We get literally dozens of SPAM comments a day. To limit the amount of SPAM visible on the blog itself, I found a very simple solution, which up to now did not produce any false positive: if a posting contains more than zero links, it will be held in the moderation queue.
WordPress offers this possibility out of the box, but the default is set to more than 2 links. I tried to limit it down to one, but this still missed to many SPAM attempts. Therefore I now have set it to zero. This works remarkably well. No SPAM postings anymore and we had just one or two false positives, which are not so bad as the comments are not deleted but just held for moderation.
I know, this is a very low-tech approach and puts some work on the maintainer of the blog, but it works almost out of the nature of SPAM, which most of the time wants to deliver links to pages to influence Google PageRank and/or lure people onto the website.
I have been using JetBrain‘s Omea Reader for quite some time and I was very happy with it. While this worked quite well as long as I was working just on one PC, I soon got trouble when I switched from the notebook to a dedicated desktop PC at home and a dedicated desktop PC at the office, while still keeping the notebook for the time in between. Omea Reader was no option any longer, as I have Linux at home and Windows in its various flavors in the office and on my notebook.
I tried several Java-based applications and tried to keep their databases in-sync between the PCs, but this work soon got boring and it happened to annoy me. So I thought I’d switch to an online alternative.
My choice soon fell for Google Reader, as I already had a Google account. Despite the privacy issues with giving my reading-habits away to big G, I am really happy with this reader. It features everything I need and is intuitive to use. I am most happy that there seem to be very knowledgeable people at Google, as they also provide a keyboard interface for navigating the feeds. This is something I really appreciate as I favor the keyboard over the mouse.
So anyone required to keep their RSS-feeds in sync between various PCs, I just can recommend giving Google Reader a try. I know there are others and I know Google Reader is not particularly new, but I just tried it out now (as I had the need for a service like this).
Google Reader is also one of the first applications to utilize Google Gears for offline functionality. This is particularly interesting for me as notebook user without a wireless broadband connection available all the time. Up to now I had no time to test it, but I will give it a try soon. I will write about my experiences then.
Note: I had this article prepared since a long time, but I forgot to publish it… This article of erik just reminded me to do so.
In a previous article I already mentioned Direct Web Remoting (DWR), the best AJAX-library I encountered up to now. I just had the time to re-discover it, as I sought something to get back to my Java skills. This library really keeps one promise: it really starts making fun to develop web-applications with AJAX. A short summary: DWR provides a very easy means for calling server-side methods which are hosted in a Java Servlet Container like Tomcat or Jetty. It masks the communication effort by providing client-side abstraction to the method calls of exported Java methods, so remote calls look local to the developer.
The new version 2.0 (release-candidate) introduces a new concept, which they call “reverse AJAX“. Reverse AJAX allows the server to asynchronously send data to its clients. It works by either polling, persistent connection or additional information on your next AJAX call. It means, that the server at any time can push data to the client, without the client’s request. In “persistent connection” this works almost “real-time”, while polling takes at least a poll-interval to notice the new information and additionally increases load on the server.
This feature allows highly interactive applications where new information can be published right away, in best case without noticeable delay. Developing a simple chat-application becomes the matter of just a few lines of server-side code.
For an example of what you can easily do now, look at this example (fake) stock ticker, which updates the data on the client without the client being required to poll for changes. Also note the simple, yet cool, inclusion of script.aculo.us effects during the update. (Hint: you need to move the mouse over the table for the application to start.)
The downside is, the feature is still in an early stage of development, it still has some problems. On my Gentoo Linux box, I can reproducibly increase my CPU load to 100% by duplicating a tab with an open persistent connection in Opera. In Firefox, duplicating the tab leads to normal AJAX calls to no longer function with about 50% chance. If Firefox enters this mode, it will queue up XMLHttpRequest causing a “normal” call to be queued behind the persistent call which will be kept open for around 60 seconds if no data is pushed from the server or even longer, if there is data. This of course makes it almost unusable at the moment, unless you can be sure, users won’t hit your site twice within the same session and/or are not using tab-duplication.
I’m really looking forward to this feature becoming stable, this is so cool and you can do so much awesome stuff with it. Thanks to all developers for their great work!
This is just a keep-alive post. As my last article has been published over three months ago now, I thought it would be time to at least write something in order to mark this blog as “not dead”. Well, I know I have no readers, so finally I’m just telling myself that I intend to write something again soon 😉 But in opinion an abandoned website is worse than no website at all. So, this website is now officially no longer “out-dated”, as there is an up-to-date article. Thanks for reading 😉
Update: Ok, now I got into writing and already published an article with a little bit more appropriate content for this blog 😉
In an earlier article I made a mistake. I told that Microsoft Vista x64 will only work with signed drivers and assumed (wrongly) that this means every driver has to go through the WHQL program for getting a signature of Microsoft’s driver quality program, which would be a quite costly process.
I now discovered an older (German) blog-article by Daniel Melanchton, in which he points out that only a digital signature with a certificate from a trusted CA is required. It seems that it is not required to go through the WHQL process, you just need a certificate. The trusted CAs seem to comprise most root authorities also accepted by Internet Explorer by default, so driver developers are not dependent on Microsoft for getting a signature.
While this still might be a problem for some established Open Source drivers, it is still an affordable and in my opinion useful approach, as digital signatures at least in most ways make the originator of a software known. Of course, this does not tell anything about the quality of the software nor if it is benign or malware. Microsoft’s approach seems to be that without force hardly any publisher will sign their drivers. Unfortunately, they might be true…
Update 2007-02-21: It seems that I still missed one point. The “Secure Media Path” depends on a valid Microsoft signature. Without this signature, drivers are supposed to disable the “Secure Media Path”, so that high-quality (e.g. HDTV, Dolby 7.1) multimedia content is rendered to lower quality.
I am currently migrating my server configuration away from mod_php towards mod_fcgid (the successor of mod_fastcgi), as this allows me to use different users for executing scripts in different directories. I use this to have every hosted virtual domain using its own system user. This should (in theory) prevent one buggy application to take over all other hosted domains as well.
I though faced one problem: I could not get phpMyAdmin working and this was a requirement of one of my clients. phpMyAdmin kept popping up the authentication dialog over and over again when using HTTP Basic Authentication.
After searching some time, I noticed that, when using PHP in CGI mode, the authentication data is not passed over to the script by default. A FAQ entry of phpMyAdmin brought the solution to this issue: a ReWrite Rule was needed for the directory containing phpMyAdmin:
RewriteEngine On
RewriteRule .* - [E=REMOTE_USER:%{HTTP:Authorization},L]
Suddenly phpMyAdmin worked 😉
I’m a passionate Gentoo Linux user, but on my notebook I use primarily Windows XP. I always missed some applications, mostly GnuCash, which has not been ported to Windows right now.
Some time ago I came around andLinux, a virtual Linux for Windows. andLinux is based on coLinux and uses the Ubuntu package repository. It is currently in beta stage, because it is still missing an installer. The download is about 130MB and extracts around 2GB to the HDD. Main advantage of coLinux is (unlike VMWare) that memory for the started processes is only allocated as required, as it is not run in a virtual machine but every started process is a real process on the host system.
Continue reading “andLinux – Using Linux on Windows”