Record Stream Using VLC

I just needed to record a video stream. Usually, I use mplayer for these kinds of jobs, but this time it failed. However, on the internet I found a way to do it using VLC, which apparently has quite a command line interface.

This comment revealed that the VLC media player comes with some command line magic. Of course, not much is documented in the man page, but the user guide on their website seems to be useful.

Long story short, I ended up with the following command to save the stream http://STREAM.mp4 to /tmp/file.mkv :

vlc http://STREAM.mp4 --sout="#std{access=file,mux=mkv,dst='/tmp/file.mkv'}" vlc://quit

Cool.

For the records, here are some alternatives:

# using mplayer
mplayer -dumpstream http://STREAM.mp4 -dumpfile /tmp/file.mp4
# using ffmpeg
ffmpeg -i http://STREAM.mp4 -acodec copy -vcodec copy /tmp/file.mp4

New GPG Key

It was time to finally replace my old GPG key. I created the key in 2008 and from today’s perspective a 1024 bit DSA key is really weak. Thus, today I decided to move to a new key and created a 4096 bit RSA key.

My old key was

pub   1024D/446DB306 2008-07-15 [expires: 2017-07-13]
      Key fingerprint = 0E75 62A5 405E 65B1 B477  4215 D9B3 5173 446D B306

And the new key is:

pub   4096R/8D2DD9BD 2014-01-15 [expires: 2019-01-14]
      Key fingerprint = 08E6 6E72 A83A 9871 CD49  3441 E81B C307 8D2D D9BD

For those of you who already trust my old key I created a transition note which is signed by both my old and my new key.

To import my new key to your key chain you can use the following command:

gpg --keyserver pgp.mit.edu --recv-key 8D2DD9BD

The new key is already signed by the old key. Those of you trusting my old key may verify the signature using:

gpg --check-sigs 8D2DD9BD

To sign the new key execute the following command:

gpg --sign-key 8D2DD9BD

And it would be nice if you upload the signed to one of the key servers:

gpg --keyserver pgp.mit.edu --send-key 8D2DD9BD

You are of course free to give me a call in order to verify the fingerprint ;-)

Gajim idling error

Just stumbled upon a small bug in Debian’s version of Gajim (0.15.4-2 – currently in testing and sid).

The following error occurs when Gajim starts to idle:

Traceback (most recent call last):
  File "/usr/share/gajim/src/common/xmpp/idlequeue.py", line 533, in _process_events
    return IdleQueue._process_events(self, fd, flags)
  File "/usr/share/gajim/src/common/xmpp/idlequeue.py", line 394, in _process_events
    obj.pollin()
  File "/usr/share/gajim/src/common/xmpp/transports_nb.py", line 420, in pollin
    self._do_receive()
  File "/usr/share/gajim/src/common/xmpp/transports_nb.py", line 606, in _do_receive
    self._on_receive(received)
  File "/usr/share/gajim/src/common/xmpp/transports_nb.py", line 620, in _on_receive
    self.on_receive(data)
  File "/usr/share/gajim/src/common/xmpp/dispatcher_nb.py", line 488, in dispatch
    handler['func'](session, stanza)
  File "/usr/share/gajim/src/common/connection_handlers.py", line 2009, in _StreamCB
    conn=self, stanza=obj))
NameError: global name 'obj' is not defined

This results in a dis- and a subsequent reconnection. As the traceback already suggests the error can be found in /usr/share/gajim/src/common/connection_handlers.py on line 2009. This is the corresponding function:

def _StreamCB(self, con, iq_obj):
        log.debug('StreamCB')
        gajim.nec.push_incoming_event(StreamReceivedEvent(None,
            conn=self, stanza=obj))

Obviously, there is no variable obj : The passed argument is called iq_obj … To fix that mistake just substitute the function definition with (replace iq_objobj in line 2006):

def _StreamCB(self, con, obj):
        log.debug('StreamCB')
        gajim.nec.push_incoming_event(StreamReceivedEvent(None,
            conn=self, stanza=obj))

This bug is already fixed in their repository (13861:239ec662de5a). Thus, this article is mainly for people not familiar with python/programming, who need a quick fix. (wasn’t able to find something on the Internet)

Btw. I’m not sure why, but this error just affected one of my four machines which are running Gajim.

Challenge is over.

SEMS challenge
SEMS challenge

About 6 or 10 moths ago we were searching for a student to work with us in the SEMS project. In order to reduce the number of applications I started a challenge. To solve this challenge you had to show some understanding for basic techniques and programming languages, so we didn’t waste our time with people not able to write a single line of source code.

And what should I say? It was successful! We’re now a great team with three students :D

However, currently this challenge seems to spread over the internet. And lot’s of people try to solve it (and many submit a wrong answer^^). But even worse, some of you guys try to exploit it by submitting something like

"; SHOW TABLES;

In general I don’t care. It was just some lines of PHP that send me an email in case of a correct answer. There is no database and the worst that can happen is a full inbox, but now I decided to close this challenge and instead forward users to this article.

Thus, if you arrive here feel free to apply for a job! I guess all of my readers, even if they didn’t solve this challenge, are perfect fellows…

If you nevertheless want to give it a try you can download the challenge.

Extended MyTinyTodo

MyTinyTodo is a self-hosted todo-list which convinces by its simplicity. It allows to maintain several different lists, you can assign tags, priorities and due dates to certain tasks. I used it myself for a long time and decided to fork the project in order to implement some stuff I missed in the original version.

 Figure 1: MyTinyTodo Result
Figure 1: MyTinyTodo Result

I do not intend to talk about MyTinyTodo a great deal. Very tiny, does nothing that isn’t necessary. No Dropbox/Facebook/Instagram etc integration. I really like this kind of software :D

But I was missing an essential feature: Creating tasks via mail. Lucky us, MyTinyTodo is distributed under the terms of GPLv3 license. Thus, I hg clone d and extended the tool with desired functionality. And since the IDE was already opened I added a tiny authentication (now: username + password; previously: .htaccess ) and secured the API by introducing a signature. Nothing special or complex, but it had to be done.

Long story short: I’m now able to submit tasks via e-mail. That means, a mail containing the following:

To: todo@your.server.tld
Subject: My New TodoItem
some more text

to describe this todo item

priority:1
tags:someTag1,someTag2
duedate:nextweek
list:myNewList

will result in something similar to Figure 1. All possible attributes that are recognized in the mail body are listed at the wiki on GitHub.

Find out more on GitHub.

Integrating Tomcat with Apache

You can configure the Apache web server to forward requests to Tomcat. Thus, you can speak to both servers on ports 80 or 443 and get rid of the :8080 for your Tomcat applications. I’m somehow doing that very often, so here is small how-to for copy&paste purposes.

Install jk

As you might know, while Tomcat is Java stuff Apache is written in C. So in general it’s not that easy to get them talking to each other. The key to achieve an integration is called mod_jk (see The Apache Tomcat Connector). So first of all you need to install it:

aptitude install libapache2-mod-jk

If it is installed you can configure an AJP worker in /etc/libapache2-mod-jk/workers.properties :

# Defining a worker named ajp13_worker and of type ajp13
# Note that the name and the type do not have to match.
#
worker.ajp13_worker.port=8009
worker.ajp13_worker.host=localhost
worker.ajp13_worker.type=ajp13

As soon as this is done the bridge is ready to close the gap between Apache and Tomcat.

Configure Tomcat

We need to configure an AJP connector on port 8009 . So open /etc/tomcat7/server.xml and add another connector next to the other ones:

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="127.0.0.1"/>

If you’re lucky there is already such a connector defined in the comments. So just remove the comment…

Configure Apache to speak through jk

Here I’ll show you how to setup a virtual host. For example, copy the following to /etc/apache2/sites-available/012-yourapp.conf :

<VirtualHost *:80>
      ServerAdmin some@body.tld
      ServerName yourapp.yourserver.tld
      ServerAlias ya.yourserver.tld

      RewriteEngine on
      RewriteRule ^/(.*)$ /YourApp/$1 [L,PT]

      JkMount /* ajp13_worker
</VirtualHost>

Ok, let me shortly explain what I did there.

  1. Everything that arrives at this vhost gets forwarded to our previously defined AJP worker (line 9)
  2. I assume your Tomcat webapp is running on server:8080/YourApp , therefor I configured a substitution of the URL to insert /YourApp (line 7). Of course you need to have mod_rewrite installed and enabled. (You may skip this line if you’re fine with having /YourApp in all your URLs)
  3. The rest should be clear. The vhost is available at http://yourapp.yourserver.tld , as well as at http://ya.yourserver.tld (lines 3&4). You can also use SSL, just configure line 1 to listen at *:433 and add the SSL stuff to the body of your vhost. (SSL exmaple)

Afterwards, enable the vhost to populate it:

a2ensite 012-yourapp

Give it a try

If this is done just restart everything:

service tomcat7 restart
service apache2 restart

Now Apache forwards all requests to http://yourapp.yourserver.tld to your Tomcat webapp at http://yourserver.tld:8080/YourApp .

Find all Text Files, recursively

Because I was thinking of something like that for a long time.

In bash/zsh (add it to your .rc ):

textfiles ()
{
    file $(find $*) | /bin/grep -E 'text|empty' | cut -d ':' -f1
}

Using this function it’s possible to open all text files of a project at once:

kate $(textfiles project/*)

Change Title of moderncv Document

Once again I had to prepare a CV for an application. I’m using the moderncv package to create the CV in and I was always bothered about the title of the document. Today I spend some time to fix that.

 moderncv produces an ugly title
moderncv produces an ugly title

Using moderncv you can produce really fancy CV’s with very little effort. But unfortunately, by default it produces an ugly title (see the screenshot taken from Okular). As you can see, there is some character that cannot be displayed by certain tools.

I guess most of my “CV-reviewers” don’t care about this little issue, if they recognize it at all, but it bothers me whenever I have to create a resumé. I already tried to override it using the hyperref package, but wherever I put the statement it seems to have no effect.

However, since moderncv is open source (yeah! lovit) I took a look at the code to see how they produce the title. It was quite easy to find the concerning statement (in my case /usr/share/texlive/texmf-dist/tex/latex/moderncv/moderncv.cls:96 , texlive-latex-extra@2012.20120611-2):

\AtEndPreamble{
  \@ifpackageloaded{CJK}
    {\RequirePackage[unicode]{hyperref}}
    {\RequirePackage{hyperref}}
    \hypersetup{
      breaklinks,
      baseurl       = http://,
      pdfborder     = 0 0 0,
      pdfpagemode   = UseNone,% do not show thumbnails or bookmarks on opening
      pdfpagelabels = false,% to avoid a warning setting it automatically to false anyway, because hyperref detects \thepage as undefined (why?)
      pdfstartpage  = 1,
      pdfcreator    = {\LaTeX{} with `moderncv' package},
%      pdfproducer   = {\LaTeX{}},% will/should be set automatically to the correct TeX engine used
      bookmarksopen = true,
      bookmarksdepth= 2,% to show sections and subsections
      pdfauthor     = {\@firstname{}~\@familyname{}},
      pdftitle      = {\@firstname{}~\@familyname{} -- \@title{}},
      pdfsubject    = {Resum\'{e} of \@firstname{}~\@familyname{}},
      pdfkeywords   = {\@firstname{}~\@familyname{}, curriculum vit\ae{}, resum\'{e}}}
  \pagenumbering{arabic}% has to be issued after loading hyperref
}

As expected the pdftitle contains a double-hyphen that is converted by latex to a dash. Apparently a problem for some programs. To fix this issue you could sudo:modify this file, but that’s of course messy. Better add something like the following to the end of the header of your document:

\AtEndPreamble{
\hypersetup{pdftitle={Your New Title}}
}

This will override the broken output of the package.

Check if certain Port is Open

Just needed to get to know whether something listens at a certain TCP port on a particular host.

Here is my workaround using Perl:

my $sock = IO::Socket::INET->new (
	PeerAddr => "1.2.3.4",
	PeerPort => 1337,
	Proto => "tcp",
	Timeout => 1
);
echo "closed" if !defined $sock;

Works at least for me. Any concerns or better solutions?

The Password Dilemma

Earlier this week I had a very small conversation with Pedro Mendes on twitter (well in terms of twitter it might be a long dicussion). It was initiated by him calling for suggestions for a password safe. I suggested better using a system for your passwords, which he thought was a bad idea. So lets have a look at both solutions.

You all know about these rules for choosing a password. It should contain a mix of lower and upper case letters, numerals, special characters, and punctuation. Moreover, it should be at least eight characters long and has to be more or less random. Since our brain is limited in remembering such things we tend to use easy-to-remember password (e.g. replacing letters using leet). But of course hackers are aware of that and it is quite easy to also encode such rules in their cracking algorithms. Equally bad is using one strong password for all accounts. So, how to solve this problem?

Using a Password Safe

The first good idea is using very strong passwords for every account and writing them down, so you don’t have to remember them. You probably often heard that writing passwords on a sheet of paper is a very stupid idea. And storing them in a document on your desktop is even worse. But there are lots of tools that help you with that problem, e.g. KeePass or KeePassX, just to name two open source solutions. You can organize your passwords and store them in an encrypted file. Thus, you just have to remember one single password to open this safe. These tools often include an excellent password generation functionality that helps you choosing passwords. And even if another website gets hacked, you just need to open your safe and replace the password with a new one. Very convenient.

Unfortunately, this solution also comes with some drawbacks. Since you cannot remember a single password you always need to have this safe with you. I usually use five different machines, so you have to distribute this file (at least to have a backup). And of course you want to have it in sync, so you might want to store it in a cloud or something. But every copy of this safe increases the chance that an attacker gets access to it. Moreover, you cannot put a subsafe containing only passwords for trivial accounts (like twitter) on your mobile phone (which I also do not trust). So, there are many weak points to get access to the safe (e.g. a design fail of the cloud, a bug in the cloud, an evil system administrator having access to your PCs at work, a law enforcements etc.). And as soon as the attacker has access to this file he just has to crack one human rememberable password to see the whole collection of your passwords. Probably including login names and links to the web sites. Worst case scenario.

Using a Password System

The second idea is using a system to generate passwords for each account. You have to choose a very strong password , and a function that creates a unique password for every account using and the (domain) name of the related service: . You just need to remember this very good and . Depending on your paranoia and your mind capabilities there are many options to choose . An easy might just put the 3rd and last letters of at the 8th and 2nd pos in (see example below). More paranoid mathematicians might choose an that ASCII-adds the 3rd letter of to the 8th position of , puts the at the 2nd position in , and appends the base64 representation of the multiplicative digital root of the int values of the ASCII letters of to . Here you can see the examples:

u:M~a{em0 twitter ur:M~a{eim0 u2.6:M~a{eW0Mi4yNDU2MjFlKzE0Cg==
u:M~a{em0 google ue:M~a{eom0 u2.4:M~a{e]0MS40MjU4MjNlKzEyCg==

So, you see if the password for twitter gets known the hacker isn’t able to log into your google account. To be honest, I guess that nobody will choose , but I think even is quite good and leaves some space for simple improvements.

However, as expected this solution also has some dramatic disadvantages. If one of your passwords gets compromised you need to change your system, at least choosing a different and maybe also an alternative for . As soon as a hacker is able to get two of these passwords he will immediately recognize the low entropy and it is not difficult to create a pattern for your passwords making it easy to guess all other passwords.

Conclusion

This is not to convince somebody to use one or the other solution, its more or less a comparison of the pros and cons. In my opinion the current password mechanism is sort of stupid, but we need to find the least bad solution until we have some alternatives. So what about creating a small two-factor auth system? You could combine the two above mentioned solutions and use a password safe in combination with a password system. So keep a short lock in mind which is necessary to unlock the passwords in the safe. Maybe something like 29A which you have to add to every password (on some position of your choice, e.g. just append it). Thus, if a hacker breaks into one service only a singe password is compromised and you just need to update this entry in your safe, and if your whole safe is cracked all passwords are useless crap. Of course you have to create a new safe and update all your passwords, but the guy who knows your old “passwords” doesn’t know how to use them. However, we are discussing on a very high level. The mentioned scenarios are more or less just attacks against a particular person. I am a sysadmin, so I would already be very glad if users won’t use passwords like mama123 and stop sending passwords in clear-text mails!

Supp: The Conversation

just for the logs (in twitter chronology: new -> old):

Pedro Mendes @gepasi at 1:13 PM - 30 May 13
@binfalse I agree, but using 30 character completely random ones seems to be the best.

martin scharm @binfalse at 5:40 PM - 29 May 13
@gepasi either using a password safe (which also has drawbacks) or a system with a strong p and a complex f.

martin scharm @binfalse at 5:39 PM - 29 May 13
@gepasi however, i support the attitude seeing every pw as compromised. so the most important rule is using unique pws for every service.

martin scharm @binfalse at 5:39 PM - 29 May 13
@gepasi even after reading this article i’d say that ur:M~a{eim0 is quite strong and i’d expect to find it within the 10% uncracked.

Pedro Mendes @gepasi at 1:18 PM - 29 May 13
@binfalse but thanks for the tip on KeePassX

Pedro Mendes @gepasi at 1:18 PM - 29 May 13
@binfalse a system is not recommended. Anything a human can remember is broken within 24h. Read http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/

martin scharm @binfalse at 1:03 PM - 29 May 13
@gepasi and even if someone breaks into twitter, your google passphrase (“ue:M~a{eom0”) isn’t compromised.

martin scharm @binfalse at 1:03 PM - 29 May 13
@gepasi quite easy to remember (when you know p), very hard to guess and brute-forcing the related hash really takes some time.

martin scharm @binfalse at 1:03 PM - 29 May 13
@gepasi e.g. p=”u:M~a{em0” and n=”twitter” would result in “ur:M~a{eim0” as a password for twitter.

martin scharm @binfalse at 1:02 PM - 29 May 13
@gepasi you just need to remember p and f, which may put the 3rd and last letter of n at the 8th and 2nd pos in p.

martin scharm @binfalse at 1:02 PM - 29 May 13
@gepasi choose a password p (as strong as possible) and a function f(p,n) that creates a unique password from p and a (domain) name n.

martin scharm @binfalse at 1:02 PM - 29 May 13
@gepasi afaik KeePassX is a good one. but i recommend to use a system!

Pedro Mendes @gepasi at 9:07 AM - 29 May 13
I need suggestions for a good password manager. Ideally only local storage (ie no cloud storage)