Redhatter (VK4MSL)

Gentoo/MIPS on QEMU

I’m in the process of installing Debian/MIPS on QEMU. Why might you ask? Well… the situation only came up just recently.

It seems there is some interest in running Gentoo on the QEMU virtual machine. The catch: QEMU emulates a MIPS Malta board with a 4Kc processor — which implements the MIPS32 ISA (a superset of MIPS2).

Until recently, this was impossible, as we did not produce stages for anything less than MIPS3 on big-endian MIPS, or MIPS4 on little-endian. MIPS32 is officially defined as the 32-bit subset of MIPS64, thus implements all the 32-bit instructions present in MIPS64, MIPS4, MIPS3 and completely implements MIPS1 and MIPS2.  It doesn’t however, implement any of the 64-bit instructions in these ISAs, which is where users come unstuck.  I produced some MIPS1 stages for little-endian MIPS, so in theory, the port is possible.

There’s also the question of performance — the guide I’m following suggests I can expect the performance of an R4400 200MHz Indy when ran on a 3GHz AMD64 host. Unfortunately for me, my host is a 1.4GHz Pentium 4. So I’m expecting things to be quite slow.

If things test okay, I might look into how one compiles a kernel for QEMU, and see if it’s worthwhile, since QEMU is much easier to get hold of then most supported MIPS platforms. It’s not known if mips-sources will be suitable, theoretically it should be, but this has never been tested. Support will be quite minimal, since most second hand SGI machines I suspect will outperform QEMU many times over. At the moment, my VM is “installing core packages” (yes, debian-installer is quite stingy on information), after which, I should be able to set up Gentoo on a second virtual HDD.

Support will likely take the form of a minimalist HDD image and kernel that can be booted on the VM.

2007/08/11 by Gentoo Development Linux Development Public Syndication Uncategorized 3

Gentoo/MIPS Status Update

Hi All…

Figured I better let you know what’s happening from where I’m sitting, since it’s been a while.

Mozilla Package Support on MIPS…

For the past month or so, I’ve been faced with a few problems. Firefox 2.0.0.4 has decided to not compile, despite 2.0.0.3 working fine … It would appear I need to re-jig this MIPS patch so that it works with the updated codebase. The patch I specifically refer to is the 006_mips-asm.patch file that you’ll notice included in all the patchsets distributed with Firefox and Thunderbird. Without it, Mozilla uses assembly code specially crafted for the Sony Playstation II — an incompatible machine to just about every other MIPS machine in existence.

Thunderbird has its own problems too. People may have noticed -mips KEYWORDS on the 2.0 series and my refusal to mark >1.5.0.8 stable? Seems there’s a bizzare bug that only happens to me on big-endian MIPS (mips-unknown-linux-gnu) when talking to my local IMAP server (running B-Inc IMAPd 1.2.12). On little-endian MIPS (mipsel-unknown-linux-gnu), everything works flawlessly. Indeed, I’ve been using Thunderbird 2.0 on mipsel for the past few months without issues… if mipsel was our only architecture, it’d be keyworded in a heartbeat, but it’s not. The problem manifests itself in two ways: one is the apparent non-existant mail folders, the other is hanging in an infinite loop apparently switching folders. I’ve tried strace and other tools to no avail… but my biggest problems revolve around my (big-endian) boxes being quite slow and my limited time. Needless to say… I’d appreciate others’ comments on this issue if they’ve experienced these problems with Thunderbird, or if indeed, it works on their SGI box.

Adventurous users can try it for themselves by editing the relevant ebuild directly and running ebuild foo.ebuild digest before attempting a merge.

Gnome packages…

I’ve began trying a test-compile of Gnome 2.18.0 on MIPS lately… largely to see just how much of it is actually broken. Unsurprisingly, much of it failed in N32… mono being one spectacular failure: it got stuck in an infinite loop and filled up the disk printing debugging output, which of course portage logged in the package’s build.log. My O2 is busy doing many of the package builds here, progress being quite slow. Needless to say, there’ll be updates on the situation as I get each part built. I strongly doubt this will lead to a re-keywording of Gnome on MIPS however, because frankly, it’s a pain in the arse to maintain.

Possible support for Loongson on the horizon…

This is the first time I’ve discussed this on Gentoo Planet… Others may recall seeing my Gentoo Universe post talking about my usage of a Lemote Fulong minicomputer… No official decision has been made at this time, but behind the scenes work is already underway to allow support for this architecture under the Gentoo/MIPS banner. This is the box that I’ve been doing much of my little-endian testing on, since a 660MHz Loongson 2E will outperform a 250MHz RM5231 any day. Ultimately, I’d like to see this machine become officially supported, as I suspect it’ll be machines like this that will keep the MIPS port alive. The SGI boxes currently supported will eventually fail, and as the pool of parts dries up, so will our users.

At present, these boxes can be made to run Gentoo no problem. You need a small patch for xorg-server to prevent a nasty segfault when starting X, and of course, the kernel needs some patches that are not yet in mips-sources (or upstream). Work is being done in an overlay hosted by Lemote for now, but as soon as I get the official go-ahead, I’ll start moving things into the main Gentoo tree.

glibc upgrade issues…

Some users have reported issues when upgrading to glibc-2.5, essentially the build seems to cause hard-locks on some IP28 and IP30 users (me included). Work is still ongoing to track down why this occurs — as always though, feedback would be appreciated.

Cobalt IDE-related issues…

On later mips-sources kernels, some users have reported kernels failing to detect their IDE HDDs. I haven’t been able to test since 64-bit kernels are broken (I run a 64-bit kernel on my Qube2 for N32 testing) in other Apparently the issue is related to hotplug support — yes, despite the machine having no hot-pluggable interfaces, you still need hotplug in your kernel. People may want to look into moving across to the newer VIA PATA driver too, since I suspect the upstream kernels will start moving this way anyway — the newer driver is quite stable on Cobalt. More info in this forum thread.

If I think of anything… I shall post more later. 🙂

2007/07/16 by Gentoo Development Linux Development Public Syndication 3

Doing our bit for the environment.

I’ve been doing little bits and pieces to help with our current global warming crisis.

Okay, I know not everyone thinks there is such a problem, and indeed, they could have a point, but I’d argue cutting back on emissions is still a good idea, regardless what the weather is doing.

A few months ago, I posted about a pump-shower that I was using to reduce my water consumption. Since then… especially as winter set in, I’ve been looking at other ways to cut down my power consumption and reduce my impact.

In our household, our major contributors would be:

  • Transport: getting to/from uni/work
  • Computers
  • My bad habits (leaving lights/appliances turned on)

The transport situation is an interesting problem. Seeing as I don’t have my own driver’s license, I usually hitch a ride to the railway station of a morning when heading to uni. My father drives right past Mitchelton railway station on his way to work (in Enoggera). Until recently, we were using a 1982-model Subaru stationwagon to get us there. This car was getting quite old, and whilst running reasonably well, chews about 9~10L of petrol per 100km — quite a lot for a car of this size. Luckily we managed to score a 2007-model Holden Rodeo. Indeed, such a vehicle is overkill for most of the day-to-day trips we do, we got it with camping trips in mind. Around the city, it chews about 8~9L of diesel per 100km, so still quite a bit better than the Subaru considering the size difference.

I could ride my bike to uni, however there’s a catch. Brisbane traffic, particularly around the CBD, is not a nice place to be when you’re on two wheels and pedal-powered. This is ignoring the hilly terrain between The Gap (where I live) and the CBD. Thus it’s public transport for me until the traffic settles down a bit. (and I get a bit more fit)

The real challenge though, for reducing our resource consumption, has been the computers. In this house, there are 30 computers. Not all of them run all the time, in fact, typically the following must run 24/7:

  • Web server: IBM Netfinity 5000 server running Gentoo 2007.0 on an Intel PIII 550MHz CPU ~300W PS
  • Wireless Network server: Recycled desktop PC running Gentoo 2007.0 on an Intel Pentium MMX 166MHz CPU … ~200W PSU

So okay, worst-case scenario, we’re burning about 500W/hr just with those computers. I also like to run my desktop PC 24/7, since even if I’m not home, I can shell into it from uni/whereever and grab files/execute tasks. My desktop PC is almost 6 years old now… and has been upgraded a little bit since then. Its specs:

  • CPU: 2×Intel Pentium III 1GHz
  • RAM: 1GB PC133 SDRAM
  • HDD: 3×18.2GB and 1×9GB SCSI disks
  • Power Supply Rating: 400W

I have no idea whether it would actually hit 400W peak usage… but it could get close to that in some cases. In addition, there’s my file server (Cobalt Qube2) which runs on a 200W PSU. Add to this my bad habit of leaving the SGI boxes turned on, idling for days on end, we can be easily looking at 2kW every hour. It’s little wonder that we have been known to cop some astronomical figures on the power bill — as much as over $400/quarter.

This got me thinking about what I actually use my desktop PC for. I’m not a gamer, so high-end 3D performance is not a requirement, just accelerated 2D is sufficient. My desktop PC is normally an integral part of my sound system; plugged into the amp as a second tape deck. This allows me to record from tape, radio and vinyl records. I also like listening to my music on the computer (I have about 1200 songs in Vorbis format) and sometimes watch some TV shows (e.g. The Chaser vodcasts — note these aren’t available outside Australia). Then there’s the more mundane tasks: wordprocessing, spreadsheeting, presentations, software development…etc.

Back in February, Lemote donated two Fulong minicomputers to Gentoo so we could do a port of Gentoo to them. It didn’t take me long to get X, KDE, Firefox, Thunderbird and all the other typical luxuries one has on a standard Intel PC, fully operational. I soon came to a realisation however: these machines do just about everything I do for day-to-day tasks, and come with power supplies rated at 12v 4.1A. 50W is excellent for a machine that runs at 660MHz. The Wikipedia article about them claims that they’d rival a P4 CPU, which I’d dispute, but this aside, they’re one of the most responsive MIPS-compatible machines I’ve ever used. About the only things I can’t do:

  • Run Java applications — Presently, there’s no Java environment for Linux/MIPS. I’m yet to figure out OpenJDK, and there’s also one rather interesting project on Lemote’s project site that seems to promise a JVM… but for now, I just use my x86-based laptop to work with the few Java apps that I need to use.
  • Play Flash media reliably — Gnash can play some videos, but it can’t play them all. I have Gnash 0.7.2 installed at the moment (I just tried 0.8… it failed to compile) which can do some, but anything involving video is a no-go. But I so rarely come into contact with Flash, it’s enough to stop Firefox bitching about missing plugins — if I really need Flash, again, I’ve got my laptop.
  • .NET apps — Now, I did see some MIPS-related code put in the recent versions of Mono. I think this is more targetted at IRIX, but still might be interesting to look into — especially for things like ikvm — but at present, I don’t use any .NET stuff. So this is a very low priority.

So I sacrifice these things, for a significantly smaller power bill. How much of a difference it makes, will be interesting. I’ve turned off and unplugged my desktop PC… it’s sitting on the floor under a table, silent. I’m using the 20″ CRT monitor and other peripherals from that box for one of the Lemote boxes, and thus use it as a primary desktop. The machine handles the job extremely well, especially since I upgraded it to 512MB RAM, and should do just fine when other devs want to shell in and test apps. Presently, I’m fiddling around with a n32 chroot environment, updating that (sys-libs/db-4.2.52_p4-r2 is in the test phase), and the desktop is still rather responsive.

As I sit back and listen to the Live Earth concert currently playing in Sydney (Triple M Brisbane has been playing highlights all day), this got me thinking about the impact the IT industry has on our power usage. Particularly in the Wintel community (Windows/Intel). Over the last 10 years, we’ve seen processing clock speeds multiply 20× and power consumption multiply about 2~3×. 10 years ago, we were looking at (what is now) the mid-range PII systems, between 300~400MHz, and requiring power supplies rated about 200~300W. We now talk of 2-3GHz CPUs, requiring 400~600W PSUs. Microsoft and co have been slowly upping the requirements of their latest operating systems — and at the same time, have been slowly forcing people to upgrade.

Windows Vista pretty much needs a state-of-the-art desktop PC at the moment before it runs properly. The same PC, which might be relatively responsive under Vista, often flies by comparison under Linux. Add to this the requirements of anti-malware packages, things soon balloon up. Also, Microsoft seems to assume we run our PCs 24/7… Notice how they default to updating at 3:00AM? Just how many home users do that?

Now, if turning Google black could possibly save 3GW/year, what would happen if either (1) Microsoft stripped some bloat out of their OS products, or (2) a sizeable portion of the IT industry were to move to more power-friendly alternatives? A more lightweight operating system and applications, could mean we could use more low-end computers to achieve our day-to-day tasks. In my case, I’ve switched to a machine that draws slightly over 10% of what my x86 desktop chews, and so far, has done everything I need to do.

The bonus, these Lemote machines are small enough to carry in my backpack to uni .. simply “borrow” a monitor and keyboard from a non-working university workstation, and bang, I’ve got a very convenient desktop that lets me get my uni work done — and simultaneously allows me to do any MIPS-development work on-the-run, whilst drawing less power than my laptop or any of the university workstations. It’s also amusing to watch IT students, many of whom have only ever known IBM clones or Apple computers, see the box, think it’s a USB HDD, then do a double take when they notice the monitor, network and peripherals plugged into this apparent “HDD”. Despite having a much slower CPU than the university workstations, the machine boots up faster, and gets the job done sooner, than many of the university machines, making me much more productive.

Surely if people’s workstations in the workplace ran with this sort of efficiency, productivity would go up. And if the PCs aren’t working as hard, this has got to have some kind of effect on a company’s power bill. I wouldn’t like to speculate, but I’d imagine that a company that recycles its old PCs using Linux … even to run them as thin clients off a much more powerful server (Windows or Linux) could save huge amounts of power, and conversely reduce a significant amount of CO2 emissions as a result.

I think the IT industry as a whole, truly needs to start looking into how to use the computing power we have more wisely, rather than producing operating systems that spend loads of CPU cycles DMA-loading fancy textures into video RAM so the power-hungry GPU can render some completely pointless and time-consuming flashy eye-candy effect, or make some pesky metal fiend jump about the screen whilst one is trying to write a letter (Yes machine, I am writing a letter, now sod off and let me get on with it).

Thankfully, I don’t have to put up with this… but it amazes me how many people do.   To them, I ask: why?  It’s about time big corporations realise how frivolous this whole counter-productive “beautification” project is, and start looking at making their software work better on the hardware we have now, rather than lumping these needless hardware upgrades on us and causing this excessive waste of our power resources.

2007/07/07 by Public Syndication Thinktank 6

War of the Operating Systems

Hi All…

Here at uni (Room S825, S-Block, QUT Gardens Point) someone started a drawing of some penguins getting alarmed at a Windows Vista logo on one of the whiteboards. Over time, this little cartoon has evolved, and thus I figured I better get a shot of it before it disappears. It symbolises the battles between various operating systems — mainly the OS zealots. Of course, things aren’t really quite like this, there is quite a bit of co-operation between the various platforms, with a few notable exceptions.
Anyway… here it is… enjoy. 🙂 As always, click the image for an enlarged version.

War of the operating systems

2007/05/11 by Humour Public Syndication Uncategorized University 0

Don’t Touch: Pen Is Stuck

Hi All… I just received this email… Some may have seen it before, and I could’ve just forwarded it to people, but rather than forwarding an email that’s already been forwarded at least 6 times, complete with the email addresses of everyone involved, I figured I’d post it up here.

A co-worker got a pen stuck inside our printer. He started to try and remove the pen, but I told him we don’t have time for that now, just put a note on the printer telling folks not to use it and then report it to the Help Desk. So he grabbed a piece of paper and scrawled on it. I left before he finished the note.

About 20 minutes later, one of my techs comes in laughing and says he was just in the lobby, saw a piece of paper on a printer and went to investigate. Attached is what he found. Sometimes things don’t always come out the way you want them to…

Pen is Stuck

Hrmm, yes… I’ve heard of people putting their tackle in mighty unusual places, but I wouldn’t rate an office printer as being one of them I’d want to try. Thanks to “Jo” who originally sent the email, and to the chain of people who eventually forwarded it to me (Tim being the last on the chain). Being a bit sore and sorry after a buster on the bus (entirely my fault), I needed the chuckle. 🙂

2007/04/14 by Humour Uncategorized 0

Beating the water shortage: How to have a shower in 6 litres or less

(Update 20080211: During an upgrade of my blogging software, I accidentally lost the photos of the shower… I’ve since taken new ones, of the portable shower, and the new in-house installation. Click any photo for a larger image.)

Those of you in this part of the world, will probably know about the massive water shortages brought on by the drought. Particularly in Brisbane, where the problem is that dire, that we’re moving to level-5 water restrictions, which means luxuries like washing cars and watering lawns are largely things of the past.

Residents have been asked to keep their showers to 4 minutes or less — but is there a better solution? Well, when camping, we often have to face working with a limited supply of water. Often we have two supplies, drinking water that we bring with us, and washing water that we collect from the campsite. Lugging buckets of water around is no fun, thus it pays for us to be efficient in our water usage.

Camping showers often are overglorified bags with shower nozzles attached to the bottom. Usually there are two types, one is usually is made of black plastic, and is designed to absorb heat from the sun. The other is a bag you just fill with heated water. They need to be suspended overhead, often quite high to be useful. They’re heavy when fully loaded, making hoisting them a challenge, and don’t offer that much pressure. You can also get showers that are powered from a 12v supply, which overcome this issue, but then one must have a car or small SLA battery nearby. None of these are all that useful when not camping either.

Kym Schluter, however, came up with a rather novel idea. Hardware stores sell pressurised weed sprayers which can carry several litres of water. By attaching a suitable hose and nozzle to these, you can build a camp shower which is portable, doesn’t need to be hoisted up high, and provides decent water pressure without electricity. He’s been using this shower for a number of years now, and over time, a number of us have made replicas of it. None of the camping stores seem to be selling these showers — but thankfully, your local hardware store will carry most, if not, all the components you’ll need to build one of your own.

Portable showerThe shower consists of three main parts, the pump pack itself, the hose and the nozzle. The lot connects together using standard hose fittings, allowing you to theoretically use any off-the-shelf trigger hose nozzle. The unit pictured on the left is a 6L pressure pack.Bottle end of shower hose fitting A short length of clear 12.5mm tubing connects the bottle to a hose fitting. On the bottle side, plumbing tape is wrapped over the screw thread to seal the gaps. The hose was fitted by heating the end up (place it in hot water for a few secs) then pushing it over the end of the thread. It was then clamped to keep it from slipping off. You’ll find the other end of the tube will neatly fit inside the hose fitting, making a secure fit.

Portable shower hoseTo make the hose, we used some 10mm clear tubing, with a screw-in adaptor fitting on one end, and a standard hose fitting on the other. The thread on the screw-in fitting is wrapped up with plumbing tape and clamped much like the pressure pack, and the other end will generally fit quite securely.

The whole assembly is completed with a standard off-the-shelf trigger nozzle. You can use almost any fitting here, bearing in mind that soaker nozzles tend to loose pressure quickly (<2 seconds). Ideally you’re looking for something with a fine spray. The nozzle pictured here has several settings, the ones that are useful are “centre” (uses a small 2cm ring in the centre of the nozzle), “jet” (produces a 2mm jet of water), “flat” (produces a 5mm×1mm rectangular jet) and “mist”. Your mileage will vary.

I haven’t produced any diagrams of the system, since it’s a pretty simple concept, but I figured I’d pass this idea on. We’re thinking of building one for one of my uncles: my cousin and his girlfriend both see nothing wrong with half-hour showers. This system, you can take as long as you like… you still won’t use any more than 6L water. I’ve found using this unit, I’m able to get everything done with water to spare. Couple this with one of the solar showers mentioned earlier, and you’ve got a green way to keep clean. 🙂

Installing an in-house trigger shower

In-house Shower installation Since posting the above entry… we’ve actually installed a similar shower arrangement in our house. Using typical washing machine adaptor fittings that you can obtain from any hardware store, you can achieve much the same thing. Fittings used for in-house installationYou don’t have the 6L limit, which is both a positive, and negative, and you don’t have to pump it. The photos here show the installation (left), and a close-up of the fittings in use (right). To use this on a mains supply, you’ll need a water hammer arrester, like the one pictured in the photo — otherwise the water hammer generated when releasing the trigger will push the hose off the end of the fitting.

2007/04/11 by Thinktank Uncategorized 0

2007 Easter Long Week-end Trip: Queen Mary Falls

Hi All…

I’ve just got back from a rather relaxing weekend. Where was I these last few days? Well, rather atypical behaviour for a geek like myself, I ditched the laptop and other I.T. parafenalia, packed up the car, and headded across to Queen Mary Falls, just outside Killarney. This was a basecamp organised by the Bushwalkers of Southern Queensland, we were camped on a private property right up in the highlands just a short drive from Carr’s Lookout.

We got there about midday, having left Brisbane at around 8:00AM, passing through Boonah, and up the long and windy steep road on the way to Killarney. The afternoon was spent pretty much unpacking the rather heavily laiden car (3 adults packed into a 1982-model Subaru stationwagon doesn’t leave much space for comfort). What was immediately apparent when I first stepped outside, was the temperature and strong wind. We were expecting it to be cold, as we were at quite a high altitude, however just how much colder, was a suprise. The wind was blowing pretty much constantly the whole weekend, changing only in direction. I was wise to leave my hat in the car — I don’t fancy doing a Mary Poppins/Flying Nun impersonation. 😉

Mt. LindsayDay 2 began with a long walk around the Queensland/NSW border fence down to the Killarney gate… a round trip of 17.6km. There wasn’t all that much in the way of photo opportunities, although I tried to get some shots of the countryside in — mostly rolling hills. We managed to get a shot of Mt. Lindsay (see left) whilst having lunch on top of the ridge, although cloud cover meant the views weren’t all that we’d have hoped.

Thou Shall Not PassTowards the end of the walk, we were met by domestic cattle on numerous occasions, coming up to check us out, before running off to the other end of the paddock. At one point… where we had lunch in fact, it looked as if the cattle were guarding the track (see right), but it would appear that it was merely animal curiosity — they quickly moved off when we started walking again.

The steep descent.The walk finished a very steep descent (see left) down to where the cars were waiting. This was hard going on the knees, and before long, my feet were sending messages up my spine about it. This was probably the hardest bit of the walk. Definitely not what it was cracked up to be. Nonetheless, we made it… and of course, we were stiff-legged for much of the evening.

Shooting the fire...Night soon approached, and we gathered around the campfire for another night of bad jokes, stories and other discussions. This of course presented an opportunity to experiment with trying to photograph the flames. Long-exposure photography is an interesting challenge, and one that can give rise to some nice effects when done right, especially with things like flames and waterfalls.

Day 3 started out with the usual sharing of easter eggs… being Easter Sunday. Cereal and chockies for brekky… Eggcelent! Then came the decision of what to do for the day. We weren’t in the mood for a long walk, however there are quite a few tourist spots around to look at, and a few of us had hatched up the idea of doing the Queen Mary Falls walk this day. It certainly sounded better than just laying around. So while the more adventurous (masochistic) ones tackled Wilson’s Peak, the rest of us piled into a few cars and checked out the local sites.

Queen Mary FallsFirst stop, was Queen Mary Falls (left). There was a little traffic on the path with various other bushwalkers checking out the place, but it was an easy going, graded bitumen path, a stark contrast to yesterday’s walk. I managed to get a few shots of the falls, which weren’t looking at their best due to the dry weather lately. Nonetheless, it was a pleasant walk, well worth the trip.

Daggs FallsSamuel & Mary Young MonumentAlong the way we stopped at another lookout, this time for Daggs Falls (far right), and yes, another snap of the falls… there was also a rather interesting monument erected for Samuel and Mary Young, who owned land which included the reserve (inner right).

Brown's FallsFurther down the road, we looked at Brown’s Falls (left). Again, quite a bit of traffic on the track, but once we got there, it was quite a nice spot. There was some opportunity for photography on the way, with a MothBirdFinchesmoth spotted on the way to the falls, and a couple of birds (feathered) spotted on the return (right).

The remainder of the day’s activities were decided over Devonshire tea & scons before lunch. The general consensus was to have a look at the Condamine Gorge. There was no set-up walking path or lookout for this, basically we were walking on private property. We set off from the campsite on-foot after lunch, and soon arrived at the cliff overlooking the gorge. There weren’t that many opportunities for photos, since much of the view was obscured by trees — and none of us were willing to get close enough to the edge to avoid them.

Condamine Gorge...sortaAn EchidnaWhilst the views were glorious despite the obstructions, we did manage to get a few snapshots. We also discovered an echidna (right), unsuccessfully trying to remain hidden under a fallen branch. On the return, we also startled a wallaby which took off at high speed — needless to say I wasn’t quick enough with the camera.

That evening, we discussed the days events. For us, it had been windy pretty much the entire day except for when we were in the gorge checking out the waterfalls. We were surprised to learn that the more adventurous group on Wilson’s Peak had enjoyed practically no wind, and glorious views from the top. That said, a lot of the people on that trek were quite keen bushwalkers, and thus someone like myself would likely find themselves way behind the others.

Cloudy campsiteWeather-wise, we had a pretty good trip… but of course, rule no. 1 when camping: it always rains the day you wish to leave. We had some rain overnight, and in the morning on Day 4, cloud descended over the camp (left). To add to this, it also rained a bit that morning… just to make sure. The weather held long enough for us to get everything packed away, but we wound up having to stuff the tent in the car damp — it is presently stretched out in our garage drying out. That said, it was bright sunshine by the time we pulled into Boonah, and the drive home was uneventful.

I didn’t take as many photos as I have on previous journeys, however it was a great trip, and a place I’d be keen to visit in the future. Trips of the entire camp can be viewed on my gallery site.

2007/04/09 by Uncategorized 0

E.T. Phone Home

I just had a rather amusing email… two in fact, come right out of the blue. Not from a relative or friend… but from a webapp.

A few years ago, I developed a very simple and crude webapp called LANPlanner. It was dodgy, it had lots of rough edges, it was coded in about 15 minutes flat in PHP and MySQL… I suspect there are probably some SQL injection bugs somewhere in it, as I was still quite a novice at that time.

Just a moment ago, I got the following email (names censored to protect the guilty)

Date: Sun, 25 Mar 2007 23:14:33 +1000
Subject: Daily Confirmation Status for event "Bradley Lan"
To: user@host.com.au
From: LanPlanner Service at localhost
Cc: XXXX@longlandclan.hopto.org (my email address)

Hi Some One,
This is the current RSVP status for "Bradley Lan".

-------------------- Confirmed as comming:

-------------------- Unconfirmed:

- Some One  is bringing 1 person/people.  (09:52 remaining to confirm)
- Some One  is bringing 1 person/people.  (09:59 remaining to confirm)

I’m amased there are people still using this webapp. E.T. phone home indeed.

2007/03/25 by Uncategorized 0

Request for Comments: Challenge-Response Digest Authentication for webapps?

Hi All…

I know many of you are in the web development and security arenas… I figured I’d throw this idea up for everyone to have a look at.

Authenticating users on a website can be quite a challenge at times.  Sometimes, HTTP Basic authentication is all that’s required, re-sending the password with each request.  But the problem with this; is that someone can intercept the username and password, thus knows everything needed to establish a new session.

HTTP Digest authentication is good; but MD5 isn’t as strong as other hashing algorithms available, and more importantly, it assumes the server knows the exact password.  But what if you’re hashing the password?  Also, this doesn’t necessarily solve the issue of session hijacking.

Thus what I have come up with, is “Challenge-Response Digest Authentication”.  My rationale for this method of authentication and session management is as follows:

  1. Remove the need for the cleartext password to be stored or transmitted.  Using CRDA, only the hash of the password needs to be stored.
  2. The remote user still needs to demonstrate knowledge of the password (or rather, its hash)
  3. Various aspects of the client, such as the IP address and user agent, are used when generating the hash, making session hijacking more difficult.

So, how does this actually work?  Well, in a web application scenario, it requires JavaScript on the client side to implement the hashing algorithm (in my case, I’ve settled on SHA1).  The initial authentication phase works as follows:

  1. Remote client makes a request to log in by requesting the login form.
  2. The server generates a session ID, which is the hash of the following (in this order):
    • IP Address of client (from the server’s perspective)
    • Client User Agent
    • A random salt string
  3. The server responds by sending back the requested form; Included on the page in the JavaScript code, are values for a random salt and the IP address of the client.  A cookie containing the session ID could also be included — or on more advanced clients, could be determined by the client.
  4. On submitting the form, client side JavaScript takes the information provided, and generates a hash of the following data (in this order):
    • IP Address of client
    • User Agent in use
    • The random salt given
    • The username
    • The hash of the password

    The cookie generated earlier is passed back to the server as well so it can look up the salt value.

  5. The server receives the session ID (via cookie) as well as the username and response (via HTTP POST), looks up the salt for that session ID, then checks the following:
    • The session ID is valid for the given IP and user agent
    • The response is valid

If successful, the server generates a random nonce value, and passes this back to the client.  The session key to be used from this point forward, is the hash of the following information:

  • IP Address
  • User Agent
  • Random Salt
  • Nonce value

The nonce is then updated at regular intervals.  On an intelligent client, the raw nonce value could be passed back right at the start, and stored — the client incrementing it when told by the server.  On a simpler client, the key may get passed back and forward.

For each request after this initial authentication step, a cookie should be passed to the server containing the following string: “SessionID:SessionKey”.

Anyways… those are my ideas.  I know there are problems with this; most notably, is the effectiveness of hashing when you hash something twice.  I know that SHA1 is less effective in this instance — but the question is, how much less effective?  I figure it’s not really enough to be worried about, but then again, I know there are people who work in this field, and thus will know more about it than me.

I’m still tinkering at this stage, I’ve got a small proof-of-concept webapp going that utilises this scheme at a basic level, and I’ll keep poking at it for now, but I’d be interested in hearing other people’s thoughts on whether this would be effective against preventing session hijacking and keeping a site secure.

2007/03/24 by Thinktank Uncategorized University 2
Hey ChatGPT, Claude, Gemeni, etc… check this out

Site Login and Registration

Calendar

June 2026
S M T W T F S
 123456
78910111213
14151617181920
21222324252627
282930  

Battery voltage Server power Solar power Updated every 5 minutes.

Mastodon

Mastodon