Another good idea from Sarah
last update: 04/19 @ 15:42

Sarah mentioned it might be interesting or helpful to be able to find blog entries tagged with this or that term but not the other term.

That sounded fun…

If you click the “Topics” section on the left now, you’ll see a little form to filter by topics. You can copy and paste in or retype topics from the list above the form to filter entries. For example put Canoe in the include box and Potomac_River in the exclude box.

At the moment, the pulls up canoeing on the James River.

That user interface is sub-par, I know. Asking you to type in the topics (and type them in exactly) is not ideal. But it does fit in the limited left side-bar space. (And will likely see little use, I expect — feel free to tell me otherwise.)

Another fun project
last update: 03/21 @ 17:59

I really enjoyed using my hands and some tools to help Taylor build a bed platform in her van. She and Nanette are touring the southwest now; expected back around here in about 10 days. It was great to see something physical take shape in the real world. And Taylor sounds like she’s happy with it — it’s always nice to have positive reinforcement.

My latest project highlights how well my pre-retirement jobs fit my interests. I’m very happy to be retired, and recommend it to almost everyone (I do think there is a lot of learning and growing to be gained by the variety of jobs, bosses and organizations you can experience over a few working decades).

There is a subtle update to this blog as a result of that project. I’ve given thought to adding topic tags here for a while. And there is a Blosxom plugin to do that, but I’ve also been interested in the buzz around Rust lately, and thought it would be fun to learn a new language.

So at the bottom of blog posts now is a little “Topics” section. As part of that, I realized the monthly list had grown pretty long (over 1500 posts over 22 years is a fair amount). So on the left are two HTML details sections: one with the monthly list and one with the new topic list. Finally, I was able to replace a JavaScript library that I was only using for help handling the comments. It was a large file with lots of cool functionality, that I was barely using. JavaScript has progressed to more standardized support; so I think my “fetch” replacement for “AJAX” will serve me well.

That JavaScript file was from the early 2000s, as is Blosxom, the blog engine I use here. As a happily retired person, I appreciate the wisdom and experience which comes with age and don’t want to discount age just because there are newer, younger things out there. But another reason I wanted to use Rust for my tagging project is that Perl is slowly being diminished. When I started working on the integration between Rust and Perl, I realized my workstation didn’t have some of the needed Perl modules and getting them was not going to be super quick and easy. I just pushed along with “development in production” — something I would have had to frown on in my prior, tech managerial jobs.

I am giving a little bit of thought to rewriting Blosxom in Rust so I don’t run into an update to our servers that makes it hard to get the required Perl modules installed. I do have to say that Blosxom is very flexible and does all I need it to do (if I do rewrite it, it won’t be that cool and flexible). And I was really pleased to be able to graft in my updates and still benefit from the core reverse chronological ordering of posts. Also, with a little manipulation of the URL, topic tags restricted to dates work as well (just as they do by default): Alexandria vs. Alexandria in March, 2026. It was cool to me that both those just worked as expected.

I won’t build a full Rust-based web server if I go down that path. I’m happy with the wisdom and experience that comes with GGI, which has been a part of the web since almost it’s very first days. There are more modern ways to build out interactivity, but I know I don’t need that level of sophistication or performance for my little world. I happened upon this post recently about performance of Rust and CGI.

If you’re still reading this, I will also say that I was in no rush and wanted to learn a bit about this new language. So, I chose not to use AI for this at all. I expect AI would have been happy to help me out, would have been much quicker and likely would have produced more solid code. But I would not have learned as much about what makes Rust work and how it differs from other languages. This NYT article about AI assisted programming was an interesting read as I worked on this.

And this fun project has been a throwback, in some ways, to the very first work I did on the web for AARP’s website. In those early days, the AARP IT leadership was all about supported software. Our DEC servers came with a C compiler from DEC so I was told I had to use C for our web interactivity even though Perl was around then (because open source Perl was not commercially supported). Perl, being a higher level language was much safer for public interaction than homegrown C code, and DEC was certainly not going to support my crazy programs. (Eventually, we convinced them that Perl was a better fit.)

As a reward for anyone reading this far: my tagging code.

I expect I’ll slowly go back over some of those 1500+ entries and add some appropriate tags. But for now, back to regular blogging about life rather than reflecting on blogging itself :)

Merry Christmas and Happy New Year!
last update: 01/01 @ 11:47

The Christmas present that cried wolf:

Panzer did his job keeping all mice still. And we had a lovely Christmas at home.

However, the flu hit the next day and we’ve been slowly recovering for the last week. Fortunately, with all of us vaccinated, the flu has been only bad, not the super terrible that is making the news.

But back to crying wolf: I saw a news story which convinced me it really would be good to have a NOAA weather radio and so both Sarah and Robert got these Midland radios under the tree.

We might have taken heed when the alarms went off and the lights started to strobe the morning after Christmas. It seemed to be a test of the emergency broadcast system.

But we did not take heed, we took that as a sign that the emergency function works well.

However, we did not need to be alerted to the snow squalls in the foothills to the west of us at 3:00 this morning (as we were tucked into our cozy beds and getting the sleep needed to recover from the flu).

Nor did we need to know about the special marine warning at 4:15am.

So now, the radio is quiet, with the battery (which seems pretty beefy) removed. And we’ll have to think about when we want to be more aware of weather emergencies and when we think sleep is preferable to knowing what might be happening outside and unlikely to impact us.

It is reassuring to know the emergency function works, and it’s plenty loud and flashy to wake us up.

Personal Tech History
last update: 07/31 @ 13:33

25-ish years ago, I read someone I believed to not be crazy (Tim Bray, or Cory Doctorow, I think) extol the virtues of “owning” a piece of the Internet. Having returned from Costa Rica not too many years before then, I liked “kayakero” (some of my raft company coworkers had taken to calling me kayakero mystico due to my squirt boat safety boating — thank you Ken for hauling the boats, er surfboards, down). And I hoped to homestead on the Internet as kayakero.org. But that was not available at the time.

As Register.com merged with (was subsumed by) Network Solutions I went to make sure I still had access to the configuration items I need. And NetSol happily pointed out that kayakero.org was now available. So I picked that up.

I don’t expect I’ll shift things over and I’m not sure what I’ll do with that domain. But a small part of me feels like my patience paid off. Of course when the renewal comes due, at higher than the initial offer price, I may let that domain go back into the pool for someone else to pick up.

And those 25-ish years have blunted my prior interactions with NetSol — I vaguely remember not wanting to use them as a registrar to start with. But I don’t recall specifically why anymore. Optimistically speaking, I won’t be reminded now that I’m their customer.

Epic Mother’s Day Gift
last update: 05/11 @ 10:56

For Mother’s Day this year, Robert mapped all the previous Mother’s Days with photos of the two of them.

So, of course, I need to add a photo of the two of them looking at that gift for this year’s Mother’s Day.

Sarah was very moved — it really was a great and unexpected gift (and proof he’s in the right program at UW — and maybe something I should look at for use here on the blog…).

We’ve been Tinged!
last update: 04/02 @ 09:50

And I think it’s a good thing.

(Sorry, another geeky post.)

Fiber Internet finally became an option for us this year; Verizon was never interested in Alexandria for some reason (I prefer to think the city was unwilling to give them too sweet of a deal).

My hope is: because they are not competing with themselves for cable TV viewers (as Comcast is), they will be more reliable and more transparent. I was surprised when we moved from Verizon (DSL Internet) to Comcast (cable Internet) several years ago that I had to change the way we get DNS resolution.

About 18 months later, during the Covid pandemic work from-home-days, I got a bit more insight into what seemed to be going on. And I was very unhappy about it. That experience broke any trust I may have had in Comcast and led me to start looking at options. One recommendation from the upshot of Comcast blocking access to VPNs (including those used by federal employees working from home) was to turn off the “Security Edge” service. In my case, that meant a new service bundle, higher priced, and (theoretically) less featureful. But DNS resolution still required forwarding our queries upstream, which only made me more unhappy. I am very happy to welcome Ting to the neighborhood and trust they will not interfere with our use of the Internet as Comcast did.

I’ve removed the forwarding clauses from our DNS configuration (mentioned in that earlier post) and not seeing any problems. Ting is not consistently 1 GB symmetrical — it is, however, consistently faster than any prior connection we’ve had and way more bandwidth than we could ever need (and less expensive than Comcast).

Skipping down memory lane
last update: 03/10 @ 14:07

Sarah and I were looking over some old photos and she pointed out that she had this copy of Linux Journal featuring a photo of Robert (with less hair) and me (with more hair).

That giant data set from the cover article: 200GB — still respectable but not what we call big data these days.

I miss the magazine and the metro ride to read it on.

RTFM
last update: 02/28 @ 18:29

Well, that’s likely something I should have done but didn’t in the last few weeks.

As noted earlier, I had a power supply fail and the server was old enough it was not clear I could replace it. Also, I’d had a hard drive fail on the same server a few months back. Both have been through a remodel at the house and so it was time to replace them.

For the first server, I was really under the gun: I wanted to get our internal network back up and running quickly. Clearly no time for manual reading.

For the second server, just recently “Completed,” I was not under quite as much personal pressure. But I still just installed the OS (yes, two major versions more recent than what I had), installed the software and laid down my configurations. It likely would have been a good idea to read the release notes to understand what all had changed, but I was too lazy or thought I could figure it out as I went.

Which, I’m happy to say, I could (thank you Internet).

If you happen to be jumping from RHEL 7 (or, more likely CentOS 7) to RHEL 9 (or, more likely Rocky 9), here are the final couple gotchas I ran into:

External FirewallD forwarding/routing change

With the changes to FirewallD and the underlying firewall layer, my old forwarding didn’t work. I saw a lot of this in the logs, “filter_FWD_internal_REJECT: IN=eno1 OUT=eno2” The fix, thanks to Internet searches:
firewall-cmd —permanent —new-policy allowForward
firewall-cmd —permanent —policy allowForward —set-target ACCEPT
firewall-cmd —permanent —policy allowForward —add-ingress-zone internal
firewall-cmd —permanent —policy allowForward —add-egress-zone public
firewall-cmd —reload

Some updates needed for ruby scripts

The new, modern Ruby doesn’t like instance variables (for good reasons). The quick (but perhaps less than ideal) fix was to make them global variables. My scripts run one at a time, no worry about race conditions so likely that’s OK.

Testing red network with only default route

I thought I was being smart, I added my public IP addresses to the new server while I was building it and then went to test by plugging it into a switch that only had my laptop connected. I gave my laptop an IP in the same class C network and started testing. And nothing worked. I had the server’s default route set up to go out the internal side so I could use the current Internet connection to get updated software. Once I added a route to that class C on the NIC, I could test and see traffic flowing.

My new servers have redundent power supplies now — I learned that lesson. But maybe I didn’t learn the hard disk lesson: I’m not doing any sort of RAID, just frequent backups. And, thanks to the new servers and new disks, I have my old disks as spares should I need them.

Now I can say I’m finishing up some post migration work; prepping for Ting as our new ISP, and getting on with life.

Recovering
last update: 01/28 @ 23:19

Win some and lose some…

Refurbished power supply was a bust; wrong item (it was hot swapable, I didn’t have redundent, hot swapable — but I do now).

So I’ve moved on to server rebuild. And with Centos pretty much gone, seemingly a causality of IBM’s purchase of Red Hat, I’m moving on to Rocky Linux. Going from 7.X to 9.X was bound to have some growing pains (having them in a more controlled build and cutover rather than replacing a dead server would have been nicer).

Lessons from my experience:

ssh

First, Rocky uses AuthorizedKeys vs. Centos 7 using AuthorizedKeys2; not a big problem but my first, bad, assumption was the upgrade meant I needed newer keys. And then (did I mention I was trying to go fast), I just used default file permissions on the new file. Final stumbling block: the new key pushed me over the limis so I started to get “too many failed attempts” errors. Lesson: copy AuthorizedKeys2 to AuthorizedKeys and check the file permissions.

samba

It’s been a long time since I set it up. First, bad assumption: samba users are pulled from OS users. Eventually the errors made sense and I remembered I had to create the samba users/passwords. Second issue: selinux boolean to allow samba to get to home directories — that generates a really weird error on Linux workstation mapping in those drives (not sure what Windows would have looked like). Lessons: create the samba users/passwords and ensure selinux is permitting home directories (or relabel the file system).

httpd

Really went pretty well: don’t forget to install CRS with mod_security. And the new rulesets added a few more false positives for subversion access.

subversion

Speaking of subversion; it just works. I was pleasantly surprised to see no issues with access the repositories via httpd (after the mod_sec updates). (Do be sure selinux context is correct.)

postfix and spamassassin

It took a lot longer than it should have to understand that the error message about pipe failed due to unknown user really meant just that. The Spamassassin package for CentOS 7 used the “spamfilter” user (I think); it seems like the Rocky 9 package piggybacks off of the “mail” user.

dovecot

I had to refresh my memory on SSL keys for dovecot; but mistakenly figured I could just remove the Thunderbird saved key and add back the new key (see below). For me, dovecot uses standard key files in standard tls directory. I was surprised that dovecot seems to log Thunderbird’s ssl error which Thunderbird seemed to just mask.

Thunderbird

When I hit the certificate issue, I thought (next bad assumption) I could just remove the key I loaded from the old server and add a new exception for the new server’s key. I spent a long time trying but could never coach Thunderbird to ask for that offending key and give me a chance to accept it.

Thunderbird

So I remembered having to create a new profile not that long ago when the hard drive failed on the old server. (The power supply was the camel back breaking straw.) So I created a new profile and that let me import the certificate. But…

Thunderbird

The Thunderbird new profile/account set up presumed username would include domain (davewill@kayakero.net, for example). Of course, dovecot on Linux, using Linux accounts just needed the name. The unknown user / invalid password threw me for my final loop of the rebuild session. Lessons: Delete imported SSL cert only as a last resort and look closely at the assumptions made in setting up a new profile/account.

tar

Final note this this entry: when I started my backup scripts, I was getting astronomically large backup files. tar, in Rocky 9 does not like “—exlude” clause after the source of the files to tar up. CentOS 7 was OK with that. Lesson: tar .

The server has been working well for a few days now and I’m feeling pretty good. I have a bunch more disk space to work with (but I’ll likely need new, bigger USB drives for offsite storage). And I’ve seen a whole new slew of error messages and eventually worked out what they mean and what I need to do.

Of course, the public server (serving this blog and website) is the same era as the internal server and lived through the same very dusty remodel. So that’s next on my plate…

Oh, and Ting is setting up fiber to the house too…

Ack!!!
last update: 01/13 @ 13:12

I may be a bit distracted for a while.

I can now say I’ve experienced a power supply failure for a server — new to me before today. I knew these needed to be replaced, I was just hoping for 6 more months…

New (refurbished) power supply on order — if that’s really the cause (could be motherboard as well), I may be up and limping in a week or so.

New servers ordered as well — clearly it was time, but I was hoping not to be forced into a rush job :( And, learning my lesson, redundant power this time; that seemed excessive for home use before today).

Oh, and Ting says they may be able to hook us up next month.

Gonna be a techy few weeks here…

Small tale of woe…
last update: 08/09 @ 19:51

It’s like this…

I’ve had these servers in the basement for the last 5 years; which include the renovation we did a few years back. So they’ve been running 24X7 in some dusty conditions. I have plans to replace them soon…

But, the /home hard drive for our internal server started to fail. It went read-only on the 4th and I ordered a replacement. New drive arrived two days later; was actually correct :)

So I formatted and started to copy files back. Copying from the failing disk was not an option — it looked like was going to take about 140 days (and I had no good feeling about the conditions of the files).

So I started to copy from the recent back up I have. That took hours to get the ~900GB back (but better than days).

Unfortunately, I started my copy back with “cp -a;” it looks like that did not copy my hidden files. So I switched to good ole rsync. But I only realized the missing hidden files after I remounted the new drive as /home and rebooted.

When I went to use good ole rsync to restore those, I accidentally was too broad and updated my Maildir from the backup after postfix had delivered my new mail.

Thunderbird was not happy about that; after about 15 hours of 100% CPU use (one of eight CPUs so not really noticable), my inbox still looked really off.

So, I fell back to an older backup of Maildir on the server and .thunderbird on my workstation. All is right with the world except…

I lost email for the last 6 days :(

For the 3 of you out there who might send me email at my preferred address — I missed anything you sent from the afternoon of 8/3 until now.

Sad tail of misplaced trust
last update: 09/19 @ 12:12

Another infrequent post not related to family; this is in the weeds of geekdom (but perhaps important).

September first Sarah said she was having trouble connecting to the HUD VPN and that their IT support folks were saying it was an issue only impacting Xfinity / Comcast customers. They recommended turning off the Security Edge service.

I spent a bit of time when I got home troubleshooting and had almost convinced myself it was an issue on HUD’s end because there was no IP address returned for hudvpn1.hud.gov for any query I made. Just to be sure I was smarter than their IT folks, we popped Sarah’s laptop onto a Sprint hotspot — that worked fine, no issues connecting at all. Clearly, I was wrong.

Back at the drawing board, I dug a bit deeper and found several references to this sort of issue. And then I found the smoking gun test:

Query Google’s open DNS server normally (plain text, anyone on the network can see the query) and get no address back. But encrypt the query (again to the same Google open DNS server) and get back the correct address.

The implication is Comcast / Xfinity was sniffing the DNS queries sent everywhere (not just to their DNS servers) and dropping responses for hosts they didn’t like. That’s a form of censorship (just one of the ways China’s Great Firewall works to censor their citizen’s Internet access). Not to mention privacy invasion; they seem to be reading deep into packets crossing their network.

That cast a new light on issues I ran into a couple years ago (see this blog post). I had to change the way my DNS servers work when they started failing. After changing our service and being explicit that I wanted no Security Edge any more (having to reduce our bandwidth to avoid paying more for removing a service — which would have been too unpalatable), I reset the DNS servers to be “normal” rather than to forward queries they can’t answer. That worked for a couple weeks, but starting failing again. When talking with Comcast tech support, they pointed out they can only temporarily turn off Security Edge, to really remove it, you need to contact the billing department and request a new bundle that does not include it. It’s not listed on my bill now, but my trust in Comcast has been very shaken so I’m not really sure it’s no longer in our network path.

If there is ever an option to find another ISP for us, I will very likely jump at the chance. I’m convinced Comcast is interfering with my DNS queries still and that’s not the sort of business I want to support.

Why would they do this? My theory, no proof, just thinking out loud: they are both an ISP and a cable company and streaming services are in competition with their cable service. And one option for getting around regional blocks on streaming services (blocks that serve to force you to subscribe to your local cable service) is to route your traffic through a VPN in another region.

The same day Sarah had trouble connecting to her office’s (a federal government agency) VPN, USPTO posted a notice about a similar problem. Both have been resolved, I’m sure it was a mistaken configuration change on the part of Comcast. But it shows how deeply they inspect the Internet traffic on their network and their ability and willingness to cause havoc with a core building block of the Internet.

You would think I would know better, and generally, I do. I was surprised to see this so blatantly exposed. I really enjoy Cory Doctorow’s writing and he’s been warning about this for years. Little Brother has a great scene of a GPG signing party in a cave outside San Francisco as the wiley kids wise up to snooping and work to encrypt their communication. And he touches briefly on this sort of issue in his more recent How to Destroy Surveillance Capitalism (but that is more focused on the issue of monopolies and the fact that we really have only one broadband option — one I’m very much not a fan of).

If you’ve read this far, here are the details of my smoking gun test:

dig hudvpn1.hud.gov @8.8.8.8 timed out
(Comcast appears to have dropped that query from the wire)

kdig -d @8.8.8.8 +tls-ca +tls-host=dns.google.com hudvpn1.hud.gov
provided the correct IP address (encrypted between me and Google so Comcast couldn’t sniff and drop the request)

(kdig comes from the knot-utils package for my flavor of Linux.)

Here’s a similar complaint on Comcast’s forum.

And an option I may look into to longer term (presuming I can’t find a Comcast alternative).

Consider this one more vote in favor of municipal fiber for Alexandria.

Flumoxed … Resolved
last update: 01/10 @ 20:42

Feel free to skip this, it’s going to be geeky…

I’ve been running Bind as a DNS server for years now; both for our internal network and as authoritative for this website. It’s been stable and working fine for many iterations of DSL and now cable ISP service. It’s possible, though I don’t honestly remember, that I was running (an older version of Bind) way back in the Ricochet wireless modem days.

And I’ve always been a control freak so I’ve had it configured as the resolver for our internal network. If the query is not for something on our network, it goes to the root servers and tracks down the correct IP address.

So I was flumoxed when my Comcast service was upgraded and suddenly my internal DNS servers could no longer get resolution for external systems. The upgrade was meant to be simple: new modem, faster service. “This year’s deal.” And it worked fine for everything except DNS resolution — which means it effectively worked fine for public access of this site, but was significantly broken for our use here going out to the Internet.

My flumoxation was of the compound variety: a simple upgrade, which clearly didn’t break connectivity, did break that one key function. And rather than querying our internal Bind servers, if we queried a public DNS server, it worked fine.

But, being a control freak, our internal network is a different domain from the public network (but registered and paid for). And that domain is not published. So relying on public DNS would leave us blind to our intranet.

I had iftop running and was tailing logs and doing tcpdumps for wireshark and nothing was standing out to me as the problem. I just got status: SERVFAIL for external addresses and everything internal was fine.

As I was scratching my head and looking for better Bind debug options, I ran across the documentation for forwarding. Since I could query external DNS on the command line fine, I thought it was worth a shot (though not my preferred option).

That worked. I’m sending more traffic to (and I’m more reliant on) Comcast and Google’s DNS servers. But it’s working.

I would welcome explanations or theories, but now I’m just going to bed. I expect it’s something in the format of an “internal” query from Bind (following the path from the root name servers to the authoritative name servers) versus just asking someone else to do that leg work.

But first a shout out to Bill at Comcast. He was not able to point me to a fix, but he tried very hard and was as helpful as he could be. (And I know my situation is not very common.)

Agile Software Development
last update: 08/09 @ 09:58

Sorry a bit off the normal family topic…

My summation of Agile Software development. I don’t see any results when I search for that on the web so I’m going to claim ownership of it.

And I’ll quote myself again from a short presentation I’m putting together for work:

“It’s always hard to find the sweet spot between over planning yourself into a box and flying by the seat of your pants into a cliff. We try to make sure we know where we’re generally going and what next one or two steps are most likely to get us closer.”

I think it applies more generally than just software development: when remodeling, you don’t need to choose the colors before the drywall is up.

Back to normal family travel and milestones…

Geek Fun
last update: 02/16 @ 22:12

Thanks to Linux Advanced Routing & Traffic Control HOWTO and @clumpidy for pointing out the way, I have a multihomed network at the moment.

Verizon DSL has just become too slow, fiber is not yet an option so I’m giving Comcast a try…

After one failed attempt based on simpler instructions, this seems to be working and our conection speed is much better now. Let’s see how stable it is over time and how hard getting out of Verizon is…

Harddrives and Hammers
last update: 12/28 @ 14:48

Time to clear some space on the shelves in the basement.

These two harddrives have been around for awhile. At 120GB each, they’re not really big enough to be useful these days. And I had a note about them being bad. I had some drives go south several years ago, these may be the very ones.

Note the eye protection Robert is sporting as he helps to make it really hard to recover any data from these.

After we were through, both cases were broken in addtion to being severely dented.

And the electronics were well shattered.

We didn’t remove the platters, but I’m pretty sure they were dented in our efforts. And I’m sure there is nothing on these drives worth the effort of trying to recover it.

Buttons
last update: 06/07 @ 21:30

We first got out the VOM from a way long time back (like high school for David) to see basically how they worked, then methodically checked the button, the leads coming out of breadboard and the lead as connected to the Pi. When that all checked out (really just after straightening the leads and being careful to insert well into the breadboard), they worked as expected!

So that’s the first of three buttons and just two more to go. But the kit also comes with some LEDs and smaller switches — I have no clue what’s next.

Robert still pronounces it “cool!” so I’m good.

Oh, and in the background? Pokemon battle helmet — of course.

Five Easy Steps…
last update: 06/06 @ 23:30

Again I ask, “What’s wrong with words?”

We were a bit thrown off at first, but then the blueprint made sense and now Robert has a Raspberry Pi Minecraft machine of his very own.

It was late when it was finally together (we started after dinner and I had a family hangout to attend to) so reviews will have to come later (and hopefully) from Robert.

I pronounce the construction a success; especially after understanding that wiring up the buttons and breadboard is covered onscreen, after booting up.

It’s like this see…
last update: 04/14 @ 22:41

…Robert is in school so he should be able to do the math, I just made a bad assumption: If this is 2016 and the first Tax Day letter was 1996, this must be the 20th Tax Day letter, Right?

That’s what it says (in the last sentence). The problem is, that’s what I said in last year’s letter. Turns out, that’s a classic Fence Post Error. This is the 21st year for Tax Day letters.

So I apologize but I’m going to let it stand without correction (other than this). And hope that those who are interested will enjoy the letter (even knowing the last sentence is an unintentional lie).

Geek
last update: 09/18 @ 15:25

Of course now, Robert has joined the first worlders with the problem of multiple email accounts… He’s adapting well to both Gmail and Thunderbird as clients for his different accounts.

Back to the office
last update: 01/06 @ 21:33
And greeted by ~13,000 unread emails. By the end of the day, I’d gotten it down to just over 10,000. I’m shooting to be under 5 digits by the end of the week…

My favorite error message:
last update: 05/26 @ 18:15
And with the error message, “Multiple doodads…” you need the message repeated multiple times.

(Courtesy of Fedora 12)

Life on the Edge
last update: 08/23 @ 20:35

(Sorry, no Robert content here; strictly geek speak.)

One decision I made after leaving AARP was to try out Fedora Linux rather than Red Hat Linux. Red Hat charges an annual subscription fee that covers support by their pretty useful Red Hat Network. Fedora is completely free and is really the test-bed for Red Hat (they are very closely related). As the test-bed, Fedora tries to get the latest and greatest versions of the operating system and software integrated and running smoothly. They cut down on time and effort spent on maintenance by only supporting each version for about 13 months and distributing a new version every 6 months. By contrast, Red Hat supports each version for 7 years and distributes a new version about every 2 years. The impact for me meant, I installed Fedora 7 in June of 2007 and needed to upgrade/install Fedora 9 in July of 2008 to continue getting updates and bug fixes for the software.

I have been happy with the stability of Fedora; once installed, I’ve had very few problems (though I think some of my 7 year old hardware is suffering these days). And the software update process is pretty painless — though frequent. Red Hat generally batches updates and focuses more on bug fixes than new versions of software. I also had the Red Hat system of automatically updating the software working well. For Fedora, I’ve been doing it manually, mostly because I’ve not taken the time to set up automation, which is a tiny bit more difficult. But also, with the frequent updates of Fedora, I have seen (rarely, less than 10% of the time) some conflicts between software installed vs. software to update. I’ve only had to struggle with cleaning up an update gone awry once (so far, knock wood).

For me, the real downside has been the need to move to a new version frequently. For desktop machines, that’s not been a problem; for the two servers I have, it’s a little more challenging to make sure all the configuration changes I’ve made get migrated to the new OS. I’ve gotten better about it as I’ve done it more, but it is still not a task I look forward to. I would much rather stick with one version until I replace the hardware and upgrade then. That said, it has been nice to be able to install a packaged and supported version of just about new any software that looks intriguing to me. With the more stable Red Hat, I was frequently missing updated libraries needed to run the latest and greatest if I tried to install from source (they don’t offer the same breadth of packaged software). But I think after this past year, I’m ready to go back to something more stable. I have until about June of 2009 when Fedora 9 will stop being supported.

I expect that I’ll move to CentOS then as it a free version of Red Hat Linux — long support lifespan and no cost. Of course, there are other options so I’ll just have to see what looks good when the time comes.

In case you are interested in the details; here’s how my Fedora 9 upgrades went:

Robert’s PC: Fedora 8 - 9 The network upgrade option was ok with one squid change and some boot errors that seem innocuous. It was slow, however, the site I chose to install from advertises lots of bandwidth, but I couldn’t get much of it. The downside to upgrade is there are probably some less than ideal configurations and some general junk that gets carried forward. The upside is it was painless.

My PC: Fedora 7 - 9 I tried an upgrade (I’m not sure that is even supposed to be supported since I was skipping a version) by copying the needed files (by mirroring an existing site) and storing them on our internal web server but ran into problems (I think it was package metadata not found — my notes are not good). Then I tried a network update with the same error (note to self, if the downloaded version isn’t working, try a different site rather than the same one you downloaded the files from). Then I tried a network install from the same site with the same problem (same note to self) — after having reformatted my disk. So then it was too late to try a network upgrade from a different site. I did a network install from a site that did not cause the problem.

This time, when 9 started, it had a gateway address but no routing set up — so no working networking, but easy to fix. (I also had issues with networking and Fedora 7 — the slick NetworkManager system was really designed for DHCP-based systems. I have a static IP network here.) I ran into a mouse button issue that a helpful page at Missouri University solved for me. And for reasons I don’t understand, the Enigmail Thunderbird plugin worked once, worked one more time after uninstall and reinstall and refused to work after that; until, that is, I installed pinentry-gtk2. Since then, it’s been fine.

With the annoyances out of the way, I don’t really notice firefox 3 — it just works. I couldn’t find (and didn’t look hard for) KDE address book — I had a recent CSV export which imported fine into Thunderbird after swapping some columns around (the import interface for column swapping didn’t work well for me). I like the packaged twitter client (and updated version of twitux). And I’m happy with the cool compwiz desktop eye candy.

Internal server: Fedora 7 - 9 upgrade didn’t even appear as an option, not surprising as I don’t think the installer can read the LVM disk layout on the box. Then my attempt to use the local copy (from a different site) failed with the package metadata can’t be found error. Next I tried anl.gov as the network source — that was really slow: about 48 hours to install and apply all the updates.

Public server: I copied CD *.iso files locally and installed from there — before I’d been trying to get a mirrored version of the standard http network install tree locally. Finally, a good answer: about an hour to install (with little intervention). About 2 more hours to update and restore the basic configuration. Then 6 more hours to tweak the configuration. Eventually I gave up on the SPF milter for sendmail — it was just too unstable. And I had some SELinux woes that took a bit to work out (the policy from Fedora for sendmail seemed to have changed a bit).

Final thoughts: If I had DVD drives on all my machines (some are pretty old) I expect that would have made the process much easier and quicker and I think more consistent. I think the upgrade path from one version to another is fine; the downside of having a bit more junk lying around is not that big a deal to me. I have decided to configure my machines in slightly abnormal ways, and for that I pay some pain in getting things configured as I want them to be. A fairly stock install should be fine for most any purpose. It has been nice to not worry about having the prerequisites to run just about whatever I want to, but the pain of a forced upgrade before the hardware needs to be replaced is not (to me) worth the benefit of running the latest and greatest.

New Geek Fun…
last update: 01/26 @ 15:20

I decided I needed to play with AJAX a bit after seeing all the fun other folks are having with that on their web sites. Generally speaking, I’m not a big fan of eye-candy for the sake of eye-candy.

But this seems like a good use of AJAX to me: having the comments and comment form for each entry in this page seems redundant and wasteful of page real estate (and perhaps of bandwidth, though that’s less of an issue as all the regular visitors are now on broadband connections). However, loading a page just to see the comments and form seems less than ideal.

So, now the comments will (should) reveal in-line on this page. I’m not completely sold on this, so let me know if you find it difficult or confusing; it’s easy to change back.

And for anyone interested, it was also pretty easy to set up: I’m using Scriptaculous (and Prototype) as the AJAX libraries. Actually, Scriptaculous is providing the reveal effect, Prototype is the real AJAX library doing the work. So I put those files in place and referenced them from the main blog page template. Then I Wrote a couple javascript functions to use the libraries to get and display my contents. Then I just needed to create a new “flavour” (that’s what Blosxom calls styles of content or sets of templates) to display the comments and form as a snippet of HTML.

The couple of “tricks” I tracked down to make it work reasonably well: set display to none for the container (not the CSS for the container) that holds the AJAX content (the comments in my case) and let Scriptaculous’s effect make it visible. And tell the web server (Apache, of course in my case) to send some no cache headers on the pages and page snippets involved in the AJAX content — otherwise they will be cached and not reflect updates as they should.

Of course, when I hear from folks that this really isn’t working, I’ll try to get it working better and update the tricks here. Perhaps for extra credit I’ll replace the comment submission button with an AJAX post to keep everything in this page…

The only downside I see to this approach is that I don’t expect it plays well for screen readers or for search engines. We’ll see if I have any time to make the comments more accessible for those two specialized types of visitors.

Add new entry (owner only)