Jaka Jančar

V štirih dneh odkar sem objavil Mobitel Monitor ga je preneslo malenkost manj kot 500 ljudi. Teden dni nazaj verjetno sploh ne bi verjel, da je toliko uporabnikov iPhone-ov/iPod Touch-ev v Sloveniji.

Baje se je app znašel celo med Top Free, a jaz tega nikjer ne vidim. Mogoče na slovenskem App Storeu (za katerega sploh nisem vedel da obstaja, dokler nisem v poročilih videl Country Code “SI”). Ne vem, meni kaže ameriškega, in tam appa ni videti nikjer, če ravno ne iščeš po njegovem imenu.

Sicer pa sem pravkar poslal v odobritev verzijo 1.0.1, ki popravi par hroščev, ki so postali posebej kritični včeraj in danes, ko so Mobitelovi strežniki začeli škripati (gotovo zaradi navala novih uporabnikov). Spremembe:

• Odpravljeno sesuvanje v primeru, ko strežnik javi napako ali pošlje napačen XML dokument.
• Če nalaganje z novim up. imenom/geslom ni uspelo, so ostali prikazani stari podatki.
• Info tipka je bila delno zakrita.
• Dodano pošiljanje verzije programa v User-Agentu.

Edit: Uuu, pa res, tudi slovenski App Store imamo in tam je Mobitel Monitor res Top Free app. Noro, screenshot kar shranim za spomin :)

No ja, jaz ostajam na svojem idealnem App Store setup-u:

• US store (appi so v USD cenejši kot v EUR)
• California (0% digital downloads tax)
• Gift cardi ($200 sem na eBayu dobil za $60, za $70 pa sploh ni problem)

Za app, ki v slovenski trgovini stane 0.79 EUR torej efektivno plačam $0.99 * 60/200 = $0.3 = 0.23 EUR, kar je pa več kot trikrat ceneje.

iPhone

OS X’s Address Book only allows adding AIM, Jabber, MSN, ICQ and Yahoo IM addresses to contacts. This has been a known issue (Apple bug #4270469) for quite a while, and there is no indication of it getting fixed anytime soon.

You can work around this by adding an URL field to your contact template in Preferences and using the “skype” schema (urls like skype:username, skype://username or even callto://username). The custom URL field can also be named any way you want, so you can set it to “Skype” (default is “home page”).

Don’t expect any fancy integration in the Skype client, like showing contact names from Address Book instead of your contacts’ own defined names, but at least you can call them from the Address Book with one click.

Step by step

Open Preferences -> Templates. Select Add Field -> URL or click the + next to an existing URL field, if you already have one. Change the name to "Skype" or something similar by clicking on it, selecting "Custom..." and typing it in.

Add URLs like "skype:username" to the newly created field for your contacts.

OS X

BSD subsystem 2.1 (and I think 2.0 too) for iPhone has a broken “su” binary. This is especially annoying, since the default user is now “mobile” and if you try to change to root using MobileTerminal, you get:

To fix the issue, copy the su binary to your Mac, run “install_name_tool -change libarmfp.dylib /usr/lib/libarmfp.dylib su” and copy it back. It should work now.

iPhone

It appears that when using an iPhone with one of the Slovenian carriers, namely Si.mobil Vodafone, incoming calls don’t work. Incoming calls work just fine with another carrier, Mobitel.

I have unlocked my iPhone using the free/open SW method, but I believe the same behavior was observed with HW-unlocked phones in Slovenia too.

Si.mobil is aware of the problem, and they are investigating it.

Another iPhone user from Malta has also reported that incoming calls don’t work for him on Vodafone MT, but he has been unable to test with another carrier or another iPhone so far.

Update (September 20, 2007): My carrier seems to have resolved the issue. Yay!

iPhone

The following is the list of issuers of qualified digital certificates in Slovenia with URLs to the root certificates and certificate revocation lists.

• SIGEN-CA
  Certificate: PEM DER
  CRL: PEM DER Text
• SIGOV-CA
  Certificate: PEM DER
  CRL: PEM DER Text
• Halcom CA
  Certificate (natural persons): DER
  Certificate (juristic persons): DER
  CRL (natural persons): PEM
  CRL (juristic persons): PEM
• AC NLB
  Certificate: DER
  CRL: PEM
• POŠTA®CA
  Certificate: PEM DER
  CRL: PEM DER

Observations

I could not find the link to AC NLB's CRL anywhere on their website. I called them by phone and they referred me to an email address (which was different from the one on their web page). I then sent an email with my question to the address and received a one-line, no hello, no signature response with the URL to the revocation list.

Also, AC NLB's CRL has a .crl extension, but is in fact PEM-encoded, even though for every other CA that extension signifies DER encoding.

Converting between formats

You can convert between PEM and DER formats using openssl.

Converting certificates:

Example (converting a certificate from DER to PEM format):

Converting CRLs:

Example (converting a CRL from PEM to DER format):

Cryptography

Assumptions

• All users of the system are happy with using their Unix passwords for Samba,
• all Unix users will have a Samba account with the same username,
• Unix and/or Samba accounts might already exist, possibly with non-matching passwords.

Prerequisites

Install the following packages, if you do not already have them installed:

# apt-get install libpam-smbpass smbclient

Unix - > Samba

In order to update the Samba password whenever a user changes their Unix password, change

/etc/pam.d/common-password:
from

password required pam_unix.so nullok obscure min=4 max=8 md5

to

password requisite pam_unix.so nullok obscure min=4 max=8 md5
password required pam_smbpass.so nullok use_authtok try_first_pass

Changing “required” to “requisite” for pam_unix will make sure that if Unix password change fails, the execution of plugins ends immediately.

In order for this to work, users must already have Samba accounts, and their Samba passwords must match their Unix passwords. Because this is not necessarily the case, we must change

/etc/pam.d/common-auth:
from

auth required pam_unix.so nullok_secure

to

auth requisite pam_unix.so nullok_secure
auth optional pam_smbpass.so migrate

This will create a Samba user, if it doesn’t already exist, and change it’s password to the Unix password, whenever the user logs in using SSH or any other service that uses default system (common-auth) authentication.

You should see a message “Added user <username>” when logging in using SSH with an account that doesn’t already have a Samba account.

Because this will also create a Samba account for root, you might want to disable root access in Samba (Debian Etch has it disabled by default):

/etc/samba/smb.conf:

invalid users = root

Caveat: This will not work if the user logs in via SSH or other services without using a password (for example by using public/private key authentication). In this case, PAM won’t have the plain-text password, which is needed to create the Samba password.

Notice: When you modify common-password to also require Samba passwords updates, any currently logged in users will not be able to change their password using “passwd” until they re-login, unless they already have an existing Samba account with a password equal to their Unix password.

Samba -> Unix

While synchronization in this direction isn't necessary if your user's won't be changing their Samba passwords directly using smbpasswd, it is nice to enable it just to prevent any mistakes which would break the above configuration.

We instruct Samba to use PAM when changing passwords:

/etc/samba/smb.conf:

unix password sync = yes
pam password change = yes

Restart Samba using /etc/init.d/samba restart.

Configure PAM to support changing of password by Samba:

/etc/pam.d/samba:

@include common-auth
@include common-account
@include common-session
@include common-password

This will use the same mechanism to change passwords when using Samba as when using “passwd”. This means it will require an update of the Unix password before attempting to change the Samba password.

Creating new users

If you attempt to create a new Unix user and set their password using passwd, you will get:

# passwd test
passwd: User not known to the underlying authentication module
passwd: password unchanged

This is because the user does not have a Samba account yet. To avoid using PAM and set the Unix password directly, use chpasswd:

# useradd test
# echo “test:newpass” | chpasswd

If you know of a way around this, don’t hesitate to tell me about it.

Testing

You can check if a given Samba password is correct by using:

$ smbclient -L localhost -U username

To test everything:

1. Create a new Unix user, use a user without a Samba account, or delete the user’s samba account using smbpasswd -x <username> (as root),
2. login as the user using SSH. You should see a message: “Added user <username>” at the very beginning of the output. Test Samba account using the user’s Unix (and now also Samba) password,
3. change user’s Unix password using passwd and test Samba account again with the new password, to see if changes are reflected there,
4. change the Samba password using smbpasswd and check both Samba account and try to log in using SSH and the new password,
5. change user’s Samba password to something else, as root, using smbpasswd <useranme>,
6. you should not be able to change your account’s password as a normal user at this point, using either passwd or smbpasswd. This is an incorrect state, but it should be fixed automatically the next time the user logs in,
7. login using SSH and your Unix password again. Try connecting to Samba again, to see whether the password was synced correctly at login time.

If everything works, congratulations.

More info

• Samba How-To: Chapter 28. PAM-Based Distributed Authentication

Debian, Software

I have made full-text 3rd party RSS feeds for a couple of sites which otherwise have feeds with excerpts only.

Uncategorized

I was looking for a way to export photos from an album in iPhoto that would name the files numerically, like 0.jpg, 1.jpg, 2.jpg, etc. This would make it possible for others to easily view them in, say, Windows Explorer, in the order I intended.

After almost giving up, my last attempt was trying to export them as a web page and it turns out it works!

First open the album you want to export, press Cmd+A to select all photos, click File > Export and select the “Web Page” tab. Then, enter 9999 (or a sufficiently high number) in “Max width” and “Max height” fields in the “Image” group box.

After clicking “Export” and selecting an output folder, three subfolders will be created within it. One of them, named “<album name>-Images”, will contain the photos numbered numerically, in the order they appeared in the album.

Apple, Software

Urnike za FRI/FE z uradne strani sem pretvoril v iCalendar format, za uporabo v iCal, Google Calendar, etc. Read more…

FRI

phpBB is one of the most, if not the most, widespread internet forum solutions. While it offers an enviable amount of features, especially through the use of various MODs, the stock codebase still doesn’t support some pretty basic features such as daylight saving time.

What I have been doing so far with the forums I maintain is, I updated the the database directly and set the time zone of every user at the beginning and the end of the DST period. I also set the default time zone in the admin panel, so the guests would also see the correct time.

While this might be an acceptable solution for a forum where all of the users are in the same time zone, it won’t work for international forums.

I guess I am not the only one patiently waiting for the upcoming phpBB 3.0 release (codenamed Olympus). It is supposed to bring so many bigger long awaited (attachments) or desperately needed (better CAPTCHAs)
features, that I was implicitly expecting some smaller features, if not even bugfixes, such as proper handling of DST.

It seems this is not the case. Not much has changed in regard to this in phpBB 3. There still isn’t a “default” option in the user’s preferences, which would always “mirror” the forum’s setting, and once the user registers his selection is saved and will not reflect any further forum-wide changes.

The only new feature is a Daylight saving time in effect on/off radio button in user and admin preferences, which makes it a bit more obvious for the users to change it on their own, but it’s only a partial solution.

Software