Тази събота и неделя пак се занимавах с пролетно почистване около блока. Неделята беше дъждовна и можах да посвърша малко работа чак привечер.

Докато валеше, реших да свърша едно добро дело - като за цветница, и да накажа лумпените, които паркират върху зелените площи до блока и ги съсипват. Потърсих в нета на кой телефон да се обадя и попаднах на:

02/9875555 - Столичен инспекторат

Съобщих им за неправилно паркиралите автомобили и дежурния ме убеди че ще изпрати инспектор. Обясниха ми, че нямало да дойде паяк да ги вдига. За съжаление до вечерта не видях да има някакъв ефект - нито колите бяха преместени, нито имаше някакви фишове лепнати на предните им стъкла.

Проблема с паркирането

5, 10 или 20 паяка не могат да решат нищо в милионен град. Предложението ми е да копираме западния модел и да пуснем инспектори в града. Един единствен човек ще бъде ефективен колкото няколко паяка. Ходи, пише си фишчета и евентуално щрака с фотоапарата. При сегашния начин на паркиране ще има малко ходене, много писане и много пари събрани от глоби. Броят на инспекторите може да бъде достатъчно висок за да се покрие града изцяло. Те сами ще си изкарват заплатите и ще ни учат на ред. А ще има и нови работни места.

За гражданското общество

Време е пак да откраднем от западния модел и да почнем да се самоконтролираме. Ние трябва да съощаваме за всякакви нередности които ни вълнуват. И в последствие да контролираме дали са взети адекватни мерки от страна на съответните органи. По няколко граждански репортажа от хора с камерки и малко подкрепа от медиите и службите ще бъдат притиснати да си вършат работата.

Кога възрастните хора се отказаха да учат младите на култура ? Кога спряха да им правят забележки ? И тяхната култура ли изчезна изведнъж ? Или страхът в следствие на анархията и безнаказаността в последните години ги обезвери ?

Мисля че възрастните трябва да дават пример на младите. Не помня кога за последно съм видял някой да се наведе и да вземе чужд боклук от земята и да го изхвърли в коша. Не помня и кога съм видял някой да прави забележка на друг, че си изхвърля боклука на земята, или прави нещо нередно. Не помня някога да съм видял някой да вземе изпражненията на кучето си и да ги изхвърли в коша ..

Въпреки отиващата си зима и пролетното почистване на зелените площи около блока (през целия уикенд!) кантара твърдо върви нагоре.
Нов личен рекорд - 84.2 кг !

Поздрав - Ша-Ша - Няма да Ядеш

Тази година видях Щъркел на 7^ми Март. Не ми се е случвало толкова рано да го видя като че ли. Обикновенно си влача мартениците до края на Април че и до Май.
Проблема ми сега е къде да ги закача. Няма цъфнали дървета, още по-малко пък и плодни ..

I've just tried to watch an embedded youtube video and the flash reported an error.
Going to the http://www.youtube site reveals the friendly:

Http/1.1 Service Unavailable

Today we were working with a partner company on a common project. I was sitting behind a colleague's back when he wrote a message to me with several notes and sent it. He used an email at Gmail and sent it to my mail which was also at Gmail.

When I got in my office his mail was not in my inbox. I just asked him to verify he did hit the Send button and he confirmed that the message was in his Sent folder.

At this point I suspect the Gmail IMAP service which I was using with Kmail. Logging in via the web interface gave me no different results.

My colleague confirmed my address was correct by sending it to me. I even wrote this one liner to verify the address was spelled correctly with e.g. no Cyrillic symbols in it:

perl -we 'my $a="deliank\@gmail.com"; my @a=split("", $a); print($_ . " - " . ord($_), "\n") foreach @a;'
d - 100
e - 101
l - 108
i - 105
a - 97
n - 110
k - 107
@ - 64
g - 103
m - 109
a - 97
i - 105
l - 108
. - 46
c - 99
o - 111
m - 109

A minute later he decided to forward the message once again. No success this time too. He also suggested to try searching for the message in my Spam folder at which I replied s.t. like:

You must be kidding me. From Gmail to Gmail in Spam ?! You've made a big amateurs out of Google ...

I was quite amused when only the second message arrived several hours later and it was indeed in the Spam folder !

Up-to this point I had confidence in Google's services. From now on, I don't.

I've been following Australian Open recently and watched the coverage of the semifinal between Murray and Cilic today. At the same time I thought what will happen in the other semifinal between Federer and Tsonga tomorrow.

At this level most of the matches are won by the player psychology. Not by his tennis skills. Sure the skills play a role when the time comes to hit certain trick shot, or to catch a tough ball. But the outcome comes from what happens in players' minds.

All this mental pressure. All these guys being so serious. Is it for the money ? Is it for the glory ? Is it for the victory ? Sure its different for each player but in the end it's just a game.

When I thought about all this a curious question came to my mind.

Hey Roger, what if I give you the tournament prize before it starts ? I would just ask you to play for fun. To show us the best of your bag of tricks.

How do you think, will we enjoy the game more ? Will Federer still be able to win ? ...

java.net.SocketException: Network is unreachable

I hit this about a week ago . First time I saw it was on my office desktop running Debian unstable. Since I was not doing too much Java on it I decided it was a problem with JConsole. I nearly lost a bet out of this:

I was pretty sure JConsole was able to attach to local processes even when they were started without any JMX options enabled. Borislav Tonchev was pretty sure it wasn't. I quickly wrote a Java class with its main method sleeping for 100 seconds and tried to attach to its process. Unfortunately I wasn't able to do so. At that point Borislav walked away with 10 bucks coming out of my pocket.

I was curious enough to check this stuff and at first appeared that Java didn't like the bsdgroups option my ext3 /tmp file system was mounted with. Trying the same thing on my home PC, with bsdgroups disabled showed this java.net.SocketException: Network is unreachable. At this point I was starting to loose ground. I decided to check the docs ( http://java.sun.com/javase/6/docs/technotes/guides/management/jconsole.html ) and they confirmed my point. I checked the documented behavior in a JVM running inside an Windows XP installation I have ( VirtualBox image for the corporate stuff in the office ) and Borislav unhappily brought my money back.

At this point I decided the exception under Debian was caused by a bug in JConsole - probably it was not maintained too much in recent releases as a similar tool appeared - VisualVM.

Several days after this long background, on Saturday, I've also hit the same exception on a production server running Tomcat. Pretty damn strange. I was not able to figure it out immediately. The actual problem was introduced in Debian in the beginning of December last year, with the netbase package setting:

# cat /etc/sysctl.d/bindv6only.conf
net.ipv6.bindv6only=1

This did not showed up on the server immediately, since the netbase upgrade did not apply the new setting. The exception appeared after a restart almost two months after the upgrade.

The workaround is to set the above to "0" as it was before, or to add the option -Djava.net.preferIPv4Stack=true to each Java process you start. I prefer the former as I did not want to configure every Java program (e.g. I use azureus/vuze) manually.

More information could be found in Debian bug #560044

Scroll-Lock key

Recently I've noticed my Scroll-Lock key was not working under X. I needed it to stop screen updates in monitoring programs like top or htop. It was working perfectly under the standard virtual consoles and judging by this post, it probably worked with konsole with versions of KDE older than 4. So I started digging to see what was going on.

At first it seemed the Scroll-Lock key was not picked at all. I was used to its light being toggled each time I pressed it. But may be some time around the upgrade to KDE4 I noticed the light being used to display the usage of alternate keymap ( EN and BG in my case ). So I did not trust the lamp and looked whether the key was actually reporting any key presses. First I looked at various console key dumpers with no great success under X and then discovered the xev program (part of x11-utils in Debian). Running xev showed me the key was working perfectly fine. So what was wrong ? Why did top ignored it under X and picked it up under the vconsoles ? I thought that the key was actually being handled by the ncurses library. So something must have stood in the way. Did konsole or KDE caught it before being send to ncurses ? In order to eliminate konsole and KDE I've started the Xserver without window manager with only xterm running ( ran xinit ). The behavior was the same under xterm. And xev would not have been able to catch it if this was the case. I was not that sure ncurses handled the key anymore and started looking elsewhere. It appeared my expected Scroll-Lock behavior was a feature of the Linux vconsoles and handled by their in-kernel code.

So no Scroll-Lock for the terminal emulators under X. Anyway, Ctrl+S (stop scrolling) and Ctrl+Q (resume it) work just fine so no real need for Scroll-Lock. Sure Scroll-Lock could be mapped to do the job, but this would be a custom solution and getting used to it would not be of much use across machines I don't maintain.

Letters with accent / Букви с ударения

While I was at the keyboard stuff I decided to look at other related things that interested me. One of them was writing letters with accents. In my native language this is often necessary since there are words/conjunctions with the same spelling and the accent is the only way to distinguish them. E.g.

па̀ра / пара̀

Note that in order to see letters with accents your screen font should also support it.

When I searched the web I first found solutions with custom keymap definitions. I've looked at them, and they were supposed to either replace or complement the definitions in /usr/share/X11/xkb/symbols/ ( part of xkb-data in Debian ). Looking at the default definitions supplied with xkb-data revealed that the "Bulgaria - Traditional phonetic" mapping I used already had what I needed. The accents were mapped to the "/" (slash) key in Level3. So e.g. writing an "а̀" was just a matter of typing "а" followed by RAlt+/. The Right alt key was mapped to the so called ISO_Level3_Shift .

The U0300 unicode symbol is representing ACUTE accent. This is the kind of accent that is used in the Bulgarian language. There is also a mirror variant of the accent - GRAVE accent. It is represented by the U0301 unicode symbol. Here is an example:

а̀ѐѝо̀у̀ъ̀ю̀я̀
а́е́и́о́у́ъ́ю́я́

See the references section near the end of document for the full list of unicode symbol tables.

All symbols you can type with your current keyboard configuration

Just to clarify things for those of you who do not know about the different levels:

• Level 1 is a key typed alone
• Level 2 is a Shift+key
• Level 3 is RAlt+key (assuming your Level3 modifier is RAlt)
• Level 4 is RAlt+Shift+key

A useful command to get your current key mappings is xmodmap. E.g.

xmodmap
xmodmap -pke

On the desktop in the office I use the following keyboard configuration:

setxkbmap -model pc104 -layout us,bg -variant altgr-intl,phonetic

executed via KDE's "System settings"->"Personal"->"Regional & Language"->"Keyboard layout".

In order to get a visual representation of the keys in the the different levels and groups the xkbprint command could be used.

In my case I have two different groups (us and bg) and each of them has four different levels. By default the xkbprint command prints 2 levels - the one specified by the -ll parameter (or 1 if it is missing) and the next one.

xkbprint -eps -color -lg 1 -ll 1 -lc en_US -nokc $DISPLAY -o xkbprint-lg1_ll1.eps

This command produces a postscript file which I have cropped below:

When the symbols in the two levels are the same only one symbol is printed on a key (I guess xkbprint does not makes a difference between lower and upper case letter). When there is a difference the symbol for level 1 is printed on the bottom part of the key and the one from level 2 on the upper part.

Let us see levels 3 and 4 in the US group too:

xkbprint -eps -color -lg 1 -ll 3 -lc en_US -nokc $DISPLAY -o xkbprint-lg1_ll3.eps

Remember that level 3 is when you hold ISO_Level3_Shift ( RAlt by default ), and level 4 is when you hold ISO_Level3_Shift + Shift. The merged labels in the image above are:

• left and right single quote mark - on keys 9 and 0 in level 3
• left and right double quote mark - on keys with the square brackets in level 4

So what we see is that we have access to various special chars that might have ever been a key or a two away from you without you ever knowing it.

Let us also see the other group that I have configured.

xkbprint -eps -color -lg 2 -ll 1 -lc en_US -nokc $DISPLAY -o xkbprint-lg2_ll1.eps

Unfortunately I did not find an easy way to print the symbols in the BG group via xkbprint. Their names are showed instead. These names are defined in the /usr/include/X11/keysymdef.h file, which is included in x11proto-core-dev.

And here go levels 3 and 4 in the BG group:

xkbprint -eps -color -lg 2 -ll 3 -lc en_US -nokc $DISPLAY -o xkbprint-lg2_ll3.eps

Note that I have cropped the images above, in order them to be readable on normal screens. You can execute the specified commands yourself and take a look at the PostScript files directly to get the rest of the picture.

The characters which names are showed as U0XXX, where X is any hexadecimal digit, represent a Unicode symbol.

References:

1. http://unicode.org/charts/ - Unicode Character Code Charts
2. http://unicode.org/charts/PDF/U0300.pdf - Combining Dicritical Marks code chart
3. http://unicode.org/charts/PDF/U0400.pdf - Cyrillic code chart
4. http://unicode.org/charts/PDF/U2000.pdf - Layout control
5. http://unicode.org/charts/PDF/U2300.pdf - Miscellaneous technical symbols code chart

Hi!

My name is Delian Krustev and I'm from Bulgaria.
I was born in July 15^th 1979 in Gabrovo.

Education

I have lived and studied in Tryavna until I got 14.
Then moved to Pravec in 1993, where I finished high school, specializing computer science.
In 1998 I moved to Sofia and got a degree in "Computer Systems" from the Technical University of Sofia.

Professional experience

I have been working on various positions since 1999:

• Java developer
• Linux system administrator
• Build manager
• CTO
• PHP developer

My professional interests are in the area of the GNU/Linux systems. I'm a big fan of Debian and use it wherever it is possible in my daily work. GNU/Linux is the OS of my desktop and servers since year 2000.

My professional interests include (not in any particular order) :

• GNU/Linux systems
• Networking
• Security
• Hardware
• System administration
• Perl
• PHP

I've been writing code in the following programming/markup languages:

• Perl
• C
• PHP
• Shell/Bash
• Java
• XML, HTML, Java script

and probably others which I forget to mention ..

Personal

My wife name is Anelia, and we are parents of the lovely Aksinia. She was born on January 16^th 2008.

A sport which I practice a lot lately is mountain biking.
I've been participating in various non-professional races - mountain/road biking, running, triathlon.
I used to play basketball in the summer, and ski in the winter.
I like tripping in the nature, especially in the mountains.

Contact

You can find me here:

• mailto:krustev@krustev.net
• https://www.facebook.com/deliank/
• https://gab.com/deliank

Handy commands

Echo service with socat:

socat TCP-LISTEN:8888,reuseaddr,fork PIPE,nonblock

And to connect to it:

echo to the echo | socat - TCP:hostname:8888

I fucking hate oversized JPEGs

find . -name "*.jpg" -size +1M -print0 | nice xargs -0 -n1 -P4 jpegoptim --size=900 --dest=../data_resized --preserve --quiet

# Alternatively use ImageMagick's convert tool to fit the image within 4K. jpegoptim above fucks up the colors of some JPGs
find . -type f -name "*.jpg" -exec convert -verbose -resize '3840x2160>' '{}' '../img_resize/{}' \;

# Then update the file mtime from the EXIF info
exiv2 -T rename *.jpg

190315

Dump stacktrace in a JVM (because I forget which was the signal every time):

kill -QUIT `pidof java`

Dump contents of any Linux virtual console

screendump is part of the kbd package in debian

# For tty1
screendump 1
# Almost the same thing (no COLUMNS/LINES interpretation)
cat /dev/vcs1

Quickly create Debian package / quick debianization

Debian new maintainer's guide
Quilt for Debian Maintainers

mkdir ~/src/debian-packages/tai64nfrac
cd ~/src/debian-packages/tai64nfrac
wget http://archives.eyrie.org/software/system/tai64nfrac-1.4.tar.gz
tar xzvf tai64nfrac-1.4.tar.gz
cd tai64nfrac-1.4
git init
git add *
git commit -m 'Initial commit. Pristine upstream sources at v1.4 .'
# dh_make no longer supports the --quilt option
dh_make -e krustev@krustev.net -f ../tai64nfrac-1.4.tar.gz
# Edit files in debian/
mkdir debian/patches
# Setup "dquilt" alias as described in "https://www.debian.org/doc/manuals/maint-guide/modify.en.html"
dquilt new DESTDIR_and_FHS.patch
dquilt add Makefile
# Edit Makefile to support $(DESTDIR) and to put files in /usr instead of /usr/local
dquilt refresh
dquilt header -e
# describe patch and save
# Option 1: Build a binary package only:
fakeroot ./debian/rules binary
# Option 2: Perform compete rebuild
#  clean the source tree (debian/rules clean)
#  build the source package (dpkg-source -b)
#  build the program (debian/rules build)
#  build binary packages (fakeroot debian/rules binary)
#  make the .dsc file
#  make the .changes file, using dpkg-genchanges
dpkg-buildpackage -us -uc
scp ../tai64nfrac_1.4-1_i386.deb me@host:/path
# If you have missed something and have already uploaded - produce a new version:
dch -v 1.4-2
# And apply the necessary changes.

To update the package see: https://www.debian.org/doc/manuals/maint-guide/update.en.html

Managing packages with quilt is not necessary for locally build packages and if you do not distribute the source packages. You can use the power of the git repository and e.g. keep pristine upstream in a branch and the debian packaging files plus patches in another.

Skype: Change video capture resolution

I've faced this when I've upgraded to 2.6.32-3 kernel. Skype was only getting partial frames from my low cost USB webcam. It appeared that it tried the highest resolution it was reporting as supported - 640x480 . The webcam was not actually working in this configuration. So to change the resolution go to:

$HOME/.Skype/YourUserName/config.xml

search for the Video tag and either modify or add the following parameters:

<Video> 
  <CaptureHeight>240</CaptureHeight> 
  <CaptureWidth>320</CaptureWidth> 
</Video> 

Debian disable ipv6

echo net.ipv6.conf.all.disable_ipv6=1 > /etc/sysctl.d/disableipv6.conf
echo net.ipv6.bindv6only=0 > /etc/sysctl.d/bindv6only.conf
# comment out ipv6 entries in /etc/hosts

Fast way to shape incoming traffic

tc qdisc add dev extern0 handle ffff: ingress
tc filter add dev extern0 parent ffff: protocol ip prio 50 u32 match ip src 174.143.184.0/24 police rate 10mbit burst 1mbit drop flowid :1

I remember trying this in the past(at some time before 2005) and it was not working. Then I had to use IMQ to get it to work. Now it appears to work just fine.

Note that the burst should probably be adjusted if you change the rate.

Working with SSL certificates

Print OpensSSL x509 certificates from a concatenated file

perl -we 'my $F; while(<>) { m/BEGIN / and open($F, "|openssl x509 -text"); print $F $_ }' < infile

Dump pkcs12 contents, including any private keys and certificates in PEM encoded form

$ openssl pkcs12 -in pk.p12 -nodes

Verify that a certificate corresponds to a private key

Get the public key from the certificate and the private key and compare them:

$ openssl x509 -noout -pubkey < aps_production.pem 
$ openssl rsa -pubout < aps_production.key 

Or compare the modulus by taking it from both the certificate and private key:

$ openssl x509 -text -noout < aps_production.pem
$ openssl rsa -text -noout < aps_production.key
# Alternatively to dump just the modulus from the private key:
$ openssl rsa -noout -modulus < aps_production.key

Another option to map a certificate to a private key is to use the extension "X509v3 Subject Key Identifier" included in the certificate:

$ openssl x509 -text -noout < aps_production.pem | grep -A1 'X509v3 Subject Key Identifier'
        X509v3 Subject Key Identifier: 
            FF:BA:2C:F6:15:4F:F7:6E:61:9E:43:A0:04:93:B5:A1:F1:38:5B:E2

If you have the private key in a PKCS12 file you can easily dump the key identifier:

openssl pkcs12 -nodes -in pk.p12

If the private key is PEM encoded, to generate the key identifier from it first dump the public key and see its components:

$ openssl rsa -pubout < aps_production.key | openssl asn1parse
    writing RSA key
        0:d=0  hl=4 l= 290 cons: SEQUENCE          
        4:d=1  hl=2 l=  13 cons: SEQUENCE          
        6:d=2  hl=2 l=   9 prim: OBJECT            :rsaEncryption
       17:d=2  hl=2 l=   0 prim: NULL              
       19:d=1  hl=4 l= 271 prim: BIT STRING

You need just the field identified as "BIT STRING". Get it and save it to a file:

openssl rsa -pubout < aps_production.key | openssl asn1parse -strparse 19 -out bitstring.der

And then calculate this bit string sha1sum to get the key identifier:

$ sha1sum bitstring.der
ffba2cf6154ff76e619e43a00493b5a1f1385be2  bitstring.der

Or alternatively:

$ openssl sha1 < bitstring.der
(stdin)= ffba2cf6154ff76e619e43a00493b5a1f1385be2