Engineers are sticklers for detail — indeed, they’re so often held feet-to-fire for the finer details their managers don’t know, cannot fully comprehend, or simply don’t care.

Many’s the engineer who is pressed for an estimate, gives one (with or without variance indicators), under- or over-estimates, and is taken to task for the bad prediction.  Similar to asking a detective “when will you solve this crime?”, some engineering work cannot be predicted, and if the engineer explains it as a “Poisson distribution”, his manager assumes “poisson” is profanity.

Some engineers no longer even try to estimate: it’s more efficient to be wrong, and punished, without wasting the effort.

Often, missing details, and discovery thereof, drive the inaccuracy.  I recall one at USL saying “less than two years”, then offering to improve the prediction within a few weeks when the manager relented and gave some details.  The manager thought he was helping by asking broad questions with few details to “get a ballpark figure” whereas the Engineer can see how the answer ranges from 2 hours to 2 years depending on environment alone.

…and then there’s the aspect of promises.  Engineers don’t promise anything but quality.  They don’t commit to a delivery, they offer their firm attempts to succeed, understanding that the delivery might be met of some features are later dropped.  They don’t answer questions unless the answer is a relatively good degree of accuracy — or unless pressed feet-to-fire for an answer that will come back and bite them later.

Lying, or inaccuracy approaching lying, is not done.  It WILL bite them later.

Being asked for answers to exceedingly vague questions will result in non-answers or answers with equally vague details.  Being asked to rough up or down significantly will be met with long decisions as to which way to go.  If an Engineer is billing, and the effort is below a certain minimum, I have known some to simply not bill for such insignificant work.

Quantizing is inaccuracy.   … an hour, a half-day, a full day, these are simply varying quanta.  Rounding up too far will yield to rounding down to zero.

Increasing inaccuracy increases the chance that either zeros will be quoted, or nothing responded at all: easier to not answer and be wrong than spend hours answering and still be inaccurate to the point of unprofessional.

So what expectation is there that a timesheet in terms of half-days will ever be accurate, and not bite the Engineer later?  ”did you really spend 1/2 day on the project you billed me for?”

Don’t impose inaccuracy on an engineer; accept the answers, record them, and if you want inaccurate or more vague results, round them yourself.

Consider arriving in a strange, new city during the era of prohibition.  In order to find stores, markets, and local associates, you pick up two telephone guides.  Remember the White Pages and Yellow Pages?  Consider those as your resources, except that your phonebooks update instantly.

You’re able to look up your friend Mike, who has invited you to dinner.  His address is in the white pages, telling you “Mike Smith: 123 Main St”, and you know how to get there.  Mike lives above a tailoring shop, and has a market nearby, which you’re able to find to buy some beef enroute to dinner.

What about a bottle of wine?  That would be nice, but it’s prohibition, everything with any alcohol is illegal.

On the way to Mike’s, beef in-hand (a couple of excellent steaks), you notice that the tailor shop below him is closed, yet many people keep entering and leaving.  That’s odd.  Mike is happy to see you when you get to his door, and he makes a great dinner; he suggests doing so again next week.

Next week, Pork’s on the menu, but you have to look up the market again.  You wrote down the name (Joey’s Eastside Butcher) and your whitepages tell you where it is.  Mike tells you on the phone to be careful, police have detected that the Tailor shop is a Speak-Easy, and is illegal.  As a lawful citizen, despite that you’d like a drink occasionally, you tend to stay away from that sort of place anyhow.

Off to the butcher’s, but wait… where’s Mike’s place?  The whitepages no longer list his building at all.  From your always-updated whitepages, Mike’s entire building is gone.  You ask a friend, they have one that doesn’t update as quickly, and it shows that last week, Mike’s address was 123 Main St.  yeah, that’s right.  Another friend has a version of whitepages from Germany, and although in a different language, it does show the local city, and it agrees: Mike’s address is still 123 Main St.  Good thing you wrote down Mike’s phone number itself rather than his name, or you’d lose all contact with Mike.  You should get yourself a German phonebook, or use one that doesn’t delete entries, just adds them.

Arriving at Mike’s building, you notice that the Speak-Easy is doing a brisk trade.  It hasn’t been shut down!  The police haven’t lifted a finger, just “hid” it by removing Mike’s building from the whitepages.  Everyone who goes there often knows exactly where it is; if they haven’t, they’ve written down the phone number already, or have it on speed-dial.

This is how these new bills work: they don’t stop crime, they simply allow it to become unlisted quickly, without any recourse, any due-process.  They just make it harder to find, quickly.  The internet whitepages is called “DNS”, and is controlled by many different countries.  DNS updates take up to 72 hours to occur, and even after that time, the services are still open.  Anyone using these services knows where to find them without having to look them up, but if they need to, they can use alternative listings to find the same address.  The piracy isn’t even affected, it continues unabated, but common people are affected: new arrivals at a website or an interest group, and those who have to find their websites when they move (which happens about as frequently as people change homes)

Worse, with some allusion to Brazil, and perhaps to some implementations of photo-radar speed-traps, there’s no double-checking of errors, no due-process.  Due to an error, not only is a building, and all it’s businesses gone, while they are barely making it through the recession.  I’m sure the people who think this is a good idea are not the small businesses and private citizens who can vanish immediately due to error.  … and we know the Department of Homeland Security makes no mistakes.

Would you give the “Internet Kill Switch” to the TSA?

Criminals will simply go to other countries’ DNS, or just use the numbers, leaving only the lawful to be the victims of bad legislation and the zealots who support it.

Crime should be stopped by actually stopping crime, not by making it and its innocent neighbours into unlisted addresses.

iCollectGadgets shows a few great photos, but the key is in the following two (with permission, I’m willing to host a copy of these on my site to reduce any bandwidth-stealing):

Button Alignment:

Earbud 3.5mm Socket:

I would strongly recommend checking out the original site: https://icollectgadget.wordpress.com/2011/10/09/how-to-choose-cases-for-iphone-4s-and-iphone-4/

IPhone is 80% battery, HTC is 57%. Sure, optimal conditions rate the content the other way, but we all know our wifi access points will hit 300 feet / 100meters range in an optimal situation: real life differs, and for my usage, HTC with MAYBE the same services active is burning battery twice as quickly.

Not sure Android is winning yet.

Fatal error: Call to undefined method WebRequest::getIP() in extensions/ConfirmEdit/Captcha.php on line 202

Apparently, this is due to rev 106097, which replaced wfGetIP() with a wgRequest->getIP() that doesn’t exist. Maybe it’s in Yesterday’s version of WikiMedia only.

My fix:
cd extensions/ConfirmEdit
svn update -r 106096

I’m putting this blog entry so that others may see it and make use of it.

I’ve found that when the NTP server is fewer than 4x reached, then it will not choose a source. When it chooses a source, a local source might cause it to flag itself as “unreliable” (leap flag with a bad result). That or a poor stratum (less than client’s fudged 127.127.1.0) is causing a client to ignore a source.

In our case, we saw an SNTP reject on status == 3 (see sntp/main.c::read_packet : “if (failed || data->status == 3″); this “status” is actually the Leap Indicator being 0%11 ( == 3), which was re-instated in RFC-2030 (superseding RFC-958) as an alarm condition (when the last second plus the next second are leap-seconds).

The client is flagging 0×2001 and 0×6001 quite frequently; this is clearly PLL/FLL changeovers, implying that it often sees a “weak” source, perhaps one that jitters too often, and swaps mode.

I’ll add to this over time if I see additional factors. As always — ALWAYS — “ntpq -c opeers” (in whatever form is permitted by your OS) is the best first-step, although “readvar” is also a good first step.

Someone (“lion”) whose industry knowledge I strongly respect, and who has an attitude of “what will XXX do for me today?” (ie not flippantly changing direction on things without clear benefit) admitted to switching to international date format.

Why is that so cool to me?

• it validates my position, but may not yet validate the stubbornness with which I’ve pursued this
• confirms the benefits are not merely in my biased opinion
• it’s easier for me personally (it’s all about me)

In this case the benefits of ISO-8601 format (the basis for W3C, RFC-3339, used by tools such as XML recommended datatypes) of yyyy-mm-dd being unambiguously understood in other countries, and sorting where least expected (filenames of presentations and revisions of tech pubs) due to its friendliness with sort algorithms no more complex than strcmp(), these benefits have made it easier to find the earliest/latest/newest versions of documents where dozens of similar content may exist.

I still argue that:

1. Locale is not Language: Just because I’m in China, I may not speak Chinese (and which China? Which Chinese?)
2. Locale is not format: in Canada, we use date formats dd/mm/yy, dd-mmm-yy, and yymmdd — so which one?
3. Language is not format: en_CA is similar to en_US, but 2/3/4 is a different date than you think
4. There are more cities than Timezones: if you’re choosing a timezone, choose a timezone, not a city, unless it helps to suggest the actual timezone
5. Don’t accidentally get into politcs: Wales and London are not so United of Kingdom; if you don’t offer “Cardiff” and “Bristol” as cities, then allow the user to choose their timezone without claiming to be British (or is that “English”?). If you don’t understand that, spend a week in Wales.

RFC822 and RFC-2822 force foreign countries to know English day-names and Month names (not hard, but entrypoint for error) and require non-trivial parsers, but some developers just don’t seem to consider that there might be an easier way.

Tools that follow java.util.Date or PHP date formats or make assumptions based on /etc/tz values, they’ll continue to limit their users’ choices, further limiting their users’ end-users’ choices. Think about what constraints you’re doing. “Rome wasn’t built in a day”, “you can’t turn a supertanker”, “can’t change China” – you don’t have to try to change the world, just don’t participate in the constraint.

Hey, it’s nice to be right on occasion. Unfortunately, I still need to choose Japan or China as locales in order to get usable dates.

snmpget -v1 -c {community} {switch IP} 1.3.6.1.3.94.4.5.1.33.{portIndex – 1}

for example: port 91, switch 192.168.1.1, community BatM4n:

snmpget -v1 -c BatM4n 192.168.1.1 1.3.6.1.3.94.4.5.1.33.90

Successive checks of this value can show the deltas that VW is reporting.

I’m using the following:

• http://community.brocade.com/docs/DOC-1733 for MIB download
• FE_RFC2837.mib defined a mismatch as fcFeMIB.fcFeMIBObjects.fcFeError.fcFxPortErrorTable.fcFxPortErrorEntry.fcFxPortLinkResetIns
• FA.mib defines the corrected value as FA.experimental.fcmgmt.statSet.connUnitPortStatTable.connUnitPortStatEntry.RxLinkReset.{port}
• ~.TxLinkReset.{port} is available as 1.3.6.1.3.94.4.5.1.34.{portIndex – 1}
• http://www.filibeto.org/sun/lib/nonsun/brocade/manuals/6.2.0/53_1001156_01_MIB_v620.pdf

Meanwhile, OIDView is a great tool if you’re not used to using “vi” as your MIB browser. In this case, it would have helped me find the values (rather then “/” to search), but I’d still need to choose the correct MIB to start with.

I get meetings through the day; sometimes, I’m the guy presenting a gotomeeting (which is a great tool), during which times I have to hide the constant stream from the Skype window. The bad part of that is that I cannot see chatter from coworkers… well, that’s not the bad part. The bad part is that when they send me messages, they assume I see them.

How can I remind them that I cannot see the messages? (should I care?)

One idea is to link the showing of my screen to a status that says “I’m ignoring Skype right now”; for which I looked at the Skype API. There’s scant detail, and the easiest (lightest way) seems to be an Applescript remote-executor. An rexec() proxy?

1. wakes-on-LAN using a UDP to a known port, from which the service starts, and timesout 5 minutes after idle? (this was a standard feature of inetd-run UDP ONC/RPC)
2. reads UDP-based command with PKI to confirm permissions (ie “here, take this cookie”)
3. sends the request to Skype (whitelist of accepted commands?) and sends the response back. The response might be too big for UDP out-of-order delivery

The net effect is a few days’ work (OK, a few hours, but try to get that in a single calendar day) I could tell my coworkers that I really am ignoring them. …or I can let them figure it out, because I work with really smart people (they tend to be smart about non-details, no sarcasm here, they really are very smart)

For years, I’ve used a version of a program called variously “limitedrun” or “timeout” in order to run servers so I can self-test against them. An example is my work on Apache (minimal) and Nagios (lots, especially testing Nagios-LDAP). If the autotest failed, which meant that the script would immediately stop, the service would not be stopped by the cleanup commands, so the shell would not complete, and the self-test would appear to hang.

Instead, I used a limited-run facility to add the logic “well, if you ran for 30 seconds without being shutdown, the test must have failed, so … BLAM snuff it!”… which would allow the self-test to completed and report the failure. A passing self-test would gracefully shutdown the services used.

I think on my work on Nagios, it’s even called “timeout”.

At v7.0-beta, CoreUtils gained timeout, which I haven’t checked for compatibility in featureset (not hard, few features in mine) but now I can use that rather than keep packing mine around (the issue is when I added to it: I had to go and update every project that had a copy, or I needed my custom RPM on every testbox).

Less work for me! More standardized! Colour me happy

This is the same as shimming a DLL or Shared-Object library.

My grasp of the obvious is so exceptional — and this method so easy — that I felt this was worth mentioning.

The problem is that when I send mail, I wand to receive a copy, I don’t want a bcc:, but Entourage (the only Exchange client for a laptop that doesn’t die) only allows saving a copy in the “Sent Items” folder. I know, it’s simple enough to copy stuff around, but hey, I can get a cronjob to do that…

1. create a file (with restrictive permissions) containing only the password:
   — /home/scott/imapsync-pw-exchange —
   tiger
   —

   In my example, user “scott” has password “tiger”. Bonus points if know where that user/pass comes from

2. drop a cron.hourly consisting of:
   — /etc/cron.hourly/scott-exchange-sync —

   imapsync \
     --host1 exchange.example.com  --port1 993 --authmech1 PLAIN \
     --host2 exchange.example.com  --port2 993 --authmech2 PLAIN \
     --user1 scott --ssl1 --passfile1 /home/scott/imapsync-pw-exchange \
     --user2 scott --ssl2 --passfile2 /home/scott/imapsync-pw-exchange \
     --folder 'Sent Items' --regextrans2 's/Sent Items/INBOX/g' 

   —

   (or, better, crontab -e yourself a cron job that fires on 5-minute accuracy)

3. profit!!!1!one!! … oh wait… uh… sit and relax.

The trick here is that we’re using imapsync to connect to our own server twice, as two clients, to sync the “Sent Items” folder. Yes, those two sections of parameters are exactly the same (except for s/1/2/ — and use the same password file) on purpose. The “regextrans2″ tells it that we want to “translate” one folder to another (that may exist). Note that we’re deleting and expunging the moved files to avoid dupes.

Why can’t Microsoft’s updater realize that it’s the app it wants me to shut down?

Besides locking the MDS and slowing down a Mac, is there any real engineering put into this product by Microsoft?

Oh, and why is Microsoft affecting Safari? That seems fishy…

a Bufferpool is simply a resource limitation on a collection of RAM — typically this is a buffer, ie in-RAM space, it cannot be swapped-out because it represents in-flight transactions, uncommitted pages, or pre-fetched content that will be needed very soon.

a Commit is the RAM that is offered to a process — in glibc, this can default to 2G. This doesn’t say that every process automatically consumes 2G of RAM, but that the Kernel offers up to 2G to the process. Recall that due to sparse garbage in RAM pages, RAM offered to a process is NEVER reaped by the system back to the common pool.

A Commit can be dangerous when the OS over-commits RAM in a long-lived environment: if up to 100G is offered on a system with only 32G, you can see how if many threads grow their demand for RAM, the system will swap out some processes to meet demand. This is a typical action in a multiuser system with swap active (NOTE: Motorola tuned their commits on smartphones because on diskless systems, there’s obviously no swap)

In a long-lived database process, if the bufferpool is a commit, then it will soon grow to maximum commit. It can never be swapped out unless the database has bursty use-cases and has no active sessions for long periods. The bufferpools configured may be in addition to the heap space taken up by the process itself (in un-pooled resource space). The database itself may limit bufferpools, but consume a number of GB over the configured bufferpool space.

The other applications on the system also can demand up to their committed RAM — why limit one process while letting the others run amok on your server?

On long-lived systems, committed RAM becomes allocated and consumed RAM. Bufferpools need to be configured, and RAM usage monitored (or at least traps/exceptions raised when a critical DB starts swapping, an indication that review is critically needed)

Bufferpools and Commit/Demand discrepancies are silent but deadly killers, like the sharks and heart-disease of the resource-management domain.

If it happens twice, it’s a bug, be it hardware, software, or meatware (users / processes).

Dishonourable mention for the bugs that rarely happen, but require a 5-alarm firedrill to diagnose, and makes a company look really, really bad

If you consider it, even the Software Architect who never talks to customers until their environment is very stable, he’d have to agree: if something happens twice, even if I’m a genius and it never happens to me, it must be more possible than alignment of the planets, so should be considered. If users keep doing the same problem, maybe they have other habits than what I have, and maybe should be considered worthy of helping rather than ignoring.

If the glorified calculators on our desks are more capable of checking for that error, then why aren’t they? (That’s a key tenet behind the Smallfoot project: use the software to do what software’s good at).

I just saw a bug in a release of our product, I think it’s handled in some of the work on the later major revision, but I’m not sure. I don’t want to file until I know, as that wastes developer resources to tell me I’m an idiot (I’ve been an idiot many times, but developer resources are quite valuable in my books). I don’t want to forget to check, but damn, there’s a lot of stuff that happens in my workday, and my memory is fairly sketchy (poor-quality meatware).

Maybe it’ll happen a third time. Thrice is definitely a bug.

This is what I said as a solution to the problem of traveling in other countries, taking your new AppleTV with you (let’s not ask why you’d pack that over, say, a helmet, or a SCUBA reg), and accessing the full line of USA Netflix content. This is all with the intention of getting access to the USA content on Netflix (with a proper, USA paid subscription) while traveling.

So I said “put a VPN on your AppleTV, and connect through there to stream content”. This also requires that the system you’re streaming through has sufficient bandwidth to both send and receive a copy of the streamed packets. I would not recommend streaming from a residential gateway on the end of a cablemodem, for example, because of the asymmetric inbalance in upstream/downstream data rates and latencies.

So we’re mostly following the FireCore Newbie Procedure:

1. Download the latest Pwnage (v4.1.2)
2. Download a compatible AppleTV version 2 image (v4.1 4M89)
3. Create a jailbroken image, which should offer ssh access
4. Use ssh to configure the stripped-down OSX on the AppleTV to connect VPN

This is very much like streaming the UK BBC Player to watch soccer outside the UK — because when you travel, you want/need/must have access to your soccer. Yes, I’m talking about you, Cannoli.

Now I need to install tools on this new box; what’s on your Mac?

• (cost) Entourage, MS/Word, MS/Excel: not by choice, and it slows down the Mac whenever they’re running
• (free) MailDrop to work with SFDC from Mail.App and Entourage
• (free) Skype with a workplace account
• (free) Click-to-Flash – to avoid wasting cycles on unnecessary flash-based webcrap
• (free) Adium (to IM non-work accounts — might not need it)
• (free) CoRD – for RDC so long as I choose a US language/keyboard
• (free) GoToMeeting
• (free) sfCubed – SFDC Sync — might not need
• (free with…) xCode
• (free with…) TomTom Home – maintain my PND
• (free) Visual Hub – might not need on this box
• (free) VLC
• (cost) VMWare Fusion (VirtualBox instead?)
• (free with…) VZAccess Manager
• (free) iPhone Configuration Utility – to share configs to other users rather than config on their phones

As you can see, everything but the Microsoft stuff and the VMWare is free or comes with the Mac. No Antivirus, the OS is strong enough as it is. Backup is done by the OS.

Either that, or ads should not be shown to User-Agent = search engine.

The problem is that the search text is tainting the accuracy of the search due to inaccurate actual content. For example, search for “Automator” and “GoToMeeting”, and you’ll find plenty of articles about Apple Automator, but the GoToMeeting content is just ads, it’s not in the usable meat of the page.

If the search engine was able to understand what parts of the page are the advertisements, and remove that from the search, it would improve accuracy of search results. This should also improve SEO for the page, since the affinity of the page to key terms can be more easily gleaned without the distraction of advert-related content that has less to do with the core of the article (for example, GoToMeeting is only barely related to LockerGnome talking about Automator)

So how do we go about doing that?

And how can we do this without reducing the effectiveness of the ads? (disclaimer: I do believe that advert-supported content enriches the web, even if I find it such a nuisance to have 60% of the screen taken up by blinking moving unrelated content)

Entourage.

Let’s talk about implicit lock-in. Yeah, that’s right.. when you use a product across an organizaiton, it can become “the norm”, failures and all. Just as Mac people are surprised at how often Windows people get locked up and have to reboot (admittedly less often in Windows 7), it’s also amazing how companies “need doc”, and “need powerpoint” and now “need docx”. For the same reason, if you cannot read a tnef extension on an email, and accept a calendar invite received in email, you’re toast.

Let’s ignore the fact that calendar entries should be handled by calendar servers, and shouldn’t require your mail client to be open/running just to transfer calendar invites to your calendar — that would be a silly tangent.

So even though I have weeks between reboots, I still need to have Microsoft Entourage running to process calendar entries.

… and when that Entourage sucks up all the core memory and starts swapping like Godzilla (he was known to swap core), the world slows down.

… and when the world slows down, the GUI cannot create a “Force Quit” dialog box to kill the offending RAM-hog.

My reboot time is 3 minutes; my boss on the phone didn’t even realize. (FWIW, Mail.app is seriously heavy on RAM, and seems to fight with Entourage over MDS)

This should be a lesson to me: don’t leave Entourage running overnight.

The config I had was very much like “Tim” wrote on Shared Know How on Sept 28, 2008 — in fact, it’s a very basic, standard config, it’s a bit difficult not to wander onto it by accident (although Tim’s article is quite useful to paint the solution and validate that “yes, it does work” — and validation is not to be understated).

The iPhone4 didn’t connect to that setup anymore, and there was very little indication why:
Aug 31 19:28:20 usloft1645 pppd[9875]: Connect: ppp0 /dev/pts/1
Aug 31 19:28:20 usloft1645 pppd[9875]: Unsupported protocol 'IPv6 Control Protovol' (0x8057) received
Aug 31 19:28:20 usloft1645 pppd[9875]: MPPE required but peer negotiation failed
Aug 31 19:28:20 usloft1645 pppd[9875]: Connection terminated.
Aug 31 19:28:20 usloft1645 pppd[9875]: Connect time 0.0 minutes.

So lacking any real diagnostic methods, I began randomizing on the configs around MPPE. Damned if it wasn’t as easy as just dropping the requirement for MPPE:

(/etc/ppp/options.pptp)
name pptpd
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
#require-mppe-128 -- works with iPhone1-3, fails with iPhone4
ms-dns 192.168.0.1
proxyarp
lock
nobsdcomp
novj
novjccomp
nologfd


I’ll need to clean up this entry a bit, but that’s the change so far, and it’s connecting. I’ll see too if I can find compatibility setting to get MPPE back, since this drops out payload-protection on a VPN which users may assume is usually secure from prying governments eyes.

In Summary, the working config right now is:

(/etc/ppp/chap-secrets)
(where “username1″ is actually a user’s username, and “password1″ is his/her plaintext password, but “*” is actually an asterisk)
username1 * password1 * # some comment ...
username2 * password2 *
...


(/etc/ppp/options.pptp as above)

(/etc/pptpd.conf)
option /etc/ppp/options.pptpd
localip 192.168.0.1
remoteip 192.168.0.128-191
debug


(/etc/ppp/ip-up.local)
# a bit heavy-handed, but gets named listening on the internal interface faster
rndc reload


This last file is a bit unusual; I found that although BIND is configured (named.conf) with the 192.168.0.1 interface to provide recursion and service, it would stop listening on the PPP link when the last connection closed:

Aug 31 19:42:54 usloft1645 pptpd[9915]: CTRL: Client 24.18.213.241 control connection finished
Aug 31 19:48:30 usloft1645 named[20202]: no longer listening on 192.168.0.1#53


This heavy-handed smack in ip-up.local causes it to listen on the 192.168.0.1 ppp0 interface again:
Aug 31 19:28:50 usloft1645 pppd[9916]: Connect: ppp0 /dev/pts/1
Aug 31 19:28:50 usloft1645 kernel: PPP Deflate Compression module registered
...
Aug 31 19:28:50 usloft1645 pppd[9916]: local IP address 192.168.0.1
Aug 31 19:28:50 usloft1645 pppd[9916]: remote IP address 192.168.0.128
Aug 31 19:28:50 usloft1645 named[20202]: loading configuration from '/etc/named.conf'