LED light bulbs

Matt's Household Electric usage
Jun-May Household Electric Use

The graph above from Seattle City Light shows 12 months of our household electric usage (Jun-May). Each bar is 2 months, so the first is Jun-Jul and the last is Apr-May. The lighter colored left bar is the prior years usage, and the darker colored right bar is the current year (Jun 2012-May 2013) usage. Can you guess in which 2-month period I replaced all our light bulbs with LEDs?

Geeky things to do with DMARC

May 25th edition.

Between 2013-05-24 17:00:00 and 2013-05-25 16:59:59, somebody at the United States Army base in Fort Huachuca, Arizona (home of the “U.S. Army Intelligence Center and the U.S. Army Network Enterprise Technology Command (NETCOM)/9th Army Signal Command”) attempted to forge an email to a Yahoo email address purporting to be from my domain cadillac.net.

I discovered this while testing the report analysis tools in Mail::DMARC, my nearly complete implementation of DMARC. DMARC is a nifty bit of tech where mail server operators (in this case, Yahoo!) report message delivery information to domain owners (in this case, me). In this case, Yahoo received the non-conforming message attempt from IP 141.116.211.97, which resolves to host-141-116-211-97.ptr.hqda.pentagon.mil. GeoIP locates the IP at:

US, AZ, Fort Huachuca, 85613, 31.527300, -110.360703, 789, 520.

Because the message didn’t conform to my published DMARC policy, Yahoo rejected it and reported information about the attempt to me. To rule out the possibility of this being a legit message being forwarded, I checked my logs and found zero messages being sent from that domain during the time period. I’d be quite curious to hear an explanation for this attempt.

DKIM and mailing lists

I recently deployed DKIM on a number of my domains. For those readers of my blog that are unfamiliar with DKIM (Hi Mom and Dad, I love you.), DKIM is just a fancy way to stamp emails with a special digital signature. DKIM makes it so other mail programs can inspect the message and determine if it really is from me.

I also manage a number of email lists, and I subscribe to a number of other lists. Email lists have a habit of appending trailers with helpful instructions for managing subscriptions, and adding prefixes to the subject. This altering of the message as it passes through the mailing list invalidates the DKIM signature.

Today I tested a “fix” for one of my Ezmlm mailing lists with these commands:

cd path/to/ezmlm/list; rm prefix  text/trailer addtrailer

Then I sent a test email to the list, and voila, the message passes DKIM validation.

How domain registrations were done in 1996

Received: from ic.net (falcon.ic.net [152.160.101.1]) by ops.internic.net
(8.7.4/InterNIC-RS) with SMTP id CAA03959 for ;
Fri, 12 Apr 1996 02:12:39 -0400 (EDT)
Received: from michweb.net by ic.net with smtp
     (Smail3.1.28.1 #6) id m0u7S0n-003EooC; Thu, 11 Apr 96 15:26 WET DST
Date: Thu, 11 Apr 96 15:26 WET DST
From: matt@michweb.net (Matt Simerson)
To: HOSTMASTER@INTERNIC.NET
Subject: [NIC-960412.367] NEW DOMAIN
Message-ID:
MIME-Version: 1.0
Received: from porthos.michweb.net [152.160.182.5] by michweb.net
  with ESMTP (Mail Server 5.0.2); Thu, 11 Apr 96 20:34:53 GMT
Content-Type: text/plain; charset="us-ascii"
Status: O

******************* Please DO NOT REMOVE Version Number ********************
Domain Version Number: 2.0
**************** Please see attached detailed instructions *****************
******** Only for registrations under ROOT, COM, ORG, NET, EDU, GOV ********
0.   (N)ew (M)odify (D)elete....: N
1.   Purpose/Description........: Business Web Site
2.   Complete Domain Name.......: michweb.com

Organization Using Domain Name
3a.  Organization Name..........: MichWeb Inc.
3b.  Street Address.............: 621 N. Lake Street
3c.  City.......................: Cadillac
3d.  State......................: MI
3e.  Postal Code................: 49601
3f.  Country....................: USA

Administrative Contact
4a.  NIC Handle (if known)......: MICHWEB2.DOM
4b.  Name (Last, First).........: Simerson, Matt
4c.  Organization Name..........: MichWeb Inc.
4d.  Street Address.............: 621 N. Lake Street
4e.  City.......................: Cadillac
4f.  State......................: MI
4g.  Postal Code................: 49601
4h.  Country....................: USA
4i.  Phone Number...............: (616) 775-8416
4j.  E-Mailbox..................: matt@michweb.net

Technical Contact
5a.  NIC Handle (if known)......: MICHWEB2.DOM
5b.  Name (Last, First).........: Simerson, Matt
5c.  Organization Name..........: MichWeb Inc.
5d.  Street Address.............: 621 N. Lake Street
5e.  City.......................: Cadillac
5f.  State......................: MI
5g.  Postal Code................: 49601
5h.  Country....................: USA
5i.  Phone Number...............: (616) 775-8416
5j.  E-Mailbox..................: matt@michweb.net

Billing Contact
6a.  NIC Handle (if known)......: MICHWEB2.DOM
6b.  Name (Last, First).........: Matt Simerson
6c.  Organization Name..........: MichWeb Inc.
6d.  Street Address.............: 621 N. Lake Street
6e.  City.......................: Cadillac
6f.  State......................: MI
6g.  Postal Code................: 49601
6h.  Country....................: USA
6i.  Phone Number...............: (616) 775-8416
6j.  E-Mailbox..................:

Primary Name Server
7a.  Primary Server Hostname....: dns.michweb.net
7b.  Primary Server Netaddress..: 152.160.182.1

Secondary Name Server(s)
8a.  Secondary Server Hostname..: mail.michweb.net
8b.  Secondary Server Netaddress: 152.160.182.4

Invoice Delivery
9.   (E)mail (P)ostal...........: E

A domain name registration fee of $100.00 US is applicable.  This charge
will cover the $50.00 maintenance fee for two (2) years.  After the two
year period, an invoice will be sent on an annual basis.

The party requesting registration of this name certifies that, to her/his
knowledge, the use of this name does not violate trademark or other
statutes.

Registering a domain name does not confer any legal rights to that name and
any disputes between parties over the rights to use a particular name are to
be settled between the contending parties using normal legal methods
(see RFC 1591).

By applying for the domain name and through the use or continued
use of the domain name, the applicant agrees to be bound by the terms of
NSI's then current domain name policy (the 'Policy Statement') which is
available at ftp://rs.internic.net/policy/internic/internic-domain-1.txt.
(If this application is made through an agent, such as an Internet Service
Provider, that agent accepts the responsibility to notify the applicant of
the conditions on the registration of the domain name and to provide the
applicant a copy of the current version of the Policy Statement, if so
requested by the applicant.)  The applicant acknowledges and agrees that
NSI may change the terms and conditions of the Policy Statement from time
to time as provided in the Policy Statement.

The applicant agrees that if the use of the domain name is challenged by
any third party, or if any dispute arises under this Registration Agreement,
as amended, the applicant will abide by the procedures specified in the
Policy Statement.

This Registration Agreement shall be governed in all respects by
and construed in accordance with the laws of the United States of America
and of the State of California, without respect to its conflict of law rules.
This Registration Agreement is the complete and exclusive agreement of the
applicant and NSI ("parties") regarding domain names.  It supersedes, and
its terms govern, all prior proposals, agreements, or other communications
between the parties.  This Registration Agreement may only be amended as provided
in the Policy Statement.

Corsair SSD + Mac = pain

Until recently, having a 3 year old laptop was unthinkably slow. Yet today I find myself with a mid-2010 MacBook Pro. Not long ago, RAM and processors leapt past the point of being good enough. My long-in-the-tooth laptop is sporting a 2.66 GHz Core i7 CPU, 8GB of RAM, and half TB of storage. All of those specs are sufficient for my needs.

The problem with my old system was the performance of the spinning disk. Its laggard ways had me lusting after a new Retina MBP with 512GB SSD. I would have leapt, but two things held me back: Anand’s advice, and my employer donating a Corsair CSSD-F240GB2 to me. Dropping in a SSD made a dramatic difference. Instead of drooling after a new laptop, I was like a satiated diner, admiring the dessert menu, but passing.

I was content, until my Mac started to hang once a week with identical symptoms each time. Apps that did not need disk I/O (terminal & IM sessions) would keep running while those in need of disk would hang interminably. The only solution is a hard power off. I looked into it and Corsair offers a firmware update, principally to address wake-from-sleep hangs on Windows. The firmware updater is  Windows only. It’s worth a try, right?

My first stab was connecting the SSD to another Mac running Windows 7 in VMware, via USB. The update utility didn’t see the drive. To follow the updater instructions and connect via a Windows 7 computer via SATA and AHCI enabled, I would have to install Windows 7 via Boot Camp. Installing Boot Camp is generally easy: run the Boot Camp Assistant, let it carve out some disk space for Windows, reboot to the Windows install DVD and install.

Except I had a few obstacles:

  • I had replaced my DVD drive with the SSD.
  • Boot Camp Assistant will only allow a USB drive install of Windows on newer machines that ship without a DVD drive.
  • Boot Camp could not partition my disk because it could not move some files.

To get Windows installed, I had to wipe my spinning disk, clone my SSD back to it, replace the SSD with the DVD drive, boot onto the spinning disk, run Boot Camp to partition the disk, install Windows 7, replace the DVD drive with the SSD, tweak the registry to support AHCI on my SSD, and finally run the Corsair firmware update utility. Which still did not recognize my disk. My next SSD will not be made my Corsair. And it might be wrapped in a new rMBP.

 

monitoring exim with nagios

I was setting up monitoring of mail queues with the nagios plugin check_mailq and found it didn’t work on cPanel servers. Google led me to a few shell scripts that used sudo to run exim -bpc. I didn’t like that option so I dove into check_mailq, expecting to make a few changes to the code. Instead, I discovered that for exim, the check_mailq plugin expects to parse the input of a queue listing. From there, the solution was straight forward.

Edit nagios/utils.pm and set $PATH_TO_MAILQ = “/usr/sbin/exiqgrep”;

Add the nagios user to the mailnull group in /etc/group.

Add this to nrpe.cfg:

command[check_mailq]=/usr/local/nagios/libexec/check_mailq -w 100 -c 500 -M exim

Restart nrpe, and it works perfectly.

Nolisting

Nolisting is a spam fighting technique that works by listing an unavailable MX as the highest priority (lowest MX value) mail server. The idea is that any proper mailer will detect the unavailable MX and automatically retry the next highest priority MX record.

On Feb 7th, 2012, I dedicated one of my IPs to the job of not listening for SMTP traffic, set up a host record, and then configured a few mail domains with my faux MX as the highest priority.

On March 5, I removed the faux MX records. Over the course of a month, the half dozen users of these mail domains had all experienced the loss of valid mail and noticed. Undoubtably, they lost more valid messages than they noticed.

Before I removed the faux MX records, I did some sniffing of the SMTP traffic hitting my faux MX. During observation, most of the failures I witnessed were being sent by an application written using JavaMail. Apparently it’s popular with banks (for sending account notifications), news organizations, and online photo processors.

Which mobile phone carrier?

I have 4 lines with AT&T and am less than pleased. While data speeds are excellent, any call longer than 20 minutes will drop at least once. Coverage at my house is poor. AT&T’s voice quality is poor and has been for years.

My other major objection is their unlock policy. While AT&T will finally unlock iPhones after their contract is up, that still requires that I keep a 2-year old phone around for international travel. While exploring my options, I put together this TCO (total cost of ownership) comparison chart of the major US carriers (AT&T, Verizon, Sprint, T-Mobile) and a few resellers.

Mobile Phone Plans

The larger PDF also compares plans from Cricket, Virgin, and Ting. Pricing is shown for each plan with 1, 2, 3, or 4 phones.

Notes:

  • The One Time Net value assumes the value of an iPhone 5 in two years is $250. If you purchased an iPhone 4 two years ago, that’s about what your handset is worth today.
  • Ting with 3,000 minutes looks outlandish, compared to 1200-1,600 for everyone other plan. That’s because Ting and Virgin have no nights-and-weekends, or mobile-to-mobile. I looked at my past 12-months phone bills to determine how many minutes we’d need.
  • An excellent related post, Which iPhone 5 for a Global Traveller

Adventures in legacy software

Today I opened M.Y.O.B. accounting files from 1999-2001. The files cannot be upgraded because they experienced some data corruption. The only way to access the files is to run the versions of M.Y.O.B. that they were created with.

The solution was to run Mac OS 10.6 inside a VM, which unfortunately, is a violation of the Apple EULA for Mac OS 10.6. Oops. The reason for using 10.6 is that it’s the last version of Mac OS X with support for Rosetta, the PowerPC emulator that lets Mac OS X apps written for PowerPC run on newer Macs with Intel CPUs.

Rosetta allows AccountEdge (the versions of MYOB written for Mac OS X) to run, but one of the files I wanted to access was from 1999, and it requires MYOB Accounting Plus v9, which is a classic application. For that, I turned to SheepShaver, a Mac OS Classic emulator, running Mac OS 9 within the 10.6 VM.

In summary, the solution was to run two emulators within a VM. With that, I’m able to run every version of MYOB within a single VM.

I also have a VM that runs AppleWorks, for those rare occasions when I stumble across a very old file that I would like to upgrade to the latest version of AppleWorks, so that I can further upgrade it to something that’ll run on Mac OS X Lion.

Also, since I couldn’t find one online, I also created a table of the MYOB versions, their marketing names, release numbers, and year of release.

Name Version Release DB ver. Year Company
MYOB 5 5.0.8 5 1994 Best! Ware
MYOB 6 6.0.1 1996 Best! Ware
MYOB 7 7.0.3 7 1996 Best! Ware
MYOB Plus 8 2.0.5 2 1999 Best! Ware
MYOB Accounting Plus 9 3.0.4 3.5 1999 MYOB LImited
AccountEdge 1 4.7.0 2001 MYOB Limited
AccountEdge 2 5.5.3 2001 MYOB Limited
AccountEdge 3 6.5.3 2002 MYOB Limited
AccountEdge 2004 4 7.5.0 2003 MYOB Technology Pty Ltd
AccountEdge 2008 8 12.0.6 2008
AccountEdge Pro 2012 12 16.1.4C 2012 Acclivity Group LLC

 

Scale is hard: gmail edition

Sometime on or about August 8th, IMAP access to Gmail stopped working for me. I don’t depend on Gmail so I ignored the error messages for 6 days. Then I simulated an IMAP session and was able to authenticate to Gmail, but after that, all IMAP commands timed out. So I looked to the Google Apps Dashboard which reported that everything was fine. Lies. Then I found the Gmail Known Issues page where I found this:

We are aware of an issue where users are receiving an error that ‘”imap.gmail.com” is not responding’ when using IMAP on their computers, mobile devices, or tablets. We are currently working on resolving this issue.

In the meantime, you can sign in to Gmail through a web browser. For Android and iOS users, you can also download the Gmail application in the interim.

Then I found the Gmail Forum within the Google Product Forums where many other users were reporting this issue. What I find interesting about this failure was that it took 7 days before my account access was restored and many users are still affected, 9 days later.