Todd's TechnoGeek Journal

We live in a society that aspires to the mediocre. Even with our culture's weird fetish for hero-worship and celebrity, part of that twisted idolatry is the idea that celebrities are at their best when they are just like everyone else.

This idea isn't a new one, but it hit home for me again today while watching Smallville. This isn't a new phenomenon; shows like Bewitched, Charmed, and I Dream of Jeannie have been promoting the same hidden agenda for decades.

Consider the unsubtle message of these shows. Most of the shows revolve around people jumping through self-imposed hoops to be "normal." Take careful note that this isn't the same as trying to be accepted, or liked, or to fit in at school or the office. No, these are characters who are filled with self-despite because they aren't "just like everyone else."

Oh, occasionally the drama touches on their feelings of loneliness, of feeling like outsiders, but this is quite secondary. If you watch carefully, what they really dislike is being different. They haven't been ostracized because others see them as different; no, they themselves simply feel unworthy because they aren't squarely in the middle of the mainstream. They treat "being normal" as a synonym for "being happy," and yet never achieve either state--nor any awareness that they have wrongly conjoined the two in their own minds.

As a lifelong outsider myself, I find this attitude hard to comprehend. Being "just like everyone else" doesn't necessarily make you liked, or accepted as one of the group. No, it just makes you less than you are, and less than you could be. Why would anyone aspire to that?

Yes, I realize these are only TV shows. But I think they speak to the zeitgeist of our times, or their messages wouldn't be so easily accepted. To pass without comment, such ideas have to be considered common sense, and presumably self-evident to anyone who is "normal."

Being accepted is great, and being liked is terrific--but do we as a people truly feel that the only way to be liked or accepted is to be without any special merit? That being talented, smart, or strong are things to be hidden? That special skills should be buried deep, or renounced altogether? The very idea saddens me.

My skills and abilities are neither superhuman nor magical, but they do make me different. Sometimes I wish it were easier to find acceptance, and to be liked, but I've never made the mistake of thinking that being less than I am was the missing ingredient for a life of happiness.

If these shows really are an artistic mirror held up to life, it's an ugly picture indeed. Can you honestly say you want that image as your self-portrait?

Google revolutionized the search industry in a lot of ways. One of the most useful--but often overlooked--features is the Google cache. As Google spiders the web, it often takes "snapshots" of web pages at various points in time. I have no idea how long it keeps cached pages, but the fact that it does so can be amazingly useful.

As I may have mentioned before, my old web server blew up a few months back. All data was lost, and *of course* I had no current backups. One of the many things that went kablooie was my old blog.

I thought many of those pages gone forever, and decided to start over. Well, while I was idly Googling myself today, I ran across some of my old blog entries in the Google cache. Yay!

So I grabbed as many of the cache files as I could find, and am slowly reimporting the entries, with the original dates (but not time stamps) intact. The loss of time stamps is due to the fact that Blosxom used the blog entry's mtime for the time stamp, whereas Nanoblogger uses a combination of filename and per-entry keyword.

Either way, the end result is that most of the material from my old blog is being resurrected; just scan back through the 2004 and 2005 archives to find it. I hope you find it useful.

Administering your options on Yahoo Groups mailing lists can be a little annoying, because Yahoo really wants you to use their web interface for configuration rather than sending control emails to their mailing list software. It makes economic sense to them, because they get ad revenue for every eyeball that hits their web site, but nada for running the lists themselves.

Personally, I don't *want* to log into Yahoo to deal with my list options. Not only is it inconvenient, but it ties my subscribable addresses to those on my Yahoo account, which doesn't always work well if you use revocable email addresses (see TMDA) for spam filtering, like I do.

However, underneath the hood, it appears that Yahoo Groups makes use of qmail+ezmlm, so most configuration options can be managed by addressing emails to certain list extensions--provided you know what they are. So, given the mailing list foo@yahoogroups.com, the following address extensions should always be valid:

To join/leave a list:

Subscribe

foo-subscribe@yahoogroups.com

Unsubscribe

foo-unsubscribe@yahoogroups.com

To change mail options *after* you've subscribed:

Enable Digest Delivery

foo-digest@yahoogroups.com

Enable Non-Digest (Per-Email) Delivery

foo-normal@yahoogroups.com

Hold Delivery (but remain subscribed)

foo-nomail@yahoogroups.com

It is worth noting that, as far as I can tell, you can't subscribe directly to the digest version of any list on Yahoo Groups. You have to subscribe first, and *then* enable digest delivery. Strange but true.

I hope knowing this helps others as much as it does me, and I hope that savvy list owners make this information more readily available in future.

Yes, well, so it *was* a DDoS with my box as a zombie slave. After a week of investigation and (eventually) a complete rebuild of the server, I can safely say that the box was compromised.

How badly, of course, is always a tricky question to answer. It was probably a variant of the Slapper worm, though. Since some of the Slapper variants also load rootkits and provide remote shells, and because Apache runs as root when it starts up (even if it drops privilege later), I was forced to assume that the whole box--and possibly my entire network--was compromised.

Like the Million-Dollar Man, the box was rebuilt faster, stronger, and better. Probably not invulnerably so, which would require unplugging it and locking it in the depths of a bank vault before burying the entire building under a lava flow, but it's as close to impregnable as I can make it while still allowing it to be useful.

It took me four days to do a reasonable amount of investigation, and three more days to rebuild the server and harden it. The wisdom here is two-fold:

1. Even for the knowledgeable, a thorough forensic investigation is too time consuming to be useful or economical under most circumstances.
2. Even minor cracks are expensive in terms of labor, downtime, and loss of confidence in trusted systems.

Over the past few years, I've often been called on by a number of businesses to come in and do a forensic investigation after an incident. I try to discourage them, because they always seem to think it's just a few hundred dollars worth of work, instead of days or weeks of reconstruction with no guarantee of results. Heck, even just getting a sector-by-sector backup of a small server's hard drive can take half a day.

What really causes aggravation, though, is that you can't just restore from backups. With a cracked system of unknown vector, you have to assume that your backups are tainted, too. The best you can do is reinstall the OS, reconfigure your applications manually, and then *carefully* restore important data files after inspecting them.

So, a big "up yours!" to the script kiddies who have nothing better to do with their time. Botnets are lame, and DDoS isn't inherently interesting; it's just annoying. Enslaving a web server just to annoy some *other* web server operator seems rather petty, at best.

Since *any* system is crackable, given enough time and resources--even the ones encrusted in lava-encrusted bank vaults--why not at least advance the state of the art while you're at it? But please...go practice over at the Honeynet Project instead.

Thanks. :)