Not the most colorful crayon in the box

If anyone needs a copy of Windows XP, I know where you can buy a copy.

Posted by wee on 11/23/2003 at 10:52 PM | Main Page | Category: Random Stuff | Comments (1)
When the cat's away...

I just realized that I almost never post an MG entry on the weekend. That got me wondering as to why, and I came to conclusion that it's because I'm always with Tracy. Me and her are always doing something together on the weekends and I'm never really bored enough to figure out a time waster to write. Even if I'm in my office and she's half done with a book downstairs, we're always sort of "together". It's hard to explain.

She's gone now, though. She's over at a friend's house celebrating the birthday of another mutual friend. Basically, all the former work chicks are getting together... and having a sleepover. So I'm Macauley Culkin tonight. Playing loud music. Doing that Tom Cruise thing in my underwear.

OK, so maybe not.

In reality, I bought a horribly expensive, 2" thick steak (strip, of course) and fired up my charcoal-based grill. I'm pairing that with sauteed onions and green beans, and I'm opening some good wine. After that I'm going to smoke an obscenely expensive cigar that Tracy gave me for my birthday.

That's dinner. But the geek in me is already toiling away -- and has been for about an hour now. I figured out the URLs that foodtv.com uses for their printable recipes. I'm grabbing all 25,000 of them, and while I'm at it I'm stripping out the JavaScript and web bug nonsense. I'm leaving the copyrights and such in, but just removing the JavaScript alone I save about 20KB per file. Once I've got all the files (or dinner is done, whichever comes first) I'm going to write a parser that adds the relevant recipe stuff to a database. Then we can use the database to search for possible dinner ideas. For instance, if we have chicken and red wine and carrots, we'd be able to get a list of all the recipes that include those ingredients. Or exclude those plus some other ingredient (like artichoke hearts or capers).

I'm toying with the idea of writing a PHP-based "recipe viewer" that the DB search app uses. It would basically spit out the recipe pages, but would also prompt you to put the recipe in a certain category. So when you come across a good squid recipe, you'd be able to add it to the "Italian" and/or "Thai" categories. Or something. I'm not sure yet how to work it. Every once in a while I get the urge to make a certain type of food. And this would help greatly. I want to be able to tell some software what major ingredients I have, and what kind of food I'm in the mood for, and then have if give me a bunch of options -- with shopping lists based on each one. And it'll be able to print the shopping list on my receipt printer upstairs. So when I have crab, ginger and honey, I'll wind up with not only a cuisine-based recipe for those ingredients, but a shopping list of what I may not have. I've been wanting that sort of thing for a long time now.

So the wife is gone all night, and I'm writing software that will make shopping lists and print out recipes. Am I getting old, or just embracing my inner geek? That's sort of disturbing...

Posted by wee on 11/22/2003 at 07:37 PM | Main Page | Category: Random Stuff | Comments (5)
Free Opera, new joke

I went and paid for Opera recently. I've bought the previous two versions but I've resisted paying for version seven. Then I went looking to see if they had any updates available and I noticd that they had a special where you could register Opera for one operating system and then get a reg code for another OS for ten bucks. Since I have Linux and Windows floating about the house, I thought it was a pretty good deal and so I paid up.

When I got my registration email, another email came along with it. It was a gift certificate that I could "send to a friend" for a free registration of Opera. Uhhh... how come I couldn't just use it to get the WIndows version for free? I don't know, but it was mildly annoying. Ten bucks ain't too much to spend anyway, I guess. I use the software all day every day.

Since I don't know any friends who use Opera, I didn't know what to do with the free registration and it seemed a shame to waste it. So I decided to submit it to Fark, saying that the best joke gets a free registration for Opera. (I can hear you asking "What, pray tell, did your B.S. fark submission link to?" My answer is obvious: the world's largest rodent.) I got a bunch of responses (over 30, actually) but the best one was this:

Tony Blair is at his weekly meeting with The Queen, when he turns round and says: "As I'm the PM, I'm thinking of changing how the Country is referred to, and I'm thinking that it should be a Kingdom". To which the Queen replies, "I'm sorry Mr Blair, but to be a Kingdom, you have to have a King in charge - and you're not a King."

Tony Blair thought a while and then said: "How about a Principality then?", To which the Queen replied "Sorry again, but to be a Principality, you have to be a Prince - and you're not a Prince, Mr Blair".

Again, Blair thought long and hard and came up with "How about an Empire then?" The Queen, getting a little pissed off by now replied "Sorry again, Mr Blair, but to be an Empire you must have an Emperor in charge - and you are not an Emperor."

Before Tony Blair could utter another word, The Queen said: "I think we're doing quite nicely as a Country".

Subtle and dry. It took me about 30 seconds to get it, and then I laughed my ass off. I thought the various Anglophilic types in the family might also enjoy that one and so awarded the author with a free registration.

An honorable mention was the following:

How do you know when it's bed time at Michael Jackson's house?

When the big hand touches the little hand.

That Jackson weirdo is comedy gold, I tell you...

Posted by wee on 11/20/2003 at 11:21 AM | Main Page | Category: Random Stuff | Comments (3)
Changing registrars can be fun and exciting!

I recently decided to change registrars for my other domain, 27.org. It's handled by NetworkSolutions right now, because when I registered the name (in 1997) the only group who did registration was InterNIC, which was a joint venture between the US government and NetSol set up to handle domain registration. NetSol isn't well loved (more on that later), and any budding monopoly needs to get some competition.

My "service" with NetSol hasn't been bad or anything, it's just that their "services" leave something to be desired. For example, if you want to do anything with DNS within your domain (other than switch name servers around), you need to pay them an additional $25 per domain per year. Other registrars, such as register.com and GoDaddy will also host DNS for any domain they register free of charge. Since I need to monkey with DNS on 27.org, I decided to switch registrars and see what the marketplace had to offer.

I have two other domains at register.com, and they were the natural choice. The trouble is that they apparently don't handle .org domains. Why? No clue. I expect it might have something to do with Public Interest Registry taking over the .org registry earlier this year.

In any case, register.com's web site is misleading. Before starting the tranfser, I read through all their documention about how transfers work. Nothing in there mentioned them not handling .org domains. It was only when I went to initiate the transfer using their web app that I was told I couldn't transfer .org domains to them. So I wrote the customer service department a letter last night, and I got a reply this morning:

> I'm wondering if I can tranfser my .org
> domain name to register.com. Your page at
>
> http://www.register.
> com//faq/transfer-register-q3.cgi?> 1|3753131928|
>
> Says this:
>
> "At this time, only .com, .net and .org
> domain name registrations can be transferred
> to Register.com."
>
> But when I use the transfer tool on your
> site, I get this error:
>
> "Note: Only .com and .net domain names are
> eligible to be transferred to register.com.
> Therefore, the following domain name(s) will
> not be included in this transaction."
>
> So which is it? Why can't I transfer my domain
> to you?


Dear William,

Thank you for contacting Register.com regarding the domain name "27.org".

Currently Register.com is not accepting transfer of .org extension domain names to Register.com. Only .com and .net domain names are eligible to be transferred to register.com.

We would like to inform you that whenever we accept transefer of .org extension domain names to us, the information would be updated on our web site.

Moreover, Register.com does not accept registration/transfer of two character domain names.

We sincerely apologize for the inconvenience caused to you in this regard.

Well ain't that a slap on the ass. I can dig the part about them not wanting (or not being able to) to touch .org because PIR is handling it now, but what's the deal with that "two character domain" thing? What's the stigma attached to two character domains? I was hoping to have all my eggs in one basket, but I guess I can't.

The funny thing is that when I first went to register my domain in '97, I wanted to register 27.com, not .org. InterNIC wouldn't let me. They said it was "reserved". It must have become unreserved at some point, because it was registered in 1998 by a domain squatter. I actually like .org better anyway.

Here's a registrar changing tip: if you are transferring a domain away from NetSol, you might need a thing called an "authorization code" from them. You will definitely need one if you are moving a .biz or .us domain. I discovered that I needed it when I went to confirm the registrar change on GoDaddy's web site. There was the two buttons asking me to accept or decline the transfer, and this little text box asking me for an auth code. I had to call GoDaddy's tech support line to find out where to get that code since Google wasn't very helpful. I was only on hold for about 10 minutes, but they had Squirrel Nut Zippers playing as their hold music, which made it fine (I wound up turning up the volumen on my phone even). They said NetSol has to give it to me, and NetSol (predictably) has no real search feature on their site. I wound up having to call their support line to get it. Imagine my surprise to find a phone menu option for moving domains away from NetSol buried deep in their system. 10 minutes later, I had the code.

Verisign now owns NetSol, and they certainly aren't well-loved given things like their extremely presumptuous and Net-breaking SiteFinder "service" (in addition to other questionable practices). Honestly, that's not why I switched -- although the SiteFinder thing got me thinking about switching when it debuted a few months ago. But now that I think about it, Verisign is just sorta slimy and I'm glad I'm moving away from them. There's tiny evidence of this sliminess everywhere, like in charging for basic DNS sevices (and scamming people into paying to do so, according to some people). Verisign is just vaguely icky. When I called late last night to get that auth code, their 888 number starts off with a message saying "Our standard business hours are so and so. Please call back then". If you wait about 5 seconds, you get that same voice coming back with a menu of options. No doubt they figure people will hang up right away and call back during daytime hours when the cheap phone center help is working. And there's nothing wrong with this, by any means. It's just sorta creepy and calculating and deceptive. It makes you wonder what else they're up to.

Aside from the dumb name, I think I'll be happy with GoDaddy. They have a really nice website that lets you do all sorts of stuff with your domain. They're cheap too: it's only going to cost $8.95 a year to keep up my .org domain, vs. $35 a year for NetSol/Verisign. (The transfer fee was only $6.95, and they added a one year extension as well. Register.com wanted $35 to transfer with no extension.) We'll see how they do. At very least they aren't any worse, feature-wise, than NetSol and are a lot cheaper. I basically just need them to host DNS as well as act as my registrar, so I don't think I'll run into any problems.

Posted by wee on 11/20/2003 at 09:40 AM | Main Page | Category: Geek Stuff | Comments (2)
All you need to know about GNOME

All you need to know about GNOME (and its bloat) can be found in the words of the project's founder:

"I think the paperclip is a great idea."

That's just fabulous, Miguel.

Posted by wee on 11/19/2003 at 03:22 PM | Main Page | Category: Geek Stuff
Use GKrellM over SSH for remote monitoring

One of my all-time favorite programs is GKrellM. I love it. I'm a sucker for monitoring apps, and this one is the best there is (for free, anway). I typically use it to monitor a machine I'm logged into, but with version 2, you can connect a local client piece to a remote server process and monitor that machine from a distance. Even better, you can make this connection very secure so that eavesdroppers can't get intimate details of your machine. If you want to use GKrellM to remotely monitor a server over an ssh tunnel, here's how you do it:

  1. Download and install the GKrellM daemon on the machine to be monitored. If you have Red Hat 9, you might try the gkrellm-server package at freshrpms.net. (They have version for other Red Hat releases, as well as for Fedora.) You don't need the development stuff, or any of the client or plugin packages.
  2. Create a gkrellmd user. This is the user account that the gkrellmd process will run under. It shouldn't have a valid login (no home directory, etc).

  3. Add a line to /etc/rc.d/rc.local which looks like this:

    nohup su gkrellmd -c '/bin/nice /usr/bin/gkrellmd -u 3 -m 2 -P 19150 -a 127.0.0.1 -a ip_address >/tmp/gkrellmd.out 2>&1' &

    All that says "Ignoring hang-ups and with no output to a tty, run gkrellmd as the gkrellmd user; provide updates every three seconds, allow a maximum of two connections, listen on port 19150, and allow connectsion only from the IP address 127.0.0.1 and ip_address". (You want to change ip_address to match the IP address of the machine that is being monitored, of course.) You should be able to just add that right there at the bottom of rc.local and it'll start very last when the machine reboots. For this first time, however, run that command as root once so that gkrellmd starts. If you get any errors, you want to see them now. And there's no point in rebooting just to start gkrellmd (although if you want to test to make sure that it comes up, now is the time to try it).

  4. Install GKrellM on the client machine (if it isn't already). The best way is via freshrpms.net. Install all the packages, and make sure to get the various plugin packages, too.

  5. Once GKrellM is installed, you need to set up a secure tunnel to the server you want to monitor. This will connect a port on your local machine to a port on the remote machine, and the traffic in between them will be encrypted. I like doing this sort of thing in a shell script. Create one (in your home directory or where ever) and add this:

    ssh -2 -C -N -f -L 19151:ip_address:19150 ip_address.

    That says "Connect to ip_address using the SSH2 protocol, enable compression, don't execute any remote commands, fork into the background after connecting, and forward port 19150 on ip_address to port 19151 on the local machine".

  6. Now you need to start the GKrellM monitor on the client machine. You start it like so:

    gkrellm -f -s 127.0.0.1 -P 19151 &

    That says "Start GKrellM and force a host config for this specific server, connecting to port 19151 on host 127.0.0.1, and go into the background".

    You can add this to your shell script above if you want to just use it to start the remore GKrellM monitor. If you do that, you might want to embellish it a little to look for PIDs, kill old running monitors, etc.

After you run that, you should see GKrellM start up. It's connected to the remote server via your encrypted tunnel, so it's plenty safe. Right click onthe top part and configure it however you like. By using the '-f' flag, any changes you make to this monitor's configuration won't affect any locally running instances of GKrellM. You can even skin it differently.

It sounds way harder than it is (it should only take about 15 minutes to set all this up), but it's really worth it.

Posted by wee on 11/13/2003 at 04:18 PM | Main Page | Category: Geek Stuff | Comments (2)
Even if it's bad, it'll be good

Tracy and I saw the re-release of Alien last night (digital cinema, with only one other person in the theater -- it was amazingly cool and I'm tempted to go back before the release is over). Tracy had never seen it in the theater, so this was a nice chance to catch it on the big screen. The director's cut is much better than the original release, by the way. There's a scene where Ripley finds Dallas barely alive and cocooned, and he's begging her to kill him. Which foreshadowed the sequel vey well, I thought. I don't know why they cut that out.

But what got me the most enthused wasn't the movie itself. One of the trailers in the previews had me giggling like a schoolgirl. Go to the movie's website to see what I mean. Now download the trailer and imagine hearing it coming out of the theater's monster sound system. That particular "clicking" sound was immediately recognizable. I had a strong feeling of "this couldn't possibly be what I think it is... they just don't make that kind of movie..." But it's true. Even if it's as bad as Event Horizon it'll still be orders of magnitude better than 95% of the crap Hollywood puts out.

I'm betting that a certain someone I know who claims to not like going to the movies (I know! weird, isn't it?) will be lining up for this one.

Posted by wee on 11/10/2003 at 11:35 AM | Main Page | Category: Random Stuff | Comments (10)
The Rhodes boys went to 'Friends'

My three brothers and I participated in a first this last weekend: The four of us all did something together, as a group, without a parent or other relation with us. Just us guys. We went and saw a taping of the TV show "Friends". And we had a really amazingly good time.

It turns out that my brother Mickey somehow got to know Courteney Cox. They got to emailing one another and a few years ago she invited him to come see a taping of the show, as her guest (as opposed to "a member of the studio audience"). He got to sit right down at stage level, mere feet from the set of the Central Perk, and pretty much in on the filiming action. He's been going back every year for like 5 years now, and he usually takes three family members with him (they offer seating for four people total on the floor there by the stages). This year, he took his brothers.

We got all met up at a hotel in Burbank Thursday night and then around 2pm Friday, we drove the three-odd miles to the Warner Brothers lot. Once we got there we all had to show ID, in order to get these personalized passes. The passes were imprinted your name, the valid dates, who you were a guest of, etc. Like a backstage pass, I guess. So when we pulled up in Mickey's handicapped-equipped minivan they gave us some seriously weird looks and asked us all to bust out IDs. Well Mickey, being a quadraplegic in a wheelchair, doesn't have a driver's license. He has an ID card, but at Shawn's suggestion we gave the security guy Mickey's sheriff's badge. Mickey is an honest-to-goodness Special Deputy Sheriff of Maricopa County. No shit. The security guys searched the BMW in front of us, and were doing a real good job with the Lexus next to us, but waived us through. They didn't even look in the windows, much less open the doors. Good call on the badge-flashing, I thought.

We weedled our way through the soundstages to Stage 26 were Friends is filmed. Not knowing where to park, the security guy at the door radioed in and told us to park in Marta Kauffman's spot. Which was right next to the door, because she's a co-creator and producer of the show. Very surreal. We were getting seriously stared at by now. We had to ditch our cell phones before we could go in (we decided to leave them in the car since we were right there) and while we were digging them out, one security guy asked if we had any cameras. I said that there was one in the backpack attached to Mickey's chair. He said we should probably just leave it in the car "just in case". Cameras, he said, are strictly forbidden, and can get confiscated if they find them. So I dug Shawn's camera out, in a fairly flashy way, and put it in the glove box along with our phones. See, what nobody (not even Mickey) knew was that I had sthased two cameras in his backpack.

We all had to pass through a metal detector, but the metal of Mickey's chair would always set it off no matter what he had in his pack. So he could mule in a camera no sweat -- as long as they didn't search him. I was banking on the very popular and completely unreasonable subconscious reaction that many "healthy" people have about people who are in wheelchairs and who also exhibit some sort of deformity: that whatever they have is somehow contagious (or that the afflicted person is very fragile). It was a risk, sure, but I was banking that the security guys wouldn't want to get very close to Mickey or his chair. I was right, and we snuck in my new camera -- which was partially purchased just for this occasion.

Our new camera, as it happens, also takes video. And it'll take as much video as you have space for. So I purchased a 64MB SD card for stills and a 256MB card for video. I was taking another risk: that after filming I'd be seen as just another VIP type with a camera (I had seen digital pictures of Mickey's previous trips, so I knew that you were "allowed" to have cameras after the filming was over). I figured I could use the small card to get pics of Mickey with his friends (no pun intended) in the cast, and then sneak in the big card and just walk around with it while it shot video without anyone knowing. Because even though they don't mind still cameras (if you know the right people), they would get seriously pissed off about me taking video. But I decided that the chance to get Mickey interacting on the set was worth the risk. I mean, it's not like I plan on selling bootleg behind-the-scenes Friends videos or anything. It's all about Mickey, 100%.

There was another "special" group attending the shooting (a teenage girl with the Make-A-Wish Foundation), so we only had two seats down on the floor. Which meant that one person could hang with Mick and the other two had to slum it up in the seats. But we got assurances that we could switch off between takes. It was annoying, but it worked out. If anything, it made the rest of the audience kind of curious about us. But as long as one of us got down there to pimp out Mickey and make sure he was taken care of, it was fine by me. I'd have sat on the floor if need be.

It so happened that I was there with Mickey when Courteney Cox came over to say goodbye. This was towards the end of the night, after all he secnes were done. She apparently had to leave for a prior engagement, but wanted to tell Mickey that he should come back before filming is done (they have only seven episodes left to film). Mickey balked at first because Courteney's secretary said that he could come to this one taping and that's it. Courteney said that he could basically come to the rest of them if he wanted, but then Mick said he had preaching commitments and such. I wound up elbowing him and we worked it out that if Courteney will arrange for us to come, we'd work things out on our end for sure. We wound up talking for about 15 minutes, and she actually refused to say goodbye to him, and insisted that he has to come again to get a goodbye.

Courteney is a complete sweetheart, and it was nice seeing her and Mickey chat. In fact, it was interesting seeing her talk to him, because it threw into stark contrast the difference between him and the Make-A-Wish girl (and even the people in the audience, who are basically totally ignored). She was treated specially, sure, but Courteney was talking to Mickey as a friend. The difference was night and day. It was sort of mind-blowing once it occurred to me. It was too bad that she couldn't stay, though.

Right before the shooting was done (which took about nine hours; a long shoot, I understand), we all managed to get down on the floor with Mickey for the last take. Actually, we arranged that because just before the last take, Jennifer Aniston came over to say hi to Mickey (I'm serious: he's not just "a fan" -- these famous people really like him and go out of their way to hang out with him, like he's the star or something). When Trey (who was down with Mickey) introduced us all (recall that the cast completely ignores the audience, and she lookedreally surprised to see us), she said that we should all come down. So she told the security guy to let us down, and there we were. We hung out for about ten minutes, chatted, and took some pictures (she called one of the prop people over with a Polaroid camera). She even volunteered for a one-on-one picture with Shawn.

Seeing Mickey with Jennifer Aniston was prIceless. The boy was just agog. She's also an extremely nice person, and it was terribly sweet that she came over to say hi. She's also one of the most "touchy" people I've ever met in my life. When she gave Mickey a hug, she went digging in his chair to get her arms around him. That's not something most people do. And when she shook my hand, it turned into a fairly robust hug. Mind you I'm not complaining in the slightest, my personal space hang-ups notwithstanding.

After it was all over and they started herding the audience out, I arranged with the one security guy for all of us to hang out for a while and take some pictures. I had noticed an Asian gentleman photographing his family on the Central Perk set, so I figured we could bust out as well.

We mostly got pictures of us in the Joey's apartment set. The set dressing there was hilarious. Bottles of Jagermeister sitting next to baby formula on the coutner, and so forth. I managed to get a picture of the coffee table, which had condoms next to baby toys. I also got a pic of Mickey with Matt LeBlanc. Mickey has a somewhat stunned look on his face, but he was getting really tired. He was also starting to get sick, so that didn't help. But Matt told Mickey that he should come watch a taping of his spin-off show "Joey", so that was nice. Come to think of it, one of the writers (who is just in love with Mickey) is also a writer and producer of Joey, and he said he'd work it out so he could come as well. So the odds are good. We decided that it would be cool to see a taping where Courteney was guest starring.

I wound up getting some good movies to go with the pictures, but I can't let anyone see them. I put them up so that Mom could download them and keep them on Mickey's computer, but after that they are getting removed. That's at Mickey's request. Getting video was touch-and-go for a while, though. A few times I caught the head security guy giving me the stare, so I pretended to fiddle with buttons and whatnot. I would also occasionally switch to still picture mode and use the flash so that it looked like I was taking stills. I figured if caught I could always play the role of "new camera, owned by doofus" without having to stretch too much.

Anyway, that's pretty much it. I'm sure I'm leaving out a lot of details, but a lot went on that night. And this is already long enough.

Posted by wee on 11/09/2003 at 10:52 PM | Main Page | Category: News
I want my damn money back

I'm sure everyone has seen this article by now. It's an interview with Red Hat's CEO which says in part:

Matthew Szulik, chief executive of Linux vendor Red Hat, said on Monday that although Linux is capable of exceeding expectations for corporate users, home users should stick with Windows: "I would say that for the consumer market place, Windows probably continues to be the right product line," he said. "I would argue that from the device-driver standpoint and perhaps some of the other traditional functionality, for that classic consumer purchaser, it is my view that (Linux) technology needs to mature a little bit more."

I used my Red Hat Network (their service you use when you pay for support) account to email their sales/customer service folks. I asked for my money back.

Check out this blurb from Red Hat's press release announcing Red Hat 9:

Red Hat's community-based distribution became an option for home computing with the introduction of the BluecurveTM graphical interface in 2002. In Red Hat Linux 9, we've refined the installation and interface, adding new tools and applications for end users," said Brian Stevens, vice president of Operating Systems Development at Red Hat. "The result is an open source desktop operating system that is flexible and simple to use for mainstream technology enthusiasts.

So Red Hat's CEO admits that he has, over the course of many years, knowingly and intentionally sold me and others an inferior product unsutiable for its stated purposes. That's bullshit. He's been plenty happy taking my money for the past 6 years. Last January, Red Hat 9 was perfect for the desktop. This month, it isn't? I'm sure this has nothing to do with Red Hat discontinuing their commercial version of Linux.

I smell class action.

Posted by wee on 11/05/2003 at 12:22 AM | Main Page | Category: Rants | Comments (2)
How dumb are you?

So after scoring the lowest score possible for a young person alive but not in a coma during during the 80's on the music test over on Tess' page (I got 31.85; Tess got in the 140's), I was glad to see that Mig had a test linked on his site which might allow me to bandage my wounded psyche:

How DUMB are you? Brought to you by the good folks at sacwriters.com.

I thought the test itself was pretty amusing. I got the same result as Mig (an honor). But that meant it has the picture of that nerd who kinda looks like me (not so much an honor). I need a test that lies to me.

Posted by wee on 11/04/2003 at 12:07 AM | Main Page | Category: Random Stuff | Comments (4)
Possible Opera security hole

Proof that no application is without (at least the occasional) security flaw, Opera might have an issue, as reported in the latest SecuirityFocus Linux newsletter:

1. Opera Web Browser IFRAME Zone Restriction Bypass Vulnerability BugTraq ID: 8887 Remote: Yes Date Published: Oct 24 2003 Relevant URL: http://www.securityfocus.com/bid/8887 Summary: Opera is a web browser available for a number of platforms, including Microsoft Windows, Linux and Unix variants and Apple MacOS.

A flaw in the Opera web browsers security model has been discovered that could allow an attacker to access a users file system within the Local Zone. The problem occurs when handling malformed HTML iframes which point to local system locations. Exploitation of this vulnerability could result in the exposure of sensitive data or could potentially lead to the corruption of system critical files. Symantec has confirmed that the proof of concept provided by the researcher effectively gains opens access to the local file system, however it has not been confirmed whether the local files may be modified.

It should be noted that due to the nature of this vulnerability it may theoretically be possible to leverage the condition to execute arbitrary code. However, Symantec is currently unaware if a method exists under which Opera can be influenced to carry out this type of operation.

This vulnerability is believed to affect the latest release of Opera as well as prior releases.

**UPDATE: The vendor has contacted Symantec and has stated that this is not a vulnerability. Symantec has not been able to reproduce the claims made by the individual who reported this issue. This record is being retired, though it may be re-activated if further findings confirm existence of the vulnerability.

That part about possibly "executing arbitrary code" is noteworthy. This is one area where operating systems like Linux and BSD (and OS X) differ from Windows. If this latest hole exists, and if the attacker can leverage it to execute code, the worst that could happen is that it would execute code as the user which started the application. It could delete my files, for instance. But it couldn't start/stop services, reboot the machine, access other user accounts, etc. Because I'm just a user, not the root user. I can't execute any bit of code I choose. Put another way, there are some programs that I cannot run, unless I log in as the root user, or I run a special command first (and give it a password). This keeps me safe. This is also why Linux distributions like Lindows are woefully insecure. There are just some Windows "features" which need not be emulated. Getting rooted by viewing web pages as a non-privileged user is one of them.

Anyway, because I value my files, I'll be watching this one carefully.

BTW, This isn't the same bug as described in the latest @stake Opera advisory. That one was fixed in version 7.2. (Although you wouldn't have been able to guess the severity of the situation from their rather understated changelog message: "Fixed a crash caused by illegally escaped server name". I'd have liked something a little more descriptively sinister.)

Posted by wee on 11/03/2003 at 02:09 PM | Main Page | Category: Geek Stuff