For the past few days I've been ignoring upgrade errors from harfbuzz, and this morning I finally found time to track things down. The first step was to figure out what the heck "harfbuzz" is, and why it's installed. Turns out it's a glyph generator; on my FreeBSD systems, it's ultimately a dependency of rrdtool.

Trying to update the installed harfbuzz-1.5.1_1 port to the new harfbuzz-1.7.2 release was kicking back errors like this:

Traceback (most recent call last):
  File "/usr/local/bin/g-ir-scanner", line 65, in <module>
    from giscanner.scannermain import scanner_main
  File "/usr/local/lib/gobject-introspection/giscanner/scannermain.py", line 41, in <module>
    from giscanner.dumper import compile_introspection_binary
  File "/usr/local/lib/gobject-introspection/giscanner/dumper.py", line 34, in <module>
    from .gdumpparser import IntrospectionBinary
  File "/usr/local/lib/gobject-introspection/giscanner/gdumpparser.py", li...

Please be advised that the ipid.shat.net IP address echo service has been permanently discontinued.

Way back in 1999, when many of us still got a new IP address every time we dialed into the internet, I set up a page at ipid.shat.net with a server-side include (remember those?) to echo the value of REMOTE_ADDR. That little service caught on quickly. It was added into several dynamic DNS clients and various other projects with a need to determine the user's IP. I eventually took the service down in 2013, given the myriad other options available; you can just Google "IP address" to get it, now.

In late 2017, I was debugging a DNS issue and was surprised to see how many queries were still coming in for the ipid label. I decided to spin the site back up on a spare VPS and see what sort of traffic it would get. After leaving it running for a few days, it eclipsed 500 hits per second (!) and the socket churn began to overwhelm the VM. Instead o...

Yesterday, Scott Arciszewski from ParagonIE published The 2018 Guide to Building Secure PHP Software. If you develop for (or attack) the web in any language, this is an excellent reference that addresses a number of common web application pitfalls.

In the section devoted to security headers, I saw a reference to one that's flown under my radar until now: Expect-CT. Scott Helme has a nice write-up of Expect-CT, and I went off to read the specification for myself. As it happens, the HTTP Working Group just posted an updated draft today, but the changes aren't substantive.

The executive summary of Expect-CT is that Chrome can no...

Today I spotted an entry in the firewall log that's sent me down a bit of a rabbit hole. I default-deny traffic between my different network segments, and I filter most of the mundane stuff before it's logged, so this caught my eye:

    Deny UDP 169.254.5.108:17784 255.255.255.255:17784 in via dc1

Apparently port 17784 is the default port for the Universal Discovery & Access Protocol, or UDAP, a network protocol so obscure it doesn't even have a Wikipedia page. UDAP seems to be spoken mostly by LG smart TVs (UDAP originated at LG, as far as I can tell) and by a now-defunct home audio streaming product called a SqueezeBox. I don't own any of this equipment, so naturally I was curious what device the packet came from.

After running tcpdump for a couple of minutes, I came up with enough multicast packets from 169.254.5.108 to at least figu...

This week, the Plugin Vulnerabilities site posted about a local file inclusion exploit in MailChimp's WordPress plugin for WooCommerce. My thoughts about WordPress are generally unenthusiastic, so I don't spend much time looking at its vulnerabilities, but from the standpoint of a mail server operator I was interested in the MailChimp angle. As it turns out, there's nothing of impact to mail admins, though I was a little intrigued by MailChimp's fix.

The exploit, in a nutshell, is that one of the plugin's scripts accepted a template name via the query string and then called include() on a filename built from that variable:

<?php if(isset($_GET['error_notice']) 
  && file_exists(__DIR__.'/errors/'.$_GET['error_notice'].'.php')): ?>
    <?php include(__DIR__.'/errors/'.$_GET['error_notice'].'.php'); ?>
<?php endif; ?>

Direct us...

On a relatively old Mac that I was inspecting recently, I saw a load of entries in the system.log generated by a process named dashboardadvisoryd. The errors follow this pattern:

    dashboardadvisoryd[4326]: fetch: advisory list is not the correct format, could not obtain being marker
    dashboardadvisoryd[4326]: fetch: unable to get sql from net
    dashboardadvisoryd[4326]: fetch-parsers: unable to fetch data from read stream

As is common with Mac errors, a quick search turned up only one result, an unanswered 10-year-old post on the Apple forums.

Not being familiar with dashboardadvisoryd, I poked around a bit to see if I could track down what's throwing the error. The binary itself is part of the Dock, and lives at:

    /System/Library/CoreServices/Dock.app/Contents/Reso...

Reddit has been tweaking their site layout, and they've added a big yellow block at the top of the page for logged-out visitors. In addition, even after opting out of the garish new redesign, a bright red "try the redesign" banner appears in the upper left corner of the page.

While I was in the Stylish is now spyware Stylus editor adding some new rules, I figured I'd post my ad-blocking recipe here. This should suppress much of the advertising and promoted content on Reddit's classic web interface, as well as hiding the yellow signup promo, the "Get New Reddit" button, the "test our new profile experience" banner, the "Reddit Premium" sidebar ad, and the giant "Night Mode" and "Infinite Scroll" promo banners.

@namespace url(http://www.w3.org/1999/xhtml);
@-moz-document domain("reddit.com") {
    div#siteTable_organic {
        display: none !important;
    }
    span#sponsored-indicator {
        display: none;
    }
    div#sponsorship {
        di...

When working with directory contents, sometimes it's useful to list the files by age, either newest or oldest first. For example, you might want to display the 10 most recently uploaded photos in a directory, or delete the oldest files from a temp directory. PHP provides an easy way to get a directory's file listing, scandir(), but it sorts the file list alphabetically. What if you'd rather sort by date?

To build a date-ordered file list, it's necessary to read the directory contents manually with opendir() and readdir(). As each file is discovered, it can be added to an array using its modification time as the array key. Finally, the resulting array can be sorted (or reverse-sorted) by key, producing a list of files that's ordered by date, from oldest to newest (or vice versa).

Here's a function, scandir_chrono(), that implements this logic with a few extra features:

/**
 * Return an array of file paths representing the contents of the target
 * directo...

When downloading and compiling software, it's always a good idea to verify the integrity of the source files you obtain. Package handlers like yum and apt handle this automatically, but it must be done manually when you download software yourself.

ISC, the publisher of the BIND DNS server, provides cryptographic signatures with each release. If you have gpg installed, you can use the signature to validate your downloaded BIND tarball. ISC's download URLs follow a consistent naming pattern; simply change the version number in the URLs below to match the version you need.

Download the BIND source

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.29/bind-9.11.29.tar.gz
  `bind-9.11.29.tar.gz' saved [8297010/8297010]

Download the associated signature file

[root@host /home/files]# wget https://ftp.isc.org/isc/bind9/9.11.29/bind-9.11.29.tar.gz.sha256.asc
  `bind-9.11.29.tar.gz.sha256.asc' saved [833/833]
`...

Here's how to get stunnel up and running on a CentOS 6 server, and configure your local stunnel client to work with it.

Server-side installation and configuration

First, install stunnel itself on the server:

[root@host ~]# yum -y install stunnel

Next, create a key and a self-signed certificate for stunnel to use:

[root@host ~]# cd /etc/pki/tls/certs/ && make stunnel.pem

Now, generate a set of Diffie-Hellman parameters using a 2048-bit group instead of the default 1024-bit size. A 2048-bit group is recommended by the discoverers of the Logjam attack.

    [root@host certs]# dd if=/dev/urandom count=64 | openssl dhparam -rand - 2048

    0 semi-random bytes loaded
    Generating DH parameters, 2048 bit long safe prime, generator 2
    This is going to take a long time
    64+0 records in
    64+0 records out
    32768 bytes (33 kB) copied, 0.00312777 s, 10.5 MB/s
    ....................+..[snip lots of outp...