* Superstitions: You don’t get the Number of the Beast (666) when messing around with the clock frequencies in the PC. Neither in the FSB, nor in the memories or the CPU. Begone evil thing!

* Speaking of the same frequencies, why there are board manufacturers out there, who think it’s a good thing to increase the noise and power consumption, by adding extra fans to the north and south bridges, while other just add simple motionless heat sinks?

*Case connectors. Someone out there thought it was a also a good thing to have a 3 hole female power LED connection, which actually only uses 2 wires, for 2 pin motherboards. Messy solutions would be to break the connector in half, or inserting a thin copper wire between the middle hole and one of the others, just to achieve current between the board jumpers and the connector. A more professional solution is using a cable that convert a 3 hole connection, to a 2 hole one.

* I’ll add others, as I go along.

Null device R.I.P.

| July 13th, 2009

Yes, like in the Unix world, in windows you do have a device similar to /dev/null, with the same purpose.

It is critical for some applications to work, specially the ones ported from Unix environments. For instance, the remote desktop software NoMachine’s Nxclient, will complain and stop working if the null device is gone. Some viruses and trojans can make that happen.

The driver shows up under “Non-Plug-play Drivers” in the device manager. It’s a hidden device by default, or gone if there’s a problem.

To restore it, we must the following:

  1. Check for the existence of the file null.sys (the driver file) in %systemroot%\system32\drivers. The file may already be there, but it can be a fake/corrupted version. If we’re sure the file is correct (checking it’s properties), we may skip to step 4; otherwise we should continue to 2, just to make sure.
  2. Go to the command line (navigate through start/run, write cmd and press <enter>), cd to the i386 folder (installation), either on our installation drive or windows instalattion CD/DVD. 
  3. The file we need from the i386 folder is called NULL.SY_. In the windows installation context, the underscores means that the files are compressed, so we need to use the expand utility in the same folder. Do a expand null.sy_ %systemroot%\system32\drivers\null.sys .
  4. The file is in place, but that doesn’t mean that the driver is already working. Windows needs to know, through its registry, that it has a newly installed driver file and activate (in this case) the corresponding windows service. This is done by correcting relevant registry entries and reactivating the driver/driver service through rebooting.
  5. In detail, we must first add the correct permission, for the operation described in the previous step. Navigate through start/run, write regedit and press enter. The registry editor pops up. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root key. We right click over it, and select Permissions. Add the Full Control permission to Everyone. Every user now has permission to add registry entries to this key. For security reasons, we should undone this step at the end.
  6. Download this registry file, and install it (by clicking it). Windows asks for a confirmation. Answer affirmatively.
  7. Reboot. If everything goes well, we should notice a new hidden device (NULL device) under the non-plug and play devices (as I pointed out before they’re hidden by default), in device manager. We should now undone step 5.

If you are on Vista (any Service Pack or version) and:

  • The network connection fails, particularly behind a VPN.
  • Mail clients may slowly respond or even crash.
  • Remote access like rdp, ssh, xwindows clients, may  respond slowly and loose the connections.
  • Any low latency protocol may experience a poor network performance.

This is due to the new IP stack implementation in vista, that follows compliance with RFC 1323’s TCP window scale option, which isn’t fully understood by some layer 3 network devices (routers, firewalls, etc), used by your Vista client, when connecting to the network. 

Awkward as it might be, this isn’t a vista problem, but a network problem, therefore the responsibility of your sysadmin.

As a user, you can turn off this option on Vista by going to the command prompt and typing:

netsh interface tcp set global autotuninglevel=disabled

…and restarting your computer. The connection problems should be gone now.To turn back on this feature, type this:

netsh interface tcp set global autotuninglevel=normal

…and restart again. This is the default behavior, and on connections without problems, it can increase your network throughput, doing a more efficient TCP flow control.

If you are the sysadmin, you can resolve this problem at the network devices:

  • Linksys RV series (RV042, RV081, RV-16)
  • NetApp Cache Appliances NC 6.0.2 or an earlier version: The TCP splicing feature may not work together with the Window Scaling feature in Windows Vista. By default, the TCP splicing feature is enabled on NetApp Cache Appliances NC 6.0.2 or on an earlier version.
  • Cisco PIX 6.1(5), Cisco PIX 6.2(3), and Cisco PIX 6.3(1): These devices do not support the Window Scaling feature in Windows Vista.
  • Cisco IOS Software Release:Cisco IOS Software Release 12.3(15) and later versions of this software support the Window Scaling feature in Windows Vista.
  • Sonicwall: The Window Scaling feature in Windows Vista may not work if you enable either of the following features on a Sonicwall firewall device:
    • Strict TCP Enforcement Option
    • Enforce strict TCP compliance with RFC 793 and RFC 1122
  • Checkpoint NG R55 (and other versions): To work around this issue, disable the Sequence Verifier Enforcement feature.
  • As a real world example, Checkpoint’s VPN secureclient/securemote software, will surely have this behaviour, on Vista, even in it’s latest version, if the sequence verifier check (above) is turned on at the VPN server, together with the window scale option at the vista vpn client. As it isn’t Checkpoint fault, the security solutions company doesn’t release a workaround for this.

    For more information, please visit the corresponding Microsoft knowledge base.

    What happens when you leave unsuspecting active sendmails laying around, just to send logwatch report messages, for the same mail account, on linux servers, BUT for instance, with an unfinished DNS configuration (“oh..wasn’t a priority then” :P ) ?

    Yup, 4-5 days of bounce mail in mail queues.

    Worse, what happens when it finally becomes a priority and you correct it ?

    Simple expression: 4 day-sized-queue * #servers = Mailbomb on the recipient’s account.

    Problem: Selective deletion of large quantities of mail. Most webmail server software, like OWA or IMP, won’t do you any good, as their mail grouping capabilities are somewhat limited.

    Solution: If your mail server supports the IMAP or MAPI protocol (an exchange mail server), you can use outlook, to group the messages efficiently, and therefore delete large groups of unwanted mail.

    Deleting grouped messages in Outlook

    Deleting grouped messages in Outlook

    Bear in mind that MAPI not supported, neither in Outlook express, nor the Windows (Live) Mail embedded in the Vista OS. You’ll have to stick to the IMAP protocol in these situations, or use the enterprise versions of the mail client.
    Of course, if we’re talking about a Unix environment, IMAP is the (hard) way. Through testing, I found IMAP quite stressful. In the IMAP protocol you have to first delete the messages and then purge the mailbox.

    The delete step is easy and fast. Your mail agent just instructs the server to mark the messages as deleted. They’re not really gone. Just marked. You can safely undelete them.

    It is the purge portion you have to worry about. This is when messages are actually erased, and you can’t undeleted them (unless of course, you have a backup). You have to worry about, not because it’s irreversible, but because this is when the imap protocol really does a large overhead of control messages between the User Agent (mail client) and the Transport Agent (mail server). On a large setup you’ll probably won’t succeed, in deleting everything you want, all at once.

    In such scenario, please be patient and delete/purge smaller quantities of messages.

    Anyway, do NOT use POP for this. It does NOT work that way. Besides embarrassing yourself (even more), you’ll cause a lot of stress on the network, mail server and the mail client. You probably end up crashing your client and deleting useful mail from the account. In these cases, POP on the account = nuke the account.

    I tried, unsuccessfully, to do the same thing, a couple of weeks ago with thunderbird, using IMAP, but I’m sure there are clients out there, that can manage the IMAP/MAPI account’s mail list, as good as outlook does.

    Theoretically, you can do this resorting to a program/script with a IP network API, that emulates the IMAP protocol on the client side and selectively deletes mail messages based on a relevant filter, but I don’t know any piece of software that already does that.

    This procedure is also valid for an account the receives a lot a mail, even on normal operations.

    What’s your CMS?

    | June 3rd, 2009

    I’ve been messing around with CMS software for more than 10 years now.

    In the old days, I used to be a phpnuke hardcore user. In time, I was fed up with the large quantities of bugs and insecurity plaguing the nuke. SQL injections in some versions are trivial, and therefore busting a nuke’s database also is. Besides the nuke seemed to be stuck in the web 1.0. On the other hand, ironic as it is, there are security portals out there made in nuke :)

    So, I switched to Drupal. Never looked back. Drupal is a full featured CMS, stable and bug free, with enough security. It has only one rival up to the challenge of best CMS, Joomla. Depending on the site features and purposes, drupal can be better than joomla or vice-versa.

    However, these are portal oriented CMS. They are excellent to build large quantities of pages by a community of users.

    For personal use, such as a blog, Wordpress is the way. It goes several steps beyond the community CMSs, by implementing a full scale Web 2.0 CMS. The tags, syndication, CSSs, SEO, social software integration, web standards, web APIs, accessibility and usability,etc…they are all there. At least, I know I’m happy with it.

    Speaking of Internet piracy, local anti-piracy lobbies here in Portugal, blame the Internet, for everything and anything bad, that happened to the entertainment and software industries, in the last decade.

    The latest episode seems to be the alarming rate, that an obsolete business called “video rental” is imploding.

    Meanwhile the major triple-play ISPs have invested a pile of cash in Video-on-Demand (VoD), at very attractive prices for the consumer.
    These two facts can’t be connected…or can they?

    One has a lot to think about, when the most expensive titles in VoD costs less than the cheapest movie ticket. And the titles are practically simultaneous released, both to the VoD and the DVD rental markets.

    So, where does the piracy fits in here?

    Anti-piracy gets screwy…

    | May 29th, 2009

    As the entertainment industry keeps loosing bucks due to their own incompetence and useless business models, they resort to every nasty and unethical measures they can remember of, to squeeze every cent out of you.

    Meanwhile, there are others who can actually see the ridiculous side of the situation, and even predict it.

    The “IT crowd” is a British sitcom, that focus on the comedy of the geek culture. One particular sketch warns you about the whole new level, that anti-piracy fight has reached.

    Anyway, going back to 2001, a multimedia production company called Estudio, delivered to the Internet, a prophetic message about the future of the music industry. Almost a decade after it really makes you wonder how right they were…