curiousgene.com

Speaking of the Hobbit

2011-12-02T11:33:00.001-08:00

I started reading The Hobbit to the kids on last week. (Or maybe the week before, now. This draft has been sitting here for a bit.) This, in and of itself, isn't such a big thing. Many people have read The Hobbit to their children, beginning with the author himself. It's perfect for that sort of thing. Some people have even blogged their way through reading it themselves or reading it to their children.

I'm not going to do that. In part this is because I don't think that most of what I have to say would be that interesting. It's well-trodden ground at this point. This isn't to say that I won't have some comment on the kids' reaction to the Hobbit. My kids are both smart and funny (sometimes on purpose), and some of their comments will probably bear repeating.

No, I'm not going to try blogging my way through the Hobbit because I just... well, I don't want to say I don't care enough to do so, because that's not really it. I have a lot of friends that I only interact with via some combination of Facebook/Twitter/Google+/USENET, and I do care about them.

I find, though, that as my interest in Tolkien has reawakened, and I start to read not only the Hobbit but the Lord of the Rings again, my focus is shifting. I don't mean to say "Tolkien is making me not like Technology", but I'm discovering that I don't find as much enjoyment in technology, and I don't feel the desire to fiddle with computers (in particular) in my spare time. It's not an end unto itself any more. When I get home, I just want to play with my kids. I want to read them books, and draw with them, and help them do puzzles. And when they're in bed, I want to read a book.

This also helps to explain why I haven't been doing much of anything on Twitter or Google+ lately. (Facebook I avoid for a completely different reason, which is that it's just too cluttered to be usable for me any more. (Now that I write that, I see that it may not be completely a different reason.)) I think maybe I'm spending more time living my life, and less time narrating me living my life.

I still love science. I made a compass for my daughter the other day with a cork, and paper clip, and a magnet. There was no real reason for it, but she found a cork, and it seemed like we should do something with it.

I still see the value in technology. The kids get to use the iPad, when they've finished their homework, and there's no chores to do. When I read books, it's often on my Nook, because I can carry around a whole library on that thing. But unlike a year ago, I use the Nook in order to read books. I don't read books in order to be using the Nook.

A note about making the right decisions

2011-10-25T15:16:00.000-07:00

The Occupy Wall Street movement is generating an awful lot of talk. Most of it, unfortunately, is reinforcing my opinion that people, by and large, are idiots. People who aren't idiots, furthermore, become idiots when trying to deal with certain subjects. I have elected, therefore, to just stay as far away from it all as possible, because you can't win when you're arguing with an idiot.

There's one point I want to make, though, and it's about making decisions.

I'm a computer guy. When people are looking to buy computers, or sell computers, or fix whatever damage they inadvertently caused to their poor defenseless computers, they ask me for advice or help. While I don't always want to help, I usually do. I know stuff about computers, and sometimes I can ask that person for assistance when I need their expertise.

When my wife and I bought this condo, we, not knowing a whole lot about mortgages, did what all of you do when your computers are broken. We relied on the advice of an in-law, who recommended a broker. We gave him pay stubs, and tax returns, and utility bills, and letters, and DNA samples, and he returned with a pre-approval from a firm called Countrywide.

We went touring around the Valley with an agent who showed us a whole big bunch of places. There was one we liked. Nice neighborhood, good schools, blah blah. It was, I was told, a pretty good deal. I wasn't really convinced about the good deal part, but compared to the prices of some of the other places we'd looked at, it seemed like we might, if the market really did go south, still be in a place people would want to live.

When the broker showed us the Truth In Lending statement, I got a bit upset and almost told him to leave. He was reassuring. He said, yeah, there's sticker shock, it looks high, but you guys can do it. Lots of people do it. And in a couple years, you can refinance, or maybe even sell up.

So we bought it. And it's a nice house. Even though the market did tank completely, we refinanced after two years, and avoided our mortgage going adjustable. Or loan went from Countrywide, to Greenpoint, to somebody else (I think), to Chase, and then to Bank of America.

As an aside: Every interaction I've had with every one of them over the last 7 years has been characterized by either a) frightening incompetence, b) malice and an overwhelming desire to make us pay for having been one of a multitude of toxic assets, or c) both.

I don't really regret buying this place. It's comfortable, and it's in just the right place to put our kids in a really good school. I'd do an awful lot to keep my kids in a good school. It's worth it to have them tell me about what they did in school today. They make me so happy that sometimes I have to stop myself from crying because The Girl told me about something new she learned in school.

Let's be honest, though: this place isn't worth what we paid for it. It might never be worth what we paid for it. It's an albatross, and I just hope I can keep from sinking until the kids can't realistically share a room any more.

We overbought. We did it on the advice of people who probably knew better, but wanted to make some money off of us before the whole shithouse when up in flames. We will probably, some day, have to walk away from this because we won't be able to sell it without taking a loss. I can live with all that.

But if I hear somebody say that I should have done more research on mortgages, or housing trends, or I should have been able to spot a bubble, or any of the rest of the things that imply that we acted imprudently, or that we're stupid, or we deserve to be underwater, I say to that somebody: you can fix your own fucking computer from now on.

Dodger Blues

2011-09-12T23:34:00.000-07:00

We went to a spur of the moment Dodger game tonight, and while the kids had a good time, it was not my most uplifting Dodger experience. To begin with, they got pounded. And they're south of .500 again. But if I was going to get upset every time the Dodgers lost, I'd be upset a lot.

I wasn't even that upset about the crowd, or lack thereof. I went to one other game this season, and it was a bit of a ghost town then, too.

No, my problem was in the store. We stopped by the team store out behind the pavilion on the way out, and it practically empty. Not just no people shopping (us 4, and maybe 2 other people), but hardly any merchandise. I wanted to buy some baseball cards for the kids. Usually, there's packages of Dodger cards, of various vintages and manufacturers. None of them are really worth much, but... you know. Kids like baseball cards.

There weren't any. There weren't any kids' hats either. Or purses, or backpacks. Or blankets or towels. But hey, the stuff they did have was really expensive. When we were in line, one of the employees realized he was apparently in charge, and said "I don't want to be in charge of this. All the shelves are missing."

Ouch.

My wife asked him what was with the prices, and his only comment was "they're greedy".

Double ouch. Let's all hope next season brings us a better team, lower prices, and maybe a new owner.

I hope this was a good idea

2011-07-11T09:59:00.000-07:00

I have moved over to Blogger. It occurred to me that all I was really doing was a Wordpress blog, and I didn't really feel like continuing to pay for the hosting when I could just move it somewhere that does it for free.

I should point out that, though all my old posts have moved over, the old links are broken, so for the vanishingly small number of people who have landed here from Google (hi people!), sorry, you'll have to do some clicking around to find what you're after. I'll get things a bit more organized shortly.

Also, I've been using Google+ a lot, and I've decided to just go the whole hog with Google's services. Baaa.

"Social" means different things to different people

2011-07-06T02:32:00.000-07:00

Right off the bat, let me just say that I really like Google+, and will probably jump ship from Facebook once I can convince my friends to join me there. But there's a lot of opinions flying around, from a lot of places, and I think some of them are missing the point a little, and I think they're missing the point because Google+ isn't actually for them.

By "them", I mean people who get paid to write about stuff like this. By virtue of what they do, they're Public Figures, and they attract a wide variety of followers, a slightly narrower variety of trolls, and then other assorted Internet bedbugs. This is in addition to their actual, you know, friends. A complaint I saw raised about Google+ was that it was difficult to manage their Stream because of the numerous comments coming from all quarters.

Well, guess what? That's not a problem with Google+. It's a problem with you. You are, in certain circles (heh), a celebrity. Get used to it, or find another job. But you probably really like telling people what you think, and what they should think, so I'm not sure where else you're going to work. Politics, maybe.

I've also heard the complaint that it's confusing, when following somebody like MG Siegler or Robert Scoble, to have their posts always at the top of your stream because the comments are constantly bumping them.

I have solved this problem by not following MG, or Scoble, or Leo Laporte. I actually enjoy reading their opinions (I listen to TWiT, I read TechCrunch), but that's just not what Google+ is for, at least not for me. They're not, nor should they be, in any way, a part of anything that could be called my Social Network. I don't know them. I never will. I don't really care about where they went on vacation, and I don't want pictures of their dogs. If I want MG's opinion, I'll just read TechCrunch.

Just my $0.02.

Fun with Apple Remote Desktop

2011-04-13T02:45:00.000-07:00

Silly me, trying to log in to an OS X Server box with Remote Desktop. Imagine my surprise when it hung indefinitely at "Reconnecting..." On a related note, I now hate the Spinning Sprocket just about as much as I hate the Spinning Pizza Beach Wheel of Death Spinning Wait Cursor.

I ssh'd in and found that ARDAgent wasn't running. I tried the usual kickstart incantation:

$ sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -privs -all -restart -agent
Starting...
Activated Remote Management
Stopped RFB Register MDNS

No dice. Stopped RFB Register MDNS? That's a new one on me. I ran ARDAgent by hand, and found that the login process had hung. ARDAgent doesn't restart until login completes, and login never completed. I had to killall loginwindow to kill that login attempt, at which point ARDAgent fired right back up.

I'm not afraid of ssh, and I'm a proficient command-line guy. I sorted this out fairly quickly. A quick troll through the relevant mailing lists/support sites, though, shows that in the Apple world, I'm apparently in the minority. And I don't expect that to change any time soon.

I was hoping for a Cr48 by now

2010-12-21T16:04:00.000-08:00

I'm a Mac Guy. It's what I do. Got certifications and everything. But I find that I've been living more and more in Google Land. I have a Droid, mostly because I refused to deal with AT&T. But I really like my Droid. I like that I can use ASE to actually write Python and Perl on it, and run it right on the phone. I love App Inventor. I bought a NOOKcolor, despite the annoying capitalization, because it's a fairly low-cost Android tablet. The NOOK's lack of the official App Store didn't bother me, because it's got a nice web browser, which lets me do pretty much everything I wanted anyway. I use Google Apps for my little vanity domain. I use Google for pretty much everything now.

When Google announced the Cr48 Pilot Program, I realized that it was something I had imagined already. See, I'm sort of a wannabe Sci Fi writer. I have ideas that never made it into plot outlines, outlines that never saw any real writing to flesh them out, and some real writing that never got finished. One of the fleeting ideas began with Our Protagonist arriving at an airport, wiping his notebook, and leaving it in the terminal for somebody else to pick up. When he arrived at his destination, he picked up another cheap notebook and pulled down all his data, and carried on with The Plot. No carrying anything potentially incriminating or valuable through increasingly intrusive security. No possibility of somebody asking for his encryption keys. Commodity notebooks. Throw yours away at the airport, pick up another when you get where you're going, and all your data is waiting for you, if you have the patience to wait for it to sync.

When I formulated this, I was thinking satellite-based storage, outside of the control of religions and dictators. But it turns out that this basically already exists. Google account, commodity netbook, simple OS. Boot it, sign in, boom, there's all your stuff.

So I filled out the form for the pilot program, and hoped that a Cr48 would show up on the porch, and I could move into my own imagination.

It's starting to look like I won't get one, though.

Hey, Google! I want a Cr48. Can I have one?

Creating NFS mounts in Snow Leopard

2010-12-17T06:33:00.000-08:00

Back in the Leopard days, if you wanted to set up an NFS mount, you used Directory Utility. If you showed the Advanced Settings, there was a "Mounts" option, and the rest was pretty self-explanatory.

It always seemed to me like a strange place to put such a thing, much like how File Sharing management used to be a part of Workgroup Manager, instead of Server Admin. All software, though, is a work in progress, and things move around.

In Snow Leopard, NFS mounts are now configured in Disk Utility, which makes a little more sense, but is still kind of a strange place for this. Launch Disk Utility, and go to File -> NFS Mounts..., and you'll be presented with a handy-dandy little window that offers you the ability to "Edit automatic NFS mounts for this computer." Click the plus, and enter the URL and the mount point. There's two check boxes for what I'd imagine are the two most commonly-used options for NFS mounts, which are mounting read-only, and ignoring SUID privileges. There's also an Advanced Mount Options box, which appears to take the standard mount options. In fact, if you check the read-only or no SUID boxes, you'll notice that it helpfully fills in the Advanced Options box with "ro" or "nosuid", respectively.

Once you've entered the pertinent info, you have to click "Save". If you close the window, it will close with no complaint, but you won't have any NFS shares mounted. Odd UI choice, there.

A couple interesting notes:

Shares will be mounted with the nobrowse option, i.e. they won't show up in the Finder.

Just like how NFS mounts in Tiger went into NetInfo, when you create one, and record will be added to /Local/Default/NFS. So, if you're connected via SSH, and you're looking for NFS mounts, dscl is your friend.

If you're looking at the URL via dscl or Workgroup Manager, you can edit the mount options by adding flags to the VFSOpts attribute. But it's probably a better idea to use Disk Utility when possible.

It might be nice to see a utility whose sole purpose is managing automounts, and not just NFS but AFP as well. But if there were one, it would probably go into /System/Library/CoreServices, and you'd have to get there through System Preferences, or something.

Recovering a corrupted OpenLDAP database

2010-08-09T04:42:00.000-07:00

Sometimes, OpenLDAP (a key component of Open Directory) will try to launch, and will find itself with a corrupted database. Naturally, when your LDAP server (slapd, which I always imagine as a daemon that constantly slaps you in the face) can't start, everything that relies on it will fail. That's usually bad.

You see errors like this:


8/9/10 12:11:55 PM com.apple.launchd[1] (org.openldap.slapd[547]) Exited with exit code: 1 
8/9/10 12:11:55 PM com.apple.launchd[1] (org.openldap.slapd) Throttling respawn: Will start in 10 seconds

If you run slapd in Tool mode, you can figure out the exact problem, and it'll probably look something like this:

$ /usr/libexec/slapd -Tt
bdb(dc=example,dc=com): PANIC: fatal region error detected; run recovery
bdb_db_open: Database cannot be opened, err -30978. Restore from backup!
bdb(dc=example,dc=com): DB_ENV->lock_id_free interface requires an environment configured for the locking subsystem
backend_startup_one: bi_db_open failed! (-30978)

The problem is that the Berkeley DB that holds all of OpenLDAP's information has become corrupted. It happens, and it's what the db_recover command is for.
First things first: make sure slapd is not running before trying to recover the database.

$ sudo launchctl unload /System/Library/LaunchDaemons/org.openldap.slapd.plist

By default, db_recover uses the current working directory as the home for the database environment. You can specify that with the -h flag, or you can just go there first.

$ cd /var/db/openldap/openldap-data

You should probably back up the contents of this folder before continuing. You can just copy the openldap-data folder to another folder, or use tar, but you should back it up. Just in case.

Now use db_recover to fix whatever is broken.
$ sudo /usr/bin/db_recover

Once that's done (and it shouldn't take long), run slapd -Tt again to make sure it did the trick. It should just tell you that it verified the config file. Reload the slapd launchdaemon, and (hopefully) it will launch.

$ sudo launchctl load /System/Library/LaunchDaemons/org.openldap.slapd.plist

I should point out that you should absolutely be taking periodic archives of Open Directory. You can do that from Server Admin, or you can script it using the serveradmin command, but you need to do it. The OpenLDAP database isn't the only thing that can get corrupted, and sometimes restoring from an Open Directory Archive is the only way you'll get things working again.

Whattaya mean Casper Remote could not verify .dmg?

2010-05-21T02:30:00.000-07:00

Took me a few minutes to figure this out, but I was trying to install a package with Casper Remote, and it was downloading (from all appearances) the package, but then could not verify the package, so it would fail. The logs were like so:

Downloading http://my.jss:8443/Packages/MyPackage.dmg
Verifying DMG...
Error: The downloaded package could not be verified

Turns out the problem was that, for some reason, Casper thought the distribution point didn't need authentication, so the clients executing the policy were trying to connect anonymously to the WebDAV Realm. Instead of getting the DMG they asked for, they were (I imagine) getting a 404 page. Which, naturally, can't be verified as a DMG. I turned on authentication for all the distribution points, and all became right with the world.

There's a faster way to get there

2010-03-05T12:09:00.000-08:00

I was helping somebody set up a LogMeIn account the other day, and when we got around to testing, I figured I'd walk her through it. I told her to go to logmein.com. She opened up Internet Explorer, clicked in the little Google search box on whatever toolbar it was on, entered "www.logmein.com" in the search box, clicked Search, and then actually pondered for a second on which of the results she wanted to use.

Then, she clicked on the sponsored LogMeIn link.

I pointed out that she could have just entered the address in the address bar to begin with, since she went to the trouble of typing the whole thing, including the "www". I got sort of a blank look in return.

It makes me want to buy some Google stock.

Creepiest Account Creation I've Ever Experienced

2010-01-31T07:11:00.000-08:00

I just signed up for an account on the website of my newest health-care provider. As a part of the process, I was given a choice:

Have my password mailed to the address they had one file for me

Answer a series of questions drawn from "public databases" and get a password now.

Being impatient, I chose option 2. I was then asked a series of questions.

Which of a list of addresses (that included my mom's) I was associated with

Which of a list of cars (including a truck that was my dad's) I was associated with

What city my brother Tom lives in

What month my brother Pat was born in

What age range best described my mother.

Think about that. From knowing who I was (they have my name, address, and SSN at the very least), they were able to glean slightly more about my family than I even know, since I couldn't remember when Pat was born. (There's a lot of us. Cut me some slack.) So I have to wait for my password to come in the mail. This happened in an automated fashion, and it took about... 7 seconds? Maybe 10?

It was disconcerting.

Google Wave, anybody?

2009-12-05T14:15:00.000-08:00

I can't decide how I feel about Google Wave yet. In some ways, it seems to me like they took Usenet and IRC, threw them in a blender with Gmail, and then threw the somewhat messy result into my browser. It's clearly still in beta.

That being said, it's sorta cool, and I have invites. So if anybody wants one, ping me. All yours.

Note to Apple: Stop hiding useful things in strange places

2009-11-21T12:45:00.000-08:00

By "strange places" I mean /System/Library/CoreServices, and by useful things, in this case, I mean Server Assistant. That's where it lives now, along with Directory Utility, and a few other useful things like Screen Sharing and Kerberos.

This comes up because I needed to create some AutoServerSetup files, something I hadn't yet had to do for Snow Leopard. Naturally, I go looking for Server Assistant in /Applications/Server, where it would have been under Leopard, and of course it wasn't there.

CoreServices seems to have become a dumping ground for things that fall into the "Apple would rather you didn't run these unless you really need to" apps. There's other ways to get to them, of course. You can start Server Assistant from Server Admin, and Directory Utility is now launched from the Login PrefPane. But it just seems like a pain. Directory Utility is a useful utility. Put it in the Utilities folder. Server Assistant is useful when you have servers to set up. Put it in the Server folder.

Xsan 2.2, SMB, Extended Attributes, and Things Not Quite Working

2009-10-30T11:59:00.000-07:00

I was setting up a fresh new Xsan the other day. All the systems were Intel-based, all of them were running Mac OS X 10.6, and we were installing Xsan 2.2. So I enabled Extended Attributes on the volume. So far, so good.

Towards the end of the engagement, I had reason to share a folder on the volume from the NAS bridgehead via SMB. I connected from my MacBook, moved some files back and forth, and all was good. I connected from a Windows XP machine, and tried to copy a file off the volume. The progress bar got just about all the way to the end before it was rudely stopped by an error.

Error Copying File or Folder
Cannot copy FILENAME: Cannot find the specified file.
Make sure you specify the correct path and file name.

I turns out that Windows (XP, at least - I haven't tested on anything else) is not so happy with those extended attributes. No big deal, though. You just have to disable those. If you look in /etc/smb.conf, you'll notice two lines:

stream support = yes
ea support = yes

Just change those both to no. This is the same fix that's required to get roaming profiles to work properly for Windows clients.

How to hit Grand Slams

2009-10-13T06:13:00.000-07:00

Anybody who knows me knows I'm a Dodger fan. My priorities are, in order:

My family

Baseball

Everything else

I just thought you should know this before continuing.

On July 10, Matt Kemp hit his third Grand Slam of the season. There was a lot of talk about this at the time, since the NL record for most grand slams in a season (tied this year by Albert Pujols, as it happens) is only 5. Three is pretty good.

There was also a lot of talk earlier in the year about Matt Kemp batting 8th in the lineup. So much talk that Dodger Thoughts had to resort to a The Matt Kemp Batting Eighth Get It All Out of Your System Thread.

Nobody, that I saw, really stopped to put these two things together. Think about it - how do you hit a Grand Slam? You have to be able to hit a home run, which isn't easy, but lots of people can do it. You have to be able to do so with the bases loaded, which I'm sure is an even tougher feat. But the most important part is that you have to come up to the plate with the bases loaded. And there's nothing you can do to control that. If it happens, it happens. If it doesn't, it doesn't.

The middle of the Dodgers lineup was definitely being productive in the earlier part of the season, which meant that in the 8 spot, Kemp was getting to the plate with good odds of having runners on base. It was like a second cleanup spot.

So how, metaphorically, does one hit a grand slam? Somebody needs to have loaded up the bases for you first. If you're dealing with a computer guy, and he seems to keep hitting those metaphorical grand slams, you should ask yourself who keeps loading up the bases for him. If it's you/your employees/your business practices that's creating the situations in which it's possible for this guy to pull out grand-slam-grade accomplishments, you might want to consider making everybody's life a bit easier.

If situations like this are arising without apparent outside intervention, you might want to look into your computer guy's abilities and practices.

If you are the computer guy, and you keep finding yourself in these situations, then you should take a long, hard look at the way you're maintaining your systems, look at your workflow, and figure out who is loading the bases for you, and find a way to make it not happen.

Anyway. Go Dodgers.

Hey, where's my san volume?

2009-08-31T12:33:00.000-07:00

I ran into a strange problem a little while ago, and it seems to be showing up more and more. What happens is, your Xsan clients suddenly can't mount volumes. Sometimes the mount point is there but the volume doesn't mount, sometimes neither, sometimes the volume does mount. It's all very intermittent, and it's a bit maddening.

It only happens after the 10.5.8 update, and only (from what I can tell) on clients that were originally running Xsan 1.4, and were upgraded to Xsan 2.

serialnumberd, and I'm sure you're aware, is required for an Xsan client to work properly. With Xsan 1, this got launched by a Startup Item, namely /System/Library/StartupItems/SerialNumberSupport. With Xsan 2, this gets launched by a LaunchDaemon, /System/Library/LaunchDaemons/com.apple.SNServer.plist. If you happened to start with Xsan 1, and upgrade to 2 (and along the way probably went from Tiger to Leopard), you might have both. If you happen to have both, and you ran the 10.5.8 update, things might break.

It's easy enough to test. Just kill the Startup Item.

sudo SystemStarter stop SerialNumberSupport

Give it a minute. If your Xsan volumes suddenly decide to mount, then you should consider moving that Startup Item out of the way. It will bring you nothing but tears.

Changing passwords with dscl

2009-04-08T04:09:00.000-07:00

Let's just assume that you have some Macs with an administrative account whose password needs changing. (There's so many possible reasons for this that hypotheticals are really unnecessary.) They've got ARD running, but actually controlling them, and using System Preferences to change the password:

is time-consuming

is also tedious

means you might have to interact with somebody, and

is time-consuming.

So you select the computers that need passwords changed, click that handy-dandy little "UNIX" button (or go to Manage -> Send UNIX Command...), and enter the following.

dscl -u username -P password . -passwd /Users/username newpassword

If you're unfamiliar with dscl, I highly recommend you check out the man page. The first username and password are to authenticate as a user than can actually make the change you're trying to make. The dot is where we specify the data source - which directory node we want to make a change in. Since this is a local acccount, we can just use the local domain. Then we specify the command (in this case, "-passwd" to change a password), the path to the user (relative to the data source - I know that /Users/username would also be the location of their home directory, but that's just a coincidence), and the new password.

And then, we make extra special certain that we clear our History, because otherwise, anybody who gets their hands on our computer now has both old and new passwords.

Missing Persons in DSLocal Part 2

2009-03-04T09:48:00.000-08:00

So here's what happened:

Jan 12 09:22:36 Edit1 com.apple.loginwindow[26]: -xaDiskDisappeared: removing "_windowserver" with home "/var/empty" from DSLocal because disk disappeared.

‘xsDiskDisappeared’ is a function of external accounts in Leopard. External accounts are a new feature that you can use in managed environments. They allow you to let a home directory for a user be created on an external disk. Very handy, especially in (for instance) a school with a lab full of Macs. Let the students carry their home directory with them on a USB drive or an iPod.

What we have here, though, is a disk with Leopard installed is being treated as an ‘external accounts’ disk, and when it’s removed, the system is deleting the users. In this case all of the system users. If you disable external accounts on the Open Directory Master, this should stop happening.

On a related note, I tried to trick my trusty PowerBook G4 into letting me use External accounts without being bound to Open Directory. No dice. I did get a home directory on my iPod by adding a user using Workgroup Manager, and specifying my old iPod as the location for that user's home. Automatic creation of the home directory will fail, though, and the whole thing was just ugly.

On a related note, you can use Workgroup Manager to manage a whole range of interesting things on your Mac. But I'll get to that later.

Fast User Switching and ARD

2009-02-16T08:24:00.000-08:00

This may not be a good idea. There's only one quote relating to this that I can find, in the ARD Admin guide.

Note: Multiple users logged in via Fast User Switching can lead to confusing or
conflicting reports. When a second or third user logs in to a computer, there is no way
of knowing which user is the active user. Session length may not reflect actual usage,
and login and logout times overlap.

So, 3 users logged in using Fast User Switching can confuse ARD. Bad start. What I saw happen just today, though, was ARD getting so confused, that it wouldn't let me Observe or Control the client any more. Kickstarting ARD didn't help either. Did I mention this server was in a different time zone?

I ended up rebooting the server. Good thing SSH was turned on. I'm trying to reproduce this on another system. I'll update if I can make it happen.

So, avoid fast user switching over ARD.

On Being Irreplaceable

2009-02-05T04:29:00.000-08:00

I heard a commercial on the radio the other day, pushing IT training as a way to become irreplaceable. That's the way to job security!

This is a bad way to get job security, for a lot of reasons.

First, let's take it from your point of view. Assume for a moment you achieve this goal. You're the one source for (for instance) information and solutions when it comes to your server systems. You're the go-to person. Then you get married, and you head off to a nice week (or two, if you're lucky) of honeymooning bliss with your sweetie. Your phone will ring in the airport while you're waiting to board your plane. Guaranteed. You'll have voicemail when you get off the plane. You'll spend a lot of time on the phone. Your significant other will not be amused.

I've been irreplaceable, and it sucked. My time was no longer my own. I had brought upon myself an obligation to serve the need I had created.

Now let's look at it from you employer's point of view. You have this IT guy (or gal), and he (or she) knows all. Irreplaceable.

Let's first assume you're a good person, and they trust you, and like you. And then you get married. And you're off on your honeymoon, and your phone doesn't work. Or you're having a child. You're in the hospital, and your phone is off. Something breaks, and you're not available. Sure, you'll be back in a couple of days, but now your employer is thinking, what if this person gets hit by a car? What if he dies? We're screwed.

Congratulations, you're now holding your company hostage, whether you want to or not.

Now let's assume that you're sort of a curmudgeon, prone to cynicism. Effective, but not exactly pleasant. At some point, your employer will think, what if this guy snaps? What small thing is going to push him from just cynical and unhappy to resentful and possibly vengeful?

Congratulations, you look like you could hold the company hostage at any time.

Either way, it's your very irreplaceability that might push your employer to find a way to replace you before accident or malice put the company's future in your hands.

So how do you achieve job security? I don't know. I'll tell you what I'm doing right now, that seems to be working well. I do the best I can. I try to be honest about what I can and can't do, and be honest with myself about what I'm good at and what I'm not good at. I strive consciously to maintain my drive and my focus, because that doesn't just happen, you have to push yourself to be motivated sometimes. You do your best.

Cleaning out /var/virusmails

2009-02-02T01:00:00.000-08:00

bin/rm: Argument list too long

Ever seen that before? I ran into it while trying to clean out /var/virusmails on a Tiger Server system. It had about 230,000 items in it. The solution? find and xargs.

find /var/virusmails/ -name 'spam*' -print0 | xargs -0 rm -f

This will remove any file in /var/virusmails whose name starts with "spam". Of course, if you just want to remove any file in there (like those virus and banned ones), regardless of name, you would instead use

find /var/virusmails/ -type f

which will just return anything that is a regular file. find has a lot of very interesting options. I highly recommend that you check out the manpage for it. And for xargs, while you're at it.

Something to note: putting sudo before the command will sudo the find, but not the rm. Better to run the whole thing as root. Just be careful. Avoid tyops.

The joy of xargs

2009-01-30T03:47:00.000-08:00

I had a situation where I had a directory with about 230 subdirectories, comprising about 900GB. I had a number of 450GB drives I needed to back it up to, and I didn't want to have to do a 230 different cp commands. Enter xargs. I love xargs. You give it a source of input, and a command to run, and it will run the command, using the supplied input as arguments.

So for my 230 directories, I need to hand a certain number of those directories as an argument to cp. I decided to copy anything starting with a through i to one drive, j through r to another, and s through z to a third. From the source directory, you do this:

ls -d [a-i]* | xargs -J name cp -Rp name /path/to/backup/folder/

The -d flag is important, as that will make ls just return the name of the directory. The [a-i]* will match anything starting with a through i, followed by any number of characters. The -J lets you specify a replacement string. This takes the input supplied via the pipe, and for each line of input (in this case, the name of a directory), runs cp, replacing "name" with, in this case, the name of a folder.

And, of course, -Rp to recursively copy everything in those folders, preserving permissions, special attributes, ACLs, etc.

Missing Persons in dslocal

2009-01-11T04:15:00.000-08:00

I ran into a Leopard system the other day that was behaving erratically. I looked at system.log, and encountered some errors I'd never run into before.


Jan  6 10:04:42 Edit1 /System/Library/CoreServices/coreservicesd[60]: _scserver_ServerCheckin: client uid validation failure; getpwuid(92) == NULL
Jan  6 10:05:13 Edit1 com.apple.launchd[1] (com.apple.launchd.peruser.92[183]): getpwuid("92") failed
Jan  6 10:05:13 Edit1 com.apple.launchd[1] (com.apple.launchd.peruser.92[183]): PID 182 "SFLSharedPrefsTo" has no account to back it! Real/effective/saved UIDs: 92/92/92
Jan  6 10:05:13 Edit1 com.apple.launchd[1] (com.apple.launchd.peruser.92[183]): PID 166 "SecurityAgent" has no account to back it! Real/effective/saved UIDs: 92/92/92

Lots of those, and for various UIDs and myriad processes. I thought I'd open up dscl and see what was up with the system users.

Edit1:~ user$ dscl

Entering interactive mode... (type "help" for commands)

> cd /Local/Default/users

/Local/Default/dsRecTypeNative:users > ls

daemon

user

root

Apparently, this system had all of 3 local users. This is a bit strange, as any normal Leopard system should have at least 40.

Gene:~ gene$ dscl . -list users | wc

41 41 378

What had happened, for reasons that I haven't been able to determine, was the .plists for most of the system users and groups (located in /var/db/dslocal/nodes/Default/) were missing. I put the machine in target mode, grabbed those from a functional Leopard system, and everything was fine.

Useful Metaphors

2009-01-05T14:17:00.000-08:00

I'm sure I'm not the only Technology Professional who has heard something like this:

I click on the Start, and then the big E, and that's the Internet.

At this point in the conversation, it will be very difficult to convince Mom/Dad/Grandparent/Whoever that the Internet is anything other than what you get to with the Big E. It's not Internet Explorer. It's the Internet.

This is not an insurmountable obstacle. You just need a good metaphor.

Firefox? It's like a new TV! (Yes, exclamation point. You need to be enthusiastic. Sell it!) You get all the same channels, it's just got a different name on the front panel, and the remote is still a little different. No, no, it's still the Internet! I promise! It's still HBO when you have a new TV, right? Hey, it might even work a little better. You won't have to reset all your breakers once a week any more to make the TV come back on!