Re: Whicl linux technology existd to protect file's data at run at file granularity?

2019-02-24 Thread Elazar Leibovich
Sounds like you want IMA+EVM, specifically IMA-appraisal. I've no experience with that in practice. https://sourceforge.net/p/linux-ima/wiki/Home/#ima-appraisal https://events.linuxfoundation.org/wp-content/uploads/2017/12/LSS2018-EU-LinuxIntegrityOverview_Mimi-Zohar.pdf As I mentioned before,

Re: Security-What can be done in kernel to disable forever executable memory modificaton

2019-01-17 Thread Elazar Leibovich
a real security professional (e.g., not me), because there are probably other concerns you and me are not even considering now. On 17/01/2019 11:26, Elazar Leibovich wrote: What you probably want, is something similar to Windows VBS HVCI, which is usually achieved via underlying hypervisor

Re: Security-What can be done in kernel to disable forever executable memory modificaton

2019-01-17 Thread Elazar Leibovich
What you probably want, is something similar to Windows VBS HVCI, which is usually achieved via underlying hypervisor. It forces you to pass the security boundary of the hypervisor, even if security boundary between user/kernel is bypassed. Have a look at Bromium or QubeOS for a full

[job] KVM/hypervisor developer @Ravello/Oracle Ra'anana

2018-01-24 Thread Elazar Leibovich
Oracle is building its own cloud, OCI, with Ravello's cloud is running above it. Ravello is the only organization I know, running nested KVM in production, sometimes nested 3 levels deep, which presents some unique challenges. Here are some patches from the team:

Re: HW breakpoint on physical address w/ VM

2017-10-23 Thread Elazar Leibovich
ware.intel.com/sites/default/files/managed/c5/15/architecture-instruction-set-extensions-programming-reference.pdf [1] https://patchwork.kernel.org/patch/10007161/ On Sun, Aug 30, 2015 at 7:58 AM, Muli Ben-Yehuda <mu...@mulix.org> wrote: > On Sat, Aug 29, 2015 at 10:44:17PM +0300, Ela

Re: Smart home/electricity open standard

2017-05-21 Thread Elazar Leibovich
purchase because the option to reprogram there firmware > and avoid the vendor lock problem which most of this devices have. > > The OpenHAB froums are also a great place to find devices which work > seamlessly with OpenHAB and find other hardware recommendation. > > -- > Rabin >

Re: Smart home/electricity open standard

2017-05-21 Thread Elazar Leibovich
es > -- one of them call OpenHAB <https://www.openhab.org/> > > some devices will require a firmware flashing to make them to work with > your "cloud" and not the vendor. > > one popular and cheep devices to start with are the Sonoff switches. > > -- > Rab

Re: Smart home/electricity open standard

2017-05-21 Thread Elazar Leibovich
, it's not just the wire protocol. On Sun, May 21, 2017, 2:59 PM Rabin Yasharzadehe <ra...@rabin.io> wrote: > Please clarify what do you mean by "open standard for smart home" > are you referring to the communication between devices ? > > -- > Rabin > > On 21 May

Smart home/electricity open standard

2017-05-21 Thread Elazar Leibovich
Hi, Is there some open standard for smart home. The only thing I've seen which is close to open standard is KNX. But I'm not sure if there's a free/open source implementation of the standard ETS5 software used to configure KNX modules. Is the files specifying KNX hardware data, e.g., vd2, knxprod

Modern open source/standard for Arabic translitiration

2017-05-07 Thread Elazar Leibovich
Hi, While a little bit niche, and while unfortunately not enough Arabic speaking folks are in the hi-tech scene in Israel, I still send this query, and feel free to ask an Arabic speaking friend. Is there an open standard/de facto standard/implementation of Arabic transliteration. From Hebrew

Re: Interop with Windows zeroconf/LLMNR

2016-11-29 Thread Elazar Leibovich
; > On Tue, Nov 29, 2016 at 8:41 AM, Elazar Leibovich <elaz...@gmail.com> > wrote: > >> Hi, >> >> It's really convenient that two Linux computers usuallly have mDNS >> installed by default. >> I can then do scp x moshe.local, to my friend's laptop.

Interop with Windows zeroconf/LLMNR

2016-11-28 Thread Elazar Leibovich
Hi, It's really convenient that two Linux computers usuallly have mDNS installed by default. I can then do scp x moshe.local, to my friend's laptop. In order for that to work with Windows, one can enable Window's zeroconf standard, LLMNR. The easiest way is by configuring systemd-resolved to

Re: Gradual installation of debian packages

2016-08-06 Thread Elazar Leibovich
; does the software do that you can't test before installing on production > servers? > > On 6 August 2016 at 02:14, Elazar Leibovich <elaz...@gmail.com> wrote: > >> All real servers, with custom hardware attached, geographically >> distributed across the planet.

Re: Gradual installation of debian packages

2016-08-05 Thread Elazar Leibovich
able server images (e.g. Packer building AMI's, or Docker > containers), then it's a matter of just firing up an instance of the new > image both when testing and in production. > > --Amos > > On 3 August 2016 at 16:55, Elazar Leibovich <elaz...@gmail.com> wrote: > >> H

Re: Gradual installation of debian packages

2016-08-03 Thread Elazar Leibovich
parallel-ssh install on all the servers. > > P. S. In case of few tens of servers I'd prefer to work with ansible or > alternative, it's worh it in most cases/ > > Best Regards, Evgeniy. > > > On Tue, Aug 2, 2016 at 8:50 PM, Elazar Leibovich <elaz...@gmail.com> > wrot

Gradual installation of debian packages

2016-08-02 Thread Elazar Leibovich
Hi, I'm having a few (say, a few tens) Debian machines, with a local repository defined. In the local repository I have some home made packages I'm building and pushing to the local repository. When I'm upgrading my package, I want to be sure the update wouldn't cause a problem. So I wish to

Re: Measuring time period with rdtsc in liux

2016-04-20 Thread Elazar Leibovich
some way to measure that in userspace even without the kernel. On Wed, Apr 20, 2016 at 1:03 PM, Elazar Leibovich <elaz...@gmail.com> wrote: > I didn't think about it at first, but since the kernel uses tsc as a > clock source, I'd better have a look at what it does. > > Note that

Re: Measuring time period with rdtsc in liux

2016-04-20 Thread Elazar Leibovich
the hpet, assume it's in khz precision and round it down from userspace, but I'm still looking for a better solution to do that. I'm not a kernel expert, maybe tsc_khz is exported to userspace somehow. Anyone have any idea? On Wed, Apr 20, 2016 at 8:10 AM, Elazar Leibovich <elaz...@gmail.com>

Measuring time period with rdtsc in liux

2016-04-19 Thread Elazar Leibovich
Hi, In all recent Intel hardware, rdtsc is providing number of ticks since boot, with a constant rate, and is equal among CPUs. Vol III 17.14 For Pentium 4 processors, (...): the time-stamp counter increments at a constant rate. That rate may be set by the maximum core-clock to bus-clock ratio

[job] Ravello systems in Ra'anana Zarhin 13

2016-01-06 Thread Elazar Leibovich
Ravello systems is developing an hypervisor/virtual machine capable of running on the cloud. Companies who want to run, e.g., ESXi on the cloud, are running their software on Ravello's hypervisor which is capable of running nested on AWS or Google cloud. Ravello also emulates Layer 2 network for

HW breakpoint on physical address w/ VM

2015-08-29 Thread Elazar Leibovich
Does anyone have a creative idea how to set a hardware breakpoint on physical address with a VM. In x86-64 architecture. The best idea I've had, is patching KVM, and let him pretend some non-canonical vaddress is actually a physical address (e.g., hbr *0xf00d0A-BCDE-FGHI is equiv to a breakpoint

Re: HW breakpoint on physical address w/ VM

2015-08-29 Thread Elazar Leibovich
Oh, and the idea of the KVM patch is, for each physical HW bp, add a relevant entry in the spt, and set the hardware breakpoint there. This is assuming KVM HW bp works like I think they do. On Sat, Aug 29, 2015 at 10:13 PM, Elazar Leibovich elaz...@gmail.com wrote: Does anyone have a creative

Re: Memory pool interface design

2015-05-17 Thread Elazar Leibovich
What are other practical use cases where malloc returns NULL. You mentioned programmer error. I second, and mention restricted environment where admin ulimits your virtual memory. I'll be happy to hear more. On Sun, May 17, 2015 at 9:51 PM, Oleg Goldshmidt p...@goldshmidt.org wrote: Elazar

Re: Memory pool interface design

2015-05-16 Thread Elazar Leibovich
or handle it as he sees fit. Baruch On Fri, May 15, 2015 at 5:47 PM, Elazar Leibovich elaz...@gmail.com wrote: I'm writing a small C library, that I want to open source. I want them to be usable for embedded environment, where memory allocation must be controlled. Hence, I abstracted away

Re: Memory pool interface design

2015-05-16 Thread Elazar Leibovich
/~ladypine/vee18-agmon-ben-yehuda.pdf, Orna Agmon Ben-Yehuda, Eyal Posener, Muli Ben-Yehuda, Assaf Schuster, Ahuva Mu'alem. In proceedings of VEE 2014. On Sat, May 16, 2015 at 9:14 PM, Elazar Leibovich elaz...@gmail.com wrote: The question of whether to use a global malloc function, or to use

Re: Memory pool interface design

2015-05-16 Thread Elazar Leibovich
to check the error. Thanks, On Sat, May 16, 2015 at 11:18 PM, Oleg Goldshmidt p...@goldshmidt.org wrote: Elazar Leibovich elaz...@gmail.com writes: My question is, should I support the case of malloc failure. On one hand, it complicates the API significantly, but on the other hand it might

Memory pool interface design

2015-05-15 Thread Elazar Leibovich
I'm writing a small C library, that I want to open source. I want them to be usable for embedded environment, where memory allocation must be controlled. Hence, I abstracted away calls to malloc/realloc, and replaced them with struct mem_pool { void *(*allloc)(void *mem_pool, void

Accessing static variables from kernel modules

2015-03-31 Thread Elazar Leibovich
Hi, I was extending perf counters to sample the stack of a KVM guest from a module[0]. The current KVM profiling architecture, keeps a CPU local variable current_vcpu of the current vcpu running before vm_enter, and removes it after a vm_exit. Then, when an NMI occurs, it could check the

Re: Good design to expose debug info from kernel module

2015-03-30 Thread Elazar Leibovich
Sounds good, thanks (although it'll be harder to use from non-C programs). Do you have a good idea how to stream information as a response to ioctl? On Mon, Mar 30, 2015 at 3:31 PM, Gilboa Davara gilb...@gmail.com wrote: On Thu, Mar 26, 2015 at 11:36 PM, Elazar Leibovich elaz...@gmail.com

Re: Good design to expose debug info from kernel module

2015-03-30 Thread Elazar Leibovich
of the reasons. Thanks, On Mon, Mar 30, 2015 at 5:08 PM, Gilboa Davara gilb...@gmail.com wrote: On Mon, Mar 30, 2015 at 3:44 PM, Elazar Leibovich elaz...@gmail.com wrote: Sounds good, thanks (although it'll be harder to use from non-C programs). I usually complement each kernel module

Re: Good design to expose debug info from kernel module

2015-03-28 Thread Elazar Leibovich
AM, Amos Shapira amos.shap...@gmail.com wrote: If serialisation (aka marshalling) is considered, how about making it text based? Then you can use simple shell tools to talk to it. On 27 March 2015 at 22:34, Elazar Leibovich elaz...@gmail.com wrote: IMHO, C structs are no way near as usable

Re: Good design to expose debug info from kernel module

2015-03-27 Thread Elazar Leibovich
at this: http://www.linuxfoundation.org/collaborate/workgroups/networking/generic_netlink_howto (link got broken - place it all on a single line) --guy On 03/26/2015 11:36 PM, Elazar Leibovich wrote: Hi, I'm writing a kernel module, and I want to expose some debug information about

Re: Good design to expose debug info from kernel module

2015-03-27 Thread Elazar Leibovich
mempcy structures, without really writing serialization code (there's no endianess issues, with both sides running on the same host, by definition). --guy On 03/27/2015 10:03 AM, Elazar Leibovich wrote: Thanks, didn't know netlink. You still need a solution to parse the sent message, where

Good design to expose debug info from kernel module

2015-03-26 Thread Elazar Leibovich
Hi, I'm writing a kernel module, and I want to expose some debug information about it. The debug information is often of the form of request-response. For example: - Hey module, what's up with data at 0xe8ff0040c000? - Cached, populated two hours ago. - Hey module, please invalidate data

Re: Copying kernel stack in a generic way

2015-03-12 Thread Elazar Leibovich
two stack pages instead of one, but so far it doesn't look like I've seen truncated stacks. On Wed, Jan 7, 2015 at 11:50 AM, Elazar Leibovich elaz...@gmail.com wrote: For future reference. I examined what perf does when sampling the stack, (e.g. -g). 0. Indeed, it does not support callchain

Re: Copying kernel stack in a generic way

2015-01-07 Thread Elazar Leibovich
, tinfo, graph); } On Sun Dec 21 2014 at 9:28:01 AM Muli Ben-Yehuda mu...@mulix.org wrote: On Fri, Dec 19, 2014 at 02:19:07PM +, Elazar Leibovich wrote: I know where the stack ends, but how can I know where it begins? What assumptions can you make? Can you run kernel code in the VM (e.g

Re: Copying kernel stack in a generic way

2014-12-21 Thread Elazar Leibovich
Thanks, On Sun, Dec 21, 2014 at 9:27 AM, Muli Ben-Yehuda mu...@mulix.org wrote: On Fri, Dec 19, 2014 at 02:19:07PM +, Elazar Leibovich wrote: I know where the stack ends, but how can I know where it begins? What assumptions can you make? Can you run kernel code in the VM (e.g

Re: Copying kernel stack in a generic way

2014-12-21 Thread Elazar Leibovich
configurations and new versions. On the other hand, reliance upon OS identification would at least enable the user to call Support when he runs your code on an OS not identified as a supported OS. --- Omer On Sun, 2014-12-21 at 11:08 +0200, Elazar Leibovich wrote: Thanks, On Sun, Dec 21, 2014 at 9:27

Copying kernel stack in a generic way

2014-12-19 Thread Elazar Leibovich
I'm given a stopped virtual machine, with access to the CPU and the memory. It is now running a kernel function. I want to copy the entire kernel stack. How can I do that in a generic way, that would hopefully work across multiple kernels. For simplification, let's discuss x64. I know where

Re: How do I benchmark a spin lock?

2014-11-26 Thread Elazar Leibovich
. On Wed Nov 26 2014 at 10:43:43 AM Muli Ben-Yehuda mu...@mulix.org wrote: On Tue, Nov 25, 2014 at 08:56:01PM +, Elazar Leibovich wrote: The first question I have in mind, is, how do you define a lock benchmark? Is your goal to minimize overhead? Is your goal to minimize the latency

How do I benchmark a spin lock?

2014-11-25 Thread Elazar Leibovich
The first question I have in mind, is, how do you define a lock benchmark? Is your goal to minimize overhead? Is your goal to minimize the latency of a successful uncontended acquire? Is your goal to minimize bus load for other CPU when three CPUs are waiting for the spin lock? What we're

Re: Upgrading Ubuntu from 12.04 to 14.04

2014-05-18 Thread Elazar Leibovich
I'd urge you to consider using virtualenv to manage python dependencies. The only OS dependency you'd have, is python. You shouldn't care about dependencies beyond that. This is even more correct when deploying your application. On Thu, May 15, 2014 at 3:20 PM, Uri Even-Chen u...@speedy.net

Re: Who's counting jiffies when all CPUs idle in NO_HZ mode?

2014-03-26 Thread Elazar Leibovich
that answer, except the use of the hardware clocks. I believe it is still valid, but I'll need to look at the source code. Shachar On 26/03/14 06:38, Shachar Shemesh wrote: So I answer this here, and then I get a visit in the office with the same question... :-) On 25/03/14 23:04, Elazar

Who's counting jiffies when all CPUs idle in NO_HZ mode?

2014-03-25 Thread Elazar Leibovich
(I'm talking now about MONOTONIC_CLOCK_RAW, not taking NTP adjustment into account) To my understanding, the basic time counting mechanism at the Linux kernel, is the jiffies counter. The way it counts time, is by leveraging a CPU interrupt happening at a certain known frequency. Every time this

Re: sending to same dest via different interfaces

2014-03-05 Thread Elazar Leibovich
Another idea from colleague, is to bind the source address of the socket to the address of the desired netwrokr interface. While it doesn't guarantee anything, he said that in practice the kernel routed the packets through the desired network interface. On Tue, Mar 4, 2014 at 10:02 AM, Erez D

Re: sending to same dest via different interfaces

2014-03-04 Thread Elazar Leibovich
use the SO_BINDTODEVICE setsockopt. On Tue, Mar 4, 2014 at 10:02 AM, Erez D erez0...@gmail.com wrote: Hello I have 2 external interfaces via two eth cards, both connected to the internet I want to send a udp packet to same host:port, but choose dynamically which interface to use. can

Re: sending to same dest via different interfaces

2014-03-04 Thread Elazar Leibovich
that with capabilities, or use the old method of start as root, bind socket and drop privileges, or use a small server creating such sockets running as root. On Tue, Mar 4, 2014 at 11:16 AM, Erez D erez0...@gmail.com wrote: On Tue, Mar 4, 2014 at 11:05 AM, Elazar Leibovich elaz...@gmail.comwrote: use

Is there a reason to use `top` over `perf top`?

2013-11-10 Thread Elazar Leibovich
It seems that while top lists kernel provided statistics per process which is somewhat interesting but not all that useful, perf is really sampling the system, and gives a real picture of who's hogging your system, which is usually why you've started top in the first place. Let me give a trivial

Re: Is there a reason to use `top` over `perf top`?

2013-11-10 Thread Elazar Leibovich
While the point of perf not being available to non-root out of the box are valid (though, it's just apt-get install linux-tools + echo 0|sudo tee /proc/sys/kernel/perf_event_paranoid away, and it's the best bargain you'll ever make), IMHO this is indeed apple vs apple comparison. The goal of

Help recreating bug report in proxy library

2013-08-02 Thread Elazar Leibovich
Hi, I'm maintaining a small HTTP proxy library that allows you to eavesdrop HTTP requests. Someone reported a bug which I cannot recreate, so I'm trying my luck here. [repost from golang-nuts, where I didn't get an answer]. It seems to work on my machine, but a user still complain.

Re: Help recreating bug report in proxy library

2013-08-02 Thread Elazar Leibovich
installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues. On Fri, Aug 2, 2013 at 3:17 PM, Elazar Leibovich elaz...@gmail.com wrote: Hi, I'm maintaining a small HTTP proxy library that allows you to eavesdrop HTTP requests. Someone

Re: Is it OK to poll() a device file descriptor

2013-06-19 Thread Elazar Leibovich
no reason to call my callback. On Jun 19, 2013 7:47 AM, Shachar Shemesh shac...@shemesh.biz wrote: On 18/06/13 22:16, Elazar Leibovich wrote: I'm using it as a fake always non-blocking file descriptor. My main libevent-like poll loop looks like: poll(fds) for fd in fds

Is it OK to poll() a device file descriptor

2013-06-18 Thread Elazar Leibovich
Try to open /dev/null, and then to poll the file descriptor. Neither in the man page nor in the standard I see anything preventing you to poll on /dev/null, yet, it does not work on Mac OS X. You get a POLLNVAL. Run the following: https://gist.github.com/elazarl/5805848 #include stdio.h

Re: Is it OK to poll() a device file descriptor

2013-06-18 Thread Elazar Leibovich
Damn I missed that. To my defense, this bug should be also mentioned in the POLLNVAL section. As it stands now, it looks like the only reason for POLLNVAL is a closed file descriptor. Sorry and thanks. On Tue, Jun 18, 2013 at 6:09 PM, Oleg Goldshmidt p...@goldshmidt.org wrote: Elazar

Re: Is it OK to poll() a device file descriptor

2013-06-18 Thread Elazar Leibovich
/dev/zero to be more elegant. On Tue, Jun 18, 2013 at 8:42 PM, Shachar Shemesh shac...@shemesh.bizwrote: On 18/06/13 17:43, Elazar Leibovich wrote: Try to open /dev/null, and then to poll the file descriptor. Neither in the man page nor in the standard I see anything preventing you to poll

Re: filesystem capable of deduping tar.gz's content

2013-05-28 Thread Elazar Leibovich
You came late to the party, but you're the only one who brought cheque! Thanks, it's exactly what I was looking for. On May 28, 2013 4:22 PM, Ori Berger linux...@orib.net wrote: On 05/08/2013 09:22 PM, Elazar Leibovich wrote: Hi, I have a software product being built a few times a day

Re: filesystem capable of deduping tar.gz's content

2013-05-09 Thread Elazar Leibovich
On Wed, May 8, 2013 at 11:11 PM, Tzafrir Cohen tzaf...@cohens.org.ilwrote: Git stores files. It should do handle such deduping by design. But this is in Git's storage, and not in the actual filesystem: git packs them in a pack file. Use git gc to make it aware of changes, or just look at my

filesystem capable of deduping tar.gz's content

2013-05-08 Thread Elazar Leibovich
Hi, I have a software product being built a few times a day (continuous integration style). The end product is an installable tar.gz with many java jars. Since the content of the tar.gz's is mostly the same, I want to use a filesystem that would dedupe the duplicated content. As I see it, it's

Re: filesystem capable of deduping tar.gz's content

2013-05-08 Thread Elazar Leibovich
On Wed, May 8, 2013 at 10:47 PM, Oleg Goldshmidt p...@goldshmidt.org wrote: Disclaimer: I am definitely not an expert on the subject matter and I hardly know what I am talking about (in this case?). Creativity is no substitute for knowing what you are doing. Now let me try and get creative.

Output to block device in linux kernel

2013-04-24 Thread Elazar Leibovich
I'm trying to understand in more depth the handling of physical harddrive io in the linux kernel (from pdflush to the actual filesystem driver). When reading about the matter, I found out I'm missing some information at a more basic level. How a regular hard drive behaves? How is it implemented

Re: [YBA] diff'ing kernel source trees

2013-02-03 Thread Elazar Leibovich
Can't you copy one tree into the other and then use git diff? (Assuming at least one of them has a git repo it came from). On Sun, Feb 3, 2013 at 6:36 PM, Jonathan Ben Avraham y...@tkos.co.il wrote: Hi Linux-IL colleagues, To diff two kernel trees based on the same version from the mainline,

Re: SSD drives

2013-01-03 Thread Elazar Leibovich
Instead of assuming, you should've used Google ;-) To my (limited, I'm far from a crypto expert) understanding, Intel of course also seeds the PRNG with a true random number generator, and it complies NIST standard for randomness.

Re: RNG (was: Re: SSD drives)

2013-01-03 Thread Elazar Leibovich
If you're a gateway that does SSL (and thus need to do many kex)? Like F5 On Thu, Jan 3, 2013 at 1:50 PM, Nadav Har'El n...@math.technion.ac.ilwrote: On Thu, Jan 03, 2013, Yedidyah Bar-David wrote about RNG (was: Re: SSD drives): RDRAND is also a PRNG, reseeded at most once every 1022

Re: SSD drives

2013-01-03 Thread Elazar Leibovich
On Thu, Jan 3, 2013 at 3:13 PM, Oleg Goldshmidt p...@goldshmidt.org wrote: I'd say that it is up to Intel to prove that their TRNG design is truly non-deterministic. Um, but in Intel's case, they at least *tried* to prove that their TRNG is good enough. I don't think WD tries to make its

Re: SSD drives

2013-01-03 Thread Elazar Leibovich
$ cat /dev/urandom /dev/null kernel panic: radiation higher than the maximal safe amount On Thu, Jan 3, 2013 at 5:21 PM, Nadav Har'El n...@math.technion.ac.ilwrote: On Thu, Jan 03, 2013, Michael Shiloh wrote about Re: SSD drives: perhaps they use radioactive decay? Scroll down to Geiger

[job] Web application security researcher

2012-11-28 Thread Elazar Leibovich
For a security team, Web Application security researcher is required. While the job is not a Linux Job per se. Most relevant servers are linux servers, and Linux knowledge is required. For further details feel free to contact me in private. ___

Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). I thought of replacing the default shell with a shell that keeps its pid file in a central place. If such a file already exist, it'll kill the other running shell before logging in.

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 10:27 AM, Oleg Goldshmidt p...@goldshmidt.orgwrote: On Mon, Nov 12, 2012 at 10:05 AM, Elazar Leibovich elaz...@gmail.com wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). I thought of replacing

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 10:54 AM, Oleg Goldshmidt p...@goldshmidt.orgwrote: On Mon, Nov 12, 2012 at 10:40 AM, Elazar Leibovich elaz...@gmail.com wrote: No problem with my scheme, if sshd won't kill old sessions, new sessions will... (or maybe I misunderstand you). No, I misunderstood you

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 12:30 PM, Tzafrir Cohen tzaf...@cohens.org.ilwrote: On Mon, Nov 12, 2012 at 10:05:02AM +0200, Elazar Leibovich wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). Sessions != shells. Of course, what I

Re: Is forbidding concurrent ssh sessions a good idea?

2012-11-12 Thread Elazar Leibovich
On Mon, Nov 12, 2012 at 8:33 PM, Dotan Shavit do...@shavitos.com wrote: On 11/12/2012 10:05 AM, Elazar Leibovich wrote: I'm considering to disallow concurrent ssh sessions on a single-purpose production machine (say, DB server). You shouldn't... I'd just add 'who' to the end

Re: where to host web server

2012-10-21 Thread Elazar Leibovich
On Sun, Oct 21, 2012 at 1:49 PM, Oleg Goldshmidt p...@goldshmidt.org wrote: Out of curiosity, what is the security limitation? Even if hosted externally, I'd expect the machines to logically belong to the Technion (e.g., in the technion.ac.il sense as well as in every legal sense) If

Best practice for using CAS/atomic semantics in C/C++

2012-10-20 Thread Elazar Leibovich
What's the best way to get atomic/CAS instructions in C/C++, while keeping your code as portable as possible? Unfortunately, the best looking solution so far looks like depending on GCC's intrinsics, (since it's so widespread), but it doesn't sound right. There's also a project from HP,

Re: Looking for directions about compiling and tracing OpenJDK

2012-10-09 Thread Elazar Leibovich
Why do you need the Java source for that? Can't you use gdb, find out the the address of the mmap'ed area, and add a watchpoint there (scripted to log access and continue). On Tue, Oct 9, 2012 at 1:06 PM, Amos Shapira amos.shap...@gmail.com wrote: Thanks to both of you. To give more details

Re: What's the practical use of the error close() returns?

2012-07-27 Thread Elazar Leibovich
. It also failed with no space left on device, when it was trying to flush the rest of the data that was on the way to the file. Orna On Thu, Jul 26, 2012 at 11:49 PM, Elazar Leibovich elaz...@gmail.comwrote: I was always intrigued by this unix tidbit, closing a file can return an error

What's the practical use of the error close() returns?

2012-07-26 Thread Elazar Leibovich
I was always intrigued by this unix tidbit, closing a file can return an error. In practice, it is rarely checked (as far as I've seen) What does it mean? If I understand it correctly, recent write can lie about its success. But when do you really need it? If you have a piece of information you

Re: What's the practical use of the error close() returns?

2012-07-26 Thread Elazar Leibovich
On Fri, Jul 27, 2012 at 12:12 AM, Nadav Har'El n...@math.technion.ac.ilwrote: So it seems to me that checking the close() only *sometimes* lets you know of write errors which you'll otherwise miss. But since you'll anyway miss other write errors (those coming after the close()), it's not

Re: remote install linux?

2012-06-18 Thread Elazar Leibovich
Here's how I did an unattended install with no screen or keyboard: http://askubuntu.com/questions/122505/how-do-i-create-completely-unattended-install-for-ubuntu/122506http://askubuntu.com/questions/122505/how-do-i-create-completely-unattended-install-for-ubuntu/122506#comment149734_122506 On

Re: Unicode in C

2012-03-13 Thread Elazar Leibovich
2012/3/13 kobi zamir kobi.za...@gmail.com So I guess that you're also in the UTF-8 camp. yes, but my opinion about utf-8 is just my opinion. i like python and python defaults to utf-8. Python's internal representation is not UTF-8, but UTF-16, or UTF-32, depends on build parameters. Thus

Re: Unicode in C

2012-03-13 Thread Elazar Leibovich
On Tue, Mar 13, 2012 at 1:19 PM, Meir Kriheli mkrih...@gmail.com wrote: Nitpick: It's actually ucs2/ucs4 (which preceded the above but are compatible). Double nitpick, UTF-16 and UCS-2 are identical representation, and it's better to always use the name UTF-16 as the FAQ

Re: Unicode in C

2012-03-13 Thread Elazar Leibovich
On Tue, Mar 13, 2012 at 5:22 PM, Nadav Har'El n...@math.technion.ac.ilwrote: Qt appears to use internally UTF-16. What major free software C library actually prefer UTF-8? Are you talking about the internal representation, or the external interface? The internal representation is in many

Re: Unicode in C

2012-03-13 Thread Elazar Leibovich
Something very important, one need to consider is Unicode normalization. That is, how to strip out the Niqud, and to substitute, say KAF WITH DAGESH (U+FB3B) with just a KAF (U+05DB) etc. I guess that you're doing that already to some degree in hspell, so (in case you're translating to

Re: Unicode in C

2012-03-13 Thread Elazar Leibovich
On Tue, Mar 13, 2012 at 10:16 PM, Nadav Har'El n...@math.technion.ac.ilwrote: On Tue, Mar 13, 2012, Elazar Leibovich wrote about Re: Unicode in C: Something very important, one need to consider is Unicode normalization. That is, how to strip out the Niqud, and to substitute, say KAF

Re: Unicode in C

2012-03-12 Thread Elazar Leibovich
On Mon, Mar 12, 2012 at 3:20 PM, Omer Zak w...@zak.co.il wrote: If you need to use Far Eastern fonts and/or have random access for your text, use fixed size wide character encoding (16 bit or 32 bit size). Note that UTF-16, doesn't really offer random access, due to surrogate pairs (not all

Re: Unicode in C

2012-03-12 Thread Elazar Leibovich
The simplest option is, to accept StringPiece-like structure (pointer to buffer + size), and encoding, then to convert the data internally to your encoding (say, ISO-8859-8, replacing illegal characters with whitespace), and convert the other output back. Do you mind using iconv-like library? On

Re: Unicode in C

2012-03-12 Thread Elazar Leibovich
On Mon, Mar 12, 2012 at 5:39 PM, E L elyl...@cs.huji.ac.il wrote: What's the advantage of using ucs-4 internally? Especially if the program needs to save memory (embedded devices are pretty common these days). UTF-32 or UCS-4, is the only encoding form that allows random access to each

Re: Unicode in C

2012-03-12 Thread Elazar Leibovich
On Mon, Mar 12, 2012 at 7:37 PM, Nadav Har'El n...@math.technion.ac.ilwrote: On Mon, Mar 12, 2012, Elazar Leibovich wrote about Re: Unicode in C: The simplest option is, to accept StringPiece-like structure (pointer to buffer + size), and encoding, then to convert the data internally to your

iconv_open fails when suid bit is on

2012-02-13 Thread Elazar Leibovich
In RHEL 5 system, libc-6, I'm seeing the following strange phenomena $ cat iconv_test.c #include stdio.h #include errno.h #include fcntl.h #include iconv.h void iconv_test() { static int nr = 0; iconv_t iconv = iconv_open(MSCP949,UTF-8); //iconv_t iconv = iconv_open(UTF-16,UTF-8); if

Re: iconv_open fails when suid bit is on [SOLVED]

2012-02-13 Thread Elazar Leibovich
On Mon, Feb 13, 2012 at 12:22 PM, Yedidyah Bar-David linux...@didi.bardavid.org wrote: Indeed, and to strace programs that do this, I do something like that: Thanks! Worked like a charm. Here's the trouble: [pid 31526] open($ORIGIN/tls/i686/sse2/libKSC.so, O_RDONLY) = -1 ENOENT (No such

Unlock dialog does not appear occasionally in Ubuntu

2012-02-12 Thread Elazar Leibovich
This is the second ubuntu installation I'm having this problem with. Occasionaly, after the screen is locked, the Unlock dialog does not appear, and thus it is impossible to log in. I see the cursor and the desktop wallpaper, mouse is fully functional, but I cannot login. I resort to `service

Re: Unlock dialog does not appear occasionally in Ubuntu

2012-02-12 Thread Elazar Leibovich
On Sun, Feb 12, 2012 at 12:46 PM, Tzafrir Cohen tzaf...@cohens.org.ilwrote: Workaround: enable the keys that were disabled (by default) in the recent X11 security fix: http://who-t.blogspot.com/2012/01/xkb-breaking-grabs-cve-2012-0064.html It's a matter of simple xkb configuration. As for

Re: Please review my Java Unicode pitfalls

2012-02-07 Thread Elazar Leibovich
I made a short example of a few pitfalls the Java programmer might fall into when handling with Unicode text, I'll be glad if the smart folks here would have a look at it, and point out mistakes or missing pitfalls. The package have no dependencies except JUnit and Hamercrest testing framework.

Re: Free Software on Android

2011-12-29 Thread Elazar Leibovich
On Wed, Dec 28, 2011 at 1:18 PM, Nadav Har'El n...@math.technion.ac.ilwrote: Regarding point 2, wouldn't it be nice if it were possible to have a programming language which you can use to program the Android, on the Android itself, and run applications? Applications written in that language

Refund on preinstall Windows license in Israel [slightly OT]

2011-12-21 Thread Elazar Leibovich
Have anyone tried to get a refund on a Windows license on a preinstall machine he bought? Is it possible in Israel? How much money will they refund? How complicated is it? ___ Linux-il mailing list Linux-il@cs.huji.ac.il

Re: Unix History: Why does hexdump default to word alignment?

2011-12-01 Thread Elazar Leibovich
On Thu, Dec 1, 2011 at 10:10 AM, Nadav Har'El n...@math.technion.ac.ilwrote: When you say words and word aligned here, you mean historic 2 byte words. Indeed. Is there any other meaning for word other than two bytes? This is indeed *NOT* a very useful default on any modern computers. In

Re: Unix History: Why does hexdump default to word alignment?

2011-12-01 Thread Elazar Leibovich
On Thu, Dec 1, 2011 at 11:32 AM, geoffrey mendelson geoffreymendel...@gmail.com wrote: Well, let's see, going back to the 1960's, IBM 1401, word size set by a bit in memory, a word mark on a digit. Thanks for educating me, you need to get a job in CS archaeology. But what did the word mark

Re: Unix History: Why does hexdump default to word alignment?

2011-12-01 Thread Elazar Leibovich
On Fri, Dec 2, 2011 at 9:28 AM, guy keren c...@actcom.co.il wrote: you can use a debugger only for the basic code. you cannot use a debugger when you're dealing with multiple threads that access the same shared data and could have race conditions. in those cases you need to run a test, find

Unix History: Why does hexdump default to word alignment?

2011-11-30 Thread Elazar Leibovich
The default behaviour of hexdump is to align data word-wide. For instance printf '\xFF\xFF\x01' | hexdump 000 0001 003 This makes little sense to me. In C, structs are not necessarily aligned to words, and it doesn't seems useful to view about any data format for which

Re: Checkpoint VPN client for Linux - is there any?

2011-10-27 Thread Elazar Leibovich
2011/10/27 Noam Meltzer tsn...@gmail.com If I remember correctly CP has some kind of plugin/extension/some other kind of lie called snx. Or at least snx was the utility for linux which was the VPN client. You need some kind of license per user for that in the firewall. Didn't work for me

Re: Newer gcc swallow version control keywords

2011-10-21 Thread Elazar Leibovich
On Tue, Oct 18, 2011 at 1:50 PM, Oleg Goldshmidt p...@goldshmidt.org wrote: I didn't understand how, eg, my C++ scheme don't work. I think it should work even if you're including the $Id$ strings in the headers files. Apart from the fact that you assume that main.cc is mine (what if my

  1   2   3   >