High Tech Sorcery

Playing with Rails XSS protection

specialj — Mon, 23 Aug 2010 07:22:06 +0000

So in Rails 3 xss is protection is built in. This is good. In fact, I’ve wanted to see this since I first start coding rails in the 1.x days. I have not started any Rails 3 projects yet but I have been playing with enabling this on a Rails 2.3.8 project by using erubis and the rails_xss gem. Switching over I found lots of problems where strings which should be safe are being escaped. Of course I can easily mark the string as safe but I wanted to learn why this was happening. I found that the join method does not seem to keep strings safe.

>> ("foo".html_safe + "bar".html_safe).html_safe?
=> true
>> ("foo".html_safe << "bar".html_safe).html_safe?
=> true
>> ["foo".html_safe, "bar".html_safe].join.html_safe?
=> nil
>> ["foo".html_safe, "bar".html_safe].join(''.html_safe).html_safe?
=> nil

I’ve also noticed that mail_to does not return an html_safe string. It appears to have been fixed in Rails 3 but not correct in the rails_xss gem.

Kernel patches I’m hoping to see in Ubuntu 10.10

specialj — Mon, 16 Aug 2010 22:16:47 +0000

I’m planning on buying/building a new computer and I think I will install Ubuntu 10.10 on it. My plan is to use btrfs for the first time. Risky, but I will be taking nightly backups. However, Ubuntu 10.10 is planning on shipping with the Linux 2.6.35 which has a severe btrfs performance regression as documented here:

But besides that I’m also hoping that the I/O performance situation will be improved. It has been very difficult to track down where the bug is but I have certainly experienced it. I haven’t tested the patches but if they work I hope they find there way into Ubuntu 10.10

Using an SSD as a cache device

specialj — Thu, 22 Jul 2010 10:35:15 +0000

Running SSD’s in RAID can get very expensive very quickly. A more cost effective solution is to have a disk RAID and use an SSD as a cache. I’m not sure if any of these are production ready but all are worth watching:

zfs-fuse – supports the ZFS L2ARC feature which can be used to setup an SSD as a cache for a ZFS pool. Checksums SSD data and supports multiple devices.
bcache – a recent project for caching linux block devices. Currently only supports 1 cache device and offers no checksumming.
- Bcache: Caching beyond just RAM
- Want to use an SSD as cache? Now you can
flashcache – created and released by and for facebook this at least seems to be in production. documentation is not great however.
- Facebook releases Flashcache

Bcache: Caching beyond just RAM

Learned a lot about nested attributes and Rails

specialj — Fri, 04 Jun 2010 08:59:00 +0000

It’s been a frustrating night trying to figure out how accepts_nested_attributes_for, autosave, dirtyness, and Rails versions all fit together. Going to try and summarize my findings and hopefully I’ll get it right.

accepts_nested_attributes_for turns on autosave
autosave will cause any loaded associations to be saved when save for the parent object is called
the key word is “loaded”, so a find with an include will cause the association to be loaded, and thus autosaved (took my a long time to track this down)
in Rails 2.3.5 the association is saved regardless of dirty state
in Rails 2.3.8 the association is saved only if dirty

xAuth as an alternative to OAuth

specialj — Tue, 01 Jun 2010 10:01:42 +0000

In doing some work with OAuth today I cam across xAuth which is apparently supported by Twitter. Good thing to be aware of:

Using xAuth, an alternate OAuth from Twitter

Pay attention to the default IO scheduler

specialj — Tue, 01 Jun 2010 08:06:30 +0000

With recent versions of Ubuntu running as Xen DomU’s I’ve noticed that the default scheduler is deadline. I’ve read documentation that noop should be the preferred scheduler. However, I make use of ionice, as do disk intensive programs such as fcheck. It’s not often noted but ionice only works with the cfq scheduler and because of that cfq is probably the best default for any system.

The desktop I would buy today

specialj — Sat, 08 May 2010 17:16:46 +0000

While choosing an SSD may be difficult at the moment, other components for a solid workstation are not. Here’s what I’ve been looking at for the past few months:

Motherboard: ASUS M4A785TD-V EVO (AM3 AMD 785G HDMI ATX)
- This is one of the few consumer motherboards that supports ECC (though unbuffered only). It also has 128MB SidePort Memory and an onboard eSATA port which distinguishes it from the ASUS M4A785T-M/CSM. It requires a 24 Pin power connector.
CPU: AMD Phenom II X4 945 3.0GHz Socket AM3 95W Quad-Core
- The best combination of efficiency (95W), speed (3.0 GHz, 6MB L3), and cost ($140). The 925 is less than $10 cheaper; the 955 is 125W.
RAM: Right now Kingston has a pretty cheap ECC Unbuffered 2×2GB DDR3 1333 kit.
PSU: This depends on other hardware choices but I’m a fan of SeaSonic and Antec EarthWatts for high efficiency and low noise.
Case: This is not a recommendation as case choice is so subjective but:
- Foxconn TS-1 300W
- Antec Three Hundred 430W
- Antec NSK 4482B 380W
- COOLER MASTER Elite RC-310-BWN1-GP
- APEX SK-503-C
CD/DVD Burner: This is a difficult market as OEM drives are quite common but they are often lacking features from the retail versions and are also often rebrands of other models. For an OEM drive the cheapest of the Sony Optiarc, ASUS, and Lite-On is the way to go since they will likely be the same drive.
- OEM Asus 24B1xT = OEM LiteOn iHASx24Y = OEM Sony Optiarc AD-724xS = Retail LiteOn iHASx24-98
- Retail Asus 24B1xT = Retail LiteOn iHASx24A – these have SmartErase/E-Hammer (MediaTek chipset)

Getting more entropy for virtual servers

specialj — Wed, 05 May 2010 03:54:38 +0000

It is not uncommon for people to have performance problems with the their virtual servers and chalk it up to virtualization as the problem instead of insufficient entropy. Running a mail server or SSL web server are particularly vulnerable to virtual servers without much entropy. I have noticed that my virtual servers have had a lot less entropy in the past 6 months or so. I decided to revisit what simple and effective solutions exist to solve this problem.

I decided I would do a search for debian and ubuntu packages that could be used without much modification or configuration.

reseed – this pulls random data from random.org. However, it does this over HTTP so this package should be avoided unless one wanted to rewrite it to use HTTPS.
randomsound – this pulls random bits from a soundcard. This is good for a host system with a soundcard but not useful for a virtual server.
rng-tools – this is supposed to pull from a hardware true random number generator however some people have used /dev/urandom as the source. This is probably not a good solution.
haveged – this basically uses interrupt timing to generate random numbers. Not a lot has been written about haveged but it seems like the best easily available solution. It would be nice to review the quality of the random numbers though.

Other options:

KVM supposedly has a virtio-rng device which can pull entropy from the host into the guest. This would still potentially create a need for entropy creation on the host but could be a simpler setup for those using KVM.
It would be pretty easy to write a script to download random bits from random.org using HTTPS.

My kingdom for the perfect Linux filesystem

specialj — Wed, 05 May 2010 00:18:50 +0000

It is extremely difficult to keep up with all the filesystems being developed for Linux these days. Clearly, so much activity represents an understanding that the current filesystems do not address the needs of users. However, as is all too often the case, development is extremely fragmented with very small groups each trying to build the 1 true filesystem and thus each effort taking longer than a collaborative project.

What I want from a filesystem: snapshots, replication (local, aka RAID and network), checksums (at least optionally), compression (at least optionally), and some basic intelligence such as when a checksum fails and replication is used to get the data from another replica. Yes, fast error recovery and good performance are important too.

So what have we got right now:

zfs-fuse – an interesting option, has most features I’m looking for except network replication, but definitely questionable reliability due to small size of project
btrfs – also looking good in terms of features but small development and way behind schedule. no idea when it will be ready for production
nilfs – small development team and small user base, does have checksums and snapshots but that’s it
glusterfs – network and local replication but no snapshots, compression, or checksums at this time
ceph – looks to have all features by adding network replication over btrfs, but who knows when it will be ready, or when btrfs will be ready
hammer – dragonflybsd filesystem that has a read-only port on linux, no further development scheduled
xtreemfs – has checksums and network replication but snapshots scheduled for the 2.0 release
tux3 – dead
crfs – dead
pohmelfs – not enough info
gfarm – haven’t seriously researched

So, what’s a sysadmin to due? Abandon Linux for OpenSolaris or Nexenta? I am thinking of giving nilfs another chance. I know it has checksums but I have no idea what happens when a checksum is wrong. It would be interesting to put nilfs on a raid 1 md setup and then trash one of the disks to see how it handles it. It would be nice to run zfs-fuse through the same test as this is the test zfs has excelled at for some years now.

Chromium Extensions

specialj — Fri, 23 Apr 2010 01:31:11 +0000

I’ve been playing with the beta builds of chromium for a while. There are not nearly as many useful extensions are there are for firefox but these have helped:

Copy Without Formatting
FlashBlock (there’s also this FlashBlock, not sure what the practical difference is)