Pants Full of Unix

So, I’d been wondering about this for a while, but I think I’d like it better if it were correct: I’ve an iPhone 3G and the 3.0 OS update certainly installed the voice recording application, and it does work just fine. Scratch that, I can’t read. No, my 3G does not now do video recording. So, useful list after all!

Btw, I wouldn’t mind doing a speed comparison if one of you out there picks up a 3G S. Given that the 3G is only barely noticeably faster than the original in most real world use cases, I’m rather dubious of this “faster than ever” claim they’re making. There’s a limited number of things one can do with the handset to change that: the network’s throughput is much more important.

iTunes 8.2 has introduced a new feature: if you have a keypad lock on your phone (or iPod touch? I guess they can do that?) then you must authenticate to the device before iTunes will sync with it. I went through three emotions about this, roughly aligned to Id, Ego, and Superego (in that order):

1. This is irritating, get out of my way.
2. Actually, I like this because it was, previously, a glaring security hole.
3. Oh, it’s still a glaring security hole exploitable by anybody clever enough to keep an old version of iTunes about and it gets in my way now.

That’s about as far as my thought process on this goes and I’ve concluded the whole thing is both silly and irritating. Maybe I’ve missed something?

Dear Microsoft Windows,

When there are fewer than 10 icons on my desktop, I probably do not want your “assistance” to tidy up, no matter how long it’s been since I saw fit to open (for example) that phonetic alphabet PDF. It really won’t be necessary for you to keep asking EVERY FUCKING ASS WEEK.

Thanks!

I’ve let this one kick around in the back of my mind for a while, because I’m about to accuse someone, in public, of being grossly unprofessional which could, itself, be considered unprofessional. I confess that my first impulse was to simply post the whole email thread, edited only mildly to conceal identities, but that’s obviously petty and immature. With that caveat covered, I do have what I think is an important point to make here, so I’m going to attempt to walk this fine line.

Recently, my employer has gone forward with a hardware refresh of our backup infrastructure. The portions of this hardware refresh that were more or less up for grabs were the tape library that held LTO-4 drives and how we would do encryption key management for those drives. The tape library considerations were the HP MSL series (4048s already in the building, 8096s required for this usage), Sun StorageTek SL500s, or SpectraLogic T120s (or, at the outside T200s, but that’s overkill for this environment). I won’t go into which we selected or why here, because that’s not the point (feel free to drop me a line if you’re curious, but my take is: any of these options is acceptably serviceable, so it comes down to what fits best in your environment and cost from your relevant VAR). Each of these options locks one into that vendor’s key management (unless you choose to do it in your backup software, but I have a reason not to do so that is spelled VMS), which is an irritation that will be addressed at a later date.

My confessed discomfort should be painfully more clear by the dawdling length of the introduction. The point here is that one of those vendor’s sales representative (not the VAR, I take care to note) broached the borders of acceptable behavior on his part to an inexcusable extent: he got angry, at me, via email, for politely informing him that I planned to choose another vendor’s product. And he clicked “send” (or, probably, hit Alt-S; whatever). He should be ashamed, and I expect that he is, at this point, given that I intimated to the VAR salesperson that, regardless of whatever decision we’d already made, that would have sunk the sale.

I’d asked the VAR the same question that I asked the other two: is it feasible for us to buy your schlock and switch our backups to it, but stick an LTO-4 into our existing STK L180 library, duplicate from 9940 to LTO-4 media there, with encryption, and expect to be able to read those tapes for recovery. The answer, in all cases, was, “No, that shit don’t work because none of the vendors want to play nice with each other on key management.” This VAR slightly misunderstood the question (or was misinformed), so I wrote:

[REDACTED], your answer to number 1 is actually “No” [His answer had been a qualified "Yes", but the qualifications meant it wasn't useful for me]. That is, I can’t use [REDACTED]’s product in order to write an encrypted tape outside of a [REDACTED] library (which I could then read, later, inside a [REDACTED] library).

Thanks for the responses!

I wasn’t more irritated by this than by other VAR/vendor responses to the same question: you just can’t do that with the current state of affairs unless you do all of the key management yourself, and I’m uninterested in writing and supporting (potentially past my current employment) software to do that, so my thanks were genuine.

But he Cc’ed his sales rep from the vendor, and that’s where things got messy with just one email. He (the vendor now, not that VAR) wrote:

Please tell me a secure solution that can and we will point out more then one issue to dispute that claim. We have always talked about process not just glitzy marketing claims.

Now, that’s just unprofessional, without regard to context (of which a minute detail: he addressed me, outside of the quoted material, by my given name’s nickname without ever having been encouraged to do so; my co-workers call me that, but I never said he could and I sign emails with my full name… at least he spelled it correctly), but for bonus points it’s both technically and factually incorrect.

First, technically: I can write (it’s a three weekend hack; bet me three cases of Bols Genever and I’ll prove it, but check the price on that first, because it approaches half my hourly for the same work, and I’d be releasing it under either a CC or BSD license with my name on it) a secure solution to manage keys for LTO-4 tape drives across various disparate libraries and even backup products, restricting the latter to POSIX-(mostly-)compliant operating systems. (Making it also work for our VMS systems would require some consultation with the relevantly skilled parties at my employer and another weekend or two. And another case of Genever at the bare minimum, because I’ll be fucked if I’m writing code for OpenVMS for my goddamn health.)

Second, factually: this particular vendor’s presentation is nothing but “glitzy marketing”. I have, on my desk at work, no fewer than three spiral-bound, high-gloss, heavy-stock brochures about their products, in three different form factors, only two of which even pertain to tape libraries. This is, in fact, the second time (across disparate employers) I’ve been pitched by them, and they remain the most gut-wrenchingly, plasticly cheerful saleslime I’ve ever had the misfortune to encounter.

Curiously, that wasn’t the tape library I chose to buy. Twice now. They should consider just a dab of tact, I think.

Something verging on two months ago, I noticed that I wasn’t able to reach certain websites that I frequent (usually by way of RSS feeds) from my home Internet connection (a business DSL dry loop through Verizon). Some examples: Foobooz, riotclitshave (it’s a pun on right-click, save; shut up), Jeffrey Morgenthaler’s blog. What these sites have in common is that they are hosted by Dreamhost. The sites weren’t down (using my VPS as a proxy confirmed that without even needing to bother with things like Down for everyone or just me?), they were just failing to send packets back to me, semi-specifically.

I did a bit of research and found that not only did it appear that I was pretty obviously being explicitly blocked, other customers of my ISP were not. This irritated me more than a little bit, since I do like to believe that I have a reasonable idea of what I’m doing, I do take care of the security of my systems and networks at home (although I’ve been known to get a bit lax given that I do this shit all day at work), and I strive to be a very responsible network neighbor.

So I went looking for contact information for Dreamhost on their website… and found things sorely lacking. Web forms yes, one that applied to my situation, not so much. Phone numbers, no. Actual email addresses, no. This didn’t look good, but I went ahead and filled out a web form and emailed, by way of GMail (since any outgoing SMTP connection from my mail server would, of course, be ignored) what I expected to be the Usual Suspects:

Date: Sat, 21 Feb 2009 15:29:05 -0500
Subject: Could you explain why you’re blackholing my source IP address?
From: gabriel rosenkoetter
To: abuse@dreamhost.com, postmaster@dreamhost.com, webmaster@dreamhost.com

So far as I know, I have done nothing to attack you. My network is not open,
my mail server is secure with valid reverse DNS entries, and I’m not running
any webscraping. Could you please explain why you have blocked my access to
your customers’ web sites and provided me with difficult at best recourse to
contact you?

Dubious that anyone would see either of those (identical) missives, I reached out to some of my contacts in the Industry. By which I mean I asked whether anybody in the IRC channel where some of us sysadmin types hang out (no, that’s no longer EFNet #root for me any more; long story, politics, drama, and baggage) knew anyone at Dreamhost. One responded promptly in the affirmative and was very helpful in passing my query along. Here’s the thing about the lazyweb: you get better results with a self-selectedly intelligent audience, which, curiously, you rarely find on the world wide web proper.

And then I went out for the evening and straight to bed afterwards, only to rise to actual Results the next day! (Well, okay, fine I saw the reply on my iPhone while I was out, but I was in neither mood nor position to deal with it properly then.)

It appears (but I’m not certain: I put the same text in the web form and the email) that it was actually the web form (which I guess involved Sales, since nothing else seemed appropriate and they seemed like the folks who might care that someone couldn’t get to their customers’ web sites)—but maybe it was imajes’s influence? The world may never know!—that yielded the only unautomated response:

From: DreamHost Sales Team
Subject: Re: [REDACTED@gmail.com [REDACTED]] Could you explain why you’re blackholing my source IP address?
Date: Sat, 21 Feb 2009 18:09:29 -0800 (PST)
To: gabriel rosenkoetter

Thanks,
Phiya C

To which I, of course, promptly responded:

From: gabriel rosenkoetter < [REDACTED]@gmail.com>
Subject: Re: [[REDACTED]@gmail.com [REDACTED]] Could you explain why you’re blackholing my source IP address?
Date: Sun, 22 Feb 2009 12:39:01 -0500
To: [REDACTED]@dreamhost.com, [REDACTED]@gmail.com
Cc: DreamHost Sales Team

In many traceroute implementations, including FreeBSD’s (which this is), !X
means “communication administratively prohibited”, so I’m pretty sure that
there is an ACL on that pnap.net border gateway that’s dropping packets.
(The same thing happens with TCP packets.)

It took another 36 hours or so (which I am certainly in a position to understand; who knows, maybe an electrician decided to take one of their production DCs completely offline like one did to mine), but that then yielded this:

From: DreamHost Sales Team
Subject: Re: [[REDACTED]@gmail.com [REDACTED]] Could you explain why you’re blackholing my source IP addr
Date: Tue, 24 Feb 2009 16:28:52 -0800 (PST)
To: [REDACTED]@gmail.com

Thanks,
Brian S

I am just now, as in after this is posted, getting around to responding to ask whether they’ve got any change management documentation from when that block was put in place to document what I appeared to be doing because, as previously mentioned, I like to think I run an acceptably sound ship, and I’d like to know if I’m screwing up in some way so that I can fix it.

Overall, however, I am very, and unexpectedly, impressed with how well Dreamhost responded. Bravo!

Update: (2009-03-07 15:30 UTC-0500) Well, nothing’s perfect. They definitely didn’t understand what I meant when I asked for logs of any attack, mostly that I’m not one of their customers, but I do understand their privacy concerns:

From: DreamHost Sales Team
Subject: Re: [[REDACTED]@gmail.com [REDACTED]] Could you explain why you’re blackholing my source IP add
Date: Sat, 7 Mar 2009 06:10:12 -0800 (PST)

Thanks,
Javier R

Oh well.