TANSTAAFL

One of the best known SF acronyms outside of Science Fiction is TANSTAAFL, from Heinlein’s The Moon is a Harsh Mistress. It means “There aint no such thing as a free lunch.” more to the point, it means that there is a price for everything in time, money, sweat, or effort.

This to me holds true in the Linux world, and with many of the often brilliant “free” programs that are available.

You can probably see where this is going.

I’ve been trying to set up proxy services on my G5 running Leopard, so I can get rid of the Suse box that currently has no purpose in life outside of acting as a network proxy server for controlling web access. Running one less computer is good, even if the toaster-box doesn’t add much to my electric bill, and the G5 is becoming less and less my primary workstation anyway – my MacBook Pro is.

Getting squid installed – the proxy software – was pretty simple. The problem? I wanted to run it in conjunction with some filtering software called Dansguardian. This is the part where you shake your head, tsk, and say “ahh… foolish mortal.”

OSX launches background programs in a whole new way from traditional Unix/linux methods. The package I installed was fairly up to date and had a proper startup entry in it. or so it seemed.

The long and the short of it is I have the proxy working, but not the filter, and I’m spending much time on this simply because I want to figure the puzzle out, not because it’s cost-effective.

It’s fun, in a way, but usually I spend too much time fixing other people’s computers to want to have “fun” tinkering.

A Neat Feature in Stacks

Yes, I loathe the ever-changing stacks icons, and the workarounds needed to make a stack a consistently identifiable target.

That said, there are a few features that you look at and wonder how you lived without it.

For example.  A new file gets downloaded to your inbox. You click on the stack and the stack pops open. Click on the disk image file and the disk mounts. Then you install your software. Now it’s time to clean up.

Now, my past practice has been to open up my inbox and drag the image file from the inbox into the trash. Unthinking, I clicked on the stack again since my selection arrow was nearby,  clicked on the image file, and stopped.

I didn’t want to reopen it. So still holding down the mouse button while kicking myself mentally and expecting to see a new “disk” pop up on my desktop, I instead see the file move with the arrow. Before I realize what I’m doing I drag it into the trash.

Not quite believing what I just saw, I open up the trash, and sure enough, the file is there.

Wow.

UPDATE: As of OSX 10.5.2 Apple fixed the stack issue. You can now have the icon in your dock show up as the containing folder, and keep a nice, easy to identify target. They’ve added some more improvements too.

Virus Scams

 

A client of mine recently received an email purporting to be from the Department of Justice (and another one from “the IRS” ) relating to claims made against their business. It had some official-looking language about case numbers and claims filed by so-and-so, and noted that a copy of the complaint was included “in the pdf below.” They were suspicious for several reasons, and asked me to check it out.

Even if you expect the IRS or DOJ to email you out of the blue with this kind of thing, addressing the recipient by the wrong gender is a big red flag. The other thing that made me immediately suspicious was the “pdf” file was zipped.

The ZIP format is an incredibly useful compression and archiving standard that was even more important back when internet access was typically via modem. The downside is that if the package is really a virus installer it will not only unpack the virus files but execute them, infecting your system. For this reason any decent virus scanner will search through .zip files as they come in, but some viruses still slip through, especially in email. Also, PDF files are already compressed so there is little benefit from further compressing them (technically speaking – the graphics are already compressed. You may save some space by compressing the text more). Someone legitimately sending a PDF – or any document small enough to reasonably email (a word DOC file, etc.) – will almost never go out of their way to zip it up. Laziness, if nothing else, practically guarantees this.

As a matter of nettiquette, never email someone a .zip file without warning them ahead of time, and if you receive one without a prior heads up from a known, trusted source, be very suspicious. One of the nastiest infections I cleaned out looked like it came from a trusted source so the client opened it up without checking with the sender.

To wrap the story up, I took a snapshot of my virtual Vista installation under VMWare Fusion so I could restore to that earlier point, and looked at the zip file.  As expected, the antivirus software immediately caught it and archived it.

Minor Recovery Issues.

I’ve been more a fan of the VMWare Fusion virtual windows solution than Parallels, usually because Fusion has had less stability issues (especially relating to one client’s Quickbooks needs) and was just a little more polished. Well, sometimes you find rough spots.

Apparently Fusion assumes the hard drive size never changes. After installing the new HD in my MacBook pro and recovering from backups, everything else worked great, but Fusion couldn’t run the Boot Camp parition. While the error told me it realized the partition map had changed, Fusion would not give me the option of pointing to the new drive.

It was not a difficult fix – I found where Fusion stored the virtual machine file that pointed to the Boot Camp partition and deleted it, allowing Fusion to create a new one.  Nevertheless, VMWare should not assume that people will never change disks or partition maps, and should have provided an option to reset where it should find the Boot Camp partition.

One Month of Leopard

It’s been (just over) a month with Leopard. I’ve used four different installs (including a troubleshooting install) on five separate computers, three of them mine.

All and all, I love it. I’ve got my Mail Act-on back up and running for easy mail sorting. Inquisitor works again in Safari. Candybar has been updated and replaced Pixadex, including dock modification for those not happy with the default dock. EVE online works great on my MBPro, though I just don’t have the time. Quicklook is absolutely indispensable. Spotlight searches work quicker, and searches make more sense. Back to my Mac and the built-in screen sharing work well as can be expected across various networks.

I love it. Don’t regret it for a second.

That said – there are a few issues (other than my initial blue-screen – thanks again Logitech) that really annoy me:

1) Groups and Permissions on updates. In Tiger and earlier versions of the Mac OS, every User had a group created for it of the same name. When updating, Leopard does not change the existing user group or any related permissions in your home folder. So far so good, this makes perfect sense. What doesn’t make sense to me is why this group didn’t get entered into the groups available to Leopard when it was busy wiping netinfo, so that every file in my home folder was associated with an unknown group, instead of staff. Fortunately it’s much easier to change groups and home folders for a user account than it used to be.

2) ACL’s. Two of my machines had rogue ACL’s creep up out of nowhere, one of them twice, that would not allow me to delete files without authenticating first to get root privileges. Of course, this prevented things like calendar updates through iSync as well. Worse, the “man” page (documentation for commands) didn’t get updated to reflect the new ACL commands available that allowed removal of ACL’s without having to isolate ACL-infested files from those that aren’t.

3) Stacks targets – with a set of drawers icons and some creative sorting I’m now working around this, but *shrug* I shouldn’t have to work around this to get a stable visual cue.

Five Days of Leopard

I’ve spent five days with leopard now, installing it four times on three different computers, the most recent one two days ago. It’s left one heck of an impression on me. Mostly favorable. If your Mac can run Leopard, you should install it. The sheer scope of the improvements is worth it. Having another computer, or a .mac account and integration with calendar and other services on a Leopard server will make it even more worthwhile.

Other people have given their short little overviews. Others have released articles in dribs and drabs on different features. Yet others have released a veritable book on the subject. As a result, this review will be heavier on my impressions and what I went through.

I got the install DVD on Friday. The packaging was, as usual, wonderful. I chose my Macbook Pro to install it on as between the three Macs that could be upgraded, it was not only backed up (as they all were), it was the machine I could suffer the most disruptions with.

So in goes the DVD. Reboot, choose “upgrade.” So far so good. I click through the initial menus and let the install procedure start as I go off to make dinner. A while later, my son wanders into the kitchen. “Dad? Is it supposed to have a blue screen?”

Uh-oh. Try the usual precautions. Safe mode boot didn’t work. Doing a file-system check in single user mode proved that the hard drive is still in good shape. I decided it was worth some time doing tinkering. I’d have to help other people out of their troubles after all, so I didn’t want to jump the gun and do an “archive and install” or “clean install”. I may be backed up but I didn’t want to spend hours rebuilding my utilities and preferences.

A little research and I dug up a thread in the Apple Discussion Boards where people were already fighting with the same issue. About halfway down someone had decided to poke around on the premise that a set of system extensions referred to as APE was at fault. APE, or Application Enhancer was a third-party system hack used by Cleardock, Shapeshifter, and other programs that modify the appearance and behavior of the OS. Needless to say this can make the system… unstable.

The official Apple page (recommending an archive and install but giving the instructions I followed) is here. Daring Fireball also has more on the subject, including how the Logitech drivers for mice and keyboards, among other things, can install APE without your knowledge.

So I reboot holding down COMMAND-S on the keyboard into the single-user command-line mode, type in the commands needed to check and mount the hard drive, delete the relevant files, and reboot. Viola! It works.

Finally I got my .mac information set up, verified I still had my mail library and signatures (Mail predictably updated the library) and started to see what changed and testing what broke.

Insofar as the kerfluffle with the stacks and the dock… I don’t mind the new dock, but I prefer to apply the default side-dock format to the dock as it’s cleaner and easier to tell what is running. I found the new stack behavior a little frustrating at first because I had several folder shortcuts that I wanted to go and open up the folder, but most of them I used by right-clicking to get a menu of the contents anyway. So, once I recalibrated my expectations and realized I was trading submenus for easier-to click targets and a slight inconvenience in actually opening up the folders (when actually needed) I was more than happy with the effect. In a roundabout way, this is a return of the “drawers” behavior of OS8 and 9, complete with spring-loaded folders that you can drag files and documents to.

I hate the icons for the stacks. I hate them for the simple fact that as an aggregation of the icons for the contacts, I’m trading a minimum of useless information about the contents of a folder for an easily identifiable target to click on. Without wasting time to hover each one, it’s almost impossible to identify which is which reliably. While I’m not a huge fan of the new dock, and less a fan of the hard-to-differentiate new folder icons, I cannot understate how much I loathe the dock. Please please make it possible to keep a stable icon there!

 

I discovered to my annoyance that the calendar does not keep a side drawer open with the details of the currently selected event. I can deal with this change because it also makes it clearer when I’m looking at vs. just editing an event, and minimizes screen usage when I don’t need the details. That said, I love the “current time” bar that runs across the window. It did miff me a bit to discover that all of the subscribed folders had been pulled out into their own category from the groups I had them in.

I checked out the new syncing preferences for .mac, and decided to forego the syncing of widgets and preferences. My laptop and desktop have many overlapping uses, but they are fundementally used in different environments (field vs. office) with different tools needed at my fingertips.

Parental controls now allow for remote control of other macs on your local network. Hmmm… so now if all my future computers are macs I can administer the ones my children will use centrally insofar as web access, and get rid of the proxy server I run. I can also set hours for when they can get on online. I can also run Fusion to let my kids play some W98 games like Zoo tycoon… and probably faster than the current old Win machine they have access to.

When waking from sleep, I get to the password prompt consistently faster. The wiki feature in the dictionary is cool, and makes a program I already use regularly vice pulling down my volumes even more useful. I also trashed a “refresh finder” script I had available because Apple finally, finally made it update in a consistently timely manner when new files are added.

Spaces took some time to wrap myself around. The biggest problem was me – trying to figure out a separation of work modes that would allow me to maintain different virtual desktops. That said – if you use it as a clutter remover it works great, because unlike many variants I’d seen, you still have access to all of your apps through the Dock or COMMAND-Tab – which instantly switches you over to the correct screen. After I figured this out I don’t do any manual desktop switching – which is easy enough to do. The one hitch I’ve had is I often use CNTRL-Arrow in text editing, so I have to find another default key to switch my spaces.

Screen sharing is easily turned on if you want to use the “Back to my Mac” .mac feature or just access your desktop from across the house using Chicken of the VNC or the built-in Screen Sharing app. Like all of the network services it’s off by default. The only thing that threw me was that turning on file sharing automatically allowed guest access to the public folders – though the guest account was otherwise disabled. While it’s easy enough to stop sharing out public folders or turn off ALL guest access, it did throw me.

Actually, I like how they implemented guest access in general. You can log in as “guest” and get a temporary, restricted workspace that erases itself when you are done. The next “guest” again gets a pristine, sandboxed space to access the web. This is a great way to give my kids access to my main desktop when they’re online…

Back to screen sharing for a minute. This has a few other implications. First, those of us in tech support and consulting can now easily access the computer of any client that we can iChat with. This feature also reduces the future need to install the more flexible VINE server on many client desktops, though the jury is still out on servers, depending on security needs. This is yet another way that a user-friendly feature will also be a big help for IT folk. it alsomeans that those of us with .mac accounts have less need for a service like GoToMyPC or LogMeIn.

Speaking of big help – Time Machine. This is possibly the biggest single reason to get Leopard – so that you can have effortless, consistent backups. I’ve lost count of how many clients do a poor job in maintaining backups. While it won’t help with keeping copies offsite, this feature will save a lot of headaches where it comes to “oops I deleted my file” or “oops, my hard drive died” in shops where we don’t have our hands on Retrospect enough to make sure that the users files are regularly backed up. Time machine makes this process almost effortless. One thing to beware of – If you have any Paralells or Fusion windows images, you may want to make them exceptions or back them up separately unless you’ve got a much, much bigger backup drive than your main drive. Aperture also has some issues with Time Machine

When installing this on my desktop, I noted a few other things. First of all, while the Sharepoints prefpane was still available, all of the SMB and Appletalk share configuration data had been wiped out. instead, those share points now were in the Apple sharing preference pane. Also, after opening Cronnix, I noticed that ALL of my scheduling CRON scripts were gone that I used for mounting my backup disks. Not much of a loss since I’ll be using time machine anyways, but you may want to back up your Crontabs if you’re geeky enough to use them. (I was using CRON to schedule applescripts and other scripts that I only wanted to run on my desktop instead of through iCal).

Insofar as most of my programs, here’s the rundown:

Mail improvements. Here’s where I got hurt the worst. While I don’t mind saying good bye to mail.appetizer (it can be obtrusive), Mailtags and Mail act-on effectively don’t work. The good news is that the creator is already making it Leopard-compatible, and the “Leopard” beta of mailtags is available. I’ll just hold off for the final version. That said, the note-taking ability is useful, the contact-data sensing is just phenomenal, and it can now indent without quoting! The templates are fluff, but slick fluff, and very well implemented. mail has always been great about letting you pick an alternate outbound server if you can’t reach your default, but now you can also choose a different outgoing server as you compose your email.

Inquisitor, an app that gives me instant search results as I type in Safari doesn’t work. It may never be updated as it relied on access to parts of the Safari WebKit code that Apple has severely restricted access to. I will miss it.

Transmit and Quicksilver seem to work fine overall (with updates) though the “open all files with this tag” feature of the tagging module needs updating. The growl notifications are working just great.

Chax has disappeared, but most of the features it provided were rolled into iChat anyway. As it is I’ll still be using Adium except when I need the new “theater” and “screen sharing” modes.

I haven’t run mine yet, but apparently Photoshop works, though may “crash” upon closing out the program. I know Adobe has posted some other issues but apparently the main graphics programs all work OK.

As noted previously, APE is (very) broken. Wouldn’t matter to most non hardcore geeks except Logitech uses it as a basis for their mouse and keyboard drivers.

LiteIcon, an App that allows you to change the default system icons is broken. We’ll have to wait for an update on that or Candybar (from the iconfactory).

Desklickr doesn’t change the desktop out.

Google Earth needed me to reinstall/download the latest version on my laptop.

My Cisco VPN settings were wiped out. I am not sure yet if simply reinstalling will fix this. I WILL get a Time Machine backup first….

Tinkertool says that it is not fully compatible, but shouldn’t break anything, even if some effects are unexpected.

The Wacom drivers needed to be replaced with a new version.

Internet Explorer 5 (OSX version) still works as well as it ever did, for what it’s worth.

Other things that apparently still work:

  • Bonjour Browser
  • MagiCal
  • Aleph One
  • MythII
  • MS Office
  • FlickrUploader
  • Synk (with an update)
  • Canoscan drivers

Stuff I still need to test:

  • Blender
  • Emulators
  • Freeciv
  • Handbrake
  • Lingon
  • NeoOffice
  • nethack
  • Pic2Icon
  • Picasa Web Albums

That’s it in a nutshell.

This is Not Customer Service (I’m looking at You Comcast).

I am about this close to canceling my account with Comcast. After all, I don’t really watch TV and my life would be much more peaceful if I didn’t have to listen to anything else on the Disney channel for a while either. I’ve already been less than exceptionally happy with their response time for connection issues due to cabling (several days to a week), and level of knowledge. What really takes the cake is the experience that a neighbor just had.

Cue up Gilligans Island: “Sit right back and we’ll tell a tale…”

Four days ago my neighbor called and complained that her computer couldn’t get online. I had her check her cable modem and sure enough, the lights weren’t right, and we reset the modem. It worked. For a short while.

The next day the problems came up again. I went over to look, and sure enough, the cable modem was flaking out and not consistently showing a connection light. I had her call Comcast, and amazingly, they were able to get someone out the next day.

The technician came out yesterday, and angered my neighbor to no end. She felt she was being bossed around. She was also suspicious of how often he called in to HQ, though I can’t say how necessary or unnecessary that was. What really got my goat was that after replacing her old Motorola “surfboard” modem with a different modem, he didn’t get it registered. Apparently the system was down at HQ, or possibly Comcast still uses IE5 for their config utility (which of course won’t work on an Intel Mac), or he didn’t know enough about Macs to get them setup, or something, but he couldn’t get the modem registered and activated, and left it that way with her confused about what to do. Note – this can easily be done by calling in the serial number. He also told her that she couldn’t have her cable modem split off the same wall point as one of her TV’s, and that he’d have to come back to run a separate line.

The last tweaked my antennas, because I’ve seen competent cable installers before. I know perfectly well that with decent splitter fittings and filters and tight connections that you can split the signal all sorts of ways and still have it work. Since there is only one cable coming up to the house the biggest practical advantage to splitting the cable indoors is that it’s not exposed to the weather. From previous experience weather can make a big difference. The fittings don’t like to have water in them.

Either way, I went over this morning to get the modem registered, and immediately had problems. It took a long time to get a valid address, and I couldn’t resolve the download site for the software (incidentally this is why I don’t know if they still use IE 5 for mac configuration). I called it in to tech support, and they registered the modem serial number, and I got an address. I thanked them and switched back to the wireless router.

More trouble. Mail started coming in but I couldn’t get to any web sites reliably or get a full page to load. Ping checks were showing 30-60% packet drops – meaning about half of the data was randomly wandering off into the wastelands never to be seen again. So I reset the modem and called tech support. While on hold for “slow connection” I realized I had not yet gotten an address but finally managed to pull up a valid public address as the phone flunky answered.

I refuse to give out this name, because the following help desk idiot is a perfect example of how not to ever talk to a client, even though he started out pleasantly enough.

We went through the script, resetting the modem and rebooting the computer (I actually rebooted in addition to the DHCP renew which would do the trick most times. I also tried disabling/enabling the ethernet port). I slowly received a new address. I even managed to ping the router. What I couldn’t do was resolve names. I tried to point this out to the helpdesk but he insisted that a) I had a valid IP and b) he could communicate with the modem so c) there was no problem and I’d have to take any other issues up with my manufacturer, i.e. Apple.

Here’s where he really proved he earned idiot, and then some. I patiently explained to him that yes, I had an IP address, and I was apparently getting some proper comms as I could ping known IP addresses (at least the router) but I could not resolve names and until I could I couldn’t get a website.

“Well try to open a webpage.”

I stopped for about thirty seconds, and told him “Okay, I’ll humor you.” Of course, no response and no web page. Again, I was told “Call Apple.”

We went through several rounds of this with me explaining that a) I make my living at this, b) I was using my own laptop from across the street and also on Comcast so I bloody well know the computer was fine, and c) I knew for a fact that the network wasn’t, and until they fixed the problem on their end so I could resolve names I never would get online.

I was told effectively “I don’t care,” “I don’t care how many computers you use there and who makes them you have a valid IP so you need to call the manufacturer,” “If it was our problem we’d have other people complaining,” and finally “I don’t know what all this stuff is about names.”

Oh yeah. And “I can’t help you, call Apple.”

After a couple more rounds trying to explain to him that a name lookup was needed to get a website and being told “I can’t help you,” I finally asked him to “please bump me up to someone who can help.”

For anyone paying attention who ever, ever has to manage or work in customer service, yes, this was a mildly open-ended question. I didn’t specify “your supervisor.” Yes, by now I’d told him quite bluntly that he was ignorant of networking, though only after I’d already explained to him for the umpteenth time that name resolution was needed for web browsers to work and that both computers in question worked fine elsewhere so the problem was their network (and I didn’t yell). Nevertheless what happened next left me speechless. This is filed under “Let’s see what we can do to piss our customers off.” It’s also filed under “never ever ever ever ever do this.”

He transferred me to Apple.

That’s right. The next thing I heard on the phone was the automated prompting system at Apple Inc.. Not a supervisor. Not someone who actually understood how networks worked or would listen to me when I told him I wasn’t getting all of the required network data or consistently getting a valid IP address.

He transferred me to Apple.

Wow.

For what it’s worth, there is a tech who at least listens over there. Tom, here’s to you. I called back five minutes alter after I’d regained my composure, explained to you that I still had problems getting an address and that even with an address I couldn’t look up names, and you listened. I also told you I tried several machines including known working ones from other households, and you listened. You also checked the data on the modem, and realized the signal levels (despite the visit the other day) were still not quite right by enough to cause problems.

They had two trucks there the next day replacing cables. Everything there works fine now.

I guess calling Apple wouldn’t have solved the problem after all.

I will be pricing out the local Bellsouth (wups, AT&T) service though. Even with the hassle of getting new internal lines installed so I can have the DSL modem where I need it and the outbound mail policies at Bellsouth, this experience coupled with past unreliability in my own house left such a bad taste in my mouth I’m inclined to never pay a dime to Comcast again.

Software Not to Ship With a Product or “How using a Western Digital Mybook Stopped me From Burning CD’s.”

I recently saw a customer comment for an audio/USB adapter that stated “I’d have given this a perfect rating if they hadn’t included the crappy software.” Apparently, while the adapter did an absolutely bang-up job, the software that came with it to record audio was buggy, crash-prone, and difficult to use.

The good news is that for me, and for a lot of people buying that adapter, the included software was entirely secondary. But what happens when software that needs to be installed for using a product has issues?

Enter the Western Digital Mybook drive a client of mine bought. This drive looks sharp, and comes with Firewire ports and plenty of storage, so they bought one to use for backups. In the 1 Terabyte size it needs to be configured using their RAID utility before a Mac will properly recognize and use it. The RAID is internal to the drive casing, so that’s not an issue either. I’ve got to say that overall it seems to be a nice machine.

What is an issue is that a background service is installed – apparently to allow you to launch their crappy backup utility. By crappy I mean slow even on a brand-new Mac with lots of memory, flaky, and too simplified to make me comfortable using it.

Even that isn’t the showstopper.

The other day, only a few after installing two of the drives, a client of mine inserted a blank CD-R and the disk would not read. We literally spent hours trying to trace down the problem. It turns out that one of the services installed with the Mybook software can and often enough does prevent the system from properly reading blank CD media. Deleting the file starting the service will stop the problem. I got the fix from the following thread at the Apple support forums, and can say for a fact it worked for my client as well.

You’ll find the answer 13 posts down:

http://discussions.apple.com/thread.jspa?messageID=4343400

Why I’m Glad I Don’t Depend on Windows…

except to make money off the fact that other people do depend on it.

To make a long story short, Microsoft had some issues with their database that determines if your computer has a valid copy of Windows Vista or XP on it, and the validation servers were unavailable. Many people all over the world had their computers automatically check in over those few days because they were installing a new copy of Windows or updating or installing something like Windows Defender that required a validation check. Those people were immediately placed in a “reduced” mode that shut off features on their computers.

update: Of course, this all makes my earlier rant on the problems of software activation schemes look prescient.

update2: And the guys from User Friendly throw in their two cents…

Backing Up Is Hard to Do …

One thing that I’ve had underscored recently is a hint I repeatedly give my clients that can be put across in four words. Back Up Your Stuff

Nevertheless, despite repeated warnings, many people don’t. Some just flat out don’t believe that they will be the one whose hard drive ends up making strange and scary klunking noises. Others are well-intentioned, but just don’t manage to because, frankly, backup software is still more difficult to run than it should be. Nevermind the hassle of adding and removing drives, etc. for laptops, and you start getting some real headaches that explain why those of us who are a bit confused and even scared around computers wouldn’t want to spend the time.

The surprising thing is not that it happens in the business world as well, but that among those who do back up, it’s all too common to only back up the server and not track down laptop and other users who may keep files on their local hard drive.

When you’re dealing with a machine like a tablet PC, and the hard drive or other component fails that will result in it getting sent to the shop, you’re staring at losing a lot of critical data. You know: Family photos, your CD collection for iTunes, copies of tax returns, your email.

So. Do what you have to. Get an external drive. Archive stuff off to CD or DVD. use another computer in the house as a place to duplicate your critical information. Whatever. Just please, keep extra copies.