Lately, this hasn’t been my experience at all. I’ve found that text wraps fine when I’m reading emails, but when it’s time to write one (whether by replying or starting from scratch), I’m writing into a window with a horizontal scrollbar, which makes it impossible to see all of my text (or, for that matter, the text I’m replying to) without continuously swiping left and right to see the beginning and end of each line.

It’s like Mail.app is enforcing a message width wider than the window it’s giving me to write in. Super frustrating, especially for correspondence that isn’t pithy.

It doesn’t seem to be a new phenomenon, and none of the workarounds I’ve found on forums have worked for me:

• rotating the device
• power cycling the device
• disabling “Increase Quote Level”
• removing and re-adding the account
• using Gmail instead of IMAP (I noticed the same behaviour on both types of accounts)

The only “solution” that “works” is dropping my iPad text size to the smallest available setting. But that makes text tiny across the entire device, and I’m too old for that.

I had just about given up on Apple’s Mail app when I noticed that hitting “Send Again”–on an email I had just sent with the wrapping issue–brought up the exact same message without the wrapping issue.

It turns out my fancy HTML signature (not actually very fancy–just a table to keep things aligned) was causing the whole thing. I’ve deleted my iOS email signatures and wrapping works perfectly.

Apparently Mail on iOS doesn’t know what to do when email signatures contain HTML tables. I’ll have to figure something else out. Meanwhile, hopefully this discovery (that took me far too long to make) will help someone else.

The post iOS Mail.app: when text doesn’t wrap while you’re writing an email appeared first on luke arms.

It’s not important that serious calculators pale into insignificance beside modern smartphones and tablets. I will always cherish the memory of my HP32SII and no, I’m not weird, you’re weird.

Anyway, I discovered something in the built-in Calculator app in macOS High Sierra the other day: RPN MODE. Which means one doesn’t need to run the very excellent PCalc to confuse everyone who doesn’t understand RPN.

Seriously. Just press ⌘R.

Why wasn’t this mentioned during a keynote, Apple?

Update: it looks like this feature has been available since OS X Tiger. I’m shook.

The post RPN mode in macOS Calculator appeared first on luke arms.

The result: rebooting after doing an apt-get dist-upgrade leaves you with no desktop environment.

The fix: use aptitude to trigger a downgrade of the relevant compiz packages (first you might need to use Ctrl+Alt+F1 to get a terminal session, and you might need to install aptitude too).

Here are the commands I needed:

$ sudo apt-get install aptitude
$ sudo aptitude install ubuntu-desktop unity unity-tweak-tool

Reject the first “solution” offered by aptitude, and when it offers to downgrade compiz, accept. Then, if needed:

$ sudo reboot

The post Did you lose your Ubuntu 16.04 “Unity” desktop after apt-get dist-upgrade? appeared first on luke arms.

Result: you need to enter the passphrase for each of your SSH keys at least once per session, where previously you could enter it once and never type it again.

Given the security implications of making it too easy to open an SSH session without authenticating yourself, I can’t fault Apple for this. But if you’re a heavy SSH user, you might agree that it’s more painful to work with now.

Thankfully, there is a workaround. I’ve just added this to my ~/.profile file:

if [ "$USER" != "root" ]; then

    if ! ssh-add -l | grep -q 'id_rsa.lkrms'; then

        ssh-add -A

        if ! ssh-add -l | grep -q 'id_rsa.lkrms'; then

            ssh-add -K "$HOME/.ssh/Keys/id_rsa.lkrms"

        fi

    fi

fi

Now, every time I open a terminal, ssh-add -l is grepped for id_rsa.lkrms. If it’s missing, ssh-add -A is called to add SSH identities from my keychain. If id_rsa.lkrms still hasn’t appeared, I will be prompted for my passphrase, and it will be stored in my keychain for future use.

The post Using your keychain with ssh-add on macOS Sierra appeared first on luke arms.

Signing authorities have improved in both areas (i.e. cost and turnaround), but Let’s Encrypt has taken it to a whole new level. Their free certificate service moved out of beta earlier this year, and with my one-and-only SSL certificate coming due for renewal, I thought I’d take it for a spin.

Let’s Encrypt issue 90-day certificates (commercial authorities typically offer 12-24 month certs), so their service is designed to be consumed by automatic certificate management software rather than end-users. This means there’s no user-facing front-end – another departure from traditional CAs.

You’d be forgiven for thinking all of this sounds terribly complicated, but with certbot, it couldn’t be much easier (assuming you’re running your own server). You just download and run the certbot-auto script and follow the instructions. In my case, as an Apache user, getting this blog running on HTTPS was as simple as:

$ certbot-auto --apache -d lkrms.org,www.lkrms.org,arms.to,www.arms.to,lukearms.net,www.lukearms.net

This command looked after reconfiguring, testing and reloading Apache. Then I dropped the following into /etc/cron.d/certbot:

42 2,14 * * * root /usr/local/bin/certbot-auto renew --quiet --no-self-upgrade

Now, as my Let’s Encrypt certificates expire (or are revoked), they are automatically renewed. Twice daily.

Suck on that, NSA / metadata retention agencies / ASIO / AFP.

NO DATAS FOR YOU.

The post No more HTTP: implementing Let’s Encrypt certificates appeared first on luke arms.

curl: (35) Server aborted the SSL handshake

Apparently something is currently broken about accessing GitHub-hosted raw content via https://raw.githubusercontent.com. It’s probably nothing do with your curl version.

Here’s an alternate install command that worked for me:

/usr/bin/ruby -e "$(curl -fsSL https://github.com/Homebrew/install/raw/master/install)"

You’re welcome.

UPDATE: it’s possible I was experiencing this issue due to intermittent problems with Telstra’s network.

The post Installing Homebrew on El Capitan when SSL won’t give you a handshake appeared first on luke arms.

Ben Brooks on The Brooks Review:

Stop wasting my time, stop wasting everyone’s time. If you want to write something cutesy, put it on your blog. Release notes should be clear, concise, well structured, and helpful.

Once upon a time, I thought it was great when creative/hilarious release notes appeared in my App Store updates tab. Now, I’m with Ben. Make them useful.

The post App update notes appeared first on luke arms.

I’ve meaning to link to this piece for a while, but in my new role as a web developer, it takes on additional significance. Even for developers who aren’t targeting “third-world” users, the reality is that sometimes Internet links are slow, and building websites and web-based products that function admirably when bandwidth is severely limited should be one of our priorities. Click through for some good ideas on how to do this.

The post Developing for painfully slow Internet appeared first on luke arms.

That’s OK. Wait for the next post. Google will bring my Linux desktop-loving geek friends to this one.

It’s a pretty easy fix on Ubuntu 14.04. Create a file called /etc/modprobe.d/wlan.conf with this inside:

options iwlwifi led_mode=1

And reboot. Your WiFi LED should stay on when you’re connected. Without blinking.

Thank you, other blogger.

The post Running Ubuntu on a laptop? Annoyed by your flashing WiFi light? appeared first on luke arms.

I’ve been an Apple convert for a few years now (I started to see the light in 2010-ish), but every 12-18 months, I grab a Google-endorsed device that can run the latest version of Android and put it through its paces.

I do this because I feel obliged to speak without ignorance on the advantages and disadvantages of the major mobile platforms. Also because playing with new tech is fun.

There’s more to it than the UI

When it comes to Android vs. iOS, the differences are much bigger than user experience. Apple’s business model is completely different to Google’s, which impacts on everything about its hardware, software and online services.

Some of the differences are less obvious than others. For example, Google’s efforts to retain and profit from its users’ data are no secret, but most people don’t realise just how much of their personal information is being passively disclosed. Apple, meanwhile, draws most of its profit from hardware sales and actively avoids the disclosure and retention of user particulars.

A more obvious difference is in the area of version fragmentation. Android hardware vendors aren’t obliged to provide timely software updates for their devices–even if they contain critical security patches–and most of them don’t. Meanwhile, iOS updates are made available, to all devices capable of running them, simultaneously. You can guess which of these ecosystems is riddled with unpatched, deprecated operating system software.

But let’s talk about the UI anyway

Assuming we’ve made peace with Android’s underlying constraints, the next question to ask is: how does its user experience stack up?

To find out, I tested Android “Lollipop” (5.1.1) on a Nexus 7 (2013 version). I tried to use it productively for about a week, in place of an equivalent iPad.

I accept that without migrating all of my data to Google’s cloud services, my experience of the platform wasn’t completely immersive, but hopefully you’ll agree that it was immersive enough to make a few meaningful observations.

1. Reading and typing

iOS always set a high bar when it came to the display, entry and editing of text, but with Lollipop, Android has caught up pretty comprehensively. Its new font (Roboto) is crisp and appealing; the default keyboard has an improved layout and responds without the lag of earlier versions; and working with text selections is much less frustrating than it used to be.

It’s not just the keyboard that’s more responsive. Animations are vastly smoother, and scrolling is finally on par with iOS. I can’t overstate the importance of these these improvements–they significantly increase user enjoyment and confidence.

2. App updates

Android’s built-in apps receive updates via Google’s Play Store. This allows core apps to be updated without the overhead of a full operating system update (great!), but it also makes for a volatile experience when the Play Store app itself needs updating (not so great!). After factory resetting my Nexus 7, I had the Play Store app crash, then declare it wasn’t installed, before eventually starting to work again. Unfriendly much?

The Play Store also had trouble resolving dependencies between core apps while they were being upgraded. A bunch of “You must upgrade X before you can upgrade Y” notifications were thrown at me after I hit “Update All”. This sort of thing shouldn’t happen ever, much less immediately after a factory reset (i.e. with no third-party apps in play).

3. Settings, settings, settings

The design of Android’s “Settings” app has improved significantly since previous versions, but I still found it relatively cluttered, with too many superfluous “advanced” options offered too prominently. Your mileage may vary.

Enterprise users will be annoyed to find that proxy auto-discovery remains unavailable in Lollilop. Manually entering a PAC file URL is still necessary. Apple has been all over this for years now. C’mon, Google!

Also, disabling those annoying keyboard tap sounds is not a simple task, because settings for “Sounds” aren’t all in one place. (I eventually found the toggle I was looking for–deep in “Keyboard” settings. Argh.)

Finally: IMAP users still can’t configure the stock email app to use custom mailboxes for Sent messages and Trash. Their names are hard-coded into the app.

4. Notifications

I liked that I could turn off all notifications for a set period of time (unlike “Do Not Disturb” mode on iOS, which needs to be manually switched off). I didn’t like that I could allow “priority” interruptions during this notification blackout–simply because it’s not clear what a “priority” interruption is (“Did I configure this? Do I trust my former self to have configured it properly? Is my presentation going to be interrupted by a Facebook message?”) I also didn’t like that the UI for this feature only appeared when I used the volume rocker. It belongs on the main notification panel.

My verdict

Android as an operating system isn’t bad. Like iOS, it has annoying shortcomings in some areas, but overall, it’s fast, beautiful and easy to use. When it’s not, pop-up tips pick up the slack.

So why do I think it “still sucks”?

It’s the apps.

Or, to be more specific, it’s the tablet apps.

Android has been tablet-friendly for years now, but a large of number of app developers (including Facebook) stubbornly refuse to build tablet versions of their apps. With a few exceptions, most of the apps I tried on the Nexus 7 opened as stretched or magnified phone apps. I could access all of my content, but the apps were so useless I couldn’t do anything with it.

The iOS App Store, meanwhile, is full of high-quality tablet apps.

Also, iOS plays nice with IMAP.

Also, Apple doesn’t hunger and thirst for my metadata.

The post Why Android still sucks appeared first on luke arms.

Lovers of technologies like RSS, Tiny Tiny RSS + Fever and Instapaper will want to get on this.

I’ve been using Reeder 2 for Mac since it was released, and although it’s hard to imagine a better desktop blog reader, the next version is also an Instapaper client, which trumps all of the other improvements (in my opinion).

I grabbed the latest beta last night and dropped it into /Applications as a Reeder 2 replacement. It picked up my previous configuration instantly, and adding my Instapaper account was straightforward. Thankfully I was able to configure manual archiving for Instapaper (this is analogous to marking RSS posts read, which I prefer to be automatic “on-open”) and was able to catch up on most of my “Read on Desktop” folder straightaway.

Aside from a few non-critical UI glitches, this is a very stable beta. Well worth your time.

The post Reeder 3 for Mac is in public beta, and it’s awesome appeared first on luke arms.

Haven’t had a need for this since discovering it, but it looks like a useful web development tool that’s cross-platform and generally excellent.

Hat tip to One Thing Well, a blog worth following if you’re a nerd / geek / similar species.

The post As seen on “One Thing Well”: Charles appeared first on luke arms.

So when they decided to force everyone to upgrade to their not-smart subscription-licensed “SMART Notebook 14” by leaving the previous version broken on OS X Yosemite, I was in a bit of a pickle.

Thankfully, a bit of determination (a.k.a. trawling through crash reports and Google results for “yosemite ruby 1.8 HALP PLZ”) was all it took to figure out that getting Notebook 11.4 working on Yosemite is as easy as copying Ruby 1.8 from a Mavericks machine over to Yosemite.

It’s in /System/Library/Frameworks/Ruby.framework/Versions/. I just tar’d the 1.8 folder up and copied it over.

You’re welcome.

The post Running SMART Notebook 11.4 on OS X Yosemite appeared first on luke arms.

So, this looks a little bit important.

The post Upgrading to OS X Yosemite with Homebrew installed appeared first on luke arms.

For those of us who manage large iPad deployments (and would prefer iOS 8 to be installed by end-users), this is a problem. Potentially a multiple-terabytes-through-a-finite-pipe problem.

Thankfully the Squid hack I figured out during the iOS 7 launch works with iOS 8 too. Otherwise we’d be in trouble.

The post OS X Server doesn’t cache iOS 8 appeared first on luke arms.

I didn’t understand all the angst over getting U2’s latest album for free–until I read Marco’s latest post. Now, I’m inclined to agree. Very clumsy work by Apple.

The post Regarding U2 and Apple appeared first on luke arms.

I didn’t realise software could be compassionate or otherwise, but this piece makes some interesting points (using poignant examples from the non-tech world). Worth a read.

(Language warning: one bad word.)

The post “Compassionate” software appeared first on luke arms.

John Gruber put this together late last year, and I’ve had it queued for posting since then. It remains a helpful summary of Apple’s approach to privacy, especially as it applies to delivering iMessages between devices.

Assurances from corporations aren’t always very, um, assuring, but so far it seems Apple are leaders in respecting the privacy of their users (even if it’s just to minimise their exposure to subpoenas and such).

The post Daring Fireball on iMessage encryption (and privacy in general) appeared first on luke arms.

My experience with the Retina iPad mini alongside full-size iPads (including a brief play with the iPad Air, which does indeed perform like a “desktop-grade” device) confirms everything Shawn Blanc has written here.

If you can’t decide which iPad to buy, go have a read!

The post iPad Air vs. iPad mini with Retina appeared first on luke arms.

Or you could just download my macOS-ready mssql.so (compiled for PHP 5.6.30 on macOS Sierra 10.12.6) and skip to the end. (18 Aug 2017)

Previous versions are available below.

Prerequisites

• Xcode with command line tools (these are installed when you first run Xcode)
• Latest autoconf source from http://ftp.gnu.org/gnu/autoconf/ (or Homebrew installed)
• Latest FreeTDS source from http://www.freetds.org/ (or Homebrew installed)
• Source for the same version of PHP that ships with macOS (5.6.30 on macOS Sierra 10.12.6; run `php -v` from a terminal if unsure)

Build and install autoconf

If you’re a Homebrew user, brew install autoconf is easier than the following.

$ tar zxf autoconf-latest.tar.gz 
$ cd autoconf-2.69
$ ./configure 
$ make
$ sudo make install

Build and install FreeTDS

FreeTDS is on Homebrew too: brew install freetds

Alternatively:

$ tar zxf freetds-patched.tar.gz
$ cd freetds-1.00.54
$ ./configure 
$ make
$ sudo make install

Build and install mssql.so

Don’t worry, unlike some of the Internets will tell you, there’s no need to rebuild PHP itself. Nor do you need to write an essay after .configure.

Update (18 Aug 2017): phpize doesn’t seem to work out-of-the box anymore. If it can’t find the files it needs (you’ll see grep errors), try adding a symbolic link like this: sudo ln -s /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX10.12.sdk/usr/include/php/ /usr/include/php. System Integrity Protection will need to be disabled first.

Here goes:

$ tar zxf php-5.6.30.tar.gz
$ cd php-5.6.30/ext/mssql
$ phpize
$ ./configure --with-php-config=/usr/bin/php-config --with-mssql=/usr/local/
$ make
$ sudo cp modules/mssql.so /usr/lib/php/extensions/no-debug-non-zts-20131226/

If you have trouble with the final step, System Integrity Protection is probably enabled. Disable it temporarily.

Finally, add this line to your php.ini (probably in /etc/php.ini):

extension=mssql.so

And restart Apache if necessary.

Done!

Previous versions

If you’re running an old version of macOS, you might find one of these binaries helpful:

• mssql.so compiled for PHP 5.4.17 on OS X Mavericks 10.9 can be downloaded here. (17 Nov 2013)
• mssql.so compiled for PHP 5.4.24 on OS X Mavericks 10.9.4 can be downloaded here. (6 Jul 2014)
• mssql.so compiled for PHP 5.5.14 on OS X Yosemite 10.10.1 can be downloaded here. (22 Dec 2014)
• mssql.so compiled for PHP 5.5.27 on OS X Yosemite 10.10.5 can be downloaded here. (16 Sep 2015)

The post PHP with FreeTDS on macOS Sierra appeared first on luke arms.

Just a heads up that I have updated my earlier posts about gaining access to Apple’s Profile Manager PostgreSQL database. The commands therein now work on Mavericks.

If you’ve upgraded from OS X Server 2.0 on Mountain Lion, you’ll have to open up remote access from scratch. Data is retained (flawlessly in my case), but the PostgreSQL instance has been moved and a new database (with a new name) created beside the old one.

Virtual hugs,

Me

The post Hacking Profile Manager on Mavericks appeared first on luke arms.

Much has been made of Gmail not working under Mail.app on Mavericks, but for those of us who use it with Exchange, it’s been a similar story (with less rage). I’m happy to report that the latency/timeout/crash problems I was experiencing with Mail.app and Exchange 2010 appear to be resolved with this update.

And there was much rejoicing!

The post Mail.app on Mavericks: now plays nice with Exchange appeared first on luke arms.

The only downside (aside from the “later in November” ETA on the Retina iPad Mini) is the downloading involved. Mavericks is ~5.5GB, and with 4 machines to upgrade [just in my house – there are a bunch more at work], downloading through the App Store each time would be painful.

As usual, Apple haven’t made it TOO easy to download-once-install-many (you can’t just restore a DMG onto an install partition anymore), but at least there’s an install media console utility built into the Install OS X Mavericks app.

Here’s how you use it:

1. Use the App Store to download Mavericks. It’s pretty hard to miss at the moment; go to the Updates tab if it’s not immediately obvious.
2. After downloading, cancel the installation process that will automatically start. (I just used Cmd-Q to quit the installer, but I think there’s a proper Cancel button too.)
3. Prepare your install media. I partitioned off 8GB on a USB hard drive. A USB stick might be your weapon of choice (8GB minimum, unless 6GB sticks exist). For the command below to work without alteration, you’ll need an empty Mac OS Extended (Journaled) partition called “Untitled”. Disk Utility makes light work of this.
4. Open a terminal and run the command below. When it asks for a password, give your OS X user account password.
5. Press and hold the Option key while rebooting. Select your new install media and proceed.

sudo /Applications/Install\ OS\ X\ Mavericks.app/Contents/Resources/createinstallmedia --volume /Volumes/Untitled --applicationpath /Applications/Install\ OS\ X\ Mavericks.app --nointeraction

The post Creating OS X Mavericks install media appeared first on luke arms.

Click through for a thorough and insightful commentary on Google’s move towards “closed source” with Android. There’s some eye-opening stuff on the so-called “Open Handset Alliance”, too.

Things are much more straightforward over here in Apple-land.

The post Android: less “open” every day appeared first on luke arms.

Right now, my challenge is upgrading almost 200 iPads to iOS 7 with minimal pain (read: zero device handling). Factor in less-than-ideal Internet bandwidth and Apple’s disinterest in allowing proxies to cache iOS updates, and it’s been a bit of a headache.

First, a word of advice: ask your users not to upgrade when prompted. Do this before Apple release a major update, to buy yourself some time to test it on your network and to check that the update is being cached properly.

Hopefully your iPad fleet is already using your Squid proxy. Ours is configured (via Apple’s Profile Manager) to use a PAC file when it’s on our WiFi network. The PAC file directs all but onsite requests to Squid.

Unfortunately, iOS doesn’t use the proxy for everything; system update authorizations, in particular, don’t get out unless permitted on your firewall. Here’s the relevant rule on our iptables firewall (no_proxy_ok is one of our custom chains, as is tcp_allowed):

-A no_proxy_ok -p tcp -m comment -m tcp -m multiport -d 17.0.0.0/8 -j tcp_allowed --dports 80,443,5223,2195,2196 --comment "allow Apple services (e.g. APNs, updates)"

Mercifully, the update itself is requested via the proxy, but getting it to cache is non-trivial. Obviously max_object_size needs to be big enough to accommodate a 1GB+ file. I went with 2GB:

maximum_object_size 2048000000 bytes

But this wasn’t enough to get the update to cache. A bit of sleuthing led to the first problem: Apple adds HTTP headers like these to its updates, so Squid discards them:

Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache

The workaround is to break HTTP a little by adding this line above any other refresh_pattern entries in your squid.conf:

refresh_pattern -i appldnld\.apple\.com 129600 100% 129600 ignore-reload ignore-no-store override-expire override-lastmod ignore-must-revalidate

refresh_pattern -i phobos\.apple\.com 129600 100% 129600 ignore-reload ignore-no-store override-expire override-lastmod ignore-must-revalidate

This forces Squid to treat objects from *.appldnld.apple.com and *.phobos.apple.com as “fresh” (i.e. cacheable) for 90 days (129600 minutes), no matter what appldnld.apple.com and phobos.apple.com say.

Finally, I made sure appldnld.apple.com requests were excluded from Squid’s delay pools and filtering ACLs; you may need to make similar tweaks. I also found that maximum_object_size wasn’t being applied correctly to cache_dir, so I defined it explicitly, i.e.:

cache_dir aufs /var/spool/squid3 256000 128 256 max-size=2048000000

iOS 7 is rolling out smoothly as I type.

The post Caching iOS updates on a Squid proxy server appeared first on luke arms.

But PagePlus only runs on Windows, and I’m not spending much time on Windows these days. Pixelmator and iDraw are excellent for bitmap and vector editing respectively, but iStudio Publisher is still missing a few features it needs to cut the mustard as a serious DTP app.

So I’ve been experimenting with Scribus, which is open-source, cross-platform and (surprisingly) well-documented. Being Qt-based, it’s not as snappy as PagePlus, but it’s usable on slower machines and meets all of my other requirements.

I’ve only found one catch so far: when exporting to PDF, its font outlining is slightly inaccurate (text looks heavier than it should, at least when using Avenir LT’s OpenType fonts). And it can’t embed OpenType fonts. There’s a workaround, though: export from Scribus without outlining or embedding any fonts, then use Ghostscript to do the embedding afterwards. Here’s a little BASH script that looks after it on OS X:

#!/bin/bash

if [ $# -ne 1 ]; then

    echo "Usage: embed_fonts.sh MyPdf.pdf"
    exit 1

fi

if [ ! -f "$1" ]; then

    echo "Not a file: $1"
    exit 1

fi

command -v gs >/dev/null 2>&1 || { echo "Ghostscript not found."; exit 2; }

TEMPFILE="$(dirname "$1")/nofonts.$(basename "$1")"

mv -vf "$1" "$TEMPFILE"

FONTPATH=/Library/Fonts:~/Library/Fonts

gs -sDEVICE=pdfwrite -sFONTPATH=$FONTPATH -dPDFSETTINGS=/prepress -dAutoFilterColorImages=false -dAutoFilterGrayImages=false -dColorImageFilter=/FlateEncode -dDownsampleColorImages=false -dDownsampleGrayImages=false -dDownsampleMonoImages=false -dGrayImageFilter=/FlateEncode -o "$1" "$TEMPFILE"

The post Embedding fonts in a PDF (after creating it) appeared first on luke arms.

My last post was about getting access to OS X Server’s Profile Manager database; this post is about doing something useful with it.

Hypothesis: given live access to data from Profile Manager and Active Directory, it should be easy to write a Squid external_acl_type helper that maps incoming IP addresses to usernames. An optional check for group membership? Trivial. Amirite?!

I was half-right. The lookups weren’t hard, but getting the helper to terminate when Squid wanted it to, and to NOT terminate prematurely, required a little trial-and-error. Turns out Squid keeps its helpers alive by sending them empty lines, so terminating on empty input isn’t such a good idea.

Anyway, here’s the code that has our iPad fleet “authenticating” with our Squid proxy server transparently. It’s been tested on Linux (Ubuntu 12.04 LTS) and OS X. Yes, Python would have been better than PHP, but I’m more fluent in PHP, and the PHP CLI interpreter is efficient enough for this purpose.

Update 23-Dec-2014: this script is now hosted on GitHub.

To use it in squid.conf (assuming you’ve pulled it down to /opt/git/extensions/squid/external_auth.php):

external_acl_type external_auth ttl=300 negative_ttl=5 children-startup=10 children-max=40 children-idle=10 ipv4 %SRC %MYPORT /opt/git/extensions/squid/external_auth.php

acl Apple_Devices external external_auth
acl Staff_Apple_Devices external external_auth staff
acl No_Filter_Devices external external_auth no_filter
acl No_Access_Devices external external_auth no_access

The “staff”, “no_filter” and “no_access” values map to $SQUID_LDAP_GROUP_DN in the configuration file – customise as needed (many groups may be defined).

Finally, use your new acls in some access rules, e.g.:

http_access allow localnet Staff_Only_Websites Staff_Apple_Devices
http_access deny localnet Staff_Only_Websites Apple_Devices

Questions? Errata? Do comment.

The post Squid authentication via OS X Profile Manager and Active Directory appeared first on luke arms.

Let’s say you’re running the MDM software Apple ship with OS X Server, Profile Manager. (You’ve chosen this because you don’t really need the fancy features of Casper and friends.)

Let’s say you’re also running other services that would benefit from live access to Profile Manager’s device metadata, e.g. a Squid proxy that implements MAC-based iOS authentication (because proper proxy authentication has been broken on iOS since forever). “An external_acl_type that could check enrolled device MAC addresses be super-awesome!” you say to yourself.

Where to start?

Turns out, Profile Manager data lives in an embedded PostgreSQL database, and opening it up for remote access is relatively straightforward.

First, you’ll need to modify /Library/Server/ProfileManager/Config/PostgreSQL_config.plist (note: this path has changed in Server 3.0) to enable access over TCP/IP (by default, postgres only listens on a UNIX socket). Edit the existing listen_addresses= entry, and add the last two lines:

<string>-c</string>
<string>listen_addresses=OSX_SERVER_LAN_IP</string>
<string>-c</string>
<string>port=5432</string>

Note: Server 3.0 creates multiple instances of PostgreSQL, one for each service that depends on it, all on different UNIX sockets. Just in case another instance opens PostgreSQL for TCP connections on localhost, I recommend binding the Profile Manager instance to a LAN-facing IP. Alternatively, you could use a non-standard port.

Then tell postgres that any host on your network is allowed to connect with an encrypted password, by adding a line like this to /Library/Server/ProfileManager/Data/PostgreSQL/pg_hba.conf (note: changed in Server 3.0):

host all all 192.168.0.0/16 md5

Almost done! Now you just need to set up a postgres user to connect as. Start by opening a psql session:

sudo -u _devicemgr psql -h /Library/Server/ProfileManager/Config/var/PostgreSQL devicemgr_v2m0

(This entire command has changed in Server 3.0; note particularly the new database name.)

Then you’ll probably want to run a couple of commands like:

CREATE USER squid WITH PASSWORD 'XXXX';
GRANT SELECT ON ALL TABLES IN SCHEMA public TO squid;

If you want to create a more privileged user:

CREATE USER dbadmin WITH PASSWORD 'XXXX';
GRANT ALL ON ALL TABLES IN SCHEMA public TO dbadmin;
GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO dbadmin;
GRANT ALL ON ALL FUNCTIONS IN SCHEMA public TO dbadmin;

Reboot the server and test with pgAdmin or some other PostgreSQL admin tool.

Oh, and don’t blame me if you break your Profile Manager, or Open Directory, or your entire OS X Server.

The post Under the hood: OS X Server’s Profile Manager appeared first on luke arms.

Before reading this piece, I didn’t have an opinion on Microsoft’s restructure, nor did I consider it especially significant.

I still don’t have an opinion, but at least I understand why it’s probably going to damage Microsoft in the long-term.

The post stratēchery on Microsoft’s restructure appeared first on luke arms.

He didn’t just have an awesome name.

He was responsible for much of the innovation and vision that saw technology become what it is today.

Vale.

The post Douglas C. Engelbart appeared first on luke arms.

Of course I was fully aware that its $0 price tag made me the product, and that relying on ANY Google service was asking for trouble (Google’s “discontinuation” of useful features and products is legendary). But I hadn’t been able to find an equally compelling RSS reader. As of early 2013, nothing else existed.

Thankfully, a vast array of options have emerged since Google’s announcement, and I’m happily settling in with Feed Wrangler.

My selection criteria?

• Cloud-based, i.e. automatic syncing of feeds and read posts across multiple devices.
• Supported by Reeder and Mr Reader, to enable comfortable reading on my iPhone and iPad. Planned support in these apps was OK if a decent mobile reading interface was provided in the meantime (Feed Wrangler has its own iOS apps, for example).
• Respectable browser-based reader, for when I’m able to catch up while on a desktop/laptop.
• Dead-easy setup, so I can comfortably recommend it to less tech-savvy friends.
• Not free, not expensive. No ads, minimal risk of discontinuation without notice.
• Attractive. Nice mobile app icons, clean branding, intuitive UI.

Based on all of these, I settled on Feed Wrangler. Others have reviewed it in detail (props to Federico Viticci for this especially thorough review), so I won’t do that again here. But if you do switch to Feed Wrangler, bear in mind that your Google Reader folders won’t appear. Similar functionality is available under “Smart Streams”, but you’ll have to create these from scratch.

Still, I’ve been using it for about two weeks and am loving it!

The post Feed Wrangler: my new Google Reader appeared first on luke arms.

While I’m wearing my Google-hating hat, here’s a Daring Fireball piece that adds another piece to the puzzle. My favourite bit:

But those statements from Jobs and Ive are not absurd. If they’re not the absolute truth, they’re at least truthy. Whereas Larry Page’s pablum regarding Google not being pitted against other companies is farcical.

You’ll need to click through for the context.

The post “What rankles about Google is their hypocrisy” appeared first on luke arms.

I’ve been meaning to link to this one for a while. A good article to read if you don’t understand why people like me don’t trust Google. Meanwhile, PRISM has happened. The plot is thickening.

The post “Larry Page wants you to stop worrying and let him fix the world” appeared first on luke arms.

I use cygwin for occasional access to GNU utilities like find, and for rsync-based data replication between computers. Given POSIX permissions don’t map to NTFS permissions, this can be problematic. By default, when cygwin writes to NTFS volumes it replaces any existing NTFS permissions with new ones that replicate the effect of POSIX permissions. This is fine for cygwin-only parts of the filesystem, but if you like your NTFS permissions (including, say, ACL inheritance and propagation) and don’t want them to be butchered, you’ll need to mount your filesystems with the noacl option.

Unfortunately, noacl slows down cygwin’s filesystem operations by a factor of… well, lots. I’ve been enduring this for a while now, but I’m glad to have finally found the cause. With noacl enabled, cygwin can’t efficiently determine the executability of files, so it has to read the first few bytes of each file to figure it out. This slows stat down immensely.

The solution? Add exec, notexec or cygexec to your filesystem mount options. These instruct cygwin to treat every file on the filesystem as executable (or not executable). With this line in /etc/fstab, I’m golden:

none /cygdrive cygdrive binary,posix=0,user,noacl,exec 0 0

The post Mounting local filesystems in cygwin appeared first on luke arms.

It’s pretty much a given that major Microsoft product releases follow the release-first fix-later model these days (e.g. Vista → Windows 7, Windows 8 → Windows 8.1).

Should they adopt Apple’s “don’t-even-announce-it-until-it’s-RTM” approach, or would Google’s “launch-it-in-beta-and-fix-it-on-the-fly” be a better fit?

Click through for Owen Williams’ take on what Microsoft’s current approach is costing them, and what their options are. (via Svbtle)

The post Should Microsoft iterate? appeared first on luke arms.

Another insightful piece from Ben Thompson on the value Google is getting out of Google+, and why its apparent lack of success relative to Facebook and Twitter is just a misunderstanding.

This changed my mind re: G+, and not in a good way.

The post Why Google+ is NOT a failure appeared first on luke arms.

Click through for some enlightening analysis of Google’s pursuit of Android despite their lack of genuine interest in mobile hardware and operating systems. In light of the breadth and length of today’s keynote at Google I/O, this makes a lot of sense:

…now that Android is successful, Google is back to focusing on “the best of Google”.

(via Marco Arment)

The post Android as a “detour” appeared first on luke arms.

Not that I want one. Much.

The post Lumia 920: great phone? With an ad this good, I don’t care. appeared first on luke arms.

App bundles come and go, but this is the first one I’ve actually sprung for, and if you’re a Mac user, you might want to too. I’m picking it up for xScope and Fantastical, but a couple of the other apps look interesting too.

It doesn’t hurt that 10% of bundle sales are donated to charities. And extra apps are unlocked for all purchasers when sales targets are hit.

Clicky clicky!

The post MacHeist $9.99 bundle (not a sponsored post) appeared first on luke arms.

Marco Arment’s take:

The Verge’s headline for this article: “Google changes how it measures Android version adoption, sees uptick in Jelly Bean devices”.

A more accurate title would be: “Google changes how it measures Android version adoption to show an uptick in Jelly Bean devices”.

Stay classy, Google.

The post Number-fudging 101, by Google appeared first on luke arms.