Yet another Sony rootkit analysis

F-Secure's description and blog posting. Note that, according to this posting, this is an independent confirmation of Mark Russinovich's analysis that I posted about yesterday and the day before.

(From autographedcat.)

All your guitars are belong to us

Nice hack: a coverpop of every guitar on Amazon (from Music thing)

LISP hackers take note

Public domain LISP logo, available here. (From LWN.)

Days of wine and... lemmings?

If you read this, if your eyes are passing over this right now, even if we don't speak often, please post a comment with a memory of you and me. It can be anything you want, either good or bad. I promise not to come after you with a spatula, either way.

When you're finished, post this little paragraph on your blog and be surprised (or mortified) about what people remember about you.

(From cflute and many others; the wording is said to have come from cadhla.)

Playing with nanoblogger

Spent some time this afternoon installing and playing with nanoblogger -- a reasonably complete command-line blogging package in the form of a shell script. Great fun, though the code is a bit ugly and almost completely uncommented (yeah, I know... it was hard to write, it should be hard to read...).

Things I like

• Installation's a snap: just run nb --blogdir dir --add and you're in $EDITOR looking at a pretty-well-commented configuration file.
• It's built expecting that every user will have at least one blog, maybe more, in different locations and with different configurations.
• It allows for both a local working copy and an uploaded, published copy, and you can specify what command to use for uploading
• It's all stored in flat text files (no database) and all processing is done offline, to generate fast static pages on your website.
• You can re-use parts of the blog as components in other web pages.

Things I don't like

• The only available comment package uses PHP and a database, and doesn't take the local/published dichotomy into account. It's not really integrated as a plugin.
• The lack of a web interface makes it unusable by anyone but a hacker. Works for me, but I wouldn't turn my family or even many of my coworkers loose on it.
• Shell scripting, though it makes for a clever hack, is pretty inefficient.
• I don't really like the choice of representation in the raw data files -- it's tantalizingly close to RFC822 , but different.
• It's not easy to simply create a post as a file directly in Emacs and get it published.

I think nb is going to be OK for an internal, work blog, but it's not what I really need for some of the home projects I'm contemplating. Still, it has a lot of good ideas I can steal research.

The other package I've been looking at, blosxom is also pretty close -- closer in some places, farther in others. The biggest problem, at least in the Debian version, is that it's centralized: all the templates and config files are shared, so there's no good way to give every user a completely separate blog the way you can in nb. (Update 11/3: the combination of the isp and config plugins appears to fix this.)

Looks like I'll be building my own after all.