WordPress Not Showing Dialogs

My WordPress installation is generally troubleless. Yes, there was an issue with upgrade or occasional missed post, but nothing that would annoy me too much. Except…

For quite a while I’ve been having trouble with the plugin detail page. Whenever I tried to open one, it would greet me with Refused to connect or something similar (depending on browser and its version). Mind you, everything would work but some annoyance would always linger.

Until one day I accidentally opened it in a separate tab. Wouldn’t you know it, the damn thing worked. That lead me to check console tools where I saw WordPress attempting to use iframe. Quick check of my web server configuration told me I had HTTP header X-Frame-Options set to "deny". To make it simple, I was blocking myself. Change to a slightly more permissive X-Frame-Options="sameorigin" solved it.

Minor issue that I have been ignoring for better part of the year solved by a pure accident. Doesn’t get better than that. :)

LineageOS in the Case of Vendor Image Mismatch

I few days ago, after I updated my Nexus 5x with the latest LineageOS, I was faced with the following message:

A vendor image mismatch has been detected. Typically this means image is out of date. Please ensure your vendor image matches OPM7.181205.00

What this rather scary message essentially tells you is that LineageOS update was built on newer version of your phone’s image than the one you have installed. For me that meant a visit to Google’s firmware page and download of factory image for Nexus 5x.

Assuming one wants to keep LineageOS and not downgrade to the official firmware, we have to go into downloaded zip file and find another zip file within. It’s in that inner file one can find vendor.img.

Place vendor.img in the same folder you already have platform tools in (I just assumed you have one) and get the phone into fastboot. I personally love Advanced restart functionality withing Developer menu and I simply reboot phone by pressing power key a second or two and selecting Bootloader. However, one can also do it from platform tools command prompt:

adb devices
 List of devices attached
 00b94424d9a02666        device

adb reboot bootloader

If there is no device listed at all, make sure you have USB Debugging turned on in the Developer menu.

Once your phone gets into bootloader, we simply need to upload vendor.img followed by a final reboot:

fastboot flash vendor vendor.img
 Sending 'vendor' (190332 KB)                       OKAY [  4.299s]
 Writing 'vendor'                                   OKAY [  3.098s]
 Finished. Total time: 7.431s

fastboot reboot
 Rebooting
 Finished. Total time: 0.009s

Pesky message should be gone until a next vendor image comes along.

Familiar Column Selection in Visual Studio Code

If you ever dealt with any advanced text editor, you are probably aware of column (a.k.a. block selection). You press Shift+Alt and then either use mouse or arrow keys to have a bit unusual block selection. While not needed often, it’s invaluable when it comes to dealing with text in columns.

Visual Studio Code does support it but, of course, there are minor issues. First of all, unlike almost any other editor (including Visual Studio!), shortcut is actually Shift+Ctrl+Alt. Fortunately this can be fixed either by manually remapping key bindings for column selection or by simply installing Visual Studio Keymap extension.

While that sorts out column selection key shortcut, it still leaves one annoying problem - if you move cursor in any direction while multiple lines are selected, you will see multiple cursors move - instead of more usual selection cancellation. Fortunately, you can add a few key bindings in keybindings.json to deal with that issue:

[
    {
        "key": "left",
        "command": "cancelSelection",
        "when": "editorHasMultipleSelections && textInputFocus"
    },
    {
        "key": "right",
        "command": "cancelSelection",
        "when": "editorHasMultipleSelections && textInputFocus"
    },
    {
        "key": "up",
        "command": "cancelSelection",
        "when": "editorHasMultipleSelections && textInputFocus"
    },
    {
        "key": "down",
        "command": "cancelSelection",
        "when": "editorHasMultipleSelections && textInputFocus"
    },
    {
        "key": "pageup",
        "command": "cancelSelection",
        "when": "editorHasMultipleSelections && textInputFocus"
    },
    {
        "key": "pagedown",
        "command": "cancelSelection",
        "when": "editorHasMultipleSelections && textInputFocus"
    }
]

Now you can enjoy block selection that works properly. :)

DRM Exceptions

A few days ago The Library of Congress has published Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies. To make a long document short, you get to bypass a bit of DMCA (Digital Millennium Copyright Act) rules.

Most of the media talk about playing older games and fixing consoles or jail-breaking your phone but that’s not the full scope. For example, there is a security research exception. Without this exception any company ending as butt of a joke could sue the security researcher. And, the way how DMCA was written, they would prevail. Mind you, they still get to sue you, but now their victory is unlikely.

For Nth year in row, these rules also plug a hole in e-book accessibility. For example, without this exception, blind people would depend on the mercy of DRM-protected content producers. With this exception, they can use software of their choice to help them read and, if software has to break DRM to do it, so be it.

Lastly, one important category is fixing your vehicles. Quite a few manufacturers (John Deer comes first to mind but they are not alone) have been using DRM as a way to prevent you from fixing your vehicle yourself. There is quite a lot of revenue to get if you can block those pesky independent repairmen. Well, at least now they cannot use DRM to do this.

However, it’s not all good news as these provisions expire every three years and thus there is always a possibility of “LoC giveth, LoC taketh away” situation in the future. And just having right to DRM circumvention doesn’t mean shit if you still cannot get replacement parts and/or any replacement parts you do obtain are potentially seized.

But it is a good step forward.

Seattle Code Camp - Cryptography Failures

As you read this another Seattle Code Camp talk is behind me and its time to share the slides.

Due to way how I structure my presentations, just slides alone will probably not work for you. However, if you still want to proceed or you were at presentation and you want slides for links and resources contained within, feel free to download them here.

Seattle Code Camp 2018

Registrations for Seattle Code Camp 2018 are open. If you come on September 15th you can hear me speak about cryptography failures. All intention is for this to be a lightweight and funny talk but let’s see how funny crosses the language barrier. :)

If you attend, feel free to say hi, whether you attend my talk or not. :)

Monitoring Certificate Expiration

Once you get Let’s Encrypt certificate setup, there are two more things needed. First one is setting up renewal as our certificates don’t last more than 90 days. The second one is often overlooked - actually monitoring how long before certificate expires. If anything prevents your certificate renewing, you definitely want to know it.

My approach to this problem is introducing an extra step in my daily e-mail report (I will assume here you have one setup already). This bash code will connect to a server, enumerate all certificates within /etc/letsencrypt/ directory, extract their name, and give an extra warning if certificate is expiring in less than 15 days.

Without the further ado, here is the code excerpt:

NOW=`date +%s`

PEMS=`ssh ^^myuser^^@^^myserver.example.com^^ find /etc/letsencrypt/ -name "cert.pem" -print`
for PEM in $PEMS
do
  NAME=`echo $PEM | rev | cut -d'/' -f2 | rev`
  EXPIRY_RAW=`ssh ^^myuser^^@^^myserver.example.com^^ openssl x509 -enddate -noout -in "$PEM" | cut -d= -f 2`
  EXPIRY=`date -jf "%b %d %T %Y %Z" "$EXPIRY_RAW" "+%s"`
  REMAINING=$(( EXPIRY - NOW ))
  REMAINING_DAYS=$(( REMAINING / 86400 ))

  if (( REMAINING_DAYS >= 15 ))
  then
    echo "• $NAME expires in $REMAINING_DAYS days"
  else
    if (( REMAINING_DAYS < 0 ))
    then
      echo "‼ $NAME expiry cannot be determined"
    else
      echo "‼ $NAME expires in $REMAINING_DAYS days"
    fi
  fi
done

Professional C++ (Fourth Edition!)

If you are curious about C++ and the news it brings (yes, development is still much alive) you are in luck. Written by Marc Grégoire and dealing with the 17th edition of C++, you are sure to find something interesting.

This C++ release includes a filesystem API, template argument deduction for constructors, optional values, the variant type, the any type, parallel algorithms, string conversion primitives, nested namespaces, and more. Considering the wide net this edition has casted, you are sure to find something useful for your development.

While C++ is not the easiest language to learn or perfect I found that a lot of examples is extremely helpful to make this medicine go down. And this book does deliver as examples are available for both Windows and Linux. Even better, you can check examples without downloading book. A bit cheeky but excellent way to determine how interested in the book you might be.

Book is published by Wiley/Wrox and available at Amazon.

About Time

As we approach yet another biyearly daylight savings time change, there came a news about politicians actually doing something smart for a change. European Parliament voted to keep the same UTC offset the whole year round. If this decision is followed through, gone are the days of hunt for every clock to update it an hour back or forward before the next change comes.

And yes, of course it is not as simple as turning the daylight change off. First it needs to get to the European Commission that traditionally likes to avoid implementing anything. Then all member states need to agree when to do it. Then decision needs to be postponed multiple times. Then everybody will try to implement the decision at the very last moment. You know, the usual.

However, for the first time in forever there is some hope. I can already see myself talking to my grandchildren about the dark times when people all around the world changed their time by hour (or less - damn you Lord Howe Island), for reasons long forgotten, and at the time every country decided upon themselves.

Grandchildren will probably just say that grandpa is crazy and that this could have never been. And then they will go out to play in the UTC world…

Meltdown and Spectre

It has been a very scary start of the year. We’re only a few days in and world is already falling apart. If you aren’t scared already, it is enough to see a demonstration for Meltdown and Spectre exploits to feel very uncomfortable.

I won’t go into the details as this dreadful exploit family already has a web page with all the information one could desire to know. If that’s not enough, probably every major news outlet has an article or two about it.

In the midst of all this ruckus and panic unfortunately, for most of us, there is nothing to do. Due to the nature of these faults, fix has to be either done in hardware (albeit with some mitigations via microcode update) or in OS kernel of your choice. There is simply nothing application developer can realistically do but wait. Once “big boys” have done their work, there will be a flurry of activity if you need to do some performance testing and that’s it. Explicit regression testing will not be needed as you have it automated to run over night anyhow (wink-wink) and the risk of user code breakage is quite low.

If you are dealing with OS maintenance, you will have a bit more work to do. While some patches are already out, more are still expected, and I trust Murphy will ensure that at least some patches will receive patches of their own. If you are dealing with a cloud environment you will have your work multiplied by a factor but that comes with a saving grace of easily automating stuff across many machines. It will be busy but surmountable.

Those of us who also deal with hardware, I pity. Updating firmware is annoying even when there is no pressure. Generally machine has to go down to even think about it. Then you will try to automate it only to find out that 50% of your blades simply didn’t “take” the update and vendor coolly advises that “it sometime happens” and that you should proceed with manual installation.

And, of course, these servers haven’t had their firmware updated for a while and microcode you want to get will come with bunch of other firmware fixes and changes you don’t want to deal with right now. Tough luck - microcode will not be “backported” to your current version. Just hope it doesn’t change some obscure default causing issue when machine is finally booted up or that you will need to update your pristine 1.0 to some other version before you can even think about getting the latest.

And please don’t think about going home because you’ll see BIOS with microcode update ready in the next few days for your home computer too. For example, my Dell has it for a couple of days now. So you will go updating all personal computers only to discover your wife’s laptop doesn’t boot anymore…

May you live in interesting times, indeed.