AMing Blog

Download Google Drive for mac

2012-04-25T10:17:00.001+08:00

The Google Drive is debut and ready for use. Following is the link for the Google Drive installer for mac

http://dl.dropbox.com/u/15969780/installgoogledrive.dmg

Ruby on Rails on CentOS 5.7

2012-02-06T20:15:00.002+08:00

I am trying to deploy a rails application on the CentOS 5.7.

Here is the steps I used to deploy a Rails application on a clean CentOS 5.7. Please comment if you have any suggestions.

Install Prereq Package

yum update -y yum install -y curl curl-devel mysql mysql-server mysql-devel httpd httpd-devel autoconf automake binutils gcc gcc-c++ zlib-devel openssl-devel readline-devel apr-devel apr-util-devel /sbin/chkconfig --levels 235 mysqld on /sbin/chkconfig --levels 234 httpd on

Install Ruby

Step 1: Download

# Source code: version 1.8.7-2011.12 curl -O http://rubyenterpriseedition.googlecode.com/files/ruby-enterprise-1.8.7-2011.12.tar.gz

Step 2: Install

# Extract it: tar xzvf ruby-enterprise-1.8.7-2011.12.tar.gz # Run the installer (completely safe, none of your system files will be touched!): ./ruby-enterprise-1.8.7-2011.12/installer # Simply press Enter if asking for your input

Step 3 Install Passenger

/opt/ruby-enterprise-1.8.7-2011.12/bin/passenger-install-apache2-module # Simply press Enter if asking for your input

Step 4: Make Phusion Passenger use Ruby Enterprise Edition instead of regular Ruby

# Follow the instructions that the Ruby Enterprise Edition installer gave you.

Step 5: Add Ruby enterprise to path

export PATH=/opt/ruby-enterprise-1.8.7-2011.12/bin:$PATH

Reboot

reboot

Deploy the rails app

1. gem install rubygems-update2. update_rubygems
3. gem install sqlite3 -v '1.3.5' 
# create /etc/httpd/conf.d/passenger.conf

# LoadModule passenger_module /opt/ruby-enterprise-1.8.7-2011.12/lib/ruby/gems/1.8/gems/passenger-3.0.11/ext/apache2/mod_passenger.so # PassengerRoot /opt/ruby-enterprise-1.8.7-2011.12/lib/ruby/gems/1.8/gems/passenger-3.0.11
# PassengerRuby /opt/ruby-enterprise-1.8.7-2011.12/bin/ruby 
# 
#  virtualhost *:80="" /virtualhost 
#    ServerName server_name/server_name 
#    DocumentRoot app_dir/public/app_dir 
#    SetEnv rails_env production 
#     directory="" app_dir="" p="" public=""=""/app_dir=""/directory 
#        Allow from all 
#        Options -MultiViews 
#
#

# Place the rails app under 
# Configuration of the database setting. Open the /config/database.yml with editor 
# Change the username and password under the production tag according the database settings 
# For example2: 
# production: 
#  adapter: mysql2 
#  encoding: utf8 
#  database: production 
#  username: 
#  password: 
#  socket: /var/lib/mysql/mysql.sock

Init the rails app

/opt/ruby-enterprise-1.8.7-2011.12/bin/bundle install --no-deployment --without development --without test # Run only if the db is not created and the user has privilege to create database. # RAILS_ENV=production /opt/ruby-enterprise-1.8.7-2011.12/bin/rake db:create RAILS_ENV=production /opt/ruby-enterprise-1.8.7-2011.12/bin/rake db:migrate RAILS_ENV=production /opt/ruby-enterprise-1.8.7-2011.12/bin/rake assets:precompile

# change the permissions of the application's directory chown -R apache:apache  chmod -R u=rw,g=r,o-rwx  chmod -R ug+X  chcon -R -u system_u -t httpd_sys_content_t

restart http server

/etc/init.d/httpd restart

HOWTO: Setup a Pure-FTPd server with virtual users on FreeBSD

2011-08-23T15:54:00.002+08:00

Pure-FTPd

Pure-FTPd is a free (BSD), secure, production-quality and standard-conformant FTP server.

This guide provides instructions for using the virtual user system to manage and control users. By using virtual users, FTP accounts can be administrated without affecting system accounts.

Push commits

Let's initiate Pure-FTPd's installation by entering the following commands:

% su

# portsnap fetch update

# cd /usr/ports/ftp/pure-ftpd

# make config

A menu containing Pure-FTPd options will pop-up. In my case, I've opted to leave these options at their defaults.

# make install clean

# rehash

Having finished the installation process we now move into the configuration stage. We'll start by copying the sample configuration file and set the configuration options:

# cd /usr/local/etc

# cp pure-ftpd.conf.sample pure-ftpd.conf

# chmod 644 pure-ftpd.conf

The chmod command was run to be able to edit the file (default permissions are set to -r--r--r--).

# vi pure-ftpd.conf



VerboseLog yes

PureDB /usr/local/etc/pureftpd.pdb

CreateHomeDir yes

The CreateHomeDir option makes adding virtual users more easy by creating a user's home directory upon login (if it doesn't already exist).

We can either import users with system-level accounts (defined in /etc/master.passwd) at once or create new users manually. To import users that already exist on your system into the virtual user database, enter these commands:

# pure-pwconvert >> /usr/local/etc/pureftpd.passwd

# chmod 600 /usr/local/etc/pureftpd.passwd

# pure-pw mkdb

It should be noted that pure-pwconvert only imports accounts that have shell access. Accounts with the shell set to nologin have to be added manually.

To add users to the Pure-FTPd virtual user database manually, we need to create a system-level account that will be associated with virtual users. Create a new user named vftp like this:

# pw useradd vftp -s /sbin/nologin -w no -d /usr/home/vftp\

? -c "Virtual FTP user" -m

Having done this we can now add users to the virtual users database using the commands below:

# pure-pw useradd user -u vftp -g vftp -d /usr/home/vftp/user

# pure-pw mkdb

Replace user with the desired username. With -d flag, the user will be chrooted. If you want to give user access to the whole filesystem, use -D instead of -d.

If you want to add additional users, just repeat the commands above with a different user.

To remove a user:

# pure-pw userdel user

Now to start Pure-FTPd:

# /usr/local/etc/rc.d/pure-ftpd onestart
Initiate a FTP connection to test the server:

% ftp localhost



Trying 127.0.0.1...

Connected to localhost.

220---------- Welcome to Pure-FTPd [TLS] ----------

220-You are user number 2 of 50 allowed.

220-Local time is now 13:39. Server port: 21.

220-IPv6 connections are also welcome on this server.

220 You will be disconnected after 15 minutes of inactivity.

Name (localhost:username):

Now log in with a user account created as explained above. Commands such as ls, cp, pwd and less work just like in tcsh and bash shells. To quit the FTP session type exit.

To configure Pure-FTPd to start at boot time:

# echo 'pureftpd_enable="YES"' >> /etc/rc.conf
To restart Pure-FTPd and determine if it is running:

# /usr/local/etc/rc.d/pure-ftpd restart

# /usr/local/etc/rc.d/pure-ftpd status

Pure-FTPd provides useful features for personal users as well as hosting providers. I've only touched the tip of the iceberg so do take a look at the project's website for the excellent documentation that is available.

reference: http://forums.freebsd.org/showthread.php?t=591

Task Killers - Helping or Hurting?

2011-07-18T19:36:00.002+08:00

This is, hands down, the most commonly held conversation I have with any new, current, or prospective Android user since the G1. It has occupied space on every forum I have ever been to, and continues to be a staple conversation in the community. So here we go, I am going to do my best to answer this question here and now; Are Task Killing apps helping or hurting our phones?
Task Killers were amongst the first 5,000 apps in the Market, and can be seen in the form of dozens now, all claiming differences in performance and functionality. The basic concept is the same for all of them, being that a list is shows with how much memory each running app is using and a big button to "kill" the running app, in order to free up space to make everything else run faster. The applications do perform this job. The app is halted and memory is freed. For a moment or two anyways. Android was built to handle multi-tasking intelligently, and part of this is resource resolution. I look to Android Engineer Dianne Hackborne for backup.
Applications may seem present to the user without an actual process currently running the app; multiple applications may share processes, or one application may make use of multiple processes depending on its needs; the process(es) of an application may be kept around by Android even when that application is not actively doing something.

So when you kill an application, you are killing all related services, even if those services are being used to help other applications. So, for example, you are trying to download a movie, and you decide the app controlling the download needs more memory, so you kill any apps you arent using. It's possible that, all of a sudden, you will nolonger be downloading your movie, because you unknowingly killed a process handling that download. Make sense?
Before you go there, I know. You have been in the IT field since the lightbulb and you know what tasks you are killing and you know that they are helping and you have never had a problem. Sure, I will admit that if you know exactly what you are doing, and you are just that starved for resources, you can use a Task Killer for some momentary relief of memory. This would be very helpful for someone who felt they required that level of control, except Android already does that. Here's the application life cycle chart!

See? Android already has things built into the life cycle of every application that monitors for whether or not an app needs more memory, and is already prepared to handle any apps not in use. Additionally, applications that are considered "critical" like the Phone app (you do remember that these things make calls right?) will suspend all activity, granting priority to that application. With this evidence, plus the thousands that I have seen who claim that their phones run faster without Task Killers than with them, I feel confident in saying that Task Killing applications can often be more harmful than useful, and I recommend not installing them at all. If you already have one installed, uninstall it for a week, and if what I am saying here is not helpful, write me and let me know!

How to find size of a directory & Free disk space

2011-06-28T11:18:00.000+08:00

'du' - Finding the size of a directory

$ du
Typing the above at the prompt gives you a list of directories that exist in the current directory along with their sizes. The last line of the output gives you the total size of the current directory including its subdirectories. The size given includes the sizes of the files and the directories that exist in the current directory as well as all of its subdirectories. Note that by default the sizes given are in kilobytes.

$ du /home/david
The above command would give you the directory size of the directory /home/david

$ du -h
This command gives you a better output than the default one. The option '-h' stands for human readable format. So the sizes of the files / directories are this time suffixed with a 'k' if its kilobytes and 'M' if its Megabytes and 'G' if its Gigabytes.

$ du -ah
This command would display in its output, not only the directories but also all the files that are present in the current directory. Note that 'du' always counts all files and directories while giving the final size in the last line. But the '-a' displays the filenames along with the directory names in the output. '-h' is once again human readable format.

$ du -c
This gives you a grand total as the last line of the output. So if your directory occupies 30MB the last 2 lines of the output would be

30M .
30M total

The first line would be the default last line of the 'du' output indicating the total size of the directory and another line displaying the same size, followed by the string 'total'. This is helpful in case you this command along with the grep command to only display the final total size of a directory as shown below.

$ du -ch | grep total
This would have only one line in its output that displays the total size of the current directory including all the subdirectories.

Note : In case you are not familiar with pipes (which makes the above command possible) refer to Article No. 24 . Also grep is one of the most important commands in Unix. Refer to Article No. 25 to know more about grep.

$ du -s
This displays a summary of the directory size. It is the simplest way to know the total size of the current directory.

$ du -S
This would display the size of the current directory excluding the size of the subdirectories that exist within that directory. So it basically shows you the total size of all the files that exist in the current directory.

$ du --exculde=mp3
The above command would display the size of the current directory along with all its subdirectories, but it would exclude all the files having the given pattern present in their filenames. Thus in the above case if there happens to be any mp3 files within the current directory or any of its subdirectories, their size would not be included while calculating the total directory size.

-

'df' - finding the disk free space / disk usage

$ df
Typing the above, outputs a table consisting of 6 columns. All the columns are very easy to understand. Remember that the 'Size', 'Used' and 'Avail' columns use kilobytes as the unit. The 'Use%' column shows the usage as a percentage which is also very useful.

$ df -h
Displays the same output as the previous command but the '-h' indicates human readable format. Hence instead of kilobytes as the unit the output would have 'M' for Megabytes and 'G' for Gigabytes.

Most of the users don't use the other parameters that can be passed to 'df'. So I shall not be discussing them.

I shall in turn show you an example that I use on my machine. I have actually stored this as a script named 'usage' since I use it often.

Example :

I have my Linux installed on /dev/hda1 and I have mounted my Windows partitions as well (by default every time Linux boots). So 'df' by default shows me the disk usage of my Linux as well as Windows partitions. And I am only interested in the disk usage of the Linux partitions. This is what I use :

$ df -h | grep /dev/hda1 | cut -c 41-43

This command displays the following on my machine

45%

Basically this command makes 'df' display the disk usages of all the partitions and then extracts the lines with /dev/hda1 since I am only interested in that. Then it cuts the characters from the 41st to the 43rd column since they are the columns that display the usage in % , which is what I want.

GTask v1.0.0

2011-06-02T09:30:00.000+08:00

WebOS client for the Google Task. Keep track of what you need to do. Manage you task list and synchronize with the Google Task.

Have been a WebOS user for a year. I am also a user of the Google Task. I cannot find a good application to synchronize between my Palm pre phone and the Google task. Recently Google has release its Task API for access task list through Restful interface. So I make a WebOS Google Task client. It is easy to use just get the authorization to access the task list by login the Google account. The task will be available as list format on the device.

This is the first version, only have limited functions:

Login to the Google Task for access right.
Get the list of tasks from the Google task.
Remove the task from the list.

Any comments are welcome.

Ref: https://developer.palm.com/appredirect/?packageid=info.xming.gtask

Removing carriage returns from MS-DOS (^M) in VIM

2011-05-12T12:44:00.000+08:00

If you ever try to edit a MS-DOS file, you'll notice that each line ends with a ^M character. This is caused by the funny way that MS-DOS treats the end-of-line. (For some background on this problem take a look at The EOL Story.

Remove the ^M in Vim

To remove the ^M characters from a MS-DOS file, enter the command:

:%/{Ctrl+V}{Ctrl+M}//{Enter}

This command starts with a colon (:) to tell Vim to enter ex mode. All ex start with a line number range, in this case its from the first line (1) to the last ($). The slash indicates the start of the "from text". The {Ctrl+V} tells Vim to treat the next character as a regular character even if it's a special one. The next character is {Ctrl+M}. (This would be treated as {Enter} without the {Ctrl+V}.) The next slash ends the "from text". What follows is the "to text" enclosed by slashes. In this case it's nothing (//).

Not display the ^M

You also can

:set fileformats=dos

It will hide the ^M's, without touching the file.

Using dos2unix

There's a program called dos2unix that should strip those for you. Windows uses different line-ending characters which is why that happens.

dos2unix

Using GIT to Manage Config Files

2011-05-04T10:57:00.002+08:00

One thing I like about GIT, among others, is that it creates a repository locally. This makes simple things easy, still not disallowing complex things.

A good use of GIT is to manage the configuration files in a GNU/Linux system. This article describes the way I do it.

In this example, I will use the Squid proxy/cache server configuration as an example, but the principles apply to any configuration.

Ok, so here are the steps.

Zeroth step is to install GIT. ;-) On Debian/Ubuntu systems, install the "git-core" package.

First create a git repository in /etc/. On Ubuntu systems, you may have to use "sudo", or become root with "sudo -s" before running the following commands.

# cd /etc
# git init

This will create a GIT repository in /etc/.git/. This step needs to be done only once. Any recent version of GIT should accept the "init" command, otherwise run "git init-db".

Now add and commit a file, so GIT will create the "master" branch. We add the "hostname" file in this example.

# git add hostname
# git commit -m "Initial commit." hostname

If you don't use the "-m" option, GIT will start an editor to enter a comment.

I prefer to use three branches.

master: This is the branch that holds the working configuration of the running system.
stock: This branch contains the "default" configuration files as installed.
play: This branch is used for experimenting.

Now that the "master" branch is already created, let's create the other two.

# git branch stock
# git branch play

You can always use "git branch" command to see available branches with active branch highlighted.

In this example, we install Squid, and manage its configuration file /etc/squid/squid.conf using GIT.

Let us switch to the "stock" branch, install Squid, add the config file, commit it, and switch back to the "master" branch. Switching to a branch is called "checking out".

# git checkout stock
# apt-get install squid
# git add squid/squid.conf
# git commit -m "Adding stock config file." squid/squid.conf
# git checkout master

It is always a good idea to switch back quickly to the "master" branch, as we need to keep the "stock" branch clean without any of our changes going there accidentally.

Now you will notice that the "squid/squid.conf" file has gone missing, because we added it in the "stock" branch, not in "master".

To get the config file to the "master" branch, we need to merge it with the "stock" branch.

# git merge stock

I do all my experimenting, however small, in the "play" branch. Before starting an experiment, I switch to the "play" branch and merge it with "master", so both "master" and "play" will be identical at the beginning.

# git checkout play
# git merge master

Now the experimenting begins. I would change the config file, start/restart Squid, and 1001 other things.

During experimenting, it is very useful to view the changes I have done by using the "git diff" command.

Even if the experiments are not successful, I would still commit any partial work to continue later. There is nothing to worry as we are in the "play" branch. Use the "git branch" command to verify this.

# git commit -m "Partially finished experiment." squid/squid.conf

To get the system back to its previous state, we can always switch to the "master" branch.

# git checkout master

Make sure to commit the changes in the "play" branch before checking out the "master" branch. Otherwise, those changes will be lost.

Once the experimenting is successful in the "play" branch, we can merge them to the master branch.

# git checkout master
# git merge play

When backing up the system, make sure you include /etc/.git/ to save the history of your configurations.

Use "git log" to view the history of commits.

Happy gitting!

Managing Multiple Heroku Accounts

2011-04-16T02:15:00.000+08:00

I recently ran into an issue where my personal Heroku account and the owner account of a Heroku app that I was maintaining were different. For those that don’t know, your account is tied to an ssh key which allows you to run privileged commands via terminal. Though you can get most of these commands being a collaborator on a project, you cannot add addons or manage resources. For that you must be the owner. The issue in this situation was the ‘owner’ had no technical skills and was not going to be running commands. Even if he could run these commands, he was paying me to manage the whole process so I needed to act on his behalf. As you can imagine, I don’t want my personal account to ‘own’ his application. So how do you deal with this?

Let’s understand a bit more about how your account is associated. When you install the Heroku gem and run your first command it will ask you to enter your email and password and set your default ssh key before the command is issued. It will store this data into a .heroku/credentials file in your home dir. The problem is you can’t add another email account. One option is to make multiple credential files for each account you want to impersonate. You would then need to change out the file based on what user you want to impersonate. Not ideal.

Luckily someone else has had this problem and wrote up a Heroku add-on. @ddollar created heroku-accounts to manage this for us. The rest of this post is just an explanation of what I ended up doing and his readme is more than sufficient to guide you. What I find curious is Heroku has no official doc on how to tackle this problem though I suspect that will change soon (especially since a couple of my friends work there and will likely add it after reading this).

Install the add-on

heroku plugins:install git://github.com/ddollar/heroku-accounts.git

Next set up your personal account (the one you use for all your side projects, hacking, etc). It will ask you for your email and password.

heroku accounts:add personal

This way of adding an account will require you to tie your ssh key to the account manually. The command gives you an example to put into your ~/.ssh/config file, such as:

Host heroku.personal
HostName heroku.com
IdentityFile /PATH/TO/PRIVATE/KEY
IdentitiesOnly yes

Since you most likely want this account to be your Heroku default run this command:

heroku accounts:default personal

Next up, it’s time to make a new account for your client. In this case because we’re starting fresh you can use the auto option which will generate an ssh key and modify your .ssh config.

heroku accounts:add --auto

It’s going to ask you for an email and password like the first account add. In this case you use your client’s owner email and password. Once in place you can run Heroku commands as owner.

Now whenever you want to act on the behalf of the owner you just need to make sure you’re using the client account such as:

heroku accounts:set

If you want to learn more about the commands this addon has, just ask help:

heroku help

The one command that I haven’t seen that would be nice is a way to see what account you’re acting as. I guess if you aren’t sure you can always use the set command.

I foresee that I will have to act as owner on several Heroku accounts in the near future. Having a way to sanely change accounts is going to be vital. I don’t think I’ll be the only person with this situation. Hope this helps!

Ctrl-S hang Terminal

2011-04-11T19:22:00.000+08:00

It happened to me a lot many times. While working on terminal, sometime the terminal hangs due to pressing Ctrl-S.

Ctrl-S and Ctrl-Q have been around since the days of green-screens and dumb terminals (aka the 80s). Ctrl-S is scroll-lock on, and Ctrl-Q is scroll lock off. This works in a lot of places on a lot of operating systems. Try it when booting or shutting down at a text screen. Chances are Ctrl-S will stop the scrolling messages. When done, press Ctrl-Q to continue.

To resume the terminal press Ctrl-Q.

Use Tmpfs for /tmp

2011-04-09T02:04:00.000+08:00

Add the following line in the /etc/fstab

tmpfs /tmp tmpfs rw,mode=777 0 0

and then run "mount /tmp" or reboot the machine

Ref:
http://wiki.freebsd.org/TMPFS

Using Subversion in FreeBSD

2011-03-24T14:29:00.000+08:00

General Information
Subversion (SVN) is an alternative to using Concurrent Version System (CVS) for collaborative development, though it has other uses if you develop on more than one machine and wish to keep all your work in a central location. This guide will show you how to setup Subversion with Webaccess via the Apache2 mod_dav svn module. If you already use apache 1.3 you can continue to use that, just change the port that apache2 listens on in its httpd.conf file.

Subversion Book is an excellent resource for information outside the scope of this guide.

Requirements

Local root access on the box or be able to su to root.
A SSH client such as puTTy or SecureCRT (if you are setting it up remotely).
A plain text editor, I prefer nano

Installation
We have to start out by building apache2. Because we are building it with the intention of using Subversion with it, we must build it with Berkeley DB (sleepycat) support, as the Subversion filesystem is actually built as a sleepycat database. It is this that allows for the versioning of files.
#
# cd /usr/ports/www/apache2
make install WITH_BERKELEYDB=db42
We make sure that the apache2 aprutil library is known, this file sometimes seems to get "lost"
#
#
# ldconfig -m /usr/local/lib/apache2/
echo "/usr/local/lib/apache2" >> /etc/ld.so.conf
echo "/usr/local/lib/apache2" >> /etc/ld-elf.so.conf
Instruct the Operating System to run apache2 at startup
# echo 'apache2_enable="YES"' >> /etc/rc.conf
Now to build Subversion
#
# cd /usr/ports/devel/subversion
make install -DWITH_MOD_DAV_SVN

Configuration
OK, subversion and apache with berkeley db support are now compiled and installed. You have a choice of either creating a single huge repository for all of your projects, or individual repositories for each. I will detail each now.

General Setup
Create Subversion Home folder
# mkdir -p /usr/home/svn
Create a generic repository format
#
#
# mkdir -p /usr/home/svn/default/trunk
mkdir /usr/home/svn/default/branches
mkdir /usr/home/svn/default/tags
Copy some files will need for the web interface
# cp /usr/ports/devel/subversion/work/subversion-1.0.6/tools/xslt/* /usr/local/www/data-dist/

Note: The path to the tools/xslt will change with versions of subversion so change the subversion-1.0.6 to whatever it is for your version of subversion, ie subversion-1.0.7 or subversion-1.0.8 and so on.
Setup Blanket Access: If you wish to enable htaccess style password login to the subversion repository then use this system. This is the basic access control system, which can be extended to enable per directory access control as well.
#
# mkdir /usr/home/svn/access
touch /usr/home/svn/access/users
Create the users using the htpasswd utility
# htpasswd -mb /usr/home/svn/access/users username password
Configuring Apache2 for Blanket Access control
# nano -w /usr/local/etc/apache2/httpd.conf
Add the following to the httpd.conf file, this can be at the bottom or wherever, it will create a http://www.myservername.com/svn/ URL which you can then access
## SVN WebDAV Repository Setup

DAV svn
SVNParentPath /usr/home/svn/repos
SVNIndexXSLT "http://www.myservername.com/svnindex.xsl"

# anonymous first
Satisfy Any
Require valid-user

# authenticating them valid ones
AuthType Basic
AuthName "Subversion Repositories"
AuthUserFile /usr/home/svn/access/users

This can also be placed inside a virtual host directive

Extending the Blanket Access control to enable Per-Directory Access control
# touch /usr/home/svn/access/control
If you are going to use a single large repository with all your projects in and you wish to allow and deny some users access to certain parts of the repository, then you can setup the control file like this. In this example I will use users with the names of admin, manager (a project manager), commiter, client. The access rules are inheritted, but I will demonstrate how to override an inheritted value. If someone is not mentioned at all within the tree, then they are denied access.
[/]
admin = rw
manager = r

[/bigproject]
manager = rw
commiter = r

[/bigproject/trunk]
commiter = rw
client = r

[/bigproject/branches]
client = r

[/bigproject/trunk/manager_notes]
client =
commiter =
In this file from the very start the admin has full rights to the whole repository, and the manager can read and see all of the projects, but he has full access to the whole of the bigproject folder and the commiter can read the whole of the bigproject folder, all the development is to be kept in trunk so the commiter has full access to that, and the clients might want to be able to get the latest builds of a project, so they can read it. They might also want access to the stable branches, so they are allowed read access to that. Finally, the project manager has some project notes which he doesn't want anyone else to gain access to, so the client and commiter are set to empty permissions which denys them access to that folder. You can also specify general access rights for all by using the '*' and assigning access rights to that.
Now the same again, but using per directory access control on a multiple repository system
[bigproject:/]
admin = rw
manager = rw
commiter = r

[bigproject:/trunk]
commiter = rw
client = r

[bigproject:/branches]
client = r

[bigproject:/trunk/manager_notes]
client =
commiter =
Edit the apache2 config file to use per-directory access control. Find the Blanket Access control Location area and add the below lines just underneath the SVNIndexXSLT
# If we are using the Per-Directory Access Control then we leave this uncommented
# Access Control
AuthzSVNAccessFile /usr/home/svn/access/control
It should look like this
## SVN WebDAV Repository Setup

DAV svn
SVNParentPath /usr/home/svn/repos
SVNIndexXSLT "http://www.myservername.com/svnindex.xsl"

# If we are using the Per-Directory Access Control then we leave this uncommented
# Access Control
AuthzSVNAccessFile /usr/home/svn/access/control

# anonymous first
Satisfy Any
Require valid-user

# authenticating them valid ones
AuthType Basic
AuthName "Subversion Repositories"
AuthUserFile /usr/home/svn/access/users

Building a Single General Repository
Create our single main repository
#
# svnadmin create /usr/home/svn/repos
svn import /usr/home/svn/default file:///usr/home/svn/repos -m "initial import"
Should you later want to divide this repository into project folders, you will need to checkout the whole repository and use the svn move, svn copy and so on commands, which can be found in the Subversion Book

Building a Multiple Project Repository
Make a new repository
#
#
# mkdir /usr/home/svn/repos
svnadmin create /usr/home/svn/repos/projectname
svn import /usr/home/svn/default file:///usr/home/svn/repos/projectname -m "Initial Import"

Final Setup
Make sure that apache can read the svn repositories
# chown -R www:www /usr/home/svn
and make the access control and userlist readable only by apache. All the contents are pretty much encrypted, but you don't want other shell users peeking at them, though they could get through via a php script, but this is the best way to go about it.
#
# chmod 600 /usr/home/svn/access/control
chmod 600 /usr/home/svn/access/users
There, you now have a fully working Subversion Repository. To checkout the contents of the trunk of a project in your repository via the command line tool
# svn checkout http://www.mydomain.com/svn/projectname/trunk projectname
this will make a folder called "projectname" in the current folder you are in when you run the command.

Once you have made changes to a project you can commit those changes by changing into the project folder then
# svn commit -m "Notes regarding the changes"
And finally to update your copy of the code from the repository, change into the project folder then
# svn update
These commands are all for the SVN Command line tool, which is installed as part of the devel/subversion port. If you wish to use the command line tool and not create the files needed for running a repository with apache2, then use
#
# cd /usr/ports/devel/subversion
make install clean
and skip the remaining steps.

There is also a range of clients. The best for Windows, in my opinion, is TortoiseSVN, a comprehensive list of other clients for SVN can be found here

Reference
http://www.bsdguides.org/guides/freebsd/misc/subversion.php

Use a Google Voice Number from Outside the U.S.

2011-01-27T19:34:00.000+08:00

With Google Voice, you can send text messages and place calls to regular phone numbers from the computer or your mobile phone.

Visit the YouTube channel of Google Voice to learn about all the other cool things that you may do with your Google Voice account.

While Google Voice is no longer an invitation-only service, you need to be in the United States (that is, your computer must have a U.S. IP Address) and you must also have a local US phone number in order to activate your Google Voice phone number.

How to Get Google Voice outside the U.S.?
There are however some simple workarounds that will help you enable Google Voice from anywhere outside the USA. I activated Google Voice from India but the same procedure should work with other countries as well.

Step 1: Get a US Phone Number. This process should not take more than five minutes.

Step 2: Download and install Hotspot Shield (make sure you decline the optional toolbar). This is required because you can't sign-in to Google Voice from a non-US I.P. address.

[*] Hotspot Shield may insert audio ads in websites which are annoying but the reason I recommend it is because the software requires no configuration and you can easily disable it with a simple right click.

Step 3: Start Hotspot Shield, if it's not already running on your system, and then visit IP2Location to confirm that your location is listed as "United States." If not, disconnect your current Hotspot Shield session and reconnect to get yourself a new IP Address.

Step 4: Launch the Express Talk softphone software (you may have previously downloaded this software for activating your local US phone number).

Step 5: Open voice.google.com in your web browser and sign-in with your Google account. If you get an error message saying – "Google Voice is not available in your country" – clear your browser cookies and try again.

Use a Google Voice Number from Outside the U.S.
5a. It's time to pick a Google Voice phone number. You may enter a US area code and some word to get a memorable phone number or pick one from the available choices.

5b. Enter a four digit pin for voicemail, accept the Terms and continue.

Use a Google Voice Number from Outside the U.S.
5c. In the next screen, input your local US number that will ring when someone dials your Google Voice number.

Use a Google Voice Number from Outside the U.S.
5d. Click Call Me Now. Google Voice will call your local number and this should ring the Express Talk software. Enter the confirmation code using the dial pad of Express Talk and once it is verified, your Google Voice phone number is ready for use.

Also see: VoIP Services for Making Phone Calls

Next steps – You may download the Google Voice App on your iPhone /Android or access it directly via m.google.com/voice if you have an unsupported mobile phone.

How to Get a US Phone Number

2011-01-27T19:32:00.000+08:00

This tutorial describes how you may easily get your own US phone number from anywhere in the world without spending a penny.

Once you have a US local phone number, your friends and relatives in the US will be able to dial you from their landline or regular cell phones without paying international rates. The calls can be forwarded to your mobile phone or desktop based VoIP softphones (also see: Make phone calls over the Internet).

[*] Skype also offers a service called Skype-In (also known as Online Number) where you can get a local phone number for USA but it costs around $18 for 3 months.
Getting your own USA Phone Number – Step by Step

Step 1: Sign-up for a free account with CallCentric.com and click continue. CallCentric will send you a confirmation mail to verify your email address.

Step 2: Once you’ve verified the email address, provide your city and country code, agree to the terms and conditions and click “Sign me up.”

Step 3: CallCentric will now provide you with a virtual tour of their websites. Skip it and choose – “Go to My CallCentric.” The next screen will list your CallCentric # in the format 1777** – copy that number to the clipboard.

Step 4: Open a new browser tab and go to phone.ipkall.com. Set the account type as SIP and paste the CallCentric # from the clipboard into the field that says SIP Username. The hostname is in.callcentric.com and choose the same email address and password that you used while setting up your CallCentric account.

[*] The default area code for your local US phone number is 253 but you may choose a different one from the drop-down. For this example, I’ll go with 425.

Step 5: Within a minute, you should get an email from ipkall.com with your new local phone number. Keep the email handy as you’ll need it while configuring the SIP client.

Step 6: Now that we have got ourselves a US phone number, let’s activate it.

6a. Download and install Express Talk on your computer. The trial version is good enough for our task. Make sure that you don’t install any of the “optional components” like toolbars, etc. during the setup.

6b. During installation, choose the default options for all the wizard screens. When you are on “SIP Setup,” choose “Yes, I already have a SIP account” and click Next. Fill the SIP details as in Step 4 above. Finish the setup.

6c. Once the setup is complete, go back to your My CallCentric page and refresh it. You should see a notification saying – “your phone is registered.” Done!

Access clipboard from Command Line in Mac X

2011-01-25T16:54:00.000+08:00

It lets you copy text to your clipboard from the command line. This means you can (among other things) copy the contents of a file on a remote server into your clipboard, ready for pasting:

echo 'Hello World!' | pbcopy

Pastes from your clipboard to stdout.

echo `pbpaste`

What can’t you do! Oh, you want examples? Well…

* You could grab the output of a grep/awk/sed to paste into IM/IRC.
* You could use a macro tool (like iKey, QS, et cetera) to create text modifying workflows that grab highlighted text, manipulate it, and replace it inline.
* You could pull changelogs from svn into the clipboard when tagging for release so you could email them to coworkers.

Add blank spacers to the Mac OS X Dock

2011-01-24T00:49:00.000+08:00

You can add blank spacers to the Mac OS X Dock by issuing a defaults write command in the Terminal, you can see the effect in the screenshot above with the space between the Firefox icon and iChat icon.

To get a spacer paste the following command into the Terminal:

defaults write com.apple.dock persistent-apps -array-add '{"tile-type"="spacer-tile";}'

You then must kill and relaunch the Dock to have the spacers appear, you can do this with the following command:

killall Dock

SVN commits fail error- Can't get exclusive lock

2011-01-16T14:41:00.000+08:00

The SVN server is run On the Freebsd server and the subversion repository is NFS mounted. When doing a commit, an error message shown on the svn client:

svn: Can't get exclusive lock on file '/svn/repo/db/transactions/7802-2.txn/rev-lock': No locks available

The problem finally is solved by running rpc.lockd(8) and rpc.statd(8). on the svn server and the nfs server.

To enable rpc.lock and rpc.stat by adding the following to the /etc/rc.conf:

rpc_lockd_enable="YES"
rpc_statd_enable="YES"

Start the application by restarting the machines or using:

# /etc/rc.d/lockd start
# /etc/rc.d/statd start

Reference:
http://www.freebsd.org/doc/handbook/network-nfs.html

Growl Notification from iTerm 2

2011-01-04T14:06:00.004+08:00

The iTerm 2 project has been around for a while, but it recently caught my attention again as development has become very active recently. Recent versions of iTerm support Growl notifications which is one of my favorite feature.

To enable the Growl notification, Go to Preferences->AdvancedSettings, Check the Enable Growl notifications.

To initiate Growl events from the command line in iTerm with:

echo $'\e]9;Growl Notification\007'

The example shows how to get an alert after a long make. I know I would never remember that command so I wrote a little Bash user defined function to do the same. Add this to ~/.bash_profile file:

growl() { echo -e $'\e]9;'${1}'\007' ; return ; }

Now the command to initiate a notification would be:

make; growl "make done"

Reference:
http://sites.google.com/site/iterm2home/
http://code.google.com/p/iterm2/
http://widgetterm.sourceforge.net/

WD Advanced Format Drive speed issues on ZFS

2010-12-27T14:18:00.000+08:00

Why change to 4096-byte sectors?

If you're familiar with disk structure, you know that disks are broken down into sectors, which are normally 512 bytes in size; all read or write operations occur in multiples of the sector size. When you look closer, hard disks actually include a great deal of extra data in between sectors. These extra bytes are used by the disk's firmware to detect and correct errors within each sector. As hard disks grow larger, the result is that more and more data must be stored on each square centimeter of disk, resulting in more low-level errors, thus straining the firmware's error correction capabilities.
One way around this problem is to increase the sector size from 512 bytes to a larger value, enabling more powerful error-correction algorithms to be used. These algorithms can use less data on a per-byte basis to correct for more serious problems than is possible with 512-byte sectors. Thus, changing to a larger sector size has two practical benefits: improved reliability and greater disk capacity—at least in theory.

Why are there performance effects?
Unfortunately, changing the apparent sector size in firmware can degrade performance. To understand why, you should understand something about file system data structures and how partitions are placed on the hard disk.
Most modern file systems use data structures that are 4096 bytes or larger in size. Thus, most disk I/O operations are in multiples of this amount. Consider what happens when Linux wants to read or write one of these data structures on a new disk with 4096-byte sectors. If the file system data structures happen to align perfectly with the underlying physical partition size, a read or write of a 4096-byte data structure results in a read or write of a single sector. The hard disk's firmware doesn't need to do anything extraordinary; but when the file system data structures do not align perfectly with the underlying physical sectors, a read or write operation must access two physical sectors. For a read operation, this takes little or no extra time because the read/write head on the disk most likely passes over both sectors in succession, and the firmware can simply discard the data it doesn't need. Writes of misaligned data structures, on the other hand, require the disk's firmware to first read two sectors, modify portions of both sectors, and then write two sectors. This operation takes longer than when the 4096 bytes occupy a single sector. Thus, performance is degraded.
How can you tell if your data structures are properly aligned? Most file systems align their data structures to the beginning of the partitions that contain them. Thus, if a partition begins on a 4096-byte (8-sector) boundary, it's properly aligned. Unfortunately, until recently, most Linux partitioning tools did not create partitions aligned in this way. The upcoming section, Aligning partitions, describes how to do the job with common Linux partitioning software.

How to fix in ZFS
So, what does this have to do with ZFS? ZFS doesn’t have a pre-set block size. It uses variable sized blocks depending on the amount of data it is writing. If it’s writing 1000 bytes, then it will write the minimum number of sectors necessary to fit that data, which in the case of 512-byte sectors, is 2. This means that writing 1000 bytes requires reading and writing 4096 bytes or maybe 8192 depending on alignment. This means that properly aligning the partition will not solve the issue with ZFS. Here we need a different solution.

How to fix in ZFS
There is a hack to force zpool creation with minimum sector size equal to 4k:

%gnop create -S 4096 ${DEV0}
%zpool create tank ${DEV0}.nop
%zpool export tank
%gnop destroy ${DEV0}.nop
%zpool import tank

Zpool created this way is much faster on problematic 4k sector drives
which lies about its sector size (like WD EARS). This hack works perfectly
fine when system is running. Gnop layer is created only for "zpool create"
command -- ZFS stores information about sector size in its metadata. After
zpool creation one can export the pool, remove gnop layer and reimport the
pool. Difference can be seen in the output from the zdb command:

- on 512 sector device (2**9 = 512):

%zdb tank |grep ashift
ashift=9

- on 4096 sector device (2**12 = 4096):

%zdb tank |grep ashift
ashift=12

This change is permanent. The only possibility to change the value of
ashift is: zpool destroy/create and restoring pool from backup.

Reference:
http://www.ibm.com/developerworks/linux/library/l-4kb-sector-disks/
http://hardforum.com/showthread.php?t=1546137
http://www.nexentastor.org/boards/1/topics/1318
http://kerneltrap.org/mailarchive/freebsd-fs/2010/12/21/6885750
http://www.cod3r.com/2010/06/zfs-on-western-digital-ears-drives/

Gem for ruby in Cygwin

2010-12-03T17:46:00.002+08:00

don't try to install rubygems for cygwin using the gem that comes with the ruby one-click installer for windows. instead, get the tarball, or zip file, and install it using the included installer script.

since rubygems is pure ruby you don't have to worry about having a compiler installed. it should just work with the default cygwin install plus ruby and its dependencies. to install it, do the following steps:

download the rubygems tarball from ruby forge
unpack the tarball
in a bash terminal, navigate to the unpacked directory
run the following command:
ruby setup.rb install
update rubygems by running the following:
gem update --system
note: you may need to run the updated command twice if you have any previously installed gems.

Setting Gmail account in Alpine

2010-11-17T01:07:00.001+08:00

On 2007 October 24 Google started supporting IMAP access to Gmail (Google Mail). To use Pine to access and manage your Gmail messages, type MSLA (Main> Setup> collectionLists> Add) and add a collection like this:

Nickname  : Gmail                                             
Server    : imap.gmail.com/ssl/user=id@gmail.com                                                       
Path      :                                                                                                                 
View      :

where the Nickname is anything you like and id@gmail.com is replaced by your Gmail or Google Apps sign-in ID.

Creating the role

Now that you’ve configured your collection list, Alpine will now be able to fetch email from your Gmail account. To send mail, you need to create a role. From the main menu, press ‘S’ to enter the setup screen. Press ‘R’ and then ‘R’ again to get to the role rules screen. Press ‘A’ to create a rule. Give it nickname, and then set “Current Folder Type” to Specific. Highlight “Folder List”, press ‘T’ and then navigate to your Gmail inbox. Press return/enter to add it to the folder list.

That’s the most complicated part. Now, scroll down to the “Actions begin here” section. Change the Set From field to something like this:

'John Doe'

Change the name to your name and the email address to your Gmail address. Once that’s done, edit the Use SMTP Server field:

smtp.gmail.com:587/tls/user=your_name@gmail.com

Again, change the email address to your Gmail address. Before saving and quitting the screen, make sure that all the options in the “Uses begin here” section are marked “With confirmation”.

Gmail's IMAP server is different, as is Gmail's POP server, which is discussed in POPping Gmail is Different below. To successfully use Pine to access and manage your Gmail IMAP collection, I recommend that you do the following.

Important: Read the Gmail Help article about How do actions sync in IMAP?
Keep in mind that...

Each Gmail folder that you see in your Pine Gmail collection is actually a Gmail label.
All your non-spam non-trash messages are in the [Gmail]/All Mail special folder.
Each non-spam non-trash message can appear in multiple folders.
To put a message in multiple folders, use Pine's Save (S) command multiple times. Be careful about whether you copy or move the message. Pine's Save ^R subcommand is a toggle that controls whether or not the message isRemoved from the current folder after the Save is done.
When you use Pine to "Delete" (D) a non-spam non-trash message, the Gmail IMAP server immediately deletes & expunges the message from the current folder, but it will still be in the [Gmail]/All Mail special folder and any other folders that it happens to be in.
To "archive" a message that is in your Gmail INBOX, use the Pine D command to Delete it from the INBOX. It will still be archived in [Gmail]/All Mail. Tip: When accesssing your Gmail INBOX with Pine, you can think of D as meaning Done (but don't think this way in non-Gmail folders!).
When you use Pine to "Delete" (D) a message in the [Gmail]/All Mail special folder, the command is ignored.
To delete a message from all the folders it is in, including the special [Gmail]/All Mail folder, use Pine's Save (S) command to move or copy the message to the [Gmail]/Trash special folder.
When you use Pine to "Delete" (D) a message in either the [Gmail]/Trash or the [Gmail]/Spam special folder, the message is immediately deleted & expunged and cannot be recovered.
To search all your non-spam non-trash Gmail messages, open the [Gmail]/All Mail folder and use Pine's Select (;) command and other aggregate operations to zoom (Z) in on the search results.
Pine folder means Gmail label!

Type MSC (Main > Setup > Config) and use the following configuration settings.
```
:
incoming-archive-folders       = 
 :
read-message-folder            =   
 :
[ ]  auto-move-read-msgs
 :
[X]  save-will-not-delete
 :
pruning-rule =
               (*)  don't rename, don't delete  
 :
```
The first three settings and the last (pruning-rule) setting prevent Pine from trying to archive messages in a non-Gmail way (see #2f above for the Gmail way of archiving). The first three settings also work around a Gmail bug that causes Pine to complain about "Message to save shrank!" [subscription to the Alpine-alpha list is required to view this link].

The fourth setting, save-will-not-delete, makes it easier to save a message in multiple folders (discussed in #2d above) and makes it less likely that you will misplace a message and need to go hunting for it in the[Gmail]/All Mail special folder.
You might want to set up incoming-folders (Pine shortcuts) for your frequently used Gmail folders.

Notes:

The Gmail special folders reside in [Gmail]/ on some accounts and in [Google Mail]/ in other accounts. The name of this directory depends on whether the "Gmail" trademark belongs to Google in the account-holder's country.
The Gmail IMAP server does not support many of the standard system IMAP flags. For example:
- The \Answered flag and the \Recent flag are not supported in any Gmail folder.
- The \Deleted flag is not supported in the [Gmail]/All Mail folder and is supported in a non-standard way in other folders (as discussed in #2e, 2f, 2g, and 2i above). On a standard (non-Gmail) IMAP server, a message with the \Deleted flag is not actually deleted until it is expunged (X command in Pine). For details, see The IMAP Way of Deleting a Message at Deflexion.com and Saving Your Trash below, which discusses Pine's expunge-only-manually feature.
The Gmail IMAP server does not support user-defined IMAP flags (IMAP keywords), which are discussed in Setting Up Keywords (Labels) below.

See Also:

Google Help > Gmail Help > IMAP Access
Wired.com : Software : Web Services : IMAP, YouMAP, WeMAP: Mail Protocol's Proponents Argue for Better Support by Paul Adams, which includes some quotes by me about Gmail and IMAP :-)
POPping Gmail is Different and Gmail Tips below

蘋果Apple CEO賈伯斯Steve Jobs 對史丹佛畢業生演講

2010-10-29T23:36:00.025+08:00

今天，很榮幸來到各位從世界上最好的學校之一畢業的畢業典禮上。
我從來沒從大學畢業過，說實話，這是我離大學畢業最近的一刻。
今天，我只說三個故事，不談大道理，三個故事就好。

第一個故事是關於人生中的點點滴滴如何串連在一起。

我在里德學院（Reed College）待了六個月就辦休學了。
到我退學前，一共休學了十八個月。那麼，我為什麼休學？（聽眾笑）這得從我出生前講起。
我的親生母親當時是個研究生，年輕未婚媽媽，她決定讓別人收養我。
她強烈覺得應該讓有大學畢業的人收養我，所以我出生時，她就準備讓我被一對律師夫婦收養。
但是這對夫妻到了最後一刻反悔了，他們想收養女孩。
所以在等待收養名單上的一對夫妻，我的養父母，在一天半夜裡接到一通電話，問他們
「有一名意外出生的男孩，你們要認養他嗎？」
而他們的回答是「當然要」。
後來，我的生母發現，我現在的媽媽從來沒有大學畢業，我現在的爸爸則連高中畢業也沒有。
她拒絕在認養文件上做最後簽字。直到幾個月後，我的養父母保證將來一定會讓我上大學，她的態度才軟化。
十七年後，我上大學了。但是當時我無知地選了一所學費幾乎跟史丹佛一樣貴的大學（聽眾笑），我那工人階級的父母將所有積蓄都花在我的學費上。
六個月後，我看不出唸這個書的價值何在。那時候，我不知道這輩子要幹什麼，也不知道唸大學能對我有什麼幫助，只知道我為了唸這個書，花光了我父母這輩子的所有積蓄。
所以，我決定休學，相信船到橋頭自然直。
當時這個決定看來相當可怕，可是現在看來，那是我這輩子做過最好的決定之一。（聽眾笑）

當我休學之後，我再也不用上我沒興趣的必修課，把時間拿去聽那些我有興趣的課。這一點也不浪漫。
我沒有宿舍，所以我睡在友人家裡的地板上，靠著回收可樂空罐的退費五分錢買吃的。
每個星期天晚上得走七哩的路，繞過大半個鎮去印度教的 Hare Krishna 神廟吃頓好料，我喜歡 Hare Krishna 神廟的好料。
就這樣追隨我的好奇與直覺，大部分我所投入過的事務，後來看來都成了無比珍貴的經歷（And much of what I stumbled into by following my curiosity and intuition turned out to be priceless later on ）。
舉個例來說。當時里德學院有著大概是全國最好的書寫教育。
校園內的每一張海報上，每個抽屜的標籤上，都是美麗的手寫字。
因為我休學了，可以不照正常選課程序來，所以我跑去上書寫課。我學了 serif 與 sanserif 字體，
學到在不同字母組合間變更字間距，學到活字印刷偉大的地方。
書寫的美好、歷史感與藝術感是科學所無法掌握的，我覺得這很迷人。
我沒預期過學這些東西能在我生活中起些什麼實際作用，不過十年後，當我在設計第一台麥金塔時，我想起了當時所學的東西，所以把這些東西都設計進了麥金塔裡，這是第一台能印刷出漂亮東西的電腦。
如果我沒沉溺於那樣一門課裡，麥金塔可能就不會有多重字體跟等比例間距字體了。
又因為 Windows抄襲了麥金塔的使用方式（聽眾鼓掌大笑）。
因此，如果當年我沒有休學，沒有去上那門書寫課，大概所有的個人電腦都不會有這些東西，印不出現在我們看到的漂亮的字來了。
當然，當我還在大學裡時，不可能把這些點點滴滴預先串連在一起，但在十年後的今天回顧，一切就顯得非常清楚。
我再說一次，你無法預先把點點滴滴串連起來；
只有在未來回顧時，你才會明白那些點點滴滴是如何串在一起的（you can't connect the dots look-ing forward; you can only connect them looking backwards ）。
所以你得相信，眼前你經歷的種種，將來多少會連結在一起。
你得信任某個東西，直覺也好，命運也好，生命也好，或者業力。
這種作法從來沒讓我失望，我的人生因此變得完全不同。（ Jobs停下來喝水）

我的第二個故事，是有關愛與失去。

我很幸運－年輕時就發現自己愛做什麼事。我二十歲時，跟 Steve Wozniak在我爸媽的車庫裡開始了蘋果電腦的事業。
我們拚命工作，蘋果電腦在十年間從一間車庫裡的兩個小夥子擴展 !
成了一家員工超過四千人、市價二十億美金的公司。
在那事件之前一年推出了我們最棒的作品－麥金塔電腦（ Macintosh），那時我才剛邁入三十歲；然後，我被解僱了。
我怎麼會被自己創辦的公司給解僱了？（聽眾笑）
嗯，當蘋果電腦成長後，我請了一個我以為在經營公司上很有才幹的傢伙來，他在頭幾年也確實幹得不錯。
可是我們對未來的願景不同，最後只好分道揚鑣，董事會站在他那邊，就這樣在我 30歲的時候，公開把我給解僱了。
我失去了整個生活的重心，我的人生就這樣被摧毀。
有幾個月，我不知道要做些什麼。
我覺得我令企業界的前輩們失望－我把他們交給我的接力棒弄丟了。
我見了創辦 HP的 David Packard跟創辦Intel的 Bob Noyce，跟他們說很抱歉我把事情給搞砸了。
我成了公眾眼中失敗的示範，我甚至想要離開矽谷。
但是漸漸的，我發現，我還是喜愛那些我做過的事情，在蘋果電腦中經歷那些事絲毫沒有改變我愛做的事。
雖然我被否定了，可是我還是愛做那些事情，所以我決定從頭來過。當時我沒發現，但現在看來，被蘋果電腦開除，是我所經歷過最好的事情。
成功的沉重被從頭來過的輕鬆所取代，每件事情都不那麼確定，讓我自由進入這輩子最有創意的年代。
接下來五年，我開了一家叫做 NeXT 的公司，又開一家叫做 Pixar 的公司，也跟後來的老婆（Laurene）談起了戀愛。
Pixar接著製作了世界上第一部全電腦動畫電影，玩具總動員（Toy Story），現在是世界上最成功的動畫製作公司（聽眾鼓掌大笑）。
然後，蘋果電腦買下了 NeXT，我回到了蘋果，我們在 NeXT發展的技術成了蘋果電腦後來復興的核心部份。
我也有了個美妙的家庭。
我很確定，如果當年蘋果電腦沒開除我，就不會發生這些事情。
這帖藥很苦口，可是我想蘋果電腦這個病人需要這帖藥。
有時候，人生會用磚頭打你的頭。不要喪失信心。
我確信我愛我所做的事情，這就是這些年來支持我繼續走下去的唯一理由
（I'm convinced that the only thing that kept me going was thatI loved what I did）。
你得找出你的最愛，工作上是如此，人生伴侶也是如此。
你的工作將佔掉你人生的一大部分，唯一真正獲得滿足的方法就是做你相信是偉大的工作，而唯一做偉大工作的方法是愛你所做的事（ And the only way to do great work is to love what you do ）。
如果你還沒找到這些事，繼續找，別停頓。盡你全心全力，你知道你一定會找到。而且，如同任何偉大的事業，事情只會隨著時間愈來愈好。所以，在你找到之前，繼續找，別停頓。（聽眾鼓掌， Jobs喝水）

我的第三個故事，是關於死亡。

當我十七歲時，我讀到一則格言，好像是「把每一天都當成生命中的最後一天，你就會輕鬆自在。（ If you live each day as if it was your last, someday you'll most certainly be right ）」（聽眾笑）這對我影響深遠，在過去 33 年裡，我每天早上都會照鏡子，自問：「如果今天是此生最後一日，我今天要做些什麼？」
每當我連續太多天都得到一個「沒事做」的答案時，我就知道我必須有所改變了。提醒自己快死了，是我在人生中面臨重大決定時，所用過最重要的方法。
因為幾乎每件事－所有外界期望、所有的名聲、所有對困窘或失敗的恐懼－在面對死亡時，都消失了，只有最真實重要的東西才會留下（ Remember-ing that I'll be dead soon is the most important tool I've ever encountered to help me make the big choices in life. Because almost everything - all external expectations, all pride, all fear of embarrassment or failure - hese things just fall away in the face of death, leaving only what is truly important ）。
提醒自己快死了，是我所知避免掉入畏懼失去的陷阱裡最好的方法。
人生不帶來、死不帶去，沒理由不能順心而為。
一年前，我被診斷出癌症。我在早上七點半作斷層掃瞄，在胰臟清楚出現一個腫瘤，我連胰臟是什麼都不知道。
醫生告訴我，那幾乎可以確定是一種不治之症，預計我大概活不到三到六個月了。
醫生建議我回家，好好跟親人們聚一聚，這是醫生對臨終病人的標準建議。
那代表你得試著在幾個月內把你將來十年想跟小孩講的話講完。
那代表你得把每件事情搞定，家人才會儘量輕鬆。
那代表你得跟人說再見了。
我整天想著那個診斷結果，那天晚上做了一次切片，從喉嚨伸入一個內視鏡，穿過胃進到腸子，將探針伸進胰臟，取了一些腫瘤細胞出來。
我打了鎮靜劑，不醒人事，但是我老婆在場。她後來跟我說，當醫生們用顯微鏡看過那些細胞後，他們都哭了，因為那是非常少見的一種胰臟癌，可以用手術治好。
所以我接受了手術，康復了。（聽眾鼓掌）
這是我最接近死亡的時候，我希望那會繼續是未來幾十年內最接近的一次。
經歷此事後，我可以比先前死亡只是純粹想像時，要能更肯定地告訴你們下面這些：
沒有人想死。即使那些想上天堂的人，也想活著上天堂。（聽眾笑）
但是死亡是我們共同的終點，沒有人逃得過。
這是註定的，因為死亡很可能就是生命中最棒的發明，是生命交替的媒介，送走老人們，給新生代開出道路。
現在你們是新生代，但是不久的將來，你們也會逐漸變老，被送出人生的舞台。抱歉講得這麼戲劇化，但是這是真的。
你們的時間有限，所以不要浪費時間活在別人的生活裡。
不要被教條所侷限-- 盲從教條就是活在別人思考結果裡。
不要讓別人的意見淹沒了你內在的心聲。
最重要的，擁有追隨自己內心與直覺的勇氣，你的內心與直覺多少已經知道你真正想要成為什麼樣的人（have the courage to follow your heart and intuition. They somehow already know what you truly want to become），任何其他事物都是次要的。（聽眾鼓掌）
在我年輕時，有本神奇的雜誌叫做《Whole Earth Catalog》，當年這可是我們的經典讀物。
那是位住在離這不遠的 Menlo Park 的 Stewart Brand發行的，他把雜誌辦得很有詩意。
那是 1960年代末期，個人電腦跟桌上出版還沒出現，所有內容都是打字機、剪刀跟拍立得相機做出來的。
雜誌內容有點像印在紙上的平面 Google，在Google 出現之前35年就有了：
這本雜誌很理想主義，充滿新奇工具與偉的見解。
Stewart 跟他的團隊出版了好幾期的《Whole Earth Catalog》，然後很自然的，最後出了停刊號。當時是 1970 年代中期，我正是你們現在這個年齡的時候。在停刊號的封底，有張清晨鄉間小路的照片，那種你四處搭便車冒險旅行時會經過的鄉間小路。
在照片下印了行小字：

求知若飢，虛心若愚（Stay Hungry , Stay Foolish）。

那是他們親筆寫下的告別訊息，我總是以此自許。
當你們畢業，展開新生活，我也以此祝福你們。

Understanding Network Interfaces

2010-10-25T14:48:00.002+08:00

VLAN and bridging concepts

Basics

Before getting too far into the details, it's important to know what VLANs are and how they work.

A VLAN (Virtual LAN) is, in basic terms, a group of physical interfaces on a switch that behave as if they are a separate standalone switch. This allows us to use one physical switch, but partition it into multiple LANs, each one completely isolated from the others. The switch must support VLAN configurations - most cheap switches don't allow this, but high end manageable switches do, as does the internal switch on the OpenWRT.

VLANs are used when you need to separate traffic between groups of devices, but you only want to use one physical switch. For example you might want one VLAN outside your firewall, for public web/mail servers, and another VLAN for your internal machines such as desktops and boxes with private data. They can't be placed on the same LAN for security reasons, so you use VLANs to isolate the groups of ports.

Let's say we have a 10 port switch, and we configure ports 1-5 as VLAN1 and 6-10 as VLAN2. All devices which are plugged into ports 1 thru 5 behave as if they are on their own switch, and devices in ports 6-10 act as if they're in another switch. The main rule is that communication between ports on separate VLANs is blocked - even if you configure devices with the same subnet, they will not be reachable to devices in other VLANs.

And of course, it's also possible to configure it differently - if you later decide you need to put another device in VLAN1 and you've only used 4 ports in VLAN2, you can reconfigure _any_ of the VLAN2 ports into VLAN1 (not just port 6). So then you might end up with VLAN1 as ports 1-5 and 8, and VLAN2 as ports 6,7,9,10.

The number of VLANs that you can configure on any OpenWRT device is only limited by the number of ports.

The subject of VLANs can get very complicated and extensive, but this quick summary covers what's needed for using VLANs on the OpenWRT platform.

VLAN Trunking

If you have a switch with multiple VLANs, you may want to attach a device (such as another switch) that needs to talk to more than one VLAN. This could be a firewall, which will take packets from one VLAN, filter them, then pass them to another VLAN. Alternatively, you might have a second switch that has the same two VLANs on them, and you want the two switches to exchange packets between each other for both VLANs, whilst maintaining the separation.

Rather than wasting ports by using separate ports per VLAN, we use a process known as trunking. One port on the switch must be configured as a trunk port, and this port will have connectivity to all VLANS for which it's set to be a trunk port. If you have a switch with 3 VLANs, you can configure one (or more) trunk port(s) to have connectivity to all VLANs, or just a subset of the VLANs.

How does the switch maintain isolation with this port? This is done with "tagging". Every packet sent or received from the trunk port has a little tag attached to it, indicating what VLAN it is for or from. So a device receiving packets looks at the tag to see what VLAN that packet is from. When the device sends traffic to the switch, it will add a tag itself, and the switch will look at the tag and send the packet to the VLAN indicated.

In the example of an attached firewall, a packet coming in from the internal LAN will be sent out the trunk port to the firewall, tagged with the internal VLAN number. The firewall will process the packet, then send it back to the switch with a tag for the external VLAN, and the switch will look at this tag and send it to the outside device.

You can see that a device such as a firewall will see each separate VLAN as if it's a different network interface. The internal VLAN is like a NIC on the inside of the network, and the external interface behaves just like a NIC on the outside. Because of this, most hosts and firewalls that support VLAN tags are setup such that each VLAN tag is as if it was another separate network interface, even though it's the same physical wire.

Bridging

In networking, a bridge is a link between two ethernet interfaces in such a way as to link them together to the same LAN. If you have a box with two bridged ethernet interfaces, then connect each interface to separate switches, the two switches are effectively linked together as if they're connected with a cable. You can also link together a wired ethernet interface with a wireless interface - the two are then linked together, much like a wireless AP or bridge.

One useful feature of bridging is that the Linux box which is doing the bridging can listen to and send its own traffic. It does this by creating another interface. If you link eth0 and eth1, they will be bound to an interface br0 (or br1, etc). You can then assign an IP address to br0 and it will behave like a normal network interface attached to this bridged network. You cannot configure an IP address on the bridge members (eth0 or eth1), it needs to be done on the bridge interface.

This knowledge of bridges is important below.

Interfaces under OpenWRT

Architecture

An OpenWRT box is actually three devices in one. It consists of a VLAN-configurable switch, a wireless port, and a Linux host. The switch and host are connected by one internal "wire", over which VLAN tagged packets are exchanged. All of the physical ethernet ports on the box are just ports on a single internal switch. VLANs are then used to separate the ports into groups. The diagram below shows the architecture.

By default, the switch is partitioned into two VLANs. Port 0 is configured as VLAN1, and this is labelled on the case as WAN. Ports 1-4 are configured as VLAN0, labelled on the case as LAN1-4. If you wanted, you could actually configure the WAN port as a LAN port, and a LAN port as the WAN port - the label on the chassis simply shows the WAN port in the default config.
See http://en.wikipedia.org/wiki/IEEE_802.1Q#Native_VLAN The native vlan is not tagged. Only the second VLAN needs to be tagged to separate the two data streams.

There is an internal port, Port 5, which has a VLAN-tagged connection into the Linux internals. This port is linked to 'eth0' on the Asus WL-500gP. 'eth0' is not configured with an IP address - the kernel takes the raw packets from eth0 and using the VLAN tags, it sorts the packets from VLAN0 and VLAN1. Packets to/from VLAN1 are then mapped to a logical interface called 'vlan1', and packets to/from VLAN0 are mapped to a logical interface called 'vlan0'.

There is another channel that's not shown here, which is used to configure the switch itself. The link used to send this configuration is not shown, and is a separate logical device under Linux.

Under OpenWRT, the vlan1 interface is then usually configured with the WAN ip address, and all configuration that applies to theWAN interface (eg iptables rules and routes) are applied to the vlan1 interface.

The vlan0 interface is done a bit differently. By default, the wifi interface (eth2) is bridged to the LAN ports, ie any host associated on the wireless port is automatically in the same VLAN/subnet as hosts on the LAN ports. This is done with bridging (see above). As described above, when a bridge is created, a new logical interface is created, called br0, and also as above, this br0 interface is the one that needs to have any IP address configured. So, by default, vlan0 does not have an IP address configured, instead, the LAN interface address is configured on the br0 interface.

There's also another interface visible from the shell - "eth1". This doesn't appear to be linked to anything, and is probably an unused wire on the ethernet controller, so it's ignored in all configuration. Pretend it doesn't exist. :) This is the case on the Asus WL-500gP, it may differ on other models

Interface configuration

With a knowledge of how interfaces are partitioned, it's now easier to understand how to configure interfaces under OpenWRT.

The following block configures the physical ports into VLANS:

vlan0hwname=et0
vlan0ports="1 2 3 4 5*"
vlan1hwname=et0
vlan1ports="0 5*"

The "hwname" part is always "et0". The device "et0" is the switch itself and tells the system which switch to configure with VLANS. As there's only one switch, this must always be set to "et0". If you do not include port 5 in the VLAN then the traffic will remain on the switch and will never be seen by the cpu.

The ports then are configured. The vlan0 (LAN) is configured with four ports, plus the internal tagged port, port 5. The vlan1 (WAN) is configured with only the one port, plus also the tagged port.

This configuration then gives us "vlan1", tied to the WAN port, and "vlan0" tied to the other ports. As mentioned earlier, you can change any other port to be the WAN port - just set the vlan1 port to be something else, not that you really need to!

Vlan 1, which connections the WAN port to the CPU, is then configured with an IP address and mapped to the logical 'wan' interface name:

wan_ifname=vlan1
wan_ipaddr=a.b.c.d
wan_netmask=255.255.255.0
wan_proto=static

Next the LAN side is configured. The bridge must be created and the IP address is assigned to the bridge not a vlan, but overall it's similar:

lan_ifname=br0
lan_ifnames="vlan0 eth2"
lan_proto=static
lan_ipaddr=w.x.y.z
lan_netmask=255.255.255.0

The variable "lan_ifname", which sets the actual interface to configure the IP parameters with, should of course be br0 for a bridged interface. Then the variable "lan_ifnames" actually sets the interfaces which are to be bound to the bridge interface, in this case the vlan0 interface and the wireless interface. The vlan0 ports were defined earlier as wired ports 1-4, so these plus the wireless interface are now one single logical LAN.

That's basically how the entire network device architecture is on this box. Below is an example of adding another VLAN.

DMZ Vlan

VLan Trunking on one NIC

Provided by Trent W. Buck aka twb on #openwrt

Problem: server has room for only one physical NIC, but it needs access to the internet (i.e. an upstream network) as well as absolute dominion over two downstream networks: admin and prisoner.

To achieve this, we will create three vlans on both the OpenWRT k7.09 and the Ubuntu 8.04 server. Further, all (or all but one) of the vlans need to be tagged across the physical line between the OpenWRT and the Ubuntu server.

Use `robocfg show` to display vlan status. It's probably better (more portable) to cat something in `/proc/switch/`, but I don't know what.

OpenWRT# uci show network.eth0
    network.eth0=switch
    network.eth0.vlan0=1 5*
    network.eth0.vlan1=0 5
    network.eth0.vlan2=1t 2 5
    network.eth0.vlan3=1t 3 4 5

In the above, the `5*` indicates that untagged packets on port 5 will be treated (tagged?) as vlan0. The `1t` tells the kernel to tag vlans 2 and 3 on port 1 - note that vlan1 is not tagged on port 1, which is why we eth0 instead of eth0.1 on the Ubuntu server.

Note that we do not set up interfaces eth0.2 or eth0.3, because the OpenWRT MUST NOT be accessible (at the IP layer) from the admin and prisoner networks.

Ubuntu# cat /etc/network/interfaces
    auto lo eth0 eth0.2 eth0.3

    iface lo inet loopback
    iface eth0 inet dhcp
    iface eth0.2 inet static
      address 192.168.67.1
      network 192.168.67.0
      netmask 255.255.255.0
      broadcast 192.168.67.255
    iface eth0.3 inet static
      address 192.168.68.1
      network 192.168.68.0
      netmask 255.255.255.0
      broadcast 192.168.68.255

Note that the Ubuntu vlan package says not to use vlan1, because it's generally reserved for… stuff. It seems to work for me here, probably because vlan1 is non-tagged.

Mac-Style Dvorak QWERTY Control Layout Switcher for Windows

2010-10-12T18:08:00.001+08:00

On Macs, there is a way to have the keyboard layout Dvorak when you type, but when you use a Command key, it switches back to QWERTY so you don't have to remap all the shortcuts or have them in inconvenient places.

This Layout is created for the Dvorak windows users. The layout switches back to QWERTY if the Ctrl key is hold. After you have install the layout, "Dvorak - Ctrl QWERY" will be found".

You can download the layout from the link below. Any comments are welcome.

http://rapidshare.com/files/424569287/Dvorak_Ctrl.zip

How to Sync Multiple Calendars to the iPad With Google Sync

2010-09-29T17:49:00.000+08:00

Yes, we’ve covered Apple’s iPad quite a bit this week. While there are other happenings in the mobile tech world, this was a big one — besides, I haven’t blogged much about it just yet. Oh, I will — I’ve been spending time with the device in bits and pieces over this holiday weekend — but I wanted to let the dust settle in terms of coverage. However, there’s one tidbit I wanted to share now, simply because it solves a problem for Google Calendar users that want to sync events with their iPad using Google Sync.

The problem is — using a Microsoft Exchange setup for Google accounts currently works for one single calendar on the iPad. I can’t have that, so I scoured the web for a workaround,found one in a MacRumors forum, and used it successfully. Here’s the method to use until Google addresses the issue for Apple’s iPad — you’ll need to use the Safari browser, although this might work with user agent string spoofing on other browsers too:

Open Safari and then view its Preferences pane.
In Preferences, go to the Advanced tab and check “Show Develop menu in menu bar.” If you already have this checked, you can skip this step. Close the Preferences.
In the Safari menu bar, you should now see a Develop menu option. Select it, choose the User Agent option and pick “Mobile Safari 3.1.3 — iPhone” This tells web sites that you’re using the iPhone’s browser. You need to do this to open up the mobile site for the Google Sync service.
In Safari, browse to http://m.google.com/sync and sign in if needed. Normally you’d do this on your mobile device, but Google isn’t yet recognizing the iPad properly. If you try to configure Google Sync from the iPad, it will say “Sorry, Google Sync is not supported on this device.”
Now go to the Develop menu in Safari and choose to Disable JavaScript as shown by the check mark below.
Still in Safari, choose to manage your iPad. In my list, it’s the most recent device, but if you use Google Sync across multiple devices, it could appear anywhere in the list.
In the next window, you’ll see that Google says you can sync up to one calendar to your device. Ignore that message because the workaround now allows multiple calendar selections. For instance, I chose three primary calendars and three shared calendars, offering both work and family events in one single view.Once you’ve made your selections, click the Save button. That should do it, so don’t forget to undo the User Agent change and re-enable JavaScript in Safari. On the iPad, here’s what the result looks like less than a minute after I ran through these steps:

I’m sure Google will address the one calendar limitation with Google Sync, but until they do, you can easily work around the issue in just a few minutes. Hopefully that helps — and now I’m off for some more iPad playtime so I can share all my thoughts soon.