A very active spammer decided to use a phony return address on munitions.com yesterday. The rejection messages from spam filters (“gosh, thanks, assholes”) were coming in in batches of around a thousand, which was not healthy; the machine was even rejecting SSH connections.

Fortunately, I have two virtual IP addresses with separate CBQ bandwidth queues, and ssh still worked on those. Once in, I was able to shut down the Postfix listener for munitions.com. I’ll leave it down for a few days, and hope that this clown switches phony addresses soon.

And maybe I’ll see about adding that SPF record I haven’t gotten around to…

1. The director of Constantine and Britney Spears Greatest Hits.
2. The screenwriter of Poseidon (whose next project will be Marvel Comics' Thor).
3. More a remake of The Omega Man than a straight adaptation of the original story.

Why it might not suck:

1. Will Smith appears to be acting, not simply mugging for the camera.
2. Cinematography by the Director of Photography from the Lord of the Rings movies.
3. Decent trailer.

Recently, Steven said:

After you've finished watching Misaki Chronicles, what becomes clear is that the story tellers had a really good story to tell, and knew they did -- but didn't think they could sell that story on the merits, either to their studio or to an audience. So they had to hide it, disguise it, attach things to it. Like huge boobs.

In the interests of clarity, I want to say that when it comes to the new manga series HEAVEN, creator Aoi Nanase has not gratuitously added large breasts and panty-flashing in order to market a serious story about the nature of good and evil.

more...

Whether I try to upgrade some of my music to the new iTunes Plus format, or buy something new, I just get this:

It can wait.

[update: I can’t buy anything at all; my account is now thoroughly confused in their database.]

[update: okay, it took a week, but they figured out which Dean Martin album shouldn’t have been trying to upgrade to iTunes Plus, and with that out of the way, I could determine that the season pass for The Dresden Files (not as good as the books, but not bad) was also broken]

Please point the download link on your site at the stable Mac client (4.4.1), not the CPU and memory-hogging “beta” (4.27.2) that not only clobbered my machine, but didn’t actually download anything to the directory it was pointed at.

While browsing the newly-updated iTunes store, I stumbled across the following podcast: 女の子の写真スライドショー/Japanese Cute Girl Slide Show. It’s exactly what it sounds like.

Of course, you could download the same photos at higher resolution from someplace like Zorpia, and you wouldn’t be limited to this person’s taste in music and girls. But then it wouldn’t auto-download a new one to your iPod every week, which I guess counts as a feature.

I hate it when fixing one problem breaks something else, especially when it’s subtle.

A few weeks ago while testing our new IPSec VPN connections to external partners, we discovered that I could ssh/scp through the VPN from my Macs, but none of our Linux boxes could, and another Mac running allegedly-identical software had horrible performance issues.

The fix was a change in the OpenBSD firewall that also served as the IPSec endpoint: scrub reassemble tcp. The problem went away like magic.

Today, we found out that there’s a single external partner we have to post some data to via an HTTPS connection, and it worked fine from machines outside of our firewall, but failed about 50% of the time from all the machines inside our firewall.

…except for my Macs, which worked 100% of the time. I fired up a CentOS 5 Parallels session on one of them, and it failed 50% of the time. Surely it couldn’t be…

It was. Remove the scrub line, and the HTTPS post worked from everywhere, but now my IPSec VPNs were hosed again.

So:

scrub from any to $IPSEC1_INT reassemble tcp
scrub from any to $IPSEC2_INT reassemble tcp
scrub in

The root cause appears to be the partner’s IIS server failing to properly implement RFC 1323, causing some of the fragmented packets to be rejected during reassembly.

There’s a set of sample images over on No, Dave, it’s just you that, in theory, will help you determine if your Apple laptop display has 24-bit or 18-bit color. I can detect no banding in the 24-bit image, so I must have one of the (allegedly few) good MacBooks, right?

Wrong. Before trying this test, I used SwitchResX to determine that my MacBook has an AU Optronics B133EW01, which is definitely an 18-bit display.

I suspect that all Apple (and most other) laptops have 18-bit displays, and the real news here is that Apple bought some lemons.