What I couldn’t find is a complete example that helped me understand what was going on and worked properly on OS X.

Here’s what I did, and maybe you’ll find it useful.

ESC="\033" # This is the escape sequence
NO_COLOR="$ESC[0m"
IRED="$ESC[1;31m" # ANSI color code for intense/bold red
IGRN="$ESC[1;32m" # ANSI color code for intense/bold green

# From http://railstips.org/blog/archives/2009/02/02/bedazzle-your-bash-prompt-with-git-info/
# I had to change 'git-symbolic-ref' to 'git symbolic-ref'
function parse_git_branch {
  ref=$(git symbolic-ref HEAD 2> /dev/null) || return
  echo " ["${ref#refs/heads/}"]" # I wanted my branch wrapped in [], use () or <> or whatever
}

# from http://ariejan.net/2010/04/25/ruby-version-and-gemset-in-your-bash-prompt-yes-sir
function rvm_version {
  local gemset=$(echo $GEM_HOME | awk -F'@' '{print $2}')
  [ "$gemset" != "" ] && gemset="@$gemset"
  local version=$(echo $MY_RUBY_HOME | awk -F'-' '{print $2}')
  [ "$version" != "" ] && version="$version"
  local full="$version$gemset"
  [ "$full" != "" ] && echo "${full}:" # the colon at the end is a delimiter, you could use a space instead
}

#PS1="\h:\W \u\$" # For reference, here's the default OS X prompt
#export PS1="\$(rvm_version)\W \$(parse_git_branch)\$ " # Without the colors

# I had to put the \[ and \] down here, as opposed to $IRED, to avoid wrapping funkiness.
export PS1="\[$IRED\]\$(rvm_version)\[$NO_COLOR\]\W\[$IGRN\]\$(parse_git_branch)\[$NO_COLOR\] \$ "

I encountered all kinds of weirdness getting the colors to work. The problems all centered around getting the \[ and \] correct. If you’re having problems where the wrapping is wrong, or arrow keys or the backspace causes your prompt to disappear, check your \[\]‘s. The rule of thumb is the characters you’re escaping should be wrapped in them. Keep in mind, the color codes don’t seem to include a ] at the end.

I got my color codes from here. At the bottom of that page is a dandy script which prints out all the colors and backgrounds making it easy to find a good color combination for your terminal.

References:
Ruby version and gemset in your Bash prompt? Yes sir!
Bedazzle Your Bash Prompt with Git Info

Here’s how I “fixed” it. I added the following to root’s crontab:

17 3 * * * /bin/cat /var/db/swupd/html/content/catalogs/index.sucatalog.apple | /usr/bin/sed 's/swcdn.apple.com/10.0.5.100:8088/' > /var/db/swupd/html/content/catalogs/index.sucatalog
19 3 * * * /bin/cat /var/db/swupd/html/content/catalogs/index-leopard.merged-1.sucatalog.apple | /usr/bin/sed 's/swcdn.apple.com/10.0.5.100:8088/' > /var/db/swupd/html/content/catalogs/index-leopard.merged-1.sucatalog
23 3 * * * /bin/cat /var/db/swupd/html/content/catalogs/index-leopard-snowleopard.merged-1.sucatalog.apple | /usr/bin/sed 's/swcdn.apple.com/10.0.5.100:8088/' > /var/db/swupd/html/content/catalogs/index-leopard-snowleopard.merged-1.sucatalog

Keep in mind this is the crontab for the root user (I used sudo crontab -e), not the system crontab, which is normally located in /etc/crontab. Speaking of which, where the hell did that go?

Seriously, Apple, WTF? Why is it so friggin’ hard to make a service that pulls a bunch of files off the web and generates an XML file? If I weren’t pressed for time, I’d replace swupd_syncd with a hundred lines of Ruby code.

When it comes to OS X Server, I’m aghast at how difficult it is to get the simplest things to work. The “enterprisey” Apple stuff is awesome in theory, but horrible in practice. It took days to get the OpenDirectory stuff to work properly.

Even still I have all kinds of problems. For some reason OpenDirectory decides it’s just going to take a nap, and it will take three minutes (or more) for anyone on the network to do anything. Imagine how fun it is trying to change tabs in Workgroup Manager and it takes three minutes between each mouse click.

Here’s another: periodically OpenDirectory will decide to disable a mobile user. For those of you who’ve never experienced this, when that happens, the client machine will disable the local user account. And good luck getting that re-enabled (after you enable it in WGM). You can run this command a bunch of times:

sudo pwpolicy -a LOCAL_ADMIN_SHORTNAME -n /Local/Default -u USER_SHORTNAME -enableuser

But it only works 25% of the time. The rest of the time you get messages about user not being disabled or not having a shadowhash. Sometimes if you just reset the user’s password that will re-enable the account. Otherwise reboot it a whole bunch of times until it finally figures out the account is enabled in OpenDirectory.

Well I setup a VM of Ubuntu 9.04 and guess what: the Parallels Tools don’t work. People have been asking for them since April, and now it turns out, Parallels 5 is in beta, where, naturally, the Tools will install. How much do you want to be that you’ll have to plunk down another $50 for that?

Guess what Parallels: forget you. I’m done. I wanted to support the underdog, and even if the performance of the VM is good, this business of not updating your products isn’t worth it.

Anyone out there trying to decide whether to go with Parallels or VMWare Fusion: go with Fusion!

Boo Parallels.

Update: A few days after I wrote this (Aug. 29, 2009) Parallels released an update (4.0.3846) where Parallels Tools can be installed on Jaunty. Sorry guys, rolling that out more than four months after Jaunty was released is too little too late.

That is, according to the PCI DSS. I read the PCI DSS Summary of Changes. It’s pretty much business as usual until you get to 5.1. That’s where you find this little gem:

Clarified requirement applies to all operating systems types commonly affected by malicious software, if applicable anti-virus technology exists.

Okay, sounds good.

Besides use of the term “anti-virus software,” changed the term “virus” to “malicious software.”

Good call, no doubt someone has tried to wriggle out of compliance using that excuse.

Deleted note stating “Systems commonly affected by viruses typically do not include UNIX-based operating systems or mainframes.”

WTF?!?!?!? Is this some kind of twisted April Fool’s prank.
::Channelling Brian Regan::

“Hey, come here; look what I put for Section Five. Did you see? I just did it as a joke but it’s going out like that. It’s already on the website. I don’t know what to do.”
“Just let it go I guess. There’s nothing you can do now.”

Raise your hand if you’ve ever seen a Unix box infected with a virus. Yeah, me neither.

It doesn’t take much imagination to figure out where this comes from. There’s a lot of big money that doesn’t like Unix boxes getting a free pass for pretty much all of Section 5 of the DSS.

To unravel this “mystery” let’s start by figuring out who *loses* money by Unix not needing anti-malware… Yeah it’s Microsoft. You have to think they’ve been shoving money in the pocket’s of PCI over this. After all, if businesses realize that they can save money by switching to Linux, especially in the current economic climate, they’re gonna do it. And what business wouldn’t, switching to Linux saves you the outrageous anti-malware fees and the exorbitant Windows license fees.

Now, besides Microsoft, who stands to benefit from this? Of course the answer is the anti-malware venders: Symantec, McAfee, TrendMicro, Sophos, AVG (formerly Grisoft), Kaspersky (I’m not going to dignify them with links). If you want some good laughs go read what these guys have to say about Unix viruses.

McAfee, circa 2006:

Macintosh platform vulnerability discovery rates have increased by 228 percent in the past three years alone…

Translation: Your baby is dead!
To their credit, they did follow that up with:

…from 45 found in 2003 to 143 in 2005

Holy hell! Please McAfee, take my money, just protect me!

Sophos, February 13th, 2008, says of the Linux/Rst-B virus:

Analysis of malware in Sophos’s Linux honeypots have shown almost 70 percent of the infections are due to this six-year-old malicious program.

Translation: Your baby is dead!
Holy hell! Nooooo! Not the honeypots! Those things highly secure! It takes mad 733t skillz to pwn a honeypot! Lots of critical thinking going on there.
In that same press release, I liked this:

“…we hope that Linux users who aren’t running security will at least run this tool to find out if they are infected with this granny virus.”

Ha ha, “granny virus,” awesome. And are you “running security” on your Linux box? What exactly does that mean? No matter, I wrote my own Linux/Rst-B scanner, check it:

#!/usr/local/bin/bash
echo "Scanning for Linux/Rst-B virus..."
sleep(5)
echo "No virus detected!"

To Sophos’ credit the did put this in:

Hackers typically gain control via weak SSH password or some other vulnerability.

But that’s it. The rest of the time it’s “Linux viruses are taking over! Give us lots of money, and we’ll protect you!”

Here’s the only place where you can argue Unix anti-malware makes sense: email and file servers. Let those servers be good Samaritans and catch the Windows viruses before they are spread around. It’s a waste anywhere else.

That being said, one could argue running anti-malware on a Unix box does more harm than good. It’s more than the obvious sucking up resources. My biggest problem is running anti-malware on a box adds one more attack vector an attacker has. Historically, there have been many instances where anti-malware software has made people more vulnerable, my favorite being this one.

Finally, I want to add that viruses are already becoming passe. Okay maybe not for Windows, but certainly Unix. Just look at the pwn2own contest. Yeah, the Mac fell in like two minutes, but it had *nothing* to do with a virus, or any kind of malware that’s going to be detected. And that’s the point. Linux, OS X, and other Unix OSes are not going to be taken by traditional malware. Any attacker worth his salt is gonna do it through the web browser. Email: lame. Open ports: too much work. SSH: maybe. Web browser: booyah!

The web browser is the ultimate vector, because you as a user, are giving some portion of control of your computer to a remote machine. Just look at the recent OS X viruses, they change your system network settings so your traffic goes to the bad guys site. Oh snap!

At any rate, PCI removing the statement that Unix systems are not commonly affected by malware has no basis in reality and exists *soley* to make big, slow, outdated, technology companies more money.

That’s bad enough in and of itself. But what makes it worse is the fact that PCI auditors are just an army of box ticking robots. Seriously. Trying to reason with one is an exercise in futility.

Now the worst part: There’s nothing we can do about it. PCI can come up with any bull shit, cockamamie rule they feel like, and you have comply or you’re out of business. Rant off.

P.S. – To any box ticking robots that read this, get off your Huffy and write to me. I’m not an auditor, what’s your side of the story.

Now, first you have to get the TCP/IP-APN stuff setup. To do that, go to “Settings” -> “Options” -> “Advanced Options” -> “TCP”. There are three fields: APN, Username for APN, and Password for APN. Fill them out like so:

APN: wap.cingular
Username for APN: WAP@CINGULAR.COM
Password for APN: CINGULAR1

As far as I know they are case sensitive. It’s also strange because I’ve seen other settings out there, but they have not worked for me. I checked to make sure these were working by using midpssh. When the APN settings were wrong, I kept getting “WRITING: TUNNEL FAILED” from midpssh.

Now, on your Mac, the first step is to install the modem scripts. I can’t remember where I found them, I think it was here. At any rate, I put the file here, so I can find it later.

As per the directions, unzip into Macintosh HD:Library:Modem Scripts

After that you can pair your phone, if you haven’t done so already. The Bluetooth valet/wizard thingy may ask you if you want “access the Internet with your phone’s data connection,” then you can choose the phone model and stuff. The trick is when you put in the phone number, username and password, use the APN settings. For example:

P.S. My phone was recognized as a USB modem as well, however I couldn’t get it to connect — no idea why.

Kids icons screenshot

I’ve been meaning to do this for a while: create desktop icons for links to games on the Internet for kids.  Granted, they’re not the prettiest, but kids don’t seem to care.  Besides the wallpaper on my son’s computer is mostly white, so works out alright for us.  Read on to see how I did it.

Step 1: Drag URL to Your Desktop

Step 2: Drag the Image You Want to Use For An Icon

Step 3: Open Image in Preview

Step 4: Copy Image

Step 5: Right Click and “Get Info”

Step 6: Click on the Icon to “Select” It

Step 6: Paste

Here’s a zip file containing the files I made (pictured above).

Anywho, I modified it like so:

#!/usr/bin/env bash
output=`md5 "$1"`
echo `echo $output | sed -e 's/MD5 (\(.*\)) = \(.*\)/\2  \1/'`

I’m sure the openssl md5 command would work still as well as the md5 command. They both output something similar to:

MD5 (my_file.txt) = caff1120584b95432eed1e84cb99a593

That’s where the sed thing comes in handy, to convert it to:

caff1120584b95432eed1e84cb99a593  my_file.txt

If you’re having this problem, go into “System Preferences” -> “Network” -> “Show: Network Port Configurations” and delete the “VPN (PPTP)” configuration. After that, you should be able to see L2TP over IPSec in Internet Connect.

Once you’ve downloaded and installed it, you’ll find the src.jar (not src.zip!) in /System/Library/Frameworks/JavaVM.framework/Versions/x.x/Home/src.jar

You’re supposed to have the best user interface in the world. But I found a fatal flaw. There’s no way to get windows back on the main screen.* For me it was Parallels Desktop Snapshot Manager; I used it one time when I had a second monitor hooked up.

Why is this not directed at Parallels themselves? I understand that in a perfect world all software would “do the right thing,” in this case, figure out if it’s drawing windows off screen, and remedy the situation. I’m guessing this is what Apple’s software does, since their software doesn’t seem to suffer from this problem. But we don’t live in a perfect world, so Apple you should give me a way to deal with this. GNOME allows me to manipulate windows with keyboard shortcuts? I’ll bet Win-blows will let me do it. Why can’t Aqua?

[end-rant]

* – Actually there is a way: go in and delete the plist file(s) for the application in question, but that is entirely too complicated for most users, and just plain sucks.