When I upgraded my home server from Debian 7 (wheezy) to 8 (jessie), my installation of the Prosody Jabber chat server broke. Specifically, my chat client would no longer connect, saying SSL was not supported on the server, and prosody complained about SSL support not being available whenever I ran prosodyctl. First I'll show the diagnostic information, then the fix and explanation (spoiler: downgrade lua-socket!), then the new diagnostic output.

Read more

(No excerpt available.)

(No excerpt available.)

Once upon a time, I wrote a photo gallery in PHP, accompanied by a set of PHP and SQL scripts to populate the site from a KimDaBa (now KPhotoAlbum) database. The code is *terrible*, and when it came time to adjust how I managed photo tags, I couldn't stomach editing the PHP. Slowly but surely, I've been rewriting my photo gallery software. The website is in Clojure, and mostly up to feature parity. The tricky part is the updater -- because of an odd quirk of KPhotoAlbum.

This is the story of trying to solve a problem, finding out a flaw, and then seeing the problem in another light. The intended audience is unclear. :-)

Read more

LastPass is a password manager and service that promises local-only password decryption: "Your key never leaves your device, and is never shared with LastPass." (https://lastpass.com/how-it-works, 2015-06-15.) That claim sounds good, and it's technically true under normal usage, but they completely fail to ensure that it *can't* happen -- that is, even under an attack scenario.

Read more