Archive for the ‘Computers’ Category

Don’t lose your data if Todoist goes away

Tuesday, January 24th, 2012

I keep both work and personal to-do lists in Todoist, to which I refer frequently on a daily basis. This past weekend, Todoist was down for something like 12 hours; from what I subsequently read online, it’s not the first time it has gone down.

I can cope without access to my to-do lists for 12 hours, but what scared me about this outage was the realization that my to-do lists are only in Todoist. If it were to suddenly go away for a more than a day, or if (horror or horrors!) they suddenly went down forever, all my data would be lost. That’s not OK.

Many other people have this same concern and have begged Todoist to provide a mechanism for exporting their data to back it up somewhere. Thus far, the closest they’ve come to this is supporting offline use in their iPhone / iPod / iPad app, which is better than nothing, but not good enough.

So I wrote my own. It’s a Perl script you can download here. Here’s the documentation:


NAME

todoist-fetch.pl – Simple todoist backup / restore script, to reassure you that you won’t lose all of your data if Todoist suddenly goes belly-up.

 

SYNOPSIS

todoist-fetch.pl [--help] [--manual] [--project=project] [--username=username] [--password=password] –text | –reorder [input-file] | –backup [--nocompleted]

 

DESCRIPTION

 

Modes

This script has three modes:

–text Fetch all of the items in a specific project and print them one per line, including the item ID and content for each item.
–reorder Read a list in the format produced by –text and reorder the project so it matches the (presumably reordered) list.
–backup Fetch all of your project and item data (not notes or labels, since I don’t use them, but patches are welcome :-) and print them in JSON format with some text annotations explaining what the various JSON blobs are.

 

Backup notes

The format of the backup mode output isn’t intended to be particularly user-friendly, or easy to read, or easy to import into another application. If/when you need to do anything real with the data, you’ll probably need to write another script to convert it into something useful. All it’s intended to do is snapshot your data so you’ll have it in an emergency.

Backup mode uses a non-public API call, because the public API doesn’t allow all completed tasks to be fetched except for premium users, and I’m not a premium user. If the folks at todoist change the non-public API, this will break.

 

OPTIONS

Other options in addition to the mode options described above:

–help Print usage message and exit.
–manual Print entire manual and exit.
–username (or set $TODOIST_USERNAME) Specify Todoist username.
–password (or set $TODOIST_PASSWORD) Specify Todoist password.
–project (or set $TODOIST_PROJECT) Specify Todoist password for –text or –reorder.
–nocompleted Don’t export completed items in backup.

 

AUTHOR

Jonathan Kamens <jik@kamens.us>. Please feel free to contact me with questions, comments, or suggestions! Also, please consider making a donation at http://blog.kamens.us/support-my-blog/ to support future development of this and other free tools.

 

COPYRIGHT

Copyright (C) 2012 Jonathan Kamens. Released under the terms of the GNU General Public License, Version 3 or any subsequent version at your discretion. See http://www.gnu.org/copyleft/gpl.html.

 

VERSION

$Id: todoist-fetch.pl,v 1.5 2012/01/24 19:34:17 jik Exp $

Honda Village fires us as a customer

Wednesday, January 18th, 2012

Long-time readers of my blog may remember my multiple postings about Honda Village in Newton, Massachusetts. You can read the whole series of Honda Village postings here.

(more…)

“That’s Life” comic fixed in aggregator

Wednesday, December 21st, 2011

I’ve fixed the comic “That’s Life”, which was broken in my comics aggregator.

 

Comics added to aggregator

Tuesday, December 13th, 2011

By popular demand (i.e., somebody asked), the following comics have been added to my comics aggregator:

  • Banana Triangle
  • Birdbrains
  • Dog Eat Doug
  • F Minus
  • Ink Pen
  • Luann
  • The Other Coast
  • Overboard
  • Pluggers
  • Rubes
  • Scary Gary
  • Strange Brew

Enjoy!

P.S. If you find the aggregator useful, please consider making a donation. Thanks!

 

Ongoing large-scale distributed SSH brute-force attack

Sunday, December 4th, 2011

In the past, securing SSH on the public internet has been pretty much as easy as (a) keep your OS patched, (b) don’t let root log in with a password, and (c) run fail2ban to stop brute-force attacks.

Unfortunately, it looks like the bad guys have finally figured out how to put their bots to work running distributed SSH brute-force attacks. If so, then fail2ban is no longer going to be good enough, and more sophisticated (and inconvenient) measures are going to be needed.

Prior to December 1, the five machines I maintain with SSH servers accessible to the public have been probed by an average of 13 different IP addresses per day. On December 1, they were probed by 109 different IP addresses, a 738% increase over the prior average. On December 2 and 3, they were probed by 79 and 72 different IP addresses. Not as high as the first day, but still quite a jump!

I saw this increase across the board on five different machines on four distinct networks run by four different network service providers. I’ve been in correspondence with someone at the SANS Internet Storm Center who says he’s seen a similar spike on machines he maintains.

It seems clear to me that someone is engaging in a distributed brute-force attack trying to break into servers as root via ssh.

(more…)

“Jew” is not a bad word

Monday, November 28th, 2011

Someone forwarded me a chain letter today about how offensive it is that a blatantly antisemitic web site, JewWatch, shows up at or near the top of the search results when you Google the word “Jew”.

Here’s my response: http://blog.kamens.us/jew-is-not-a-bad-word/.

 

Free Linux cloud backups for cheap bastards

Saturday, November 19th, 2011

The last time I looked, there were no options I was happy with for backing up my Linux PC in the cloud for a reasonable price. That may have changed, and perhaps if I were less stubborn I’d pay CrashPlan a few bucks per month to back up my system,  but I feel compelled to build my own backup infrastructure for three reasons: (1) I want complete control over it; (2) I worry about a company backing up my data going belly-up and leaving me high and dry; and (3) I’m a cheap bastard.

Until recently I was backing up my data into a ReiserFS filesystem being stored in the Amazon S3 cloud via s3backer. That was costing me on average a little under $5 per month in storage and transaction costs.

Then I got an offer from AppSumo for 10GB of storage for life from LetsCrate for only $25. That got me wondering… There are a bunch of cloud storage / file sharing services on the Internet right now, and just about every one of them offers some amount of storage for free. Could I find away to take advantage of all that free storage to reduce my backup costs almost to nothing?

(more…)

Post-mortem of security breach on my Linux server

Friday, September 16th, 2011

On the afternoon of September 15, I started getting some strange email messages from cron on my Linux server, which hosts my email, blog, DNS, and several web sites for various non-profit organizations I’m involved with.

(Background: One of the web sites, an old Drupal installation, handles scheduled tasks through a cron job that periodically fetches the URL /cron.php on the site. Each time /cron.php is fetched, Drupal checks if any scheduled tasks came due since the last time it was fetched, and executes the PHP code for those tasks. The scheduled tasks aren’t actually supposed to generate any output, so the cron job that fetches /cron.php shouldn’t generate any output and therefore shouldn’t cause cron to send email.)

All the sudden, the cron job that fetches /cron.php started sending me email every time that it ran. When I looked closely, I saw that the contents of the email were some strange, totally incomprehensible JavaScript fragment. I was incredibly busy, so although I thought it was curious that this should suddenly start happening, I didn’t immediately give much thought to it. After it had been stewing in the back of my mind for a couple of hours, however, I suddenly realized with a start that some script kiddie had almost certainly broken into the server and added malicious JavaScript to its pages, so I had no choice but to stop what I was doing and clean up the mess.

(more…)

Email identity thief strikes again

Wednesday, August 24th, 2011

This time, my email identity thief created an account using my email address at support.mozilla.com. I received email from the site in French asking me to confirm my email address.

I’ve reset the password on the account to prevent him from using it, but I can’t log into the account to see what profile information he specified or what he did on the site, because the site provides no way to recover a lost username. I’ve contacted webmaster@mozilla.com and asked them to provide me with the username as well as information from their logs about who created this account.

They’re a bit more likely to be willing to help then Skype, given that (a) they’re a collaborative, open-source organization and (b) I have an ongoing relationship with Mozilla, having submitted several core and Thunderbird patches and been nominated as a “Friend of the Tree”.

I’ve asked them at the very least, if they’re unwilling or unable to provide me with the username, to delete the account, since I don’t want accounts created by other people using my email address on sites all over the internet.

 

IMPORTANT UPDATE on Brave New Foundation and Nation of Change

Friday, August 12th, 2011

I wrote several days ago about spam I received from Nation of Change at an email address which had previously only been shared with Brave New Foundation. Earlier today, I wrote about Nation of Change apparently attempting to cover their tracks after their unauthorized use of email addresses was discovered and reported by me.

I have been in conversation about this with a high-level employee at Brave New Foundation, and I am now able to report the following important information:

  • Brave New Foundation does not sell, share or rent their email lists.
  • There is a Brave New Foundation employee with access to their lists who has a relative who works for Nation of Change.
  • Brave New Foundation believes that this Nation of Change employee made unauthorized use of his/her relative’s access to copy an as yet undetermined subset of Brave New Foundation’s email lists for Nation of Change’s use.
  • Brave New Foundation does not believe its employee was complicit in this unauthorized access. In fact, s/he was unaware that it had occurred until I brought it to Brave New Foundation’s attention.
  • Brave New Foundation considers this breach of their data to be extremely serious, and they are actively investigating it.
  • Brave New Foundation is considering legal action against Nation of Change both to prevent any further use of the copied email addresses and to obtain financial compensation for the damage to Brave New Foundation’s reputation and the time and resources spend investigating this incident.

All of this information, as well as some additional off-the-record supporting information that I cannot report here, was provided to me directly by an employee of Brave New Foundation. I have no reason to believe that employee is lying, and what s/he told me is consistent with my suspicions and impressions about Nation of Change. However, in the spirit of full disclosure, I want to be clear that I have not seen any hard evidence supporting any of Brave New Foundation’s allegations against Nation of Change.

When you combine these new allegations against Nation of Change with all the other issues I raised in my first posting about them, it seems doubtful that this is an organization which deserves anyone’s support.