The good news is that I didn’t notice for almost two weeks because NetBSD RAIDframe handled the situation smoothly. It kicked the broken disk out of the RAID array, reported the problem in the nightly e-mails (which I somehow missed) and kept the machine up and running. Well done RAIDframe, have a cookie!

Of the above video solutions only Flash works under NetBSD’s amd64 and i386 ports, but often not very well. While NetBSD 6.0 should improve that situation with the updated Linux emulation Flash will still be limited to the x86 ports. So how can you create a web page with an embedded video that is NetBSD-friendly despite all these technology problems?

Fortunately the new upcoming HTML5 standard can help here. Although it is still under development a lot of its aspects are already supported by modern browsers. One of them is the video element. It allows to embed a video into a web page with only a few lines of HTML code. Here is a simple example for a video element:

<video height="320" width="240">
<source src="my-video.ogv" type="video/ogg" />
</video>

This allows video playback in e.g. Firefox under NetBSD without any extra plugins. There is however one small problem: there is no single video file format that is supported by all browsers. Safari, Internet Explorer 9 and most mobile browsers only support MP4 files. Firefox and Opera however only support OGV files. Only Google Chrome supports both video file formats.

Fortunately the HTML5 video element allows you to specify multiple different video file format. Here is an improved version of our example:

<video height="320" width="240">
<source src="my-video.ogv" type="video/ogg" />
<source src="my-video.mp4" type="video/mp4" />
</video>

In this case the browser can pick either the MP4 or the OGV video file. There are various programs for creating video files in MP4 or OGV format. If you are lucky your video editing software will already support generating MP4 files. If it doesn’t you can try the ffmpeg program to convert the video file into an MP4 file. Although ffmpeg can generate OGV files as well I would recommend ffmpeg2theora for this job. It can read the same file formats and generates OGV files whose audio information is correctly played back by Firefox.

If you create a web page with video using the above recipe it will work on a large number of platforms. Playback of this video has been tested with Firefox (NetBSD, Mac OS X, Linux, Windows), Safari (Mac O X), Internet Explorer 9 (Windows), Opera (Linux) an HTC Desire Z under Android 2.3.3, an iPhone 4 and an iPad. Only an iPhone 3GS refused to play the video simply because the video’s resolution isn’t supported on that hardware.

The update from VMware 3.1.3 to 4.0.1 worked absolutely smoothly. I didn’t even have to reboot my Mac. Both of my virtual machines booted without problems afterwards. And the really good news is that NetBSD, although still not officially supported as a guest operating system, continues to run very well under VMware Fusion. My NetBSD/i386 current machine using four virtual cores and 3GB of memory actually runs faster since the update:

I haven’t particularly noticed any of the new features except the single window user interface. I suppose those enhancements are more visible if you use Window extensively.

I haven’t decided yet whether VMware Fusion 4.0 was worth the money. But nothing got broken and I could now safely upgrade to Mac OS X Lion. If you think this update is too expensive you can always try out VirtualBox.

Installing the update on my phone took about 15 minutes over WiFi and worked without problems. The phone is reporting 2.3.3 as the Android software version now.

I haven’t noticed many changes so far. A few buttons of  the UI look a little bit different and the standard browsers feels a bit faster.  Let’s see how stable the new release will work.

Silke and I tried to disassemble my keyboard, a Logitech diNovo Mac Edition Keyboard, but failed to open the case. Silke managed to remove the key caps of both shift keys but we couldn’t spot any defects. We finally had to give up and declare the keyboard a loss. This is quite disappointing considering that I bought that keyboard less than two years ago.

As Logitech are not selling any Mac keyboards at the moment and I wasn’t sure whether I wanted another one anyway I decided to buy an original Apple keyboard. I use the same keyboard at work and  get along with it quite well. Fortunately you can just order keyboard in US layout (and not only in International English) in Apple’s UK online store these days.

I was quite pleased when the Apple Store promised to deliver the keyboard within two days using the standard delivery method. I was even more pleased when the keyboard really turned up today. I really wish that Amazon UK’s delivery service was anyway near as quick as that.

Anyway, I’m happily typing along on the keyboard and now all is good.

# atactl wd0 smart enable
SMART supported, SMART enabled
# atactl wd0 smart status
SMART supported, SMART enabled
id value thresh crit collect reliability description                    raw
1 200   51     yes online  positive    Raw read error rate            0
3 151   21     yes online  positive    Spin-up time                   9441
4 100    0     no  online  positive    Start/stop count               16
5 200  140     yes online  positive    Reallocated sector count       0
7 200    0     no  online  positive    Seek error rate                0
9  89    0     no  online  positive    Power-on hours count           8477
10 100    0     no  online  positive    Spin retry count               0
11 100    0     no  online  positive    Calibration retry count        0
12 100    0     no  online  positive    Device power cycle count       15
192 200    0     no  online  positive    Power-off retract count        4
193 134    0     no  online  positive    Load cycle count               199998
194 114    0     no  online  positive    Temperature                    38
196 200    0     no  online  positive    Reallocated event count        0
197 200    0     no  online  positive    Current pending sector         0
198 100    0     no  offline positive    Offline uncorrectable          0
199 200    0     no  online  positive    Ultra DMA CRC error count      0
200 100    0     no  offline positive    Write error rate               0

While this is very useful for manual checks it doesn’t provide automatic health reporting. And the recent abrupt failure of the backup hard disk in a friend’s machine reminded me of the importance of such monitoring. I therefore decided to implement an automated solution on top of NetBSD’s S.M.A.R.T. support.

The first step was to enable S.M.A.R.T. at system startup. I added the following lines to /etc/rc.local to make that happen:

echo "Turning on S.M.A.R.T.:"
for disk in $(sysctl -n hw.disknames | tr " " \\n | grep ^wd)
do
        echo -n "${disk}: "
        atactl $disk smart enable
done

Now I only needed something that checks the reported metrics every night. I therefore added the following snippet to /etc/daily.local:

found=
for disk in $(sysctl -n hw.disknames | tr " " \\n | grep ^wd)
do
        relocated=$(atactl $disk smart status |
          sed -n -e 's/.* Reallocated sector count[^0-9]*//p')
        if [ $relocated -gt 0 ]; then
                if [ -z "$found" ]; then
                        found=true
                        echo ""
                        echo "SMART checks:"
                fi
                echo "Disk $disk has $relocated relocated sectors."
        fi
done
unset disk found relocated

The above shell code reports any IDE and SATA hard disks with relocated sectors. If a hard disk reports a lot of relocated sectors or their number is growing quickly in a short time frame the disk will probably fail very soon.

Let’s hope that this way I will get an advance warning before the next major catastrophe.

Jun 12 08:58:37 colwyn postfix/smtpd[25605]: warning: unknown[212.154.6.176]: SASL CRAM-MD5 authentication failed: PDM3MjM3NzE1Mzk1NjU1MDEuMTMwNzg2NTUxNUBjb2x3eW4uemhhZHVtLm9yZy51az4=
Jun 12 08:58:44 colwyn postfix/smtpd[25605]: warning: unknown[212.154.6.176]: SASL CRAM-MD5 authentication failed: PDU0MDA0NDczMjgzNjU2NDAuMTMwNzg2NTUyMkBjb2x3eW4uemhhZHVtLm9yZy51az4=
[...]
Jun 12 23:00:15 colwyn postfix/smtpd[12864]: warning: unknown[212.154.6.176]: SASL CRAM-MD5 authentication failed: PDQ2NjM4MzI0NTAyNTQ2ODIuMTMwNzkxNjAxM0Bjb2x3eW4uemhhZHVtLm9yZy51az4=
Jun 12 23:00:26 colwyn postfix/smtpd[12864]: warning: unknown[212.154.6.176]: SASL CRAM-MD5 authentication failed: PDMxMTA4OTY1MjgzOTM0OTkuMTMwNzkxNjAyNEBjb2x3eW4uemhhZHVtLm9yZy51az4=

It looks like somebody has written a program which tries to exploit a security vulnerability in Postfix’s Cyrus SASL component.

Fortunately NetBSD isn’t affected as the bundled Postfix binaries don’t include Cyrus SASL support. But if you are using Postfix 2.8.2 or older from pkgsrc with the sasl option enabled you should update to Postfix 2.8.3 or newer as soon as possible.

Well, this blog supports IPv6 since its creation. And I don’t have any plans to turn IPv6 access off. Oh, before I forget. Some people hid easter eggs in their IPv6 address:

> host -t aaaa www.facebook.com.
www.facebook.com has IPv6 address 2620::1c18:0:face:b00c:0:1

> host -t aaaa www.cisco.com.
www.cisco.com has IPv6 address 2001:420:80:1:c:15c0:d06:f00d

There is also a telephone exchange called Science Park nearby which provides telephone and Internet services to companies at the Science Park and also to my home. But it is not innovative at all. British Telecom made the last upgrade to this exchange more than five years ago.

Well, I suppose I should take this opportunity to thank BT for their modern broadband network and outstanding support of innovation here in Cambridge.

1. I still used UW IMAP as the IMAP and POP3 server. This software works fine in general but is neither particular fast nor under active development anymore.
2. As the Postfix binaries distributed with NetBSD don’t support SMTP Authentication out of the box my end users had to use my home grown mini SMTP server (listening on port 587) to send e-mails. This setup unfortunately made configuring e-mail client software more complicated and didn’t support STARTTLS for encrypting outgoing e-mail.

A week ago I decided to try out Dovecot. Dovecot is a secure IMAP and POP3 server for UNIX-like operating systems. In addition it can also serve as an authentication backend which adds support for SMTP Authentication to Postfix. After reading the excellent documentation in the Dovecot Wiki it took me only an hour to install Dovecot via pkgsrc , configure it and hook it up to Postfix. My system now supported SMTP Authentication and STARTTLS on both port 25 and 587.

Encouraged by this easy success I migrated the IMAP and POP3 services to Dovecot as well on the following day. I simply changed the Dovecot configuration as suggested in the migration instructions, turned off the old services, reloaded Dovecot and everything worked fine immediately.

My new setup still works reliable and fast after more than a week of service. The only compatibility problem was caused by a user who tried to use an uppercase account name. The old IMAP server had silently converted account names to lower case. Dovecot however needs to be explicitly configured to behave in this way.

Overall I can highly recommend the combination of Postfix and Dovecot. You get a fully-fleged e-mail solution with complete encryption support, a single user database and very good performance.