Heartbleed Relief: Replace the Default SSL Certificate in Parallels Plesk Panel

Heartbleed logoIf you have a web site with an SSL certificate then you are probably affected by the Heartbleed vulnerability which popped into general visibility. If your server is vulnerable, you need to do two things:

  1. Update openssl
  2. Replace your SSL certificate (since you have to assume that the certificate’s private key has been stolen).

Anyone in possession of your private key can a) impersonate your web site; and b) decrypt all past, present, and future traffic.

One little piece of the recovery is replacing the default certificate for your control panel. If you only have one server then clicking around in the control panel is OK. But if you have a lot of servers, that will quickly drive you bonkers.

Here is a shell script which will replace the default SSL certificate for Parallels Plesk Panel. The new certificate will be valid for 1095 days (three years). It will then use the new SSL certificate to secure the Plesk Panel itself. Continue reading Heartbleed Relief: Replace the Default SSL Certificate in Parallels Plesk Panel

The Flight Not Taken

Let’s talk about a road not taken, less romantic than Frost’s.

Two roads diverged in a wood, and I,
I took the one less traveled by,
And that has made all the difference.

Robert Frost

My phone rang one night and I answered to hear Sven’s voice. He was training to get his pilot’s license and had been asked to plan his next cross country flight. This one was to be at night across farmland in the middle of the country, from one small airport to another small airport. Sven wanted help figuring out the best way to handle the flight. I started asking Sven questions.

Me: How would you navigate there?

Sven: I would use the VOR [a radio navigation instrument].

Me: Does the plane have a GPS or an ADF [alternative radio navigation instruments]?

Sven: No.

Me: So if the VOR fails? [Pilots always have a Plan B, in case a radio or instrument breaks.]

Sven: Ummmm.

Me: Could you follow the interstate? The lights of the cars can be easy to see at night.

Sven: No. There isn’t an interstate running anywhere near my destination.

Me:  Is your destination airport near a town with lights that you can see?

Sven: Nope. The nearest town is 30 miles past my destination.

Sven’s instructor had posed a tough problem for him. He was to fly to an airport that would be particularly difficult to find at night. He would be flying an airplane with just a single navigation instrument. Sven’s only backup would be “dead reckoning,” a technique involving meticulous attention to airspeed, heading, and time. Now I understood Sven’s concern.

Me: If your instructor was not coming along on this flight, would you do it? Right now, with the skills you have today, would you try that flight alone?

Sven: No.

That was “the answer” and the end of Sven’s flight planning. This flight was too risky.

I congratulated Sven on figuring this out for himself, on knowing his limits. I encouraged him to tell his instructor about his decision.

After that, Sven and I talked about some of the other risks of a night cross-country flight: the difficulty locating a suitable emergency landing spot if the engine quits, the difficulty simply maintaining level flight when you cannot see the horizon, and the difficulty confirming your location mid-course when there are no visible landmarks.

By the end of our call, Sven had two answers for his flight instructor. First, he was going to say that he would not take the flight. Second, as an academic exercise, Sven was going to explain how he would fly the route if he were to do it. I think that was the ultimate goal, to get Sven to learn something about judgement and also to plan a night cross-country flight.

We can apply the same judgement to all of our trips and, most of the time, we do. But sometimes, we forget the bottom-line question: Should I take this trip at all? I missed that question one night when I was a teenager.

car crash in snow

I had been visiting a friend in Chicago one winter. By the time I was ready to drive home to Indiana, it had been snowing heavily for quite awhile. The roads were tough, to be generous about it. Less than a mile after I got onto the tollway, I lost control of my car, mashed the front end of the car into the concrete barrier on the right side of the road, bounced across both traffic lanes, crumpled the back of the car against the center divider, and came to a stop on the left shoulder. I had thoroughly wrecked our family’s good car, the one that my step-father used for his daily commute. While I was catching my breath, the snow plow drove by. Had I been one minute later, I would have been following the plow on clear pavement. Had I been a more experienced driver, I would have still been at my friend’s home, waiting for the next day and better weather to take my trip.

As I have gotten older, I have gotten less insistent about making every trip exactly when I first planned to make it. I am not more fearful; I am just more conscious of the risk-benefit balance.

Should you take that trip? Not necessarily.

You want me to register my WHAT?

To operate an automobile, I have to register the vehicle with the state government. I also have to register myself, demonstrate that I have been trained in the safe operation of the vehicle, and maintain a government issued license for vehicle operations.

I am limited in the types of vehicles that I may own and operate. I can own and operate a wide variety of vehicles but I cannot, for instance, own and operate an F-16 fighter jet, even if I can scrounge up the parts necessary to assemble one.

I can own real estate and, again, I am required to register my ownership with the government.

I can own an airplane and, yet again, I am required to register it with the government. Furthermore, I am required to notify the federal government within 30 days of buying the plane.

I can own a business and, yet again, I am required to register it with the government. Even if I just want a DBA (doing business as), I have to register the fictitious name with the government.

In none of these instances does anyone even consider that the requirement to register with the government could someday lead to having the right to own a vehicle/real-estate/airplane/business taken away.

So what’s the big deal with a national gun registry? Requiring gun owners to register their guns is no worse than requiring real estate owners to register their deeds with the government. It is no worse than requiring automobile owners to pay for a vehicle registration. Registration is not the first step on a slippery slope. It is just registration.

Missouri Teachers Challenge Facebook Ban

Good news: The Missouri State Teachers Association (MSTA) filed a law suit on Friday challenging Missouri Senate Bill 54, also known as the Amy Hestir Student Protection Act. The MSTA has asked the court to block implementation of the law pending a review of its constitutionality.

In addition to the problems that I cited in my earlier post, the law also forbids teachers who also happen to be parents from communicating privately with their own children.

While I fully understand the desire to protect children, and the desire to create legislation which will forge a safe society, the Amy Hestir Student Protection Act perfectly exemplifies a failing attempt to use a law to solve a problem which cannot be solved by government. The government can, and already has, made it illegal for adults and children to have inappropriate sexual contact. The government cannot force adults and children to only communicate “safely.” We adults, parents, teachers, etc., bear the responsibility to teach our children how to communicate safely. We teach our kids about secrets, safe and dangerous; about telling a trusted adult if another adult does or says anything suspicious; etc. Most importantly, we teach our children how to build appropriate relationships with other adults. Teachers, in addition to teaching academics, play a vitally important role in helping children learn how to interact with adults.

Bad Policy: Forbidding Social Network Contact Between Teachers and Students

Missouri is in the process of implementing a particularly bad law, forbidding contact on social networks between teachers and students. Formally, this is Missouri Senate Bill 54, the Amy Hestir Student Protection Act. The aim is laudable: protect vulnerable kids from predacious educators. Unfortunately, the law as written, and as being implemented by the school districts, is so problem-ridden that it does way more harm that good.

Here is a typical comment on implementation:

The Fort Zumwalt School District revised its electronic communications policy in June. “Basically our policy says that our teachers cannot have private conversations on a social network site,” said Superintendent Bernard DuBray. “You can have students on Facebook and other sites, but you don’t have a private conversation on them.”

Any communications between students and teachers has to be open and available to parents and administrators, he said.

From: http://www.stltoday.com/suburban-journals/stcharles/education/article_d45b61a8-b87b-5bb6-a641-9f143f6f4b3d.html#ixzz1Ud4qVBIn

The law prohibits social networking contact between students, past and present, and teachers. Here are just a few reasons why it is a bad law.

Teachers play a critically important role in the lives of many students. Often, kids will talk to teachers about things that they will not discuss with their parents. For instance, one of my high school friends trusted one of her teachers enough to have frank dialogs about sexual identity and pre-marital sex. These conversations happen in ways that are comfortable for the student. Most important, these conversations take place in private. If a student is comfortable talking on Facebook or via text messages, blocking that channel discourages the communication. I know a family of children suffering in an abusive home situation. (Yes, the local authorities are aware.) Can you imagine any of these kids talking to a teacher about it if the conversation was also open to the parents?

This law sends a whole host of bad messages to students. It tells them that, as a group, teachers are untrustworthy. It tells students that they are not skillful enough to judge safe versus unsafe private communication with teachers. It tells kids that they cannot learn about safe social networking with their teachers, though other adults are OK. It tells them that lawmakers and school districts can protect them in their on-line activities. None of these messages are true.

The Amy Hestir Student Protection Act overreaches any bounds of sanity. It forbids me, as a grey-bearded computer engineer, from having a private conversation on LinkedIn, a social networking site geared towards professional careers, with my high school physics teacher. It forbids a student from sending a text message to a teacher, even one saying, “Caught in traffic. Will be 5 minutes late. Don’t let the field trip bus leave.” It forbids a teacher from responding via text message, “OK.”

As adults, we certainly need to keep our kids safe. We do that by teaching them good judgement and empowering them to practice that judgement in reasonably safe venues. We encourage our children to grow into independent adults who can protect themselves. We fail completely with bad laws like the Amy Hestir Student Protection Act.

When the Weather Cooperates

When last I wrote about weather, I had cancelled my flight to Oshkosh, Wisconsin because of thunderstorms between home and my destination. I speculated that there was a small chance that the storms would move east, allowing me to fly later in the day. As it turned out, that was exactly what happened. In this posting, I will give you the rest of the story and explain how, as a pilot, I re-examined the weather and was able to safely make my flight after a six hour delay.

I started by checking the current radar map  and noting that the storms had moved east while, more important, new storms were not developing behind them. In other words, it looked like good flying just west of my intended route with nothing threatening to move in. Here is a picture. (Click on the pictures to see larger versions.)

Planned flight path around weather
The planned flight path involved going west and north to avoid the weather.

By taking a route west and then north, I would be able to get to a point where I could fly northeast into Oshkosh, completely avoiding the storms. There is a little bit of rain in Wisconsin but nothing that I would not be able to fly around when I got there. At worst, one of those might be directly over the airport when I arrive. Were that to happen, I would land at another airport in the vicinity and wait for half an hour or an hour, then take off again and complete my flight.

I wanted to confirm my guess about the lack of storms to the west of my intended route, though. There are a lot of people who know a lot more about weather than I do and, fortunately, pilots have access to some of them by calling Flight Service. I got a briefer on the phone and he concurred that no new storms were likely to develop to the west.

I did make the flight, as you can see in this screen snapshot. The weather in the image shows the storms when I took off. Since they continued to move eastward, I was able to cut the corners, saving distance and time, without ever flying through any significant rain.

FlightAware flight track for N7430J
The actual flight went west of the weather and involved cutting the corners to save time

I did  run into some clouds around Madison but was able to fly east and into gloriously clear weather. Once out of the clouds, I landed at Oshkosh in sunshine for a most excellent week of camping at AirVenture. The delay was inconvenient but not terribly so. I hope that this pair of postings has helped you understand how pilots make go/no-go decisions based on weather tools beyond what is available on TV and “regular” weather web sites.

How Pilots Look at Weather

People often look at me funny because I either choose to fly or choose to cancel a flight when the opposite course seems right. It happens because pilots look at weather a little bit differently, but that can be hard to explain when I do not have a computer handy. This morning offers a perfect chance to explain this kind of weird situation because I am not flying and have great graphics at hand to illustrate the situation.

I canceled a flight from St. Charles, MO to Oshkosh, WI this morning, despite gorgeous sunny weather in both cities. Not only did I cancel the flight, I cannot accurately predict when I will be able to make the trip, despite relatively good weather forecasts in both Missouri and Wisconsin. It could be 48 hours or more until I can safely fly, proving the adage: Time to spare, go by air.

I started my weather briefing this morning by laying my intended course on top of a current radar map. From this, you can see the immediate problem. (Click on the image to see larger version.)

Flight route through a thunderstorm
Planned flight route which would take the plane through a thunderstorm

Small airplanes and red stuff on the radar map don’t mix so the first thought is: Perhaps I could fly west, through the “gap” between the large storms. This might well be successful if the small storms cells over southeast Iowa are dissipating instead of growing. The animated radar loop answers this question. (Click the image to see it larger.)

Animated radar loop
The animated radar loop shows smaller thunderstorms growing between two larger systems.

The animation, showing the progression of the storms over the last hour, shows that the space between the large systems is filling with more red stuff (strong, small storms). It is becoming a wall, not an open gap. With the closure of the space between the systems, the storm line from well west of Kansas City to Chicago blocks travel by small plane from Missouri to Wisconsin.

Since I cannot fly now, the next question becomes: When can I go? For this, we turn to the current surface weather analysis chart and the 24 hour forecast chart. (Click for larger versions.)

Surface analysis
Surface analysis chart shows a front extending from the central plains well past Lake Michigan
24 hour surface forecast chart
The 24 hour surface forecast chart show the front moving south but still generating weather that might block flights to Wisconsin

The surface analysis chart shows the weather at about 4:00am this morning. The 24 hour forecast shows that, at about 1:00am tomorrow, a front will still lie across my route and may well be generating more rain and thunderstorms.

From this unscientific analysis, I reached several conclusions. First, I am not flying to Oshkosh this morning. I am much better off at home, frustrated with a delay, than stuffed into a smoking crater in a farm field under a thunderstorm in Iowa. Second, there is some small chance that the storms will blow through by later in the day and I might be able to fly late this afternoon or early this evening. Third, tomorrow is another day, even though it does not look very promising, either.

If you want to poke around at these charts yourself, see www.AviationWeather.gov and www.Wunderground.com.

For the conclusion of this story, see When the Weather Cooperates.

Are Psycho-Active Drugs Ineffective and Dangerous?

There seems to be mounting evidence that psycho-active drugs are no more effective than placebos; that they may cause real harm; and that the belief that many mental illnesses are caused by chemical imbalances in the brain has never been proven but has been forwarded by the drug manufacturers.

I was most persuaded by Irving Kirsch’s work. Drug companies only publish the studies which are favorable toward their drugs, though they submit all studies to the FDA. The FDA does not publish the negative studies either, considering them to be proprietary information. Kirsch obtained the studies for six anti-depressant drugs from the FDA through a Freedom of Information Act request. The drugs were Prozac, Paxil, Zoloft, Celexa, Serzone, and Effexor. He found that these drugs were only slightly more effective than placebos and did not have a “dose response curve,” i.e., that higher doses did not do more that lower doses. That is very unlikely in a drug that actually does something. He then compared these drugs to “active placebos,” things which cause side effects such as a dry mouth but which do nothing more, and found that the drugs were exactly as effective as the active placebos.

It is very troubling that, “a 2009 study showed that 18 out of 20 of the shrinks who wrote the American Psychiatric Association’s most recent clinical guidelines [in the DSM] for treating depression, bipolar disorders, and schizophrenia had financial ties to drug companies.”

Finally, it is most disturbing that many the psycho-active drugs cause significant side-effects (including shrinkage of the frontal cortex) which in turn cause more psychotic symptoms which are in turn treated with additional psyo-active drugs.

Take a look at two articles that I think are well worth the read. First, Al Jazeera’s Mass psychosis in the US looks at the rising rates of treatment with anti-psychotic drugs in the US. This class of drugs has become the most prescribed in the country, surpassing drugs that treat both high cholesterol and acid reflux. Much of the background for that article comes from the New York Review of Books article, The Epidemic of Mental Illness: Why?, by a former editor of the New England Journal of Medicine.

I would love to hear your reactions.

That Comfy Small Town Feeling

I remember how nice it was, after I moved from Chicago to Valparaiso, IN, that I could tell someone my name and he knew where I lived. It was a small town. We all knew where pretty much everybody lived. One time, just to see what would happen, I sent a letter to my step-father addressed simply,

Dr. Norm Robertson II
Valparaiso, IN 46383

The letter got delivered, right on time. (Here’s a grateful tip of my virtual hat to the US Postal Service employee who went above and beyond the call of duty to make that happen.)

In sixth grade, I had a paper route and wanted a checking account. Teaching me about banking seemed like a good idea to my mom so she and I walked down to the First National Bank of Valparaiso and, in a few short minutes, I was the proud bearer of my first checkbook. It even had my name, alone, on the checks. I learned how to deposit my pay and wrote checks at the bank when I needed some cash. By mid-December, I had accumulated enough money to buy my mom the electric can opener that I had been eying at Sears. The clerk was a little dubious when confronted with a sixth-grader with a checkbook but, when I told her who my parents were, the store took my check and I walked out a much more grown up boy than I had walked in.

It’s nice to be known.

These days, it is easy to get paranoid about protecting our privacy. I am not sure that we ever had much privacy so I wonder where this fear originated. How did we get from that  comfy feeling of being a well-known part of a community to worrying that our neighbors might find out too much about us? Fretting about privacy does not make us less well known; it just raises our anxiety levels.

I was idling away some time the other evening, looking up race results for some of the people that I have met since I began running in July. The Google searches turned up not only race results but ages and home addresses and photo albums. The photos even told me which high schools had been attended (a uniquely St. Louis concern, it seems). I felt like I was back in small town Indiana. Instead of being just running partners, these people became more human, more friend-ly.

I savor that small town feeling again, even if I would have to drive a car to their houses instead of ride my bike.

2,4-D Precautions

The chemical 2,4-D is a primary ingredient in many common home-use herbicides and I always figured that it must be safe. This morning, I was disturbed to find this on OSHA’s Occupational Safety and Health Guideline for 2,4-D (DICHLOROPHENOXYACETIC ACID):

Personal Hygiene Procedures

If 2,4-D contacts the skin, workers should immediately wash the affected areas with soap and water.

Clothing contaminated with 2,4-D should be removed immediately, and provisions should be made for the safe removal of the chemical from the clothing. Persons laundering the clothes should be informed of the hazardous properties of 2,4-D, particularly its potential for causing irritation and central nervous system effects.

A worker who handles 2,4-D should thoroughly wash hands, forearms, and face with soap and water before eating, using tobacco products, using toilet facilities, applying cosmetics, or taking medication.

Workers should not eat, drink, use tobacco products, apply cosmetics, or take medication in areas where 2,4-D or a solution containing 2,4-D is handled, processed, or stored.

and the following (in which I have added my own emphasis)

Effects on Humans: Human exposure to 2,4-D has been associated with central and peripheral nervous system effects, liver and kidney damage, and death [NLM 1995; Hathaway et al. 1991; ACGIH 1991]. Several case control studies of soft-tissue sarcoma and lymphoma have suggested an increased risk among workers exposed to phenoxyacetic acid herbicides, including 2,4-D. However, IARC deems the evidence of 2,4-D’s carcinogenicity in humans inadequate, and other studies have failed to confirm an increased incidence of malignancy in workers using such herbicides [Hathaway et al. 1991]. Workers employed in the manufacture of 2,4-D and 2,4,5,-T had a significantly increased frequency of slowed nerve conduction [Hathaway et al. 1991]. A farming student committed suicide by ingesting at least 6.5 grams of 2,4-D. Violent convulsions preceded death, but no significant autopsy findings were noted [Hathaway et al. 1991]. One terminal patient with disseminated coccidiomycosis was administered 2,4-D intravenously for 19 doses. Central nervous system depression and peripheral neuropathology followed this treatment. 2,4-D is mutagenic in human test systems [NIOSH 1995].

Sure… I want that stuff around my family, friends and neighbors.

2,4-D can be found in lawn herbicide mixtures such as “Weed B Gon MAX”, “PAR III”, “Trillion”, “Tri-Kil”, “Killex” and “Weedaway Premium 3-Way XP Turf Herbicide.” If you use herbicides on your lawn, check the label and take appropriate precautions. Be safe.