Diary

Welcome! :-)

This is both a wiki (a website editable by all) and a blog (an online diary about the stuff Alex Schroeder reads and does). If you’re a friend or relative, you might be interested in reading Life instead of this page. If you’ve come here from an RPG blog, you might want to head over to RPG. There are other similar categories to be found on the SiteMap.

Für Rollenspieler gibt es ebenfalls eine eigene RSP Kategorie.

2016-05-31 letsencrypt.sh instead

I’ve been using the official Let’s Encrypt client, now Certbot on GitHub, using the webroot plugin, but then I saw Andreas Gohr’s blog post Simple Let's Encrypt on Debian/Apache, based on the German post letsencrypt.sh, based on Lukas Schauer’s letsencrypt.sh on GitHub.

Setting it up required a bit of fiddling.

I created the so-called BASEDIR /etc/letsencrypt.sh, with an empty domains.txt file, the suggested hook.sh and a config (no longer config.sh!) as follows:

hook.sh:

#!/bin/bash

if [ ${1} == "deploy_cert" ]; then
    echo " + Hook: Restarting Apache..."
    service apache2 reload
else
    echo " + Hook: Nothing to do..."
fi

config:

BASEDIR="/etc/letsencrypt.sh/"
WELLKNOWN="/var/www/letsencrypt.sh/"
PRIVATE_KEY="${BASEDIR}/private_key.pem"
HOOK="${BASEDIR}/hook.sh"
CONTACT_EMAIL="kensanata@gmail.com"

I followed the Import from official letsencrypt client instructions. In the bash file, I had to set BASEDIR="/etc/letsencrypt.sh" or it wouldn’t work, and I had to run it as root. This created the certs subdirectory in my BASEDIR with all the certificates and it populated the domains.txt file. I had to look over the list of domains because five out of six domains didn’t have the www subdomain I wanted. Probably because the very first time I made those calls I had forgotten about them.

The perl file just required me to cpanm --sudo Crypt::OpenSSL::RSA and cpanm --sudo Crypt::OpenSSL::Bignum. The result of calling it I piped into private_key.pem in my BASEDIR.

For all my sites, I replaced all the .pem locations.

Old:

SSLEngine on
SSLCertificateFile /etc/letsencrypt.sh/certs/alexschroeder.ch/cert.pem
SSLCertificateKeyFile /etc/letsencrypt.sh/certs/alexschroeder.ch/privkey.pem
SSLCertificateChainFile /etc/letsencrypt.sh/certs/alexschroeder.ch/chain.pem
SSLVerifyClient None

New:

SSLEngine on
SSLCertificateFile /etc/letsencrypt/live/alexschroeder.ch/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/alexschroeder.ch/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/alexschroeder.ch/chain.pem
SSLVerifyClient None

Do this for all sites in sites-enabled.

Don’t forget to place the following in /etc/apache2/conf.d/letsencrypt:

Alias /.well-known/acme-challenge /var/www/letsencrypt.sh/

<Directory /var/www/letsencrypt.sh/>
        Options None
        AllowOverride None
        Order allow,deny
        Allow from all
</Directory>

When I ran ~/src/letsencrypt.sh/letsencrypt.sh -c the first time, I got an error, presumably because I had forgotten to restart Apache and so the challenge wasn’t being served:

alex@kallobombus:~/src/letsencrypt.sh$ sudo ~/src/letsencrypt.sh/letsencrypt.sh -c
# INFO: Using main config file /etc/letsencrypt.sh/config
Processing alexschroeder.ch with alternative names: www.alexschroeder.ch
 + Checking domain name(s) of existing cert... changed!
 + Domain name(s) are not matching!
 + Names in old certificate: alexschroeder.ch
 + Configured names: alexschroeder.ch www.alexschroeder.ch
 + Forcing renew.
 + Checking expire date of existing cert...
 + Valid till Jun 10 09:16:00 2016 GMT (Less than 30 days). Renewing!
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for alexschroeder.ch...
 + Requesting challenge for www.alexschroeder.ch...
 + Hook: Nothing to do...
 + Responding to challenge for alexschroeder.ch...
 + Hook: Nothing to do...
ERROR: Challenge is invalid! (returned: invalid) (result: {
...
})

When I tried to sudo service apache2 reload I got an error in my config. The problem was that my config was referring to the chain.pem but the import script hadn’t copied it over!

I was forced to run something like the following: cd /etc/letsencrypt.sh/certs; for d in *; do echo $d; cp -i /etc/letsencrypt/live/$d/chain.pem /etc/letsencrypt.sh/certs/$d/chain-1464687792.pem; cd /etc/letsencrypt.sh/certs/$d; ln -s chain-1464687792.pem chain.pem; done (I had picked the timestamp by looking at the other files).

Finally reloading Apache worked.

Just to be sure, I created a little text file as /var/www/letsencrypt.sh/test and tried to read it using https://alexschroeder.ch/.well-known/acme-challenge/test. That seemed to work.

And now it worked!

alex@kallobombus:~$ sudo ~/src/letsencrypt.sh/letsencrypt.sh -c
# INFO: Using main config file /etc/letsencrypt.sh/config
Processing alexschroeder.ch with alternative names: www.alexschroeder.ch
 + Checking domain name(s) of existing cert... changed!
 + Domain name(s) are not matching!
 + Names in old certificate: alexschroeder.ch
 + Configured names: alexschroeder.ch www.alexschroeder.ch
 + Forcing renew.
 + Checking expire date of existing cert...
 + Valid till Jun 10 09:16:00 2016 GMT (Less than 30 days). Renewing!
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for alexschroeder.ch...
 + Requesting challenge for www.alexschroeder.ch...
 + Hook: Nothing to do...
 + Responding to challenge for alexschroeder.ch...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Hook: Nothing to do...
 + Responding to challenge for www.alexschroeder.ch...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Hook: Restarting Apache...
[ ok ] Reloading web server config: apache2.
 + Done!
Processing arabisch-lernen.org with alternative names: www.arabisch-lernen.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug  6 17:27:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...
Processing campaignwiki.org with alternative names: www.campaignwiki.org
 + Checking domain name(s) of existing cert... changed!
 + Domain name(s) are not matching!
 + Names in old certificate: campaignwiki.org
 + Configured names: campaignwiki.org www.campaignwiki.org
 + Forcing renew.
 + Checking expire date of existing cert...
 + Valid till Jun 10 09:17:00 2016 GMT (Less than 30 days). Renewing!
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for campaignwiki.org...
 + Requesting challenge for www.campaignwiki.org...
 + Hook: Nothing to do...
 + Responding to challenge for campaignwiki.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Hook: Nothing to do...
 + Responding to challenge for www.campaignwiki.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Hook: Restarting Apache...
[ ok ] Reloading web server config: apache2.
 + Done!
Processing communitywiki.org with alternative names: www.communitywiki.org
 + Checking domain name(s) of existing cert... changed!
 + Domain name(s) are not matching!
 + Names in old certificate: communitywiki.org
 + Configured names: communitywiki.org www.communitywiki.org
 + Forcing renew.
 + Checking expire date of existing cert...
 + Valid till Jun 10 09:17:00 2016 GMT (Less than 30 days). Renewing!
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for communitywiki.org...
 + Requesting challenge for www.communitywiki.org...
 + Hook: Nothing to do...
 + Responding to challenge for communitywiki.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Hook: Nothing to do...
 + Responding to challenge for www.communitywiki.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Hook: Restarting Apache...
[ ok ] Reloading web server config: apache2.
 + Done!
Processing korero.org with alternative names: www.korero.org
 + Checking domain name(s) of existing cert... changed!
 + Domain name(s) are not matching!
 + Names in old certificate: korero.org
 + Configured names: korero.org www.korero.org
 + Forcing renew.
 + Checking expire date of existing cert...
 + Valid till Jun 10 09:18:00 2016 GMT (Less than 30 days). Renewing!
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for korero.org...
 + Requesting challenge for www.korero.org...
 + Hook: Nothing to do...
 + Responding to challenge for korero.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Hook: Nothing to do...
 + Responding to challenge for www.korero.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Hook: Restarting Apache...
[ ok ] Reloading web server config: apache2.
 + Done!
Processing oddmuse.org with alternative names: www.oddmuse.org
 + Checking domain name(s) of existing cert... changed!
 + Domain name(s) are not matching!
 + Names in old certificate: oddmuse.org
 + Configured names: oddmuse.org www.oddmuse.org
 + Forcing renew.
 + Checking expire date of existing cert...
 + Valid till Jun 10 09:18:00 2016 GMT (Less than 30 days). Renewing!
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for oddmuse.org...
 + Requesting challenge for www.oddmuse.org...
 + Hook: Nothing to do...
 + Responding to challenge for oddmuse.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Hook: Nothing to do...
 + Responding to challenge for www.oddmuse.org...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Hook: Restarting Apache...
[ ok ] Reloading web server config: apache2.
 + Done!
Processing orientalisch.info with alternative names: www.orientalisch.info
 + Checking domain name(s) of existing cert... changed!
 + Domain name(s) are not matching!
 + Names in old certificate: orientalisch.info
 + Configured names: orientalisch.info www.orientalisch.info
 + Forcing renew.
 + Checking expire date of existing cert...
 + Valid till Jun 10 09:18:00 2016 GMT (Less than 30 days). Renewing!
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for orientalisch.info...
 + Requesting challenge for www.orientalisch.info...
 + Hook: Nothing to do...
 + Responding to challenge for orientalisch.info...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Hook: Nothing to do...
 + Responding to challenge for www.orientalisch.info...
 + Hook: Nothing to do...
 + Challenge is valid!
 + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Hook: Restarting Apache...
[ ok ] Reloading web server config: apache2.
 + Done!

Note the message saying that Apache is reloading.

And to verify it, I use curl and look for the line saying “expire date”:

alex@kallobombus:~$ curl --verbose --head --silent https://alexschroeder.ch/
* About to connect() to alexschroeder.ch port 443 (#0)
*   Trying 127.0.0.1...
* connected
* Connected to alexschroeder.ch (127.0.0.1) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using ECDHE-RSA-AES128-GCM-SHA256
* Server certificate:
*        subject: CN=alexschroeder.ch
*        start date: 2016-05-31 09:32:00 GMT
*        expire date: 2016-08-29 09:32:00 GMT
*        subjectAltName: alexschroeder.ch matched
*        issuer: C=US; O=Let's Encrypt; CN=Let's Encrypt Authority X3
*        SSL certificate verify ok.
...

Yay!

Now all I have to do is install this.

I copied /home/alex/src/letsencrypt.sh/letsencrypt.sh to /etc/letsencrypt.sh/letsencrypt.sh and created the file /etc/cron.weekly/letsencrypt.sh which calls it:

#!/bin/sh
exec /etc/letsencrypt.sh/letsencrypt.sh -c

I made sure to grant it +x permissions, too. :)

And now, just to test things, let’s run the cron job:

alex@kallobombus:~$ sudo /etc/cron.weekly/letsencrypt.sh
# INFO: Using main config file /etc/letsencrypt.sh/config
Processing alexschroeder.ch with alternative names: www.alexschroeder.ch
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug 29 09:32:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...
Processing arabisch-lernen.org with alternative names: www.arabisch-lernen.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug  6 17:27:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...
Processing campaignwiki.org with alternative names: www.campaignwiki.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug 29 09:32:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...
Processing communitywiki.org with alternative names: www.communitywiki.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug 29 09:32:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...
Processing korero.org with alternative names: www.korero.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug 29 09:32:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...
Processing oddmuse.org with alternative names: www.oddmuse.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug 29 09:33:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...
Processing orientalisch.info with alternative names: www.orientalisch.info
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Aug 29 09:33:00 2016 GMT (Longer than 30 days). Skipping renew!
 + Hook: Nothing to do...

Very nice.

Tags:

Comments on 2016-05-31 letsencrypt.sh instead

I really should read the draft for the ACME protocol (via their GitHub).

– Alex Schroeder 2016-05-31 13:56 UTC

Add Comment

2016-05-31 Zombie Apocalypse on the Toadfarm

I’ve been using the Toadfarm/Mojolicious/Oddmuse setup for alexschroeder.ch for quite a while, now. I’ve decided I wanted to switch to a similar setup for emacswiki.org, but small differences keep annoying me. I already wrote about my inability to start and stop the user process using Monit. Here’s another problem: Even though I’m not using the toadfarm at the moment (port 80 is nginx acting as the proxy cache for Apache which runs on port 8080 where as Toadfarm runs on port 8081 and thus isn’t getting used unless I use it – plus port scanners, I guess), zombies are accumulating.

Today I killed and restarted Toadfarm and all the zombies were cleaned up. Good! But that doesn’t sounds like a good solution. What could be the difference between alexschroeder.ch and emacswiki.org to result in one system accumulating lots of zombies?

emacswiki.org:

One hundred zombies

alexschroeder.ch:

Null pr

I noticed that on the system that doesn’t have a zombie problem, I’ve been using some older software. Let’s upgrade the working system and see whether the zombies start appearing. I know something is wrong about this line of reasoning but I can’t help thinking that newer is better.

Perl Module alexschroeder.ch emacswiki.org
Toadfarm 0.670.74
Mojolicious 6.196.62
Mojolicious::Plugin::CGI0.230.32

Tags:

Add Comment

2016-05-31 Monit strangeness

I’m using Toadfarm on two machines. I can start the farm using my own username, and monitor it using Monit, but I can’t start or stop the farm using Monit – even though I use “as uid” and “as gid”:

check process toadfarm with pidfile /home/kensanata/farm/farm.pid
    start program = "/home/kensanata/farm/farm start" as uid "kensanata" and gid "kensanata"
    stop program = "/home/kensanata/farm/farm stop"
    ...

Weird.

At first, I thought that this actually worked on the older machine, but as it turns out, it never worked. I wonder why.

I rewrote it as follows:

check process toadfarm with pidfile /home/kensanata/farm/farm.pid
    start program = "/bin/bash -c '/home/kensanata/farm/farm start &> /home/kensanata/farm/start.log'" as uid kensanata
    stop program = "/bin/bash -c '/home/kensanata/farm/farm stop &> /home/kensanata/farm/stop.log'" as uid kensanata
    ...

The log file revealed that the hypnotoad executable was not on the path. So I added the following to my farm file:

$ENV{PATH} .= ":/usr/local/bin";

Now it will start – but not serve! I’m assuming this has to do with permissions somehow?

I think I’m giving up…

kensanata@po6:~/farm$ cat start.log
Server available at http://www.emacswiki.org:8081
farm (17832) started.

Testing:

alex@Megabombus:~$ curl http://www.emacswiki.org:8081/wiki
curl: (52) Empty reply from server

It takes a bit longer than 15s… Looks like an Oddmuse timeout?

I give up. I even added a call to id:

kensanata@po6:~/farm$ cat start.log
uid=1001(kensanata) gid=1001(kensanata) groups=1001(kensanata),0(root)
Server available at http://www.emacswiki.org:8081
farm (18294) started.

It looks good, but it doesn’t work.

I tried to make sure that I’m not using any relative paths. Log file, script, everything is getting absolute paths. And I’ve made some progress. I’m finally seeing some Mojolicious logs:

kensanata@po6:~/farm$ cat farm.log 
[Wed Jun  1 00:14:25 2016] [info] Mounting emacs with conditions
[Wed Jun  1 00:14:25 2016] [info] Loading plugin Toadfarm::Plugin::AccessLog
[Wed Jun  1 00:14:26 2016] [info] Mounting emacs with conditions
[Wed Jun  1 00:14:26 2016] [info] Loading plugin Toadfarm::Plugin::AccessLog
[Wed Jun  1 00:14:26 2016] [info] Listening at "http://www.emacswiki.org:8081"
[Wed Jun  1 00:14:26 2016] [info] Manager 19291 started
[Wed Jun  1 00:14:26 2016] [debug] Worker 19292 started
[Wed Jun  1 00:14:26 2016] [debug] Worker 19293 started
[Wed Jun  1 00:14:26 2016] [info] Creating process id file "/home/kensanata/farm/farm.pid"
[Wed Jun  1 00:14:26 2016] [debug] Worker 19295 started
[Wed Jun  1 00:14:26 2016] [debug] Worker 19294 started
[Wed Jun  1 00:14:36 2016] [debug] GET "/wiki"
[Wed Jun  1 00:14:36 2016] [debug] Routing to application "Mojolicious::Lite"
[Wed Jun  1 00:14:36 2016] [debug] Routing to a callback
[Wed Jun  1 00:14:36 2016] [debug] [CGI:CODE(0x2740360):19299] START /home/kensanata/farm/wiki.pl
[Wed Jun  1 00:14:36 2016] [error] STDERR: : Permission denied at /usr/local/share/perl/5.18.2/Mojolicious/Plugin/CGI.pm line 62.
...

I wonder what this is.

The code in question:

 open STDERR, $STDERR[0], $STDERR[1] or die "STDERR: @$stderr: $!";

Ah! There was an error logfile with not absolute path… Good, fixed, works!

So now, this is how Monit starts the Toadfarm:

kensanata@po6:~/farm$ sudo cat /etc/monit/conf.d/toadfarm.conf
check process toadfarm with pidfile /home/kensanata/farm/farm.pid
    start program = "/home/kensanata/farm/farm start" as uid www-data and gid www-data
    stop program = "/home/kensanata/farm/farm stop" as uid www-data and gid www-data
    if failed host www.emacswiki.org port 8081 type tcp protocol http
      and request "/wiki" for 5 cycles then restart
    if totalmem > 500 MB for 5 cycles then restart
    if 3 restarts within 15 cycles then timeout

This defines the Toadfarm:

kensanata@po6:~/farm$ cat farm
#! /usr/bin/perl
use Toadfarm -init;

$ENV{PATH} .= ":/usr/local/bin";

logging {
  combined => 1,
  file     => "/home/kensanata/farm/farm.log",
  level    => "debug",
};

my $farm = '/home/kensanata/farm';

mount "$farm/emacs.pl" => {
  "Host" => qr{www.emacswiki.org:8081$},
  mount_point => '/wiki',
};

plugin "Toadfarm::Plugin::AccessLog";

start ["http://www.emacswiki.org:8081"], {proxy => 1}; # needs to be at the last line

(Must change “debug” back to “warn”!)

The wiki itself:

kensanata@po6:~/farm$ cat emacs.pl
#! /usr/bin/env perl
use Mojolicious::Lite;

plugin CGI => {
  support_semicolon_in_query_string => 1,
};

plugin CGI => {
  route => '/',
  script => '/home/kensanata/farm/wiki.pl',
  run => \&OddMuse::DoWikiRequest,
  before => sub {
      my $c = shift;
      $OddMuse::RunCGI = 0;
      $OddMuse::DataDir = '/home/kensanata/emacswiki';
      require '/home/kensanata/farm/wiki.pl' unless defined &OddMuse::DoWikiRequest;
  },
  env => {},
  errlog => '/home/kensanata/farm/emacs.log', # path to where STDERR from cgi script goes
};

app->start;

Note all the absolute paths. :)

This server is now also running a Toadfarm started by Monit. Yay!

Tags:

Add Comment

2016-05-28 nginx as a caching proxy

Remember the fiasco at the end of 2014 and the beginning of 2015, when Emacs Wiki was down as I tried to switch to Fast CGI, and it kept staying down as I tried to use mod_perl, when finally Nic Ferrier stepped in and started paying for new hosting. He used nginx as a caching proxy for Apache, which continued to call the wiki as a simply CGI script.

The comments reveal quite a bit of caching issues, though. The problem was that nginx seemed to ignore that two pages with an identical URL but for different language preferences could be different. This in turn meant that a German visitor to a page not in the cache would put the page in the cache but with German menus at the bottom, for example (“Diese Seite bearbeiten” instead of “Edit this page”). And if the next visitor to the same page didn’t understand German, this was annoying.

I thought the answer was that Apache should send the “Vary” header telling the cache that accept-language should be part of the cache key. See this discussion of the Vary header, for example: Understanding the HTTP Vary Header and Caching Proxies. But it just didn’t work.

Recently, I suddenly realized that perhaps nginx doesn’t care about the Vary header Apache is sending. I learned about the proxy_header_key setting in the nginx caching guide. As you can see, the default is inadequate! $scheme$proxy_host$request_uri is not what I’m expecting. I needed to add http_accept_language to that key:

# proxy cache key is $scheme$proxy_host$request_uri by default
proxy_cache_key $scheme$proxy_host$request_uri$http_accept_language;

I get the feeling that things are working, right now! If so, it only took 17½ month to find the solution. I’m writing it down in case anybody else stumbles over this problem (and in case I need to remember in the future).

Perhaps the problem is also related to how I compute Etags for my pages: the wiki doesn’t take accept-language into account when computing Etags. Now that I think about it, perhaps that would also have helped solve the problem?

Tags:

Add Comment

2016-05-28 Blog Design

Edward Morbius just linked to Designing blogs for readers, on Google+. Or, as Edward puts it: “Designing Blogs Websites for Readers”. I felt that many of his points had been on my mind as well and that encouraged me to take a few more steps:

  1. getting rid of the big RSS symbols for some of the big categories; auto-discovery will handle this
  2. getting rid of the small RSS symbols at the end of new blogs posts (the HTML cache for old blog posts will keep these around for a long time)
  3. a link to all the posts I made in the same month; sometimes this has been useful for trips, but usually using a tag would simply be better

Then again, I think I’m going to keep comments.

Tags:

Add Comment

2016-05-27 Über die Kirche

Die Frage nach der Zukunft der Kirche bleibt spannend. Via Facebook stiess ich auf den Artikel Tut um Gottes willen etwas Tapferes! zum Thema Kirchenaustritte und Reform.

In meinem Umfeld waren die Austritte vor allem durch das Geld (Kirchensteuer), die Kindermissbrauchskandale, und die Korruptionsskandale motiviert. Selbst dort, wo der Zusammenhang klar nur für die katholische Kirche gegeben ist (Spotlight, Vatikan AG), warf man irgendwie alle Kirchen in einen Topf. Die Marke “Kirche” funktioniert nicht gut.

Auch als Identitätsstifter sehe ich überall Probleme: Ich kannte nur eine Person, die regelmässig in die Kirche ging, und sie ist dieses Jahr ausgetreten. Ich kenne ein paar Leute, die kirchlich geheiratet habe, aber mir schien das jeweils auf Druck der älteren Familienmitglieder zu geschehen, nie aus eigenem Antrieb; und auch was das Wissen selber anbelangt, ist die Situation beängstigend: kaum jemand kennt die Bibel, Referenzen werden nicht verstanden, selbst wenn es Klassiker sind (in den letzten Wochen musste ich zum Beispiel Hiob/Ijob, die Zehn Plagen und Palmsonntag erklären), auch die Kirchengeschichte ist den meisten Leuten ein Rätsel und keiner weiss mehr, was der Grund für die Spaltung der Kirche in Ost und West ist, was Nestorianismus, Arianismus, oder Monophysitismus ist, was die Anglikanische Gemeinschaft ist, und vieles mehr. Und ich interessiere mich ja eigentlich auch nur am Rande dafür, bin ja Atheist und nicht getauft. :-)

Aber wenn ich mehr weiss als die Kirchenmitglieder, habe ich auch meine Zweifel. Wenn ich allerdings die Photos zu The Mass Is Ended anschaue, bin ich gar nicht so traurig. Die Bilder haben einen eigenen Charme.

Wo die Kirche einen guten Ruf hat, ist beim Kirchenasyl, bei der Unterstützung der Flüchtlinge, gerade die St. Jakob Kirche beim Stauffacher in Zürich ist mir schon mehrmals positiv aufgefallen. Da ist man sozial engagiert.

Gleichzeitig sehe ich in der Gesellschaft auch das Problem der Vereinsamung und das Bedürfnis nach Gruppenzugehörigkeit. In dem Sinne kann die Kirche ein Bedürfnis erfüllen, genau wie es der Nationalismus auch kann. In den Worten von Umberto Eco: “Den Menschen, die sich einer ausgeprägten sozialen Identität beraubt fühlen, spricht der Urfaschismus als einziges Privileg das häufigste zu: im selben Land geboren zu sein.”

Das ist natürlich jetzt keine super Leistung, und sofort stellt sich die Frage: Was ist mit all denjenigen, welche die Religion nicht teilen – es war für mich schon als Kind nicht zu fassen, das die katholischen und evangelischen Kinder (es war eine deutsche Schule) da separiert wurden. Und da hatte ich von all den Abspaltungen und dem allgemeinen Wildwuchs aller Religionen ja noch gar keine Ahnung.

Ich vermute deswegen, dass die Bedürfnisse real sind, die Struktur der Kirche und die Fundamente der Religion hier aber nicht mehr ausreichen. Es braucht aus meiner Sicht eine allgemeinere Institution zum Thema Gesellschaft, Lebensstütze, Lebenshilfe, Reflektion, Meditation, Moral, Ethik, mit Möglichkeiten zum Engagement, ohne Bindung an eine bestimmte Heilslehre, ohne Bindung an ein Buch, eine wirkliche Oikumene – im ursprünglichen Sinn: die gesamte bewohnte Welt.

Auch die Abrahamitische Ökumene ist mir nicht gut genug. Ich will ja auch Atheisten wie mich selber erreichen. Der Weltethos, vielleicht?

Tags:

Add Comment

2016-05-27 Krank

Vorgestern hatte ich Halsweh. Gestern bin ich zuhause geblieben, Schnupfen mit verstopfter Nase und jede Menge Kopfweh. Heute ist der Schnupfen nicht ganz so schlimm, aber die Nase tropft pausenlos und aus den Augen quellen Tränen ohne Zahl. Habe ich Schnupfen und Heuschnupfen gleichzeitig?

Dabei hatte ich doch jetzt gerade etwa einen Monat Ruhe…

Tags: RSS RSS

Add Comment

2016-05-26 Proletariat, Precariat, Unnecessariat

The best explanation for the rise of Trump: Unnecessariat.

The Unnecessariat is not like the Proletariat of old, the people who worked hard, nor the Precariat, the people who feared for their jobs but worked. The Unnecessariat are the rest of us. No job, no hope, no future. I remember seeing the first glimpse of that as I watched the movie Winter's Bones (2010). White trash and Meth.

I also like the long arc the Unnecessariat story takes. Gay men dying of AIDS. The economy is not coming back. You can practically hear Bruce Springsteen singing about the post-industrial landscape. Politics for the rich. New tech gadgets for the rich. Tesla! Mars! iPad! For the rich… The rest are simply – unnecessary. No matter who they vote for. But if they vote Trump, at least we'll all go down in flames.

Hello, Hofer, Petry, Le Pen, Orbán. Blocher.

So much posting today. I am alone at home, with a cold. It’s sad, really.

Tags: RSS RSS

Comments on 2016-05-26 Proletariat, Precariat, Unnecessariat

Erkältet? Aber nicht alleine! lese jeden Satz und denke ähnlich.

Chris 2016-05-28 12:54 UTC

Add Comment

2016-05-26 Direct Democracy

Living in Switzerland, I found that reading Referendumania: Direct democracy is spreading across Europe. That is not always a good thing is a teeth grinding experience.

They write, for example: “But the recent referendums are not just wholesome exercises in civic engagement. They also reflect widespread alienation from politics and anger at the governing class. Support for old political parties has withered, while populist, anti-EU parties are gaining ground. Governments derided as elitist and out of touch find it hard to resist calls to submit controversial issues to a popular vote.” It’s hard for me to understand what point they are trying to make. The problem seems to be widespread alienation from politics and the implied solution is to keep people away from politics?

Or: “Still other referendums are pushed by single-issue groups, often with an anti-EU slant. The Dutch Ukraine vote was launched by Eurosceptic activists taking advantage of a new law that grants a referendum on any issue that can attract 300,000 supporting signatures. The vote became a proxy for discontent with the EU, not just the trade deal.” The problem seems to be discontent with the EU. The article is such that its tone seems to imply that more referendums are a problem, but the actual supporting facts they provide seem to indicate that widespread discontent with current politics is the real culprit, here. It is written from the point of view of a political establishment that sees their power base crumble. The countries lie in ruins, people no longer have faith in the future. Will the pension system still be around when we’re old? Will there be jobs for us when we finish our schools and universities? People are realizing that even if you win the rat race, you’re still a rat!

“For a start, it makes it increasingly hard to agree on transnational policies. Treaties are generally signed by governments and then ratified by legislatures. Adding referendums to the mix hugely complicates matters.” Oh no! Complicated issue is complicated!

“In countries such as Switzerland, the political system has adjusted to them. But elsewhere, […], they tend to make politicians look as if they do not know what they are doing.” Because, in actual fact, they know what they are doing? Sometimes I wonder.

I was reminded of Diese besorgten Bürger werden uns zugrunde richten by Kattascha: “Wir sind die Champions Europas. Aber wer ist eigentlich wir? Der Durchschnittsverdiener, der mitgeteilt bekommt, dass seine Rente für nichts reichen wird? Die Alleinerziehende, die sich von Monat zu Monat durchschlägt und abends auf der Couch erschöpft und traumlos einschläft? Die Pflegerin, die insgeheim hofft niemals bei ihrem Arbeitgeber in Pflege gegeben zu werden, weil längst nach Minuten und nicht nach Bedürfnissen abgerechnet wird? Die Wahrheit ist doch die: Deutschland sagt nicht Sorry für die Agenda 2010. Für Rentenkürzungen. Für Riester-Disaster. Denn Deutschland geht es doch so gut. Nur wird für viele immer klarer: Wir sind nicht dieses Deutschland. Und werden es auch nie sein.”

Tags: RSS RSS RSS

Add Comment

2016-05-26 Die Zukunft der Überwachung

Sascha Lobo schreibt Überwachungstechnik in Extremistenhand: Nazis am Abzug und untertitelt wie folgt: “Von Angst getrieben haben Demokratien die machtvollsten Überwachungsinstrumente aller Zeiten erschaffen. Jetzt könnten sie in die Hände von Egofaschisten wie Trump oder der xenophoben Rechten fallen.”

Meine Befürchtungen werden oft damit abgetan, dass wir ja keine Diktatur seien. Aber dass es so bleibt, ist natürlich kein Naturgesetzt – und erst recht nicht, wenn man so schaut, wie erfolgreich gewisse autoritäre Kandidaten an den Wahlen abschneiden. Gruselig!

Die “chilling effects” bemerke ich schon lange: es fängt an mit einem Link, den man sich nicht zu klicken traut, weil die Firewall des Arbeitgeber vielleicht mitprotokolliert, dann reisst man das Maul nicht mehr so weit auf, wenn man in der nächsten Zeit vor hat, in die USA zu reisen, dann lässt man den Laptop doch lieber zuhause, weil vielleicht sonst die Material gefunden wird, welches in der Schweiz legal runter geladen werden darf, im Ausland aber nicht, und früher wäre das ja kein Problem gewesen, aber jetzt gibt es vielleicht eine Chance, dass der Laptop durchsucht wird, dann traut man sich nicht mehr, das Anarchist Cookbook runter zu laden, obwohl das zu meiner Uni Zeit noch wie ein Initiationsritual auf mich wirkte, dann klebt man mal die Kamera vom Laptop zu, blickt misstrauisch zur Kamera in den Zügen hoch und fragt sich, ob uns da jetzt jemand beim popeln in der Nase zuschaut und am Ende räumt man dann die Handys weg, wenn man über heikle Aspekte vom Geschäft reden will. Nachfolgend ein älterer Artikel aus der WOZ von Carlos Hanimann: Staatliche Überwachung: Was hat das mit mir zu tun?

Tags: RSS RSS

Add Comment

More...

Comments


Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. See Info for text formatting rules. You can edit this page if you need to fix typos. You can subscribe to updates by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.

Referrers: The City of Iron: Fatigue based spellcasting in old-school D&D Planet Emacsen Gothridge Manor Dreams of Mythic Fantasy Asshat Paladins