Information Density: ACME Laboratories – Signal Evidence & AI Readability

[IMG: anvil logo]

ACME Laboratories
Graphics * Unix * Networks * Fun

[IMG: atom logo]

Purveyors of fine freeware since 1972. On the net since 1991.

ACME Updates.
ACME Labs maps, including:
The ACME Mapper.
ACME GeoRSS Map Viewer.
Bay Area Sandwiches.
Paris Metro map.
ACME Planimeter.
The ACME Labs freeware library.
e - tiny EMACS-like text editor.
thttpd - tiny/turbo/throttling web server.
mini_httpd - simple web server that does HTTPS.
micro_httpd - world's smallest web server?
spfmilter - SPF mail filter module.
pbmplus - toolkit for converting image file formats.
The currently-lit face of the Earth, in ASCII.
The current phase of the Moon, in ASCII.
The ACME JavaScript utilities.
The ACME Java pages.
The current phase of the Moon, in Java.
A Java printf()-equivalent.
A GIF encoder!
PostScript-like graphics.
A simple web server in Java.
Tutorials and resources:
The ACME Comment Weblet.
Web API Demonstrations.
HTML5 Canvas.
Learn how to filter out emailed spam.
The ACME Caption Maker.
The ACME Chartmaker.
The ACME Annotator.
Twoday, shows you what you tweeted on this day in past years.
Learn how to set up a FreeBSD firewall.
An HTML sampler, and a colormap sampler.
Unicode characters.
Unicode Transformations.
Unicode Decoder.
One Month, a single calendar page.
Toys and amusements:
The ACME Label Maker.
The ACME License Maker.
Just for Valentine's Day: the ACME Heart Maker.
The ACME ChuMaker.
The ACME Chocolate Registry.
ACME Labs Calendar.
ACME News, a free web conferencing system.
Jef Poskanzer's personal page.
acme.com's hardware.
What does ACME mean?
Other ACMEs on the web.

ACME Labs Freeware License.
ACME Labs Privacy Policy.
Donate $5 to help support ACME Labs.

Note: the only affiliation between ACME Laboratories and Warner Brothers
is that I've been a fan of Wile E. Coyote for decades.
[IMG: valid HTML]

[IMG: email]

[IMG: logo]

[H2]
[IMG: atom]
ACME Comments Weblet

[H4] What It Is
This little doohickey lets you add a commenting facility to any of your
web pages.
I wrote it to use on my own pages, but it's general enough to work for
anyone.
You don't have to run any special weblogging software to have commenting,
you can just outsource it.
When you set it up, you get a link on your page saying how many comments
there are.
If someone clicks on the link, they see the comments and get a form where
they can enter a new comment.
And if you have your email address on your page, then whenever someone
enters a comment you get notification by mail.
[H4] Try It
Here's an example, for commenting on this page:

[H4] How To Use It
It's real easy.
First add this HTML code to your page, to load the routines:

<script src="//acme.com/javascript/acme.namespace.jsm" type="text/javascript"></script>
<script src="//acme.com/javascript/acme.utils.jsm" type="text/javascript"></script>
<script src="//acme.com/comments/acme.comments.jsm" type="text/javascript"></script>
Then, where you want the comments link to appear, add this HTML:

<comments></comments>
That's it!
Everything else happens automatically.
If you prefer valid HTML over good-looking HTML, you can also use
<span class="comments">.
Either will work, and you can use any element, not just
<span>.
Also, if you want to refer to comments on another page, you can
add a url="" attribute.
This is unusual, typically you just let it figure out the URL by itself.
[H4] Questions
I don't want the emailed notifications, can I turn them off for me?
Well, you could take your address off the page.
Aside from that, no, sorry.
Maybe I'll add a customization settings page later.
For now I guess you could use a spam filter to get rid of the messages.
I do want the emailed notifications, but I'm not getting them; why not?
Maybe your email address on the page is not in the proper HTML format?
It should be something like this:
<address><a href="mailto:someone@some.where">Your Name Here</a></address>
The key parts are "address", "href", and "mailto".
Can I delete comments?
No.
Again, maybe I'll add that later.
Is there any security on the names and email addresses?
Nope.
Anyone can pretend they are you.
You can give a fake name and address, or none at all if you like.
Don't believe anything you see here.
Or anywhere else on the net, for that matter.
Hey, it remembered my name and email from last time. Are you cookieing me???
You bet.
This is exactly the kind of thing that cookies are supposed to be used for.
What the heck is a weblet?
I needed a name for a little web application that gets embedded in
another page.
I googled for 'weblet' and people were using the term, but not in
any consistent way.
So I decided to use it for this.
Some people also call them 'pagelets', but I don't like that because the
word looks ugly, plus there's more going on here than just a page.

[IMG: valid HTML]
ACME Labs / Comments Weblet
[IMG: email]

Donate $5 to help support ACME Labs.

Attack of the Repo Men!

[IMG: anvil]

[H3] thttpd - tiny/turbo/throttling HTTP server
Fetch the software. Release notes.

[IMG: IPv6]
thttpd is a simple, small, portable, fast, and secure HTTP server.
Simple:
It handles only the minimum necessary to implement HTTP/1.1.
Well, maybe a little more than the minimum.
Small:
See the comparison chart.
It also has a very small run-time size, since it does not fork and
is very careful about memory allocation.
Portable:
It compiles cleanly on most any Unix-like OS, specifically including
FreeBSD, SunOS 4, Solaris 2, BSD/OS, Linux, OSF.
Fast:
In typical use it's about as fast as the best full-featured servers
(Apache, NCSA, Netscape).
Under extreme load it's much faster.
Secure:
It goes to great lengths to protect the web server machine against
attacks and breakins from other sites.

It also has one extremely useful feature
(URL-traffic-based throttling)
that no other server currently has.
Plus, it supports
IPv6
out of the box, no patching required.
More specific info:

HTMLized man page
thttpd notes
options guide
auxiliary programs
web server comparisons
other web resources
[IMG: Bill]
How do you pronounce thttpd? Ask Bloom County's Bill the Cat, as seen in
User Friendly,
the excellent geek-positive comic.
[IMG: thttpd powered]
You can also use this fun Bill-based thttpd badge on your own web site
if you like.
It was drawn by Anatole Shaw.

Are you using thttpd?
There's a mailing list:
thttpd@mail.acme.com
(thttpd-request@mail.acme.com
to subscribe,
archived here).
And an announcements-only mailing list:
thttpd-announce@mail.acme.com
(thttpd-announce-request@mail.acme.com
to subscribe).
Anything sent to the announcements list also goes to the regular list,
so you don't need to be on both.

Also if you have any nice quotes I can use, send 'em in.
For instance:
"I got thttpd compiled and running on the web server at work in no time
at all, or close enough for my purposes, and I really like it, and when I
told the rest of the crew what the footprint was they almost coughed up
their lunches."
-- Martin Kelly
"Our load averages have dropped significantly since we moved our
graphics to thttpd."
-- Randy Cosby
"i just grabbed thttpd and set it up on my personal box to test it out,
and i am amazed at how quick and easy that was.
i'm a hardcore apache expert but this was just phenomenally simple.
very refreshing."
-- Jon Drukman
"I switched to thttpd on my underpowered server about 20 minutes after
downloading it."
-- Daniel Quinlan
"I just wanted to let you know that I installed thttpd
and it works really great.
The server is a P3/500 w/512 megs running FreeBSD 3.3 and when it
was using apache it was at about 11 load average and kept throwing connections
and errors.
Now it runs dandy with thttpd and the load average is between 0.1 and 0.2.
The thttpd process is at about 200 megs size and the system is usually 60% idle.
The machine serves about 400 simultaneous connections (more on peak hours)."
-- Petru Paler
"I just upgraded my htdocs development box from apache to thttpd.
I was looking for a httpd that would use less memory - I found
one that was faster and easier to use as well :)"
-- David Brownlee
"We are using thttpd to serve all of our images.
We are a huge traffic site.
We moved about a month ago from a barebones apache.
The load on our web servers dropped dramatically, as did the memory usage!
woohoo!"
-- Jeremy Brand
"Configuration: Athlon 700, 800MB RAM.
Before: Apache, load=170, machine unusable, capped at 4Mbits, SWAPPING.
After: thttpd, load=.09 (yes, that's point-zero-nine), happy at 8Mbits, only
using ~300MB of RAM."
-- Jon Oringer
Some major sites that are running or have run thttpd:
demon.net, Demon Internet, a large UK ISP
global.net.uk, Global Internet, another large UK ISP
bluelight.com, Kmart's web site
img.gamespot.com, GameSpot's image server
download.napster.com, Napster's download server
stephenking.com, Stephen King's official site
mtv.com, It's not TV, it's eMpTV.
news.excite.com, one of Excite's internal servers
valueclick.com, a banner ad broker
sealandgov.com, The Sovereign Principality of Sealand
The Drudge Report
garfield.com, the comic strip
images.paypal.com
On Red Hat Linux systems you can use RPM to install thttpd, like so:
cd /usr/src/redhat/SOURCES
wget http://www.acme.com/software/thttpd/thttpd-2.29.tar.gz
rpm -ta thttpd-2.29.tar.gz
rpm -i /usr/src/redhat/RPMS/i386/thttpd-2.29-1.i386.rpm
New in version 2.29:

Allow CGI to handle HTTP methods besides GET/HEAD/POST.
New in version 2.28:

Improvements to the FreeBSD startup script. (Craig Leres)
Minor portability tweak in mmc.c.
Fix to buffer overrun bug in htpasswd. Reported by Alessio Santoru as CVE-2017-17663.
New in version 2.27:

Stats syslogs changed from LOG_INFO to LOG_NOTICE.
Use memmove() for self-overlapping string copies instead of strcpy().
Couple of subroutine name changes for consistency.
New in version 2.26:

Ignore ECONNABORTED on accept().
Correctly implemented the config-file option change from "nosymlink" to "nosymlinkcheck", which was supposedly done in version 2.24.
Removed mailto: link from default index page.
Allow CGIs to provide both Location and Status headers. (A. Skrobov)
Better logic for figuring out CGI SERVER_NAME environment variable. (Oleg)
Updated for clang, and general cleanup.
New in version 2.25b:

Move fdwatch initialization before the chroot, so that /dev/poll can work.
Multiple fdwatch cleanups and fixes (Adam Zell).
New in version 2.25:

Prohibit "Host: ." and "Host: .." (David Leadbeater).
Don't free memory prematurely on SIGUSR1 (A.D.F.).
Use the specified charset in directory listings and errors (Jonas Ohlsson).
Lowered THROTTLE_TIME from 60 seconds to 2 seconds, plus more aggressive computation of sending rate, to improve throttle reaction time (E Frank Ball).
Added code to redistribute the throttled bandwidth fairly among the currently sending connections.
Some more throttling changes that smooth things out a lot.
Added an experimental limitation on the number of simultaneous CGIs.
Chown the log file when starting as root, so that it can later be re-opened when running as nobody (or whatever user you configure). Also tweak the logfile pathname so that it still works inside a chroot tree.
Make sure URL paths begin with a slash.
Generate multiple MIME encodings in the correct order, and with the correct separator.
Ignore EINTR on read() and write().
Fix error in httpd_read_fully() and httpd_write_fully() that could cause incorrect data to be read or written (Daniel Jensen).
Don't attempt to double-free a file descriptor if a connection times out while it is paused for throttling.
Save and restore errno in signal handlers.
The non-local referer check is no longer fooled by URLs with query strings.
Simplified handling of HAVE_INT64T (Trisk). If this causes problems, e.g. if there are still systems which don't have "long long", we can back out the change.
Keep a list of free connection structs, instead of doing linear search to find a free one (Adam Zell).
Added config.h option FLUSH_LOG_EVERY_TIME - if it's turned off, the log does not get fflushed after each request (Adam Zell).
Multiple robustness improvements to the fdwatch module (Adam Zell).
Added /dev/poll support to fdwatch (Adam Zell).
Automatically add no-cache control header on error responses.
New in version 2.24:

Added a bunch of MIME types.
Fix minor problem with returning unknown protocol on some errors.
Changed the config-file option for diabling symlink checking from "nosymlink" to "nosymlinkcheck" to make its function clearer.
Allow blank lines in the config file.
Handle more than one SIGHUP and SIGUSR2 (Cameron Gregory).
Slight change to handle_newconnect() to better deal with unexpected errors from accept(), such as running out of file descriptors (Alex Keahan).
Added optional minimum rate to throttles.
Stats syslog messages downgraded from LOG_NOTICE to LOG_INFO.
Use unsigned short consistently for port number.
Prohibit slashes in the Host: header (Marcus Breiing).
Added a -dd data_dir flag and corresponding config-file option.
Got rid of the old timer-based zombie process reaper, replacing it with a SIGCHLD handler.
Changed the idle connection checking from using a separate timer for each connection to using a single timer that checks all active connections.
Correction to missing-slash directory redirect with query string.
Added a watchdog alarm handler that forces a core dump if thttpd stops running its timers for too long.
Don't send Content-Length header on 304 Not Modified responses.
Allow user-agent log entries to be up to 200 characters long, instead only of 80.
Fixed buffer overflow bug in defang().
Re-arranged the order of calling de_dotdot() so that it doesn't get applied to query strings.
Some fixes for the syslogtocern script (paul fox).
Changed configure script to use "gcc -dumpversion" instead of "gcc --version" (Ed Goforth).
Changed most uses of \r and \n to \015 and \012 (Jens Bauer).
In ssi.c, lack of PATH_INFO is now non-fatal (David Phillips).
Some improvements to fdwatch (David Burgess).
New in version 2.23:

Added some Microsoft MIME types (Kevin Day).
Switch htpasswd from using tmpnam to mkstemp.
Use memmove instead of memcpy.
Fix to de_dotdot (Mark Dunlap).
Corrected some uses of size_t and off_t.
Rewrote figure_mime() to do binary search. If you're updating an existing installation, you'll need to do a ./configure ; make clean ; make.
Removed the x- from gzip and compress in mime_encodings.txt.
Added rudimentary option to set cache-control headers.
Simplified the IPv6 ifdefs.
Allow filenames with ? in them (Cameron Gregory).
Some improvements to the mmap cache - added a "panic mode" if you run out of address space, added DESIRED_MAX_MAPPED_BYTES config.h option.
Lowered OCCASIONAL_TIME from five minutes to two minutes.
Added include of config.h in mmc.c (A.D.F.).
Fixed compile nit in syslog.c (Peter Harris).
Added configure test for int64_t.
Fix CGI variable AUTH_TYPE (Alexandre CHERIF).
Slight correction to SIGUSR1 handling.
Split clear_connection() into two routines, one which sends a possible buffered response and the other which ignores such (David Burgess).
Remove /./ in de_dotdot() (Dana Dahlstrom).
Shortened LINGER_TIME from two seconds to half a second.
Changed some write() calls to httpd_write_fully(), as suggested by Neale Pickett.
Changed the non-mmap() read() call in mmc.c to httpd_read_fully(), as suggested by Cameron Gregory.
Added .xhtml and .xht to mime_types.txt (suggested by Dave Hodder).
Added index.xhtml and index.xht to INDEX_NAMES (suggested by Dave Hodder).
Fix to error messages for CGI.
Got rid of the custom-jiggered syslog.c, now we just use the standard system version. Also added a paragraph in the man page about the syslogd flags needed to make syslogging work from inside a chroot tree.
Fixed problem involving a connection going into lingering-close mode multiple times (Cameron Gregory).
Added a bunch of checks to the fdwatch package to make it more robust.
Added some more checks for timers getting over-written.
On generated pages which set BGCOLOR, also set TEXT LINK and VLINK.
Added some OpenOffice MIME types (Dave Hodder).
Fix to kqueue code (Alexey Dokuchaev, Michal Suszycki, qhwt@myrealbox.com).
New in version 2.22:

Fix for the garbage characters after POST data hack.
Fix for poll() problem.
Some fixes for unusual cases in the CGI file-descriptor shuffling (Michael Gorlick).
Lowered the default DESIRED_MAX_MAPPED_FILES from 2000 to 1000.
On SysV use sigset() instead of signal() (David Koblas).
Set up accept filters after listen() (Kris Spinka).
Preserve query string when doing a missing-slash directory redirect.
Fixed off-by-one error on EWOULDBLOCK (Sascha Schumann).
Special-case logging to '-' as stdout (Matt Armstrong).
Fix to poll() error handling (Sascha Schumann).
Decreased memory use on kqueue() systems (Sascha Schumann).
Added -s to usage line (Pavel Janík).
Fix for security hole that exposed contents of .htpasswd in some cases (noticed by zeno@cgisecurity.com).
Allow (and ignore) extra fields in .htpasswd files.
Added some calls to shutdown() in strategic places.
Added a timer-kill of the CGI interpose input and output process. These processes also now close the listen fd(s).
Fixed rare file descriptor leak, when we get an unknown sockaddr family (George Schlossnagle).
Zero the kqueue data structures in fdwatch before use (Jonathan Lemon).
Put virtual hostname in non-local referer syslog (Craig Leres).
Added a P3P server privacy header setting (Henrik Schack Jensen).
New in version 2.21b:

Fix for lingering-close problem from Taner Halicioglu - on some systems, it was hanging the server.
New in version 2.21:

ANSI compile nits in timers.h and libhttpd.c. I thought I had already fixed these.
Two small fixes to USR1 signal handling. Should be more reliable now.
Fixed the "throttle sending count was negative" bug.
503 Service Overloaded errors were not getting logged.
New throttling syslogs.
Tuning tweaks to throttling, it's much more accurate now.
Tweak to the sample log-rotation script.
Allow trailing whitespace on the HTTP request line - it violates the HTTP/1.1 spec, but it's harmless, and at least one client (TiVo's v1.3 http_get [not related to my own http_get]) generates it.
Changed the capitalization on some HTTP headers we generate, to interoperate with a client (yes, the same one) that is too stoopid to do case-insensitive matching.
Pass Accept-Language headers to CGIs.
Make log entries at the end of a connection instead of the beginning, so that the byte count is correct.
Off-by-one error in base-64 decoding (Archie Cobbs).
Updated man page throttling section for the wildcard change in 2.17.
Couple of fixes for top-level redirection, from KIKUCHI Takahiro.
New option to hide thttpd's version, from Paul Fox.
Changed include of <sys/time.h> to <time.h>.
Fixed cross-site scripting bug relating to the built-in error pages.
Changed the mmap cache to use ctime instead of mtime, to better handle permissions changes.
VHOST_DIRLEVELS patch, from Vadim Belman.
ssi missing-header bugfix, from Marcel Telka.
Hack to deal with garbage characters after POST data generated by some browsers.
Added -g global passwd file option, suggested by Craig Leres.
Robustness and performance improvements for mmap cache, from Evan Jones.
kqueue support, from Niels Provos.
If both select and poll are available, always use poll.
Don't syslog "Connec