japherwocky's posterous

Like most people in Benton Harbor, I wasn't really expecting Mr.
Pscholka to be helpful with our challenges, and I really wasn't
expecting him to pick a fight with my local politicians.

Our city government is in a pretty sad state. The current leaders
have pretty much shown that they are incompetent. It's a problem, and
I do appreciate that Mr. Pscholka's top priority as an elected
politician suddenly seems to be our City.

For the past four years, local politicians have pretty openly been
saying that white people are taking over the city of Benton Harbor.
Since white people aren't really invited to those conversations, this
gets accepted as truth, and many citizens (right or wrong) believe
this.

Ie, some people here sincerely believe in a shadowy white conspiracy,
and now they can point at this legislature as proof.

Instead of talking about how Wilce's government managed to bounce
checks, or about how to get our books in order, (or how to tackle the
overwhelming poverty here) we're talking about how a single man has
control over a city without being elected.

Something else to consider: In typical quirky Benton Harbor fashion,
our local elections happen in the off years. This summer and fall,
we'll have a chance to vote in a new Mayor, and four Commissioners.

Michigan has bigger problems than this, Mr. Pscholka! Give the system
that elected you a chance to work. Even if you really think these
changes are needed, wait until next year to introduce them.

After I wasted some days trying to sign my requests properly. It
seems like it could be done like this:


def send( self):

charge = '%.2f'% cost( self.orderobj)

ref = self.orderobj['uuid']+ '@' + str(time())

params = {
'callerKey': pubkey,
'callerReference': ref,
'collectShippingAddress': 'True',
'pipelineName': 'SingleUse',
'returnURL': 'http://banneramma.com:8989/receipt',
'version': '2009-01-09',
'signatureVersion': '2',
'signatureMethod': 'HmacSHA256',
'paymentReason': 'Printing from Banneramma.com',
'shipping': '5',
'transactionAmount': charge,
}

params['Signature'] = self.sign( params)

self.orderobj['transaction'] = ref
M.db.orders.save( self.orderobj)

self.redirect(
'https://authorize.payments-sandbox.amazon.com/cobranded-ui/actions/start?'
+ urllib.urlencode(params))

def sign(self, params):

paramstring = 'GET\n'
paramstring += 'authorize.payments-sandbox.amazon.com\n'
paramstring += '/cobranded-ui/actions/start\n'

def quote( thing):
return urllib.quote( str( thing), '')
paramstring += '&'.join( quote(i[0]) + '=' + quote(i[1]) for i
in sorted( params.items()) )

sig = base64.b64encode(hmac.new(secret, paramstring,
hashlib.sha256).digest())

return sig


Butt. That only authorizes payment. When it comes time to actually
get the $, you're supposed to use https://fps.sandbox.amazonaws.com/,
which always throws an error about the Version parameter for me.. a
la, https://fps.sandbox.amazonaws.com/?Version=foo

Here's a good example of the madness of the Amazon docs, also: the
two URLs your code needs to talk to are,
"https://fps.sandbox.amazonaws.com/" and
"https://authorize.payments-sandbox.amazon.com/cobranded-ui/actions/start?".
Why do you need two different domains? Why is one of them so long?
Why is one on amazonaws.com and one on amazon.com ?!?!

Meanwhile, Authorize.net with https://github.com/abunsen/Paython seems
like the easiest thing going.

For some reason, there doesn't seem to be a way to do this through the
lunarpages website, so I have to send in a support ticket, usually
along the lines of, "Hello, please reboot my VPS".

They *always* try to log in, as root, and respond with something like this:

"""
Dear Japhy Bartlett,

A technician responded to your ticket with:

Hello,

I have rebooted your VPS and now it seems to be back online. I was,
however, unable to login using the root password that we have on file
:

$ ssh -l root 74.50.13.187
The authenticity of host '74.50.13.187 (74.50.13.187)' can't be established.
RSA key fingerprint is 70:83:78:24:93:8d:59:18:11:2c:0c:ae:62:1c:08:6f.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '74.50.13.187' (RSA) to the list of known hosts.
Address 74.50.13.187 maps to vps16.lunarpages.com, but this does not
map back to the address - POSSIBLE BREAK-IN ATTEMPT!
root@74.50.13.187's password:
Permission denied, please try again.

As such, please provide us with the steps we need to follow to gain
root access via SSH. We will be looking forward to your reply. Thank
you !

Kind Regards,
Margarit Mugurel
Junior System Admin I - System Administrator Team
"""

Sorry, Margarit, the last time (three years ago now!) your support
team logged in as root, you decided to "fix" /var/www/ and trashed the
live websites running within. I don't trust you to log into my
server, and I don't really understand why you think that's part of
"reboot my server, please".

Even better, this basically means that they have a list somewhere, of
every single customer's root password, accessible by their lowest
level sysadmins. Which means that if you can break into a junior
sysadmin's computer, you have effectively hacked every single server
they host!