Search Results: "cas"

15 February 2006

Martin F. Krafft: A first glance at the Draytek Vigor 2900VG

I got myself the Draytek Vigor 2900VG, as announced, to handle my home office connection needs. I've been playing with the device all morning and am somewhat undecided as to whether I should keep it, or replace it with a tiny computer without moveable parts that runs Debian, simply for the benefit of greater control. But first, let me review the device. Don't get me wrong when I say that I am not sure whether I should keep it: the router seems solid and has a lot of functionality, and with few glitches, it mostly seems to work. Go read the specs yourself if you care, in the following I want to give my view on some of the pros and cons of the device after a few hours: The device is an all-in-one, combining WAN access (DHCP, PPPoE, PPTP) with NAT (with support for a DMZ), DHCP, VPN (PPTP, L2CAP, IPsec), a stateful packet filter, a 802.11g access point with support for WPA2 and 802.1x, VoIP gateway, a 4-port switch with VLAN and rate control, static routing and RIP, QoS, UPNP, dynamic DNS updates (e.g. no-ip.com), syslog or SMTP-based logging, and a printer server for USB printers. Basic HTTP URL and content filtering is provided, though most of it comes through the interface to SurfControl (no subscription included). Content control includes the most popular IM and P2P protocols. For all that functionality, the price is quite reasonable, if you ask me. Interaction is through a web interface that can be restricted to a couple of clients only, and is password protected (though in the clear). In any case, the device also comes with a telnet console that has a larger feature set than the web interface, but lacks documentation. Several forums exist, however, to fill this hole. The router also sports SNMP! The packet filter seems limited in what it can do: TCP, UDP, ICMP, IGMP, and only the basics for each (e.g. sockets for TCP). There are 12 filter sets with 7 rules each, and if/then logic can be implemented by branching to other filter sets. However, I can well imagine that the limit can be quickly reached. For QoS, you can define three classes, and to each assign services based on sockets and diffserv. That's it, but it should be enough for most basic use cases. VPN can be achieved with L2CAP, PPTP, or IPsec, but only pre-shared secrets are supported. Users can dial-in, up to 16 "Road Warrior" profiles can be created, and 32 LAN-to-LAN tunnels can coexist. A nice feature are the 16 schedules you can define and use throughout. For instance, certain filters can be restricted to only apply during working hours, some users may only be allowed to use the VPN to dial in during specific times, WLAN can be turned off at dusk, and VoIP devices can be routed based on the time of the day. NTP ensures this all happens accurately. I am really missing a RADIUS server on the device. As it stands, I am left to run a separate RADIUS server on the LAN, or resort to WPA2-PSK, which is a little less desirable but quite okay for my case. The device can separate LAN and WLAN clients and block any traffic between the two. I have not found a way to put LAN and WLAN into their own subnets and allow traffic inbetween. The DHCP server seems okay, it does not remember leases and will simply time out leases and use them for new requests. It is not possible to lock a MAC address to a specific IP through the web interface, one has to resort to the telnet prompt, and the limit is on 10 static leases. The device has no support for DNS updates for DHCP clients, nor is there any integration with a DNS server whatsoever. This means that for 10+ clients, you'll need ZeroConf stuff or you cannot use DNS between clients on the LAN/WLAN. All of the above are minor annoyances. I have also already found a bug (which has been known for more than a year now but remains unfixed in the latest firmware from December 2005): the device has a DNS relay without a cache (ugh!). If you request an A record, it all works. If you request an AAAA or MX record, it forgets to translate the source IP of the answer and feeds the upstream forwarder's packet straight throught. Thus, it is not possible to resolve AAAA or MX records without hard-coding the DNS servers to use in the DHCP server configuration to bypass the DNS relay. That's all for now. I have not gotten around to play with VoIP stuff yet, but one of these days...

Joey Hess: the slowly dying laptop

Yeah, my Fujitsu laptop has been dying for a year or so, it's had surgery for power, batteries, hard drive, sound, etc, it's lost every bit that could break off and still have a usable laptop (all the suede on the bottom, the lid fasteners, the pcmcia blcker, the case around the base of the lid.. the still working pcmcia eject button is my one remaining sacrificial breaky bit). It's got the marks to prove cats love it, along with all the results of throwing it in my book bag and taking off with no concern for carrying a laptop around. The screen has 4 or 5 dead pixels and recently one faint patial dead scan line. The lid is getting worryingly wobbly. The CD drive was once crushed in an airplane and then banged back into shape so it still fits in the machine and even ejects OK. I've rubbed the letters right off some of the keys on the keyboard. The speakers turned black and exuded some glue or something long ago during a hot summer, one of them is barely audible. The headphone jack broke. Oh and the laptop is also abused regularly by programs like firefox and openoffice that really didn't expect to run on a 900 mhz crusoe. All that, I can live with. The laptop bears its marks with pride, and amazingly, people still occasionally ooh and awe at it. Although more likely from a bit of a distance these days. The newest wrinkle is that I'm beginning to exceed the design specs for the keyboard. Apparently they just didn't design for it to be used so much. First some keys stopped working half the time on some days, yeilding the famous irc sessions where joeyh tlks without ny A's. Then the Function key's membrane stopped pushing it back up, so it always appears pressed, though still works. Now the Alt key is going the same route and the right side ofthespacebardoesn't work, leadingtoircsessions whereItalklike this. And it just feels like I can't touch type on it half the time anymore. A new keyboard is $100 or more. I think it's time to retire this to a d-i test machine and start looking for a new latop.
I looked at the IBM X-41 again, really like it, but still can't get past the low res display and fan. Especially with some reports that the fan runs constantly in linux. I looked at all the stuff on dynamism, but wasn't impressed enough to consider it. At the moment the Fujitsu P7120 is looking mighty appealing. Hey, it's even got the suede bottom again. And no fan.. Only problem is it has a touchpad.

14 February 2006

Matthew Palmer: Crafty Like a Fox? Or Just Dumb?

You decide! Seen floating past my eyes in my freshmeat "new releases" feed this morning is "PhpMyPixelPage", "a pre-packaged PHP Web site for creating a [...] page which mainly contains a large array of small squares where each square can be sold as advertising space." First thing here is: the original "Pixel Page" was a cute gimmick done by a clever British University student, called "The Million Dollar Home Page". He did it to finance his studies (if he's not studying marketing, he should be), which worked really well -- he got his US$1 million, and now has plenty to spend on warm beer and grotty kebabs while getting his degree. The concept has since been copied a billion times, to (presumably) nowhere near the same effect. So a pre-built site generator isn't likely to be raking in the dough for anyone -- there's just too many copycats out there. The real cause for the title of this post, though, is the licence. According to the Freshmeat item, the licence is "Free for non-commercial use". Can anyone think of a non-commercial case of selling advertising? No, neither can I. The mind boggles.

Erich Schubert: <tt>make bug</tt> with SERefpolicy

Aargh. Yesterday I spend hours trying to find out why SERefpolicy would not build. There was a suspicious message in the build process, about a circular dependency being removed, and it was obviously due to this dependency that the build did not work. But: I couldn't find anything like a circular dependency. The dependencies for this file were trivial, just two input files that are not being modified or generated or anything. Today I decided to downgrade make to the stable version (which unfortunately conflicts with current kernel-package...) - and now it compiles. Smells like "make bug" to me... You can grab the completely untested (last build didn't work, and my test machine is currently down) packages at http://selinux.alioth.debian.org/serefpolicy/ in case you want to try SERefpolicy yourself. I'd love to have a SELinux policy system which does not involve any such make and m4 black magic. The makefiles are a PITA to read, the whole thing is totally unmanageable IMHO.

13 February 2006

David Moreno Garza: Dear Mr. I m too good to call or write my fans

Or… Dear Mr. “I’m too good to make things properly for portability on Ruby packages”. Lucas Nussbaum did a great job on the pkg-ruby-extras team by writing the web page called Upstream developers, be nice to distribution (re) packagers, where he notes the problems we have brought by RubyGems, broken install.rb, extconf.rb, etc. and the like. Thanks, Lucas!

11 February 2006

Ross Burton: ZeroConf Bookmarks in Epiphany

Yesterday I noticed that Epiphany in Ubuntu (and probably Debian too) is now build with Zeroconf support, which means it will detect any web sites exported over Zeroconf and add them to the bookmarks. This totally rocks, as instead of having a number of bookmarks for various administration pages on my machines, the machines can export them over Zeroconf and when I am at home and those machines are on, they'll appear magically. The first step to having Zeroconf enlightenment is to ensure avahi-daemon is installed on all machines. It doesn't matter if there are some machines that it cannot be installed on (i.e. router running embedded software), as other machines can publish their name and services on their behalf. The first service I published is the web-based admin pages for my printer. The printer is connected to a small server called Melchett (a Buffalo LinkStation) which is running CUPS. By creating /etc/avahi/services/cups.service on Melchett with the following contents, the web site is published: 
<?xml version="1.0" standalone='no'?>
<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
<service-group>
  <name>Epson Stylus Photo R220 Admin</name>
  <service>
    <type>_http._tcp</type>
    <port>631</port>
    <txt-record>path=/printers/epson-stylus-photo-r220</txt-record>
  </service>
</service-group>
Each .service file in /etc/avahi/services defines a group of services. A group has a name, and a set of services. Each service has a number of properties:
Type
Specifies what the type of the service is (_http._tcp is HTTP over TCP). There is a canonical list of types available. This is a required element.
Port
What port the service is listening on. This is a required element, there is no default port 80 for _http._tcp services.
Text Record
This sets arbitary key-value pairs, which are interpreted on a per-service manner. For _http._tcp services the valid keys are u (username), p (password) and path.
There are also domain-name and host-name properties, but these are not used in this service description as the service is on the local machine. In summary, you can see that I have specified that there is a web page accessible via HTTP on this machine, available on port 631 at the path /printers/epson-stylus-photo-r220. When other machines search the network for web pages they'll find this service entry (with the hostname properties filled in by Avahi), and generate the URL http://melchett.local:631/printers/epson-stylus-photo-r220 A quick pop into Epiphany shows that this is indeed the case, there is now a Local Sites category in the bookmarks containing Epson Stylus Photo R220 Admin. There is one other thing I need to explain: how to publish services on behalf of other machines. Until this afternoon this required something to run avahi-publish-address to give the machine a Zeroconf name, but this afternnon Trent committed static name mapping to Avahi. When this is in a released version, I'll continue this article.

Daniel Baumann: Eiffel packaging considered painful

Our Chair of Software Engineering at the ETH Zurich is addicted to the Eiffel programming language. Thus, a PhD student is working on an Eiffel Multimedia Framework, named EiffelMedia, and I'm doing the Debian packaging. After working the second year with Eiffel stuff now, I can say that packaging Eiffel programs (not the language itself) is a major PITA, with respect to the following two aspects: Eiffel is different Eiffel is non-free

There are not one... not two... but three incompatible Eiffel compilers arround. Oh yeah... Except from some fundamental programs like Gobo Eiffel or the Eiffel Wrapper Generator (they support both all three compilers), nearly all programs are written according to the current Eiffel specifcation. So there is no real alternative to the proprietary EiffelStudio. Beeing binary-only is a major drawback too: EiffelStudio on Linux/powerpc is dynamically compiled against glibc-2.3.5, but Sarge has glibc-2.3.4. So one needs a backport of glibc, which taints the system in an unneccessary and stupid way. Please: Eiffel Software, if you are reading this, open the sources of EiffelStudio now and turn it into free software, for the greater good of us all. Make additional ports to other architectures possible and allow us, the packagers and upstreams of Eiffel programs, to drop the cumbersome support for other ancient Eiffel compilers. Let's focus us to one, single implementation and improve it.

Andrew Pollock: [life/americania] Licensed!

Last Monday, Sarah and I visited the fine institution that is the California Department of Motor Vehicles, so that we could get ourselves California drivers licences. We had to do both a written test and a behind the wheel test. The written test was your standard multiple-guess exam (36 questions, maximum of 6 incorrect answers to pass). Annoyingly, all the material on the exam was not in the California Driver Handbook, which the handbook tried to make out was the case. Fortunately it was largely a case of common sense. I got two wrong. The funniest thing was that Sarah and I both got the same exam paper, and Sarah did her test just after I finished mine, and we were allowed to keep the paper, so she could see which two I got wrong. One of the more unusual things I found about the process was that they allocated me a licence number before I'd even sat the test. Last Thursday Sarah had her behind the wheel test, and today I had mine. It was pretty easy. No reverse-parking, no emergency stopping. I just had to drive around for 15 minutes. I passed without any faults. Given it took me four attempts to get my original licence in Australia, I was pretty pleased with this. (I failed my Queensland licence a number of times due to nerves). The other thing that I was amazed to discover was that I don't get the licence for another four to six weeks! They mail it out. The DMV processes over here are just mind boggling. The fact that you can't get a licence on the spot, and that it takes something like three months to get licence plates for a new car just blows me away. It's nothing like the process in Australia.

10 February 2006

Wouter Verhelst: Hard disk keys

A while back, my desktop's 60G hard disk died. I didn't have an immediate replacement at the time; the only disk that I could put in the machine was a 13G one with data. Yesterday, however, an 80G hard disk that I bought on eBay arrived, so I shut down my desktop and prepared to put the new disk in. The machine has a removeable hard disk bay, so I put the disk in a casing and wanted to slide it in the bay. To activate it then, I need to use a key to unlock and then re-lock the bay. I appear to have lost the fucking key. I think I'll try to break the hardware lock mechanism and to short-circuit the cables that tell whether the bay is locked tomorrow. That lock doesn't serve any useful real-world purpose anyway.

Michael Janssen: Pet peeve number 1

Okay, something bugs me, and it's somewhat irrational, and somewhat rational. I totally hate really long URLs needed to "verify" that the sign-up is valid. There are more than one type of these, sometimes they are required to continue into the site, sometime just for extra features, but they are more often that not, very long. Now, I don't like long URLs in general in emails, because there are many services which allow you to shorten them for public use. Recently I signed up for 30 boxes and they sent me this monstrosity: 

http://30boxes.com/signup.php?action=finishSignup&d=aSDFJKLa43da
safjdAL5RLKj4afjrafa45J5kljtyTGJrALKJgFKLsaj5klJ4jkljakljdkalflk
fASJKjdfa4r23890fdfjskl342390fakjlei309dk390ujkal39032kd03j9djd9
Okay, so lets look at this rationally for a bit. How many unique strings can they have from that huge behemoth of an identifier. There are 145 characters. They are using the entire uppercase (26), lowercase (26) and numbers (10), so there are a total of 62 unique symbols for each spot. That gives us a total of 62145 different strings. That's 

78848779858160540639233408124436328679807474352650645474403652978
77812230999983634922053904324829205441837830921209410767866820350
39259149646534571887966722870103317751633817974743087029882020930
78213775489032524047364643001443429901072761743321026356976812032
different combinations. In scientific notation, thats 7.8 × 10259. Just for comparison, the entire number of atoms in the universe is high-balled at 6 × 1079 (on this page). That's more than a googol of identifiers for EACH ATOM, EVERYWHERE. Isn't naming each atom once enough? Then you would only need 45 characters, which would nicely fit in one line of my email client if you just shortened your "finishSignup" to "fS" and action to "a". As a bonus, it also saves you approximately 117 bytes of bandwidth per email. UPDATE: Apparently it has ALL the information, in addition to being completely too long. I replaced it with random crap.

9 February 2006

John Goerzen: My new podcast: The Sound of History

Well, it's finally time to announce my new podcast, Sound of History! The Sound of History is a weekly podcast featuring full-length, unedited, and uncut historic audio. You'll hear speeches, broadcasts, and events from around the world. Sometimes you'll hear famous people, sometimes not. Episode 1 is up now. On this episode, you'll find John F. Kennedy cracking jokes about Marx in front of a bunch of newspaper publishers, Ronald Reagan talking about the Challenger, some blues from 1922, and an Edison recording from 1902. Thanks to Cliff for mentioning that Reagan speech in a comment. That prompted me to go find it. I'm finding material for this podcast from around the Internet. Some of that music comes from archive.org, and there are various sources for presidential speeches. I'd like to find some British prime minister's speeches as well, but I'm having difficulty with that. If any of you Brits reading this know of a good site for uncut audio, accessible to Americans, please do let me know.

Jonathan McDowell: WTF is the point of SSL mailing list archives?

Why are more and more mailing list archives put behind https URLs with self signed certs? What exactly are they securing? What does it achieve other than pissing people off who have to accept the cert just in order to see a mailing list post? GNUCash is the one I happened to hit today, but it seems to be a not infrequent thing.

8 February 2006

Uwe Hermann: How to detect and defeat hardware backdoors and wiretaps?

A network card How nice. The FCC wants "a "back door" be built into all Internet-communications hardware and software to provide access for law enforcement agencies". This and similar horror scenarios for the freedom and privacy of the people are nothing unusual these days. A more general (and more paranoid) question: How do we know whether our software or hardware is backdoored/wiretapped? We all know that using a certain OS from Redmond opens a lot of security holes in itself. Add to that all the now-public attempts of agencies and companies ranging from the FBI, NSA, Sony to antivirus-software vendors who install backdoors on your PC, and you've got some very good reasons to never trust any closed-source software again. This is not a problem for most of us using Free Software and free operating systems (Linux, *BSD, etc.). Theoretically, we can read the source code of almost every single instruction being executed on our hardware, and verify that the software doesn't do any funny things like phoning home, logging keystrokes, opening backdoors and so on. However, how can we know whether or not our hardware has been backdoored/wiretapped/trojaned (or whatever you want to call it)? Given that almost all devices we own nowadays (PDA, iPod, cell phone, hardware VOIP phone, and all the other gadgets) as well as most parts of our PCs and laptops have some sort of microcontrollers on them, how can we be sure that there is no secret code hidden in there which spies on us or provides hidden backdoors to them (whoever that may be)? With some devices you can dump the firmware and analyze that, but most parts are probably not easily analyzable by mere mortals. Think network cards, builtin wireless cards, sound cards, bluetooth chips and so on. IMHO, a good first step in the right direction are things like OpenBIOS (Free Software firmware/BIOS) and OpenEZX (Free Software GSM phones). Alas, I think DRM will pose a major threat here in future, as we probably cannot easily replace custom firmware/software anymore if DRM in the worst form becomes reality. So, how would you go about to ensure that your hardware has not been backdoored? How can we detect such things? How can we defend against such things? How can we remove backdoors if we find any? Do you know of any relevant research, papers, documents, HOWTOs? Any cases you know of where such things happened? Any practical tips or advice?

Joe Wreschnig: An Open Letter: Notification of copyright infringement to Abaakouk Mehdi

Update: The Listen website has been temporarily taken down, and Abaakouk Mehdi is in the process of fixing the copyright notices. I am very grateful for this. In my mind, this issue is finished; we’ll soon see a new release of Listen, with intact copyright notices, and everyone wins. Also, so people don’t take my opinion as anything other than solely mine - Eduardo Gonzalez and Michael Urman, the other Quod Libet developers who had their copyrights infringed, have also commented on the issue with slightly different views. (But first second, a brief open letter to people who leave anonymous comments calling me an ass: The only tool free software developers have to defend themselves is their copyright. Copyright infringement is not a “minor problem” but the single largest mistake you can make when writing free software. When you take my work, and strip my name from it, and plasters yours all over it, I have every legal and ethical right to be as pissed about it as I want. I love it when people use my code. I see no reason to love it when people misrepresent my code. Without the ability to pursue copyright infringement, I might as well be writing public domain code, and in that case, I might as well be getting paid for helping software hoarders, and screw you all. Abaakouk screwed up, really badly, but you guys who don’t want me to enforce my license are a real threat to free software.) Dear Abaakouk Mehdi, author of “Listen, just listen,” Your program is ugly. But beyond that, it’s infringing upon my copyright and that of my friends. Your mmkey support, on-screen display, config.py, stock.py, much of your utils.py, and probably more but because I’m already angry enough I’m going to stop looking, is taken directly from my audio player, Quod Libet. Normally, that’s fine. It’s free software. Enjoy the source. You didn’t credit any of our work on the website. That’s fine; it just makes you an asshole, albeit a law-abiding one. But you had to go one step further and rip off most of the copyright notices. You also licensed all the code under “GNU GPL v2 or later”. You can’t do that. Quod Libet’s source is released under the GNU GPL, version 2. My one consolation is your complete incompetence. I mean, it’s really obvious from your screenshots that you ripped off our OSD, and you even left in the horrendous Python style guideline violations that we’ve since fixed. You copied and didn’t use a lot of our utility functions (and you didn’t copy and reimplemented improperly a few others). You left in half my comments, but then translated some docstrings. And to cap it off, you authenticate yourself to leoslyrics.com as auth=QuodLibet. Remove my code from your release, until you can learn how to properly, and legally, credit people.

Wouter Verhelst: Heh

Last weekend, I posted something about my new waffle iron. That post contained two links, both of which had non-working URLs. It's quite... funny that they lived there for half a week with nobody noticing. Oh well. In any case, I found out in the mean time that the iron which was part of the old device does, indeed, fit on the new one. It required removing a lot of grease and other residu, but in the end I did get it off. First thing I did it once that had happened: put it in the dishwasher. No, you don't want the details on that one. Trust me. Yuck.

7 February 2006

Erich Schubert: On "encrypting" (read: obfuscating) P2P: Please don't!

Recently there was a discussion on whether BitTorrent should get some encryption (or obfuscation, more likely) added. Right now, you can filter out BitTorrent traffic with the following iptables command (note: this needs iptables 1.3.4 and a recent kernel): 
iptables -I OUTPUT -j DROP -m string --string "BitTorrent protocol" --algo bm --from 0 --to 100
(Note: match is not optimized, the range of 0 to 100 and algo bm is arbitrary) The nice thing is, that this match is very unlikely to match non-Bittorrent traffic. Linux users can use it to filter out all BitTorrent traffic or mark it for speed restrictions. Network operators are very interested in filtering this traffic: it slows down more important traffic (and if you are e.g. using stochastic fair queing, the large number of connections for P2P filesharing will make it get a larger share than other apps!) and can cause costs. If you have mobile users, who e.g. connect their laptop to your network, they will occasionally use BitTorrent at home, and forget to disable it when they connect to your network. That's really bad, it happens and it's not like this is intentional "malbehaviour" or "sabotage"! So back to the original topic - obfuscating BitTorrent traffic. Let me explain what network operators might do when BitTorrent can't be slowed or filtered any more (Note that this already applies to some services such as Skype or Kazaa as far as I know): First of all, they might decide to filter all connections to non-standard ports. This effectively eliminates (most of) filesharing - but also e.g. Skype and some IM and chat services. Basically any non-standard service. (Note that "professional" VoIP services using SIP may still be whitelisted). Secondly, they could decide to slow down all connections to non-standard ports. This would make filesharing, Skype, IM etc. still possible, but for example file transfers via IM will be really slow. No video via Skype, probably, depending on the limits set in traffic shaping. Thirdly, they could disable all outgoing connections and require you to use proxies for that. Then you need to enable/disable your proxy all the time when switching networks, and you'll only be able to use a limited set of services. Again, Telephony via SIP is still technically possible, using a SIP proxy or by whitelisteing major SIP providers. Skype is no longer possible. IM needs whitelisting, and will likely be blocked, too. None of these options are very favourable for the users. So please do not support "obfuscated" Protocols such as Kazaa or Skype, or an obfuscated variant of BitTorrent. Stick with stuff administrators can set up policies for - and be nice to your admins. Tunneling via non-standard ports, hiding services will only get you into trouble, and probably even make innocent other users suffer. After all, filesharing - especially illegal downloading movies and music - is not THAT important, is it? So please make the important services not suffer from it. Thank you. Oh, and please use SIP, not Skype. Because your admin can whitelist your SIP provider if you tell him you need it for work or setup a proxy for that - and with Skype, he might be afraid that you become a supernode and cause high traffic costs. And then there is a much larger software choice for SIP, including many OpenSource solutions, including PBX software such as Asterisk.

Clint Adams: He wore a hat

It was wintertime somewhere in the Ozarks, in the days before the Soft Scape. A young boy named Timmy was born unto a poor family that already had one son. When that brother was killed in an accident, the parents boxed up all his possessions and hid them deep within the attic, not wishing to be reminded of his former existence. Some said that it was the only healthy option open to them, and some said that it was an ill-fitting tribute. In any case, Timmy barely even found out that he had had a brother, and any memories he developed of him were false. As Timmy grew, he sprouted hair, and learned to speak, and learned to pray. Every night, before going to sleep, he petitioned God, Please keep mommy and daddy safe. If he had had a brother still, he would have prayed for him too. The years went by, and Timmy went to school, and someone surprised him with the claim that he had once had a brother. He asked his parents about this when he got home, and they rather loudly instructed him not to discuss such things. He dropped the matter, but remained perplexed and afraid to ask any more questions. It was a long time before his explorations of the attic yielded the discovery that precipitated a great big scene. When his father saw that he had retrieved some of his brother's possessions, he beat him, and his mother screamed that if he ever went up to the attic again, she would cut off his pee-pee , and everyone was upset for quite some time. Mistaking this parental love for abuse, he drew away from them, and began to wander and drift. In the summer of his fifteenth year, he learned that love was a hobo's hand. Then, that winter, he left his parents' house for the last time. Finding himself overwhelmed by the eternal struggle for food and shelter, he started turning tricks for small change. This proved to be a dangerous occupation, and Timmy's life was rife with anxiety for quite some time. Presently, Timmy came to a little town, and in that little town lived a fireman and his wife. The fireman felt that it was time to experiment, and and inquired if Timmy would accomodate him. Timmy was more than happy to oblige for a reasonable fee, and the fireman was more than happy to continue to pay it. His wife was less than happy about the whole affair, for she felt that it reflected poorly on her as a woman, and she feared that if word got out, she would be the laughingstock of the town. Timmy was unconcerned with such issues. Some said that he was morally bankrupt, and some said that he was a practical businessman. In truth, though, the money became utterly unimportant to him, as he spiraled toward a psychotic breakdown. He had developed a fantasy wherein the fireman would leave his wife and take Timmy away, maybe to somewhere like Alabama, where no one would oppress them. As he obsessed and clung to this dream, he pulled farther away from reality and other human beings. The fireman was relatively unconcerned, but the fireman's wife grew more worried by subtle nuances that she noticed over time. You must stop this! she insisted. Give me my space! he insisted. The ongoing argument devolved into citations of marriage vows and Biblical passages, which were conveniently inconclusive. The fireman's wife was a God-fearing woman, and she knew that she could not violate 'til death do us part without being struck down, and that she could not invoke the old 'til death do us part loophole without violating thou shalt not kill and being likewise smitten. Thus she was at an impasse. Some said that she was a victim of a bad situation, and some said that it was her own fault for letting it happen. Timmy's relationship with God was much more complex, though now almost completely forgotten. He had also almost completely forgotten the existence of the fireman's wife, else he might have thought to plot against her. This memory lapse was abruptly corrected when the fireman's wife threatened Timmy. Timmy was upset and distraught and threatened her back. The fireman announced that he was tired of them both, and moved to Alabama on his own. Some said that it was irony, and some said that it was an owmen of things to come.

6 February 2006

Martin F. Krafft: Counting peas in Switzerland

Switzerland is bloody expensive, you surely don't want to be shopping here. For instance, I wanted to get myself the Lonely Planet Guide for Laos and Myanmar, both of which have had new editions released in 2005. Their price is a little more than 20 each, including the German VAT of 7%. If you buy the book in Switzerland, it's between 40 and 50 CHF (incl. 7.6% VAT), which is almost 10 more than the German price. Despite the fact that I cannot find the 2005 editions neither in Swiss stores nor on amazon.de, I'd be looking at a slight problem. Either, I can pay the higher price in Switzerland (in addition to shipping), or I can order with amazon.de (or the like) in Germany, who will subtract the VAT and ship it to Switzerland for free. Sounds great, huh? Well, it isn't really, because in Switzerland, receiving packages might mean you have to pay VAT, and not only that, they also make it unnecessarily complicated: If the goods you receive are valued less than 75 CHF, you do not have to pay VAT. However, if you do have to pay VAT, the VAT and a nominal service charge of 10 CHF count towards those 75 CHF, which means you effectively have to stay below (75 - 10 - VAT) CHF, which is 60 CHF or thereabout. Translate that to Euros, we're talking about 38 . Thus, if you want free shipping and no VAT, you have to place orders between 20 and 38 -- 20 is the minimum price to get free delivery if your order is not entirely made of books, in which case delivery would be free even below 20 . You do not want to place orders higher than 38 ever, because VAT in Switzerland is higher than the VAT for books in Germany, and the additional 10 CHF charge is not going to make up for it. So the only way for me to obtain the two books is either through the overpriced Swiss bookstores, or via two separate orders to amazon.de so as to not exceed the 38 limit. The maths gets more fun when you get away from books. For normal goods, VAT in Switzerland is still 7.6%, but 16% (and maybe soon 19%) in Germany. Thus, you will want to stay below 38 , unless the total value of the goods exceeds an amount where the cheaper 7.6% VAT + 10CHF service fee is lower than 16% VAT. This drives the limit up to 121 CHF, or about 77 . Now, if you think this is complicated, stay put. I am looking to buy myself the DrayTek Vigor 2900VG router, for which is around 265 in Germany including the 16% VAT, and 421 CHF including the 7.6% VAT in Switzerland. These prices square, but they're not including shipping, and if I would order the German product for delivery to Switzerland (which they are not willing to do, but anyway), I'd have to add the 10 CHF service charge and the 7.6% VAT. I also would not be able to claim the 16% VAT paid in Germany with EU customs because I am not a full resident of Switzerland. Man, no wonder taxes have had a long history of violence. Now I also received a 35% rebate offer from the Swiss distributor, driving the price down to 274 CHF, which is clearly a hell of a lot cheaper than the German product. So what am I waiting for? Well, Germany being an EU state and all, the German shop has to give you a 30 day return warranty and a 2 year product warranty. In Switzerland, you get no return warranty and only 1 year of product warranty. My dilemma thus becomes: are 30 days return warranty and an addition year of product warranty worth the difference of roughly 150 CHF? Seems like the answer must be "no". But I know that if I order it in Switzerland, it will break after 366 days, by the laws of Murphy. I have now asked the German distributor to match the 35% rebate. If they will, I'll order the device to my parents house in Germany. If they don't, I'll take it up with Mr. Murphy. PS: If you think the DrayTek Vigor 2900VG is not a good choice, speak up now!

Uwe Hermann: HOWTO: Encrypted USB thumb drives and (USB) hard disks using loop-AES

Yet another thing that has been on my TODO list for quite a while: encrypted USB thumb drives and/or encrypted external USB hard drives. I have finally tried this over the weekend using loop-AES. This is very useful for securing your USB thumb drive contents in case you lose it or it gets stolen. Also, I use an external USB hard drive for backups (previously unencrypted). This is encryped now, too. Here's a quick HOWTO:
  1. Get the loop-AES kernel patches, apply them, enable "AES encrypted loop device support" in "Device Drivers -> Block Devices -> Loopback device support", and recompile the kernel.
    I also enabled "loop encryption key scrubbing support" as it seems to promise higher security (can anybody confirm that?).
    If you're using the Debian kernel packages, apt-get install loop-aes-2.6-686 (or a similar package) should suffice.
  2. Get a loop-aes enabled losetup, mount etc.:
    apt-get install loop-aes-utils
  3. Securely delete the target partition: shred -n 1 -v /dev/sda3.
    Use -n 25 or higher if you want more security and have a few days time to wait for the thing to finish...
  4. Setup the loopback device: losetup -e aes256 -C 3 -S 'seed' /dev/loop0 /dev/sda3.
    Notes:
    • I used AES-256 as cipher, but others are possible.
    • The -C 3 means "run hashed password through 3000 iterations of AES-256 before using it for loop encryption. This consumes lots of CPU cycles at loop setup/mount time but not thereafter." (see losetup(8)). This is supposed to be more secure.
    • Using -S 'seed' (replace "seed" with a secret string like "g7sN4" or something) should make brute force attacks a bit harder. Don't forget the seed!
    • You'll be asked for a passphrase > 20 characters. Choose a good one. Don't forget it!
  5. Create the filesystem (I used ext3): mke2fs -j /dev/loop0
  6. Detach the loopback device: losetup -d /dev/loop0
  7. Add this to /etc/fstab:
    /dev/sda3 /mnt/crypted_sda3 ext3 noauto,loop=/dev/loop0,encryption=AES256,itercountk=3 0 0
  8. Mount the (now encrypted) partition by supplying the seed and entering the chosen password: mount -o pseed=seed /mnt/crypted_sda3
  9. Done. You can now copy stuff to /mnt/crypted_sda3 which will be encrypted automatically.
For a more detailed guide read the Encrypted-Root-Filesystem-HOWTO. A performance comparison of different ciphers is available, but in general I didn't notice too much of a slow-down because of the encryption...

Benjamin Mako Hill: Lost and Still Lost @ The Acetarium

Who ever said that the rewards of free software hacking are immaterial? Last summer, I described how Debian hackers traveling through 106 Haven in New York tended to leave leave with lighter bags than they arrived with. After the GPLv3 kick-off a couple weeks ago, I can say the Acetarium's visitors have been no less generous. That said, Mika and I are not as confident in our ability to identify the owners of misplaced items. Perhaps you can help. They say that the sum can be greater than its parts. Mika has discovered that this may, in fact, be the case with the Acetarium's lost and found. If you recognize this man is or can lay claim to any of his parts or possessions, please contact me and help us get him home.
/copyrighteous/images/lost_man-small.png

Next.

Previous.