Search Results: "spa"

3 April 2006

Martin F. Krafft: Windows kiosks

They have kiosk PCs here at the airport, running Windows 2003 over Citrix MetaFrame. Apart from being ass-slow, these systems attempt to be highly "secured": only Internet Explorer is running, the task manager is disabled, and the Citrix MetaFrame apparently sits behind a fascist firewall, which seems to integrate with Windows to a point where Putty could not establish an SSH connection to a server running sshd on port 443 (HTTPs). What the system administrators of course did not realise (and neither does Microsoft), is that Internet Explorer is such an insecure piece of crap that it's effectively no problem to do whatever you want through its holes and bugs. It tooks me only about twenty minutes until I had access to my USB stick, and another five until Putty was negotiating SSH with the help of the Internet Explorer Java Console, which happily relayed my traffic as coming from the iexplore.exe process. I always tend to smile when people talk about locking down Windows, and I regularly find new reasons to do so.

Pierre Habouzit: @debian.org and Spam (#3) alioth

Following my recent posts about SPAM in our wonderful project, Rapha l Hertzog asked me to improve alioth mail configuration to use my suggestions. Thanks to him, the improvements I've suggested are now all in place, since roughly 12 hours. Alioth Exim's configuration had a couple of problems, and was in a not very satisfying shape. Here is the list of the improvements I've suggested, and that now are in place (hopefuly for our best comfort) : Moreover greylisting has been made more efficient: before, we only greylisted on the pair (sender_ip, sender_domain) which is suboptimal: spammers always forge sender addresses from the same domains (aol, hotmail, ). So in half an hour, aol.com, hotmail.com, were whitelisted, and spammers could just get through, unannoyed. Whereas occasionnal senders on not very widespread domains were always caught. Now, greylisting uses the full sender_address, which is the mildest way to do greylisting. The hard way would be to use the usual triplet (sender-ip, sender-address, recipient-address), but given the fact that alioth does not delivers to that many recipients, not taking it into consideration is a good compromise to avoid a too huge database, with almost the same results. I hope to be able to deliver some nice curves based on alioth's traffic in about 10 days, to see if that worked as expected. Thanks again to Rapha l that made it possible.



for those who are interested, the exim4.conf snipplet to do conditionnal greylisting is :
    # acl that tell if we will greylist or not
    acl_greylist:
        # Check if EHLO greeting is resolvable
        deny
            !verify = helo
        # Deny if the host is blacklisted
        deny
            log_message = match $dnslist_domain
            dnslists = cbl.abuseat.org : dul.dnsbl.sorbs.net : dynablock.njabl.org
        # Deny if the sender address can't be verified
        deny
            !verify = sender/callout=30s,connect=5s,defer_ok
        accept
        accept
            acl = acl_greylist
Notes [1] I really think we sould also check that the helo line is either an IP or a FQDN, but that can come later

John Goerzen: Switched to Serendipity!

Well, finally! I've switched to Serendipity!

The best part: comment spam blocking that works. So to those of you that had trouble commenting on this site... try again. It should just work! (And I'm sorry you had to put up with the hassle so long.)

Serendipity is a very nice system. I'm glad I chose it. And the support from Garvin and the others has been great too.

I'm running 1.0beta2 and have found a few bugs, but nothing serious.

As I mentioned before, I wrote a tool in Haskell to convert posts, comments, and categories from Drupal to Serendipity. If you use darcs, you can fetch it with:

darcs get --partial http://darcs.complete.org/unmaintained/blogcvt

The darcs-impaired may download a tarball.

MJ Ray: Debian-Legal Package List March 2006

March 2006 traffic discussed audacity cdrtools cpp darcsweb doc-rfc-*? emacs21 eterm flamerobin fst gnoemoe grass ibpp imagemagick keyspan mozilla-* panda3d portaudio tetex-base subwiki ttf-dejavu wget wildmagic x264

Uwe Hermann: HOWTO: Disk encryption with dm-crypt / LUKS and Debian

A few weeks ago I published a small HOWTO for using loop-aes to encrypt your hard drive, usb thumb drive etc. As I have bought a new 300 GB external USB disk drive on Friday, I have tried something new this time: disk encryption using dm-crypt / LUKS. It has been suggested to me multiple times that dm-crypt is superior to loop-aes, however I didn't get a real reason. Yes, it doesn't require any kernel patches and is easier to setup. But has any serious cryptographer looked at it sharply, yet? Did it withhold his eye contact? Anyways, here's how I encrypted my 300 GB drive. I largely followed the guide at the EncryptedDeviceUsingLUKS wiki page...
  1. Make sure you run Linux 2.6.16 or better. Previous versions suffer from an implementation problem which affects the security of dm-crypt, see Linux Kernel dm-crypt Local Cryptographic Key Disclosure.
  2. Enable the following options in your kernel:
    • Code maturity level options
      • Prompt for development and/or incomplete code/drivers
    • Device Drivers -> Multi-device support (RAID and LVM)
      • Device mapper support
      • Crypt target support
    • Cryptographic options
      • AES cipher algorithms
  3. Overwrite the whole drive with random data in order to slow down attacks on the encryption. At the same time perform a bad blocks scan to make sure the hard drive is not going to die too soon:
    badblocks -c 10240 -s -w -t random -v /dev/sdb
    Replace /dev/sdb with whatever is correct on your system. If you're really paranoid, and are willing to wait one or two days, do this:
    dd if=/dev/urandom of=/dev/sdb
  4. Install the required packages:
    apt-get install cryptsetup hashalot
    The current cryptsetup in Debian already supports LUKS, which was not the case a while ago, if I'm not mistaken.
  5. Create one or more partitions on the drive:
    cfdisk /dev/sdb
    I created one big 300 GB partition, /dev/sdb1.
  6. Setup LUKS:
    cryptsetup --verbose --verify-passphrase luksFormat /dev/sdb1
    Enter a good passphrase here. Don't spoil the whole endeavour by chosing a stupid or short passphrase.
  7. Open the encrypted device and assign it to a virtual /dev/mapper/samsung300gb device:
    cryptsetup luksOpen /dev/sdb1 samsung300gb
  8. Create a filesystem on the encrypted device:
    mkfs.ext3 -j -m 1 -O dir_index,filetype,sparse_super /dev/mapper/samsung300gb
    I used ext3 with some optimizations, see mke2fs(8).
  9. Mount the encrypted partition:
    mkdir /mnt/samsung300gb
    mount /dev/mapper/samsung300gb /mnt/samsung300gb
    That's it. Everything you write to /mnt/samsung300gb will be encrypted transparently.
  10. For unmounting use:
    umount /mnt/samsung300gb
    cryptsetup luksClose /dev/mapper/samsung300gb
After unmounting, nobody will be able to see your data without knowing the correct passphrase. Drive is stolen? No problem. Drive is broken, and you want to send it in for repair without the guys there poking in your data? No problem. You leave the USB drive at home and some jerk breaks into your house, steals your drive, rapes your wife, and kills your kids? No problem. Well, sort of, but you get the idea ;-) There's more things you can do, thanks to LUKS: have multiple passphrases which unlock your data, change/add/remove passphrases as you see fit, etc. Comments?

Matthew Palmer: A Rebuttal to "Copy and Paste"

Kai, the Unix way to Copy and Paste is far less of a pain than you seem to think it is. To wit:

MJ Ray: Debian-legal Package List

March 2006 traffic discussed audacity cdrtools cpp darcsweb doc-rfc-*? emacs21 eterm flamerobin fst gnoemoe grass ibpp imagemagick keyspan mozilla-* panda3d portaudio tetex-base subwiki ttf-dejavu wget wildmagic x264

2 April 2006

Joey Hess: daylight savings crime

(Hmm, it's time for my bi-yearly DST rant. Here goes.) One of the many lame excuses given for daylight savings time is that it cuts down on crime, since more crime occurs after dark. This might be true of violent crime, since fewer people will be out after dark, but what about other crimes? It's interesting to think about ways that criminals could exploit possible confusion, broken data-keeping, etc around the discontinuity caused by daylight saving time changes. Q: Where were you on the night of October 30th 2005 between 1 and 2 am?
A: Well, I was at this bar with my friends that whole hour, I have an alibi. Ok, that's a bit easy to catch (although there's a real life story of a similar trick being used to avoid manslaughter charges), but what about more subtle cheats? All-night workers last night could pretty easily cheat their employer out of an hour's pay, for 2 am to 3 am. Conversely, if they're not careful, their employer might cheat them next fall. The only people I've ever heard discuss this are all-night radio jockies, but those guys love to hear themselves talk enough that an extra hour to do it in is not a problem to them. I'll bet that a fry cook would rather get some extra sleep. But this is still small, er, potatoes. For really nice exploits you have to take advantage of explicit failures of technology. One such failure is in the way Windows manages daylight savings changes. Unlike Unix, which elegantly flips between two time zones, such as EST and EDT, but still keeps counting each second from Jan 1st 1970, Windows actually changes the clock. Despite a brainwashed nation that has been taught that moving the hands back or forward is the right thing to do, in the world of computers, it's bloody stupid. A google for "daylight savings windows bug" turns up a million or so hits caused by this behavior, describing problems like this:
Windows reports erroneous file modification times, which change according to daylight savings.
And this:
When Windows NT automatically adjusts for daylight savings time, the times on files on Windows NT file system (NTFS) partitions and the events in the event logs are retroactively shifted by one hour, even though the files and event records were created before the daylight savings time change.
Now, I think there's all kinds of potential for criminal fun in file modification timestamps being wrong, and log files having innaccurate times. Throw in the odd backup that fails to run due to being scheduled to run at a time that never exists, and the time slip begins to seem like an ideal time for shady activities. (And a very poor time to be in a hospital hooked up to windows-controlled life-support equipment. Double-dose of morphine, anyone?) True story: A year ago I was at a fancy hotel, which was burgalarised. This hotel had electronic locks on the doors, which logged when the doors were opened, and by whom. The techies whose possessions were stolen were able to use this information, plus what they knew about when the theft must to have occurred, to narrow down the suspects to one or two hotel employees who opened the door at the right time. If those logs went to a machine running windows and the theft occurred during England's change to DST, it's quite possible the logs would have been useless. It's not too far from this kind of scenario to something suitable as an entry in Schneier's movie-plot terrorist threats contest. Although it's worth noting that the airline industry deals with timezone changes all the time, so if they have any sense, the DST change is not an exceptional event for them. One of the interesting things about plane travel to me is the way a plane in flight between timezones is a space in which no defined time zone exists. But I digress.. I suspect that the real source of fetile bugs related to DST is in the interstices between operating systems where programs have to deal with the peculuarities of multiple OSes to behave correctly. Such as this unison/linux/windows bug. Put different systems together and they fail in myriad ways, and there's room in the cracks for criminal activity. Thing is, I don't have a very good criminal mind, at all, so if any of the slightly weak approaches I've detailed above is feasable, it seems to me there must be some terrific scams, techniques, etc, that people who are good at thinking that way, and have the right motivation can use.

Joey Hess: lightning talks update

Well, we have enough lightning talks now to fill the space without anyone having to speak for more than ten minutes. I know I said you have until the 15th to make proposals, but I sorta forgot that I have to come up with something resembling a paper for this, which will probably be a list of the talks that will be given. And it's due on the 6th. So if you have been thinking about proposing a lightning talk, I suggest at least emailing me soon even if you're not ready to add it to the wiki page yet, so that I can pencil it into the schedule. I've marked the talks that I am currently planning on accepting as "accepted" on the wiki, but this is still tenative until the 15th.

Barry Hawkins: Why make a free runtime for Java?

I was at my monthly Java ™ user group meeting tonight, and during the pre-meeting discussion our president Burr Sutter asked a question he usually asks: “So, anybody working on anything exciting?” This typically is taken as “does anyone have a really cool Java ™ project that they are working on right now that would be neat for us to hear about?” I usually sit there, not saying anything. But tonight, nobody had anything much, and I finally spoke up about free runtimes for Java ™. I told them that great progress is being made in the free runtimes for Java ™ arena, particularly in GNU Classpath and Kaffe. After my update, Burr asked a very good question: “Why would you work on a free, open runtime for Java ™ programming language?” My answer follows. You would work on it in order to have a free alternative to a platform governed by the SCSL. You work on a free runtime for Java ™ because a free alternative would be better than what we have now; a closely-guarded and largely ingrown platform. You work on improving a free alternative because you are free to participate without that project demanding (via a legally-binding license) that you can only work with them from here on out, and that nothing you learn while devoting your time and energy to them (without compensation) can be used elsewhere. If you do share it elsewhere, and that project finds out, their legal team will make an example out of your ass. You prefer a free alternative runtime for the same reason that you prefer the free alternatives to the non-free frameworks and platforms available for use on Java(TM). Why is Hibernate so popular? Why is Spring so popular? Why is EJB not? Because innovation by committee, while better than a ruthless, unaccountable corporate entity concerned solely with its own betterment, is still not as good as free, open cooperation and collaboration. Is this idea so new? Don’t we try to teach kids that sharing and honesty is the Right Thing ™ to do? I will probably flesh this out as an article at some point, but I wanted to get something written down tonight, while it’s still fresh in my mind.

Kai Hendry: Copy and Paste

The main thing that makes the Unix Xorg platform so broken is copying and pasting. I’ve seen this rear its ugly head as I’ve been teaching someone about the Debian platform. I like to teach how to search for answers and then copy in samples to try. That’s so hard to do on Debian with poor skills it’s not funny. I’ve seen it written somewhere that “Copying and Pasting” is the single most productive element of everyday computing. The real Unix way of copying and pasting doesn’t use a mouse and it’s far too difficult for average users. This makes me even more convinced that the Desktop should just be the Web browser (Firefox) where CTRL+C/V/X “sort of” works…

Amaya Rodrigo: Debian-edu meeting in Hamburg

At holgi's kitchen, Zobel, White, Amaya, h01ger

1 April 2006

Andrew Pollock: [life] Tour de Cure

Sarah's been helping someone at Google organise the Google Tour de Cure team, and so I've been roped in to ride. I don't know that I'm going to be able to raise a lot of money, as I don't really like asking people for money, and I don't know that many people here well enough to be soliciting donations anyway. I got this generic email to spam people with after registering:
Dear Friends and Family, I recently accepted the challenge of cycling in the American Diabetes Association's Tour de Cure fund-raising event. I am taking part in this event because I believe in and support the Association's mission: to prevent and cure diabetes and to improve the lives of all people affected by diabetes. You, too, can help by supporting my fund-raising efforts with a generous contribution. Your tax-deductible gift will make a difference to more than 20 million Americans who are affected by diabetes and another 40 million who are at risk for developing diabetes. It is faster and easier than ever to support this great cause - you can make your donation online by simply clicking the link at the bottom of this message. If you would prefer, you can also send your tax-deductible contribution to me at the address listed below. More information on the American Diabetes Association, its programs, and diabetes in general can be found at the Association's Web site, www.diabetes.org. To find out more information on our Tour de Cure, please visit http://tour.diabetes.org. Whatever you can give will help! I greatly appreciate your support and will keep you posted on my progress. Sincerely, Andrew Pollock To donate online, click http://tour.diabetes.org/site/TR?pg=personal&fr_id=3323&px=2791919. If this link does not send you directly to my personal fund-raising page, please cut and paste the entire link, from beginning to end, into your Web browser and hit return. To send a donation: Make all checks payable to: American Diabetes Association
Mail to: Andrew Pollock
Google, Inc.
1600 Amphitheatre Parkway,
Mountain View, CA 94043-4933

Andrew Pollock: [life] More animal fostering

A mother and her litter of five kittens (four boys and a girl) were dumped at the animal shelter that Sarah volunteers at, and they needed a temporary home for about 5 weeks until they're old enough to be weaned, de-sexed, and put up for adoption, so they have taken up temporary residence in the spare room. They're about three weeks old at the moment, and very uncoordinated. The mother is only about 8 months old herself, and very affectionate. It's interesting watching her reaction to her kittens mewing. It'll be fun watching them grow up. They're a bit too small to be playful yet, but they're starting to develop their own personalities. Sarah named them:

John Goerzen: Today's New Word: "Tuttled"

So remember Jerry Taylor, the man from Tuttle, OK that threatened to call the FBI on a Linux vendor because an unrelated hosting company had misconfigured Apache?

Well, this story is just getting funnier and funnier.

First off is this story from the Tuttle Times. It basically repeats Taylor's view that the CentOS people were expected to help him with his problem, and that he was somehow entitled to their help. But there are some funny tidbits in the story:

"Phone calls from across the country started coming in to the newspaper and city offices, and e-mails from Switzerland, Australia, Wales and England were received. Many of the web sites discussing the exchange are in foreign languages." I hate to break it to you, but Australia, Wales, and England all speak English.

(Ok, so they did switch from talking about email to web, but it still sounds funny.)

"In their search to find out more, web surfers discovered that the Tuttle Times online forums were hacked, and theorized that it was in retribution for the e-mails. Those forums, however, were corrupted several months ago, and the newspaper s now former web hosts did not repair it after numerous requests. New forums should be available at the Times site in the coming weeks." I'm so glad to know that your forums were merely corrupted for months and not hacked. Sounds like the IT problems in this town extend well past the city building.

Taylor said: "[CentOS is] a free operating system that this guy gives away, which tells you how much time he s got on his hands." Grumble.

Quoting Tuttle Mayor Paxton (trying to say what was more important than this): "We have issues with sewer. People here want better park facilities. They want a library." I think this has just validated every stereotype people have about Oklahoma.


Tuttle is more than 7 times larger than my hometown in Kansas, and yet my hometown has had a library for years.

Jerry Taylor also reported having 500 e-mails and numerous phone messages when he arrived to work Monday.

There's a new blurb on the Wikipedia page about Tuttle about all this. And in their talk page about the now-deleted article on Jerry Taylor, one person wrote: "Mr. Taylor's actions have coined a new term of art "Tuttled", in reference to the invocation of criminal consequences by one who is ignorant of the true situation. Since this is now a part of the English vernacular the story behind the term should be explained to give it an historical context. It is no longer about the action of a single person and an attempt to publicly vilify him, it is about a world-wide common experience of dealing with a Kafka-esque minor government official who, through ignorance, creates problems far beyond their normal sphere of influence. The page should be returned to the public."

The Register has two new stories about it. The first reports that Taylor has been interviewed by all sorts of media and says that he did the right thing. The second, Linux conquered, Tuttle man takes on London is a story about the grandson of the namesake of Tuttle, OK -- who happens to be the current US ambassador to the UK. This person is refusing to pay the regular London car fees. The mayor of London said: "It would actually be quite nice if the American ambassador in Britain could pay the charge like everybody else and not skive out of it like some chiseling little crook."

And finally, there's some incredibly funny photoshop work on this one over at fark.com (you have to scroll down a ways). Also, this comment:

"A small-town American politician wants a British newspaper to turn off the Internet.

Say that to yourself a few times. Please."

Florian Ragwitz: Audio::XMMSClient

Yesterday I did some work for the XMMS2 Debian packages. Thereby I noticed that libxmmsclient0, the xmms2 client library, that allows you to write your own xmms2 clients, is bound to quite a lot of languages, but perl bindings were still missing. I took a look at the library interface and it seemed that creating bindings shouldn't be a big deal. Therefor I gave a try and wrote Audio::XMMSClient. There are still some rough edges, but it works pretty well already. The interface is quite close to the C API, so it's possible to work with it even if documentation, examples and a test suite are still missing. Comments on the API, the namespace and whether this module should go into the xmms2 distribution, like other language bindings, or directly to CPAN are most welcome.

31 March 2006

John Goerzen: Something other than Drupal

I've been using Drupal for this blog for most of its life. However, I'm starting to be quite annoyed by several things:



So I'm planning to switch to something else. Something where blogging will be fun again, without all the hassle of tracking down spam. It looks like either Wordpress or Serendipity, and I'm leaning towards Serendipity for now.

Peter Van Eynde: a stunning crash

Slime tells me "Lisp connection closed unexpectedly: exited abnormally with code 256". I go and see: (sorry for the long line)
* Argh! gc_find_free_space failed (first_page), nbytes=8.
Gen StaPg UbSta LaSta LUbSt Boxed Unboxed LB LUB !move Alloc Waste Trig WP GCs Mem-age
0: 0 0 0 0 0 0 0 0 0 0 0 2000000 0 0,0000
1: 121288 15638 0 0 30022 1 0 0 0 122956040 18168 74632320 0 22771058045587471891756344047460264512912328495970408565885262128721370095226093339014016268704097497686156189724993758756525399616019155487351045354729920444619442123787213803893991126769353775124417090005956563018545473316412289883581293782691217408,0000
2: 131071 6160 0 0 34634 1 0 0 69 141822136 42824 21427888 18640 0,0000
3: 87088 6169 0 0 19167 1 0 0 23 78496608 15520 2000000 19144 0,0000
4: 83996 6219 0 0 30404 915 124 109 106 128215256 1021736 2000000 30427 -0,0000
5: 0 0 0 0 4267 3287 1461 552 283 38188928 997504 40188928 5250 0,0000
6: 0 0 0 0 6127 0 0 0 0 25096192 0 2000000 5774 0,0000
Total bytes allocated=534775160
fatal error encountered in SBCL pid 23015(tid 3076041632):


No, this sbcl session was not started before the big bang :-).

30 March 2006

John Goerzen: Something other than Drupal

I've been using Drupal for this blog for most of its life. However, I'm starting to be quite annoyed by several things:



So I'm planning to switch to something else. Something where blogging will be fun again, without all the hassle of tracking down spam. It looks like either Wordpress or Serendipity, and I'm leaning towards Serendipity for now.

Ross Burton: Furious Anger, Part Two

Thursday 23rd March: DAYLIGHT ROBBERY Friday 30th March: NHS CUTS In the space of seven short days, they've managed to go from hard-line right-wing, give us tax cuts, don't "throw it away" on the state; to full-on fund the NHS more "Daily Express Crusade" your childen are All Going To Die. If these headlines were in The Onion they'd be a fine example of tabloid spin and use of language. But they are serious, and I hate this paper. NP: g tis Byrjun, Sigur R s

Next.

Previous.