Last Sunday I Watched Corpse Bride, an animation film by Tim Burton, following what was made in The Nightmare Before Christmas. Of course, animation has improved a lot since 1993 and now this film is plagued of close images of different characters. Though being a bit gore, the plot is quite interestig. Victor, who is going to marry Victoria, as their parents have agreed, messed up his vows during a wedding reharsal (the same day he meets Victoria for first time) and wanders to the forest close to the town, where he starts reciting them again. When he says them right, he accidentally marries the Corpse Bride, messing things even more. Now he has to decide to try to still marry Victoria, or go on living with his new wife. One of the problems we have in Spain with these animation movies is that lately they're are selling that most important roles are being played (dubbed) by famous actors. In this film, Victor is Johnny Depp, the Corpse Bide is Helena Bonham Carter and Victoria is Emily Watson. But as films here are always dubbed to Spanish, for us it is completely indiferent who the actor giving his voice to a character is. And this is worse when the Spanish actor that usually idubbes here an actor is not dubbing the animation film for whatever reason.

It is annoying to receive hundreds of bounces of mails I never sent. I can sympathise with the senders, although there is an effective technique to cutting them (reject mail, do not bounce it). However, when I get a mail asking me to confirm that a mail that I never sent is not spam - when it actually is - I get mad. It is very inconsiderate to send such mails: it is comparable with emptying your garbage bin on your neighbour's property. People who set up such autoresponders probably do get a spam-free zone; however, they do it by offloading the problem on Somebody Else. It is well known that spam return addresses are bogus, sometimes nonexistent but often owned by third parties who have nothing to do with the spam. I get a lot of spam myself, thank you; I do not need yours.

Just uploaded to experimental a new version of grep-dctrl, 2.3. It can do numeric comparisons:

ajk@kukkaruukku[01:02:34]:dctrl-tools$ grep-available -FInstalled-Size --gt 100000 -sPackage
Package: openoffice.org-bin
Package: atlc-examples
Package: xlibmesa-dri-dbg
Package: vtk-doc
Package: gcc-snapshot
Package: fgfs-base
Package: gcc-experimental
Package: libopenh323-dbg
Package: vegastrike-data

I am taking part for the second time in the (Inter)National Novel-Writing Month. The goal is to write 50000 words in one month of novel-like prose, regardless of quality. Essentially, it is a group effort of producing novel first drafts in a fairly good pace. Seems to work for some people, but I'm lagging behind with no realistic hope of catching up. I am writing each day, but my output is on the order of 500 words a day, not the 1700 words a day that the official goal requires on average. So, I'd properly belong in the International Write Something Month (IWriSloMo), affectionally known as I Write in Slow Motion. The goal there is to produce 200-250 words of bad short fiction (bad, short and fiction being all optional) each day in one month. But I think I'll stick with NaNoWriMo - there's gotta be the losers, too, you know :) And I get a noticeable boost from being able to compete in my own weight class (I can order participants by word count, and I can try to up my position on that list:). My current minimum goal for each day is to restore myself to the first page of Finnish contestants. So far, I have been successful. So what am I writing? It is a Horatio Hornblower pastiche set in the 25th Century and the setting is space. I can hear you yawn, but hey, nobody said it was any good! :)

Interesting.

How surprised am I.

I'm not sure why, it must be said...

Weblog Software

I’ve been keeping an online journal over at LiveJournal since 23rd February 2002. To support them I actually bought a “Permanent Account” a while back, an example of putting money behind companies and/or services which are useful - even when it isn’t required. After getting into the swing of things there I started the blog which is used upon Planet Debian and have also been enjoying that. Livejournal is a nice service, and they have great software powering the site. The Livejournal code is available and it is reasonably simple to install. (I’ve setup a few installations of the codebase, and played with them. I admit I’ve never run it in anger). Obviously it is completely overkill to run your own installation of Livejournal - unless, perhaps, you’re a school or a large company. So for my personal blog I use Wordpress. I don’t particularly enjoy using wordpress. To be honest I need only four features/abilities of weblog software:

• The ability to create posts.
• The ability for users to be able to leave comments upon entries.
• The ability to search previous entries.
• The ability to export the blog entries as a feed.

Everything else is utterly overkill. The downside of using Wordpress is threefold:

• Because it is popular there are multiple bots crawling the web and leaving spammy comments.
• Because it uses some funky addressing system any replacement would leave lots of broken links.
• It has historically had a couple of security issues.

I’ve been telling mysefl for the past few months:

• This software has got to go.
• I’ll wait until there is another security hole discovered.

So .. HTML::Template & CGI::Application will at some point come to the rescue. I’m just not sure when. I guess this means I’ve not yet written a bloggin system…. I want to only cover the basics:

• Multiple users.
• Multiple catagories/tags.
• Comments with a sane anti-spam system.

PS - The Sisters of Mercy rock.

This posting is part of my Finnish criminal court series. See the introductory essay for more information and an overview of the Finnish criminal court system. The following is a fictional account of a criminal case, one of the most frequent ones, written in the form of a play script. A PDF is also available. There is also an OpenOffice-generated XHTML renderition, which may be more pleasant to read than the version below (but lacks most of its logical markup). DRIVING WHILE INTOXICATED
A glimpse of Finnish criminal justice
Part One Dramatis personae
Presiding judge
Prosecutor
Defendant Extras
Three lay judges
Court reporter Sets
Courtroom
Courthouse lobby DISCLAIMER This is a work of fiction. Although this play is based in general terms on real life, all the specific characters and events portrayed or described in this play are fictitious, and any resemblance to real people or events is purely coincidental. The verdict presented is fictitious, and while it is based on the author's understanding of the law, it may be erroneus. No legal advice should be inferred from this work of fiction. Scene One: And so it begins The courtroom is about the size of a large school classroom, and shaped as a rectangle in terms of floor layout. The judges' bench, a long wooden table, lays near one of the short walls; the space between the bench and the wall is enough to give the judges and the court clerks comfortable room to sit and to move behind the sitting judges. At the center of the bench is the seat of the presiding judge, who has easy access to a telephone, a public address system and a panel for controlling the LED display visible in the lobby above the courtroom door. To his or her right is the court reporter's seat in front of a PC and in control of recording equipment. To the reporter's right there is room for one additional individual. To the presiding judge's left, there are three chairs for the lay judges. If one were to stand directly opposite the presiding judge, on the other side of the bench, one would find an open Bible. In front of the bench, disregarding the Bible, there is some room, approximately two meters or so. Along each long wall there is a small table, and those two tables face each other, and are therefore turned sideways from the bench's point of view. By the desk on the bench's right is the seat of the prosecutor, and the other, facing desk is reserved for the witness being examined. Facing the bench, separated from it by that empty space, are two rows of tables with chairs. Beyond them there are two rows of seats for the audience without tables; the farther row is right at the other short wall. The long wall to the judges' right contains one double door leading to the court building lobby, and the other long wall contains two sets of double doors at each end of the wall, leading to a part of the building not accessible to the public. We'll call the door closer to the bench the judges' door. The PRESIDING JUDGE is a 50-something man dressed formally in black and blue. The three LAY JUDGES are more casually but still essentially formally clothed. LAY JUDGE ONE is a sixty-something male, LAY JUDGE TWO is a female in her fourties and LAY JUDGE THREE is a female just under thirty. The COURT REPORTER is a female in her fifties, also dressed formally. It is 9:00. The four JUDGES and the COURT REPORTER are sitting on the bench. Each JUDGE has papers in front of him or her, the PRESIDING JUDGE's stack being by far the thickest. The PROSECUTOR, fourty-something man, enters through the judges' door, carrying law books and a large stack of paper. He sits down at his desk. PRESIDING JUDGE (Nodding to the prosecutor.) Okay. Let's start. (Enters codes on the LED machine. Then picks up the public address microphone.) The criminal case 'prosecutor against Matti Meik l inen' begins in room three. Parties to room three. Scene Two: Main hearing The DEFENDANT enters through the double door from the lobby. He feels a little lost. PRESIDING JUDGE (To the defendant:) Matti Vihtori Meik l inen? (DEFENDANT nods.) Please, take a seat in the front row. (He waits for the defendant to comply.) This case will be tried as follows. First, the prosecutor will read the charge. You will then respond by telling us if the charge is correct or not, that is, if you in fact did commit the acts specified in the charges, and if you did not, or the charge is only partially correct, you should state briefly why the charge is in error. The prosecutor will then present the case, he will describe us his understanding of the events in question. When he is finished, you will again have opportunity to state if the prosecutor is correct or not, and if not, in what way is he wrong. If there is disagreement between you and the prosecutor, we will hear the evidence. After that, the prosecutor will state his or her concluding opinion of the case as presented here. Again, you will have the opportunity to respond. We will conclude with discussion of what punishment, if any, would be appropriate. The court will then discuss the case alone, and will finally announce the verdict. Is this understood? (DEFENDANT nods.) Okay. Prosecutor? PROSECUTOR (Reads the charge from a paper everyone has in front of his or her.) I demand punishment to Matti Vihtori Meik l inen for driving while intoxicated. Matti Vihtori Meik l inen had on the first of May this year operated his car while his exhaled air contained 0,597 milligrams of alcohol per liter. Matti Vihtori Meik l inen's driving license must be suspended. PRESIDING JUDGE (To the defendant.) Is the charge correct? DEFENDANT Yes, it is. PRESIDING JUDGE Okay. The prosecutor will now tell us the circumstances and events in detail. PROSECUTOR Thank you. It was to my understanding late evening on May day, and the defendant had come from a bar and was apparently trying to move his car to a cost-free parking space. A police patrol happened to observe this and the defendant had apparently been a little shaky in his walking, so the officers gave him a breathalyzer test, which showed significant alcohol content. The defendant was brought in the station where a precision test was performed. The first reading was 0,597 and the second reading was 0,617; the mean of these two is 0,607, and after performing the confidence subtraction, the reading 0,597 milligrams per liter was obtained. PRESIDING JUDGE (To DEFENDANT) Well then, is what the prosecutor just said true? DEFENDANT (Speaking in a colloquial manner and very somberly. He is ashamed and wishes this would be over soon.) Yeah, it is. PRESIDING JUDGE All right. It seems to me that there are no points of disagreement, so we don't need to hear witnesses. (The PROSECUTOR nods.) Okay, it's time for the concluding statements. I think we will hear consequence opinions at the same time. Prosecutor? PROSECUTOR Thank you. I don't think there is much to say. The case has been shown beyond reasonable doubt, in my opinion. We have the precision test readings and the defendant's admission. As to the penalty... the amount of alcohol we are talking about is just below the limit for serious intoxication, so this is no small deal. On the other hand, the circumstances were not very dangerous. I think suspended imprisonment could well be considered, though a stiff fine would probably be more appropriate. The driving ban must be fairly long, obviously. PRESIDING JUDGE All right. (To the defendant.) Do you have anything to say before we adjourn to consider the case? DEFENDANT Well, I suppose it's clear that something is going to be given to me. I prefer a fine, naturally. PRESIDING JUDGE Naturally. The court will consider all options. Do you have any special requests concerning a driving ban? DEFENDANT As short as possible, of course. PRESIDING JUDGE Do you have a particular need for a car, do you need it for work, for example? DEFENDANT No. PRESIDING JUDGE Okay. Now, your income. We have here the last completed tax report for you, it says you earned 500 euros a month and had no children. Has this changed? DEFENDANT No change. PRESIDING JUDGE Okay, thank you. If you will then go outside to wait while we consider this case, thank you. The DEFENDANT exits to the lobby, the PROSECUTOR exits through the judges' door. Scene Three: Deliberation We are now in the lobby outside the courtroom. There are many doors that lead to many courtrooms. Above each door, attached to the wall, is a display showing the current case number; there is also a light saying do not enter, which is lit for most of the rooms, including Three. Also there is a numeric display which is out at the moment for most of the rooms. For some rooms, they indicate when the session will resume. Each courtroom door also has a paper pasted to the door frame listing the cases for the day. The door leading outside is separated from the lobby by a routine security check area, and one of the courthouse police guards stands there waiting for people to enter. Some other guards and janitors sit in their glass booth. There are many people sitting on the chairs, waiting for their turn to enter one of the courtrooms. DEFENDANT enters from the Courtroom Three door and sits down, waiting. It takes about fifteen minutes. During this time, announcements from other courtrooms could be occasionally heard, and people would enter or exit other courtrooms. Then... PRESIDING JUDGE (Over the PA) Verdict in the case 'prosecutor against Matti Meik l inen' in Courtroom 3. DEFENDANT exits through the Courtroom Three door. Scene Four: The Verdict The DEFENDANT enters from the lobby and sits down. After a minute, the PROSECUTOR rushes through the judges' door. PRESIDING JUDGE (Announcing to all people present.) The District Court has examined this case and has decided that Matti Vihtori Meik l inen did in fact commit the crime he was accused of in the way specified in the charge. The justification is the combination of the measured alcohol content in Meik l inen's breath and his own admission of guilt. Matti Vihtori Meik l inen is therefore sentenced to pay sixty-five day-fines, that is three hundred and ninety euros. Penal code, Chapter 23, Section 3. His driving license is suspended until the first of November this year. Road Traffic Act Section 75 Paragraph 1. One who is dissatisfied with this verdict can appeal it to the Vaasa Apellate Court within thirty days. Dissatisfaction must be declared, however, either right now to me or within a week to the Office of this District Court. (To DEFENDANT) Come and take the fine ticket and written appeal instructions (DEFENDANT takes those from the COURT REPORTER.) This hearing is concluded. The DEFENDANT leaves, as the court and the prosecutor prepare for the next case. TO BE CONTINUED
(with the next case)

I spent the whole weekend looking for a DRM-encumbered Sony CD so that I could check for myself whether my code was really being redistributed without permission. I eventually found one: Suspicious Activity?, by The Bad Plus. A rather enjoyable post-modern jazz album. I am rather lucky, it could have been C line Dion. As expected, installing the CD s custom player also installed a stealth aries.sys driver along with a few other interesting files such as $sys$DRMServer.exe, all hidden in a $sys$filesystem directory. I rapidly got rid of this cruft and started studying the really important file, ECDPlayerControl.ocx. It is the file Sebastian Porst and Matti Nikki found to be containing parts of mpglib, LAME, faad2, VLC... Evidence that the DRMS code comes from VLC There are of course obvious similarities between some functions and structures of ECDPlayerControl.ocx and the ones in VLC s source. However, given how precise the implementation of a cryptographic protocol needs to be, the possibility that two separate implementations show many similarities must not be dismissed. The data structures and constant tables especially are likely to be identical. I think however that I found strong enough evidence that this is not the case here. The original drms.c was written by Jon on 01/05/04. I then hacked on that file on 01/18/04 and reorganised it, also replacing the reverse-engineered MD5 and AES functions with clean implementations, then Jon added DRMSv2 support on 05/05/04 and I reorganised the code again on 05/08/04. Some of these changes were specific to VLC (not in that they made the code unusable outside of VLC, but rather that they made it possible to use an external MD5 hash provider, for instance), so they were the bits I was looking for in ECDPlayerControl.ocx. For instance, Jon s original code had the following instruction:

p_acei[ 4 ] = 0x5476212A;

Since all bytes of this long word are comprised between 0x20 and 0x7f, it was later rewritten like this:

char p_secret1[] = "Tv!*";

This change makes the code more human-readable because many other secrets in the Apple DRMS protocol are ASCII strings. Also, I know how to look for binaries that use the string "Tv!*", but it takes me some more time to think of a way to find binaries that use 0x5476212A. And the Sony rootkit uses the following (only relevant lines shown):

 .text:100883B8   mov   cl, byte ptr ds:xxxxx+4 ; 0
 .text:100883C2   mov   eax, dword ptr ds:xxxxx ; "Tv!*"
 .text:100883C8   mov   [esp+70h+yyyyy], eax
 .text:100883DC   mov   [esp+7Ch+zzzzz], cl

The use of xxxxx+4 shows that ECDPlayerControl.ocx uses a string instead of a 32 bits integer to store the secret, disregarding the fact that the 5th character of the string (a null char) is never used. Another example: in this commit I reorganised the DoExtShuffle() function, merging FourthPass() and FifthPass() and discarding a structure allocated on the stack. What is important here is that DoExtShuffle() was built by a complex combination of choices, the main purpose of which being to reduce the size of the C functions:

 static void DoExtShuffle( uint32_t * p_bordel )
  
     uint32_t i_ret;
     i_ret = FirstPass( p_bordel );
     SecondPass( p_bordel, i_ret );
     ThirdPass( p_bordel );
     FourthPass( p_bordel );
  

Note how i_ret is not reused and could be merged into the p_bordel array, or maybe SecondPass() merged into FirstPass(). This choice is definitely a legacy of how the code evolved. And the Sony equivalent: a perfect match.

 .text:10089F3C xxxxx:
 .text:10089F3C   mov   ecx, esi
 .text:10089F3E   call  yyyyy
 .text:10089F43   push  eax
 .text:10089F44   mov   eax, esi
 .text:10089F46   call  zzzzz
 .text:10089F4B   add   esp, 4
 .text:10089F4E   call  ttttt
 .text:10089F53   call  uuuuu

After having studied the Sony code for a while, I have of course gathered dozens of such examples. But I also discovered a few new things. Where does the DRMS code come from? The code undoubtedly comes originally from VLC, but it has traveled a lot. I would be surpried if it came directly from VLC, as no other part of VLC is included with the rootkit. And although there are parts of FAAC in the Sony code and FAAC includes VLC s drms.c, the version currently in the FAAC CVS is horribly outdated. Sebastian Porst also noticed a few obvious differences between the Sony code and the version of drms.c present in VLC. The most obvious being this one:

 if( p_shuffle->i_version == 0x01000300 )
  
     DoExtShuffle( p_bordel );
  

Which became:

 .text:10089F2E   cmp   eax, 1000300h
 .text:10089F33   jz    short DoExtShuffle
 .text:10089F35   cmp   eax, 1000400h
 .text:10089F3A   jnz   short skip
 .text:10089F3C DoExtShuffle:
 .text:10089F3C   ...
 .text:10089F58 skip:
 .text:10089F58   ...

That 0x01000400 is a version check for 4th generation iPods firmwares. I also discovered at least 40 KB of new lookup tables that seem to be used for more buffer shuffling. At first I thought it was simply F4I s DRM implementation, but the shuffling calls are nested with iPod hardware information retrieval from our DRMS code, so they re really part of drms.c. Sony distributing a DRMSv3 descrambler? The only explanation I can think of is that someone took the VLC code, added support for an upcoming Apple DRMS format version and redistributed the software without letting the VLC authors know, probably violating the GPL (I only say that because I have not found the software yet, but I feel pretty safe in saying it). Since it is based on GPL software, I was already entitled to ask Sony for the source code of ECDPlayerControl.ocx. But as the copyright holder of a significant part of the software they counterfeited, maybe I have a greater chance of being heard. Not that it would be difficult to reverse-engineer it yet another time, but it would be awesome if the next opensource iTunes Music Store file player was contributed by Sony!

I've been recently investigating a poorly maintained box (granted, it was just a workstation used for surfing the web) which was behaving oddly. In fact you could not longer login via SSH. I quickly noticed that there was a non-working sshd on it, in /usr/local/bin. So I thought - why would a badly maintained box have a non-standard SSH on it? This made me very suspicious, so I immedeately ran chkrootkit. It didn't find anything except it told me that someone had tampered with the wtmp file. The "tampering dates" aligned with the creation times of the ssh. A quick "find" run came up with the tool to do so, too. A quick check in the logfiles - which were fine, since they were not standard syslog, probably - showed that a SSH scanner had managed to login into an unprivileged account with a weak password, then used a kernel exploit from january to gain root privileges. Apparently he was unsatisfied with the sshd on the box, so he tried to put a different version on it, which, well, didn't work and he could no longer logon to the box himself. A rootkit was apparently not yet installed (verified after a clean boot), he was just about to setup his own sshd... maybe he had noticed that the box was just a stupid surfing box and then didn't care enough to cover his tracks (or just shoot himself in the foot by breaking the sshd) So if you are running boxes on the internet:

• Make sure you don't allow shell logins with weak passwords
• Have your system and kernel up to date (note: you need to reboot for activating a new kernel...)
• Don't run an sshd unless you really need to
• Maybe setup a recent-match filter to stop ssh scanners
• Scan your log files for unusual entries such as logins by users who shouldn't really exist in the first place... Use logcheck.
• Don't allow PHP scripts to run binaries on your system ...
• Or better, don't allow PHP at all

(PHP guys: yes, I know that there are some good PHP scripts. But there are tons of badly written ones, too... and PHP is a major intrusion vector, and the privilege escalation I've seen here would have worked just fine with a PHP installation not using safe mode and safe_mode_exec_dir) A firewall I maintain at our university has been tracking ssh connections using the recent match for quite some time, and a nice side effect is that it reduces all their "spam" in your logs, too (in case you bother to read them. Do at least read the logcheck results!)

I found in my mailbox this morning an announcement of my acceptance as an SPI Contributing Member. I was actually somewhat suprised as it was a while ago that I applied (sometime around July or August, IIRC); I’d almost forgotten that I’d even done so. Happy times.

I knew it for a while already, but now it's official: The point of this exercise? To point out how silly most of those memes really are. I mean, my blog would be worth nothing 'cause I don't use any technorati tags? What's next, I'm not officially using a computer if it doesn't run Windows? Hah.

Ray Ozzie: “As an industry, we have simply not designed our calendaring and directory software and services for this ‘mesh’ model. The websites, services and servers we build seem to all want to be the ‘owner’ and ‘publisher’; it s really inconsistent with the model that made email so successful, and the loosely-coupled nature of the web.” Great stuff. Can’t wait to see what comes of this. Personally, I think synchronization is going to be one of the key platform features of Web 2.0. As I’ve said before, I simply don’t buy that we’re just around the corner from ubiquitious network connectivity, and absent that, we’re going to have to deal effectively with the disconnected operation problem.

Social network services (Wikipedia) such as Friendster, Linkedin, OpenBC are one of the top "web 2.0" hypes. I'm very sceptical about them, because I don't see the real benefits for me. (I'm referring to the pure "keep contact with your schoolmates" thing, not stuff which does much more such as serious blogging - e.g. livejournal - or planets such as planet.debian) The typical use case I've heard is much like "Imagine you have made a cool product, and want to sell it to some company. Now you can search for people at that company you know (or a friend of yours knows) and call them, this will help you get a feet in the door", as well as "you can use it for finding a job". I think that's bullshit, and to a large extend because I'd neither be willing to update my information in these services all the time, nor would I be willing to help just everybody here - most likely I'd just delete and ignore the email, and be really annoyed by a call (I'm annoyed by calls anyway)... It's not that I despise social networking per se. But I despise quantity instead of quality. I care a lot for my friends, and I'm in several groups grown around some technical issues; when someone is looking for a job I pay attention for suiteable offers around me; if someone needs something else I do try to help. But I'll only do that for people I'd really call friends. If you just want a quantitative number, last I checked my ranking was #36 in the global PGP keyring, meaning I have the 36th shortest average distance worldwide to verify a cryptographical key. So what? Of course I also tried one of the social networing services given above, joined a group for a university I was at. Even before the adminstrator of that group added me, I got an "invitation" by one "linkaholic". I rejected it, and even considered to report it as "spam" to the operator. I did indeed know that person, but all we had was a flamewar on a mailinglist, and I found him highly unsympatic. So why should I add him to my network? Where are the benefits for me (except that I'll maybe get an annoying call sometime in the future, when I could have forgotten about him)? No, in my opinion this social networking hype is built entirely on a hype, basically saying "look how well-connected I am, everybody knows me, and I know everybody", even when these relationships are only present on the computer, without anything worth being called a "relationship" behind. The flame-war I mentioned earlier was btw. on the topic of Resume/CV books. Which are even worse than this social networking thing, IMHO.

Oh man, this is soooo cool! I wonder if there’s enough space for a proper hard drive in there?

The photo is from yesterday, but it is still new for most of you so the photo-a-day is still going strong for me :)
Today was spend in a very productive fashion - bugfixing. I had a lot of feedback for SBackup over last couple of months - it was time to fix some of the bugs people were reporting. Therefore version 0.9 of SBackup will be hitting you nearest mirror as we speak (I mean, I am uploading it now :)).
This realease is mostly a hey-this-thing-is-still-alive-and-kicking-ouch release and it also includes a TODO file with my plans for its future. I expect more feedback both on features and bugfixes for the stable 1.0 branch and for the planned 2.0 rewrite.
Also I spent couple of hours reviewing Wiki engines with an idea to put one on SourceForge to provide documentation for SBackup - I found no good candidates. I wanted a simple wiki, preferably in python, with MySQL database (SourceForge mounts web directories read-only). Not good. Now I am considering making a page in Wikipedia and using that as a documentation page. Scream at me violently if have any other solutions :)