Search Results: "beh"

30 October 2008

Marc 'Zugschlus' Haber: Nagios, Parent Hosts, and traceroute on the Internet

Nagios has the - very useful - feature of “parent hosts”. If it deems a host A being down, it first checks its parent host, B, and reports A only as down if B is up. This goes back recursively until a host with state “up” is found and only the first “down” host is actually reported. This keeps on-call people from being bombed with alerts in case of major network outages and makes sure that the alerts that are actually sent out do reasonably accurately describe the actual outage. As an individual who has some “external” servers in various data centers on the Internet, I would like to not be alerted multiple times that my servers at ISP C, D, and E are down if there is an outage at the ISP F hosting my Nagios installation or at one of the various exchange points temporarily rendering the servers unreachable (without me being able to do anything). The solution sounds easy but is surprisingly hard. How one could solve the issue For each host in the manual nagios configuration, do a traceroute and generate host stanzas for each of the hosts found:
$ sudo traceroute -I icmp -n -A 213.239.240.200
traceroute to 213.239.240.200 (213.239.240.200), 64 hops max, 28 byte packets
 1  <snip>
 2  217.243.221.150 [AS3320]  1 ms  0 ms  0 ms
 3  62.154.10.106 [AS3320]  1 ms  2 ms  2 ms
 4  217.239.40.226 [AS3320]  51 ms 217.239.40.234 [AS3320]  3 ms 217.239.40.226 [AS3320]  60 ms
 5  193.159.226.2 [AS3320]  3 ms  3 ms  3 ms
 6  213.239.240.200 [AS24940]  6 ms  7 ms (TOS=238!)  8 ms
$
This sounds easy and surely can be accomplished in a few hundred lines of perl. However, this makes it necessary to parse Nagios configuration if one wants to obtain the list of configured hosts directly from there. Unfortunately, the syntax of Nagios configuration is “historically grown” which makes it quite illogical and awfully hard to parse - this would easily double the size of the traceroute-based configuration generator. Additionally, the (real) traceroute given above shows three other issues that might arise from such a setup. Dynamic Routing Network paths are not as static as a traceroute suggests. On the Internet, the ISPs use BGP to connect their networks together and to ensure connectivity. In case of network reconfiguration (which may be caused by desired technical or policy changes or actual failures), the traceroute to a given network host may change. Considerable experience is needed to judge whether a change in the traceroute is only short-term while one looks at it, or long term meant to stay. Of course, only long term changes should be reflected to Nagios configuration. The possibility of changes makes it necessary to distinguish between “manually” and “automatically” generated Nagios host entries and to have a mechanism to quickly re-generate the “automatic” entries according to the current situation found on the network. Alternative Network Paths If you look at hop 4 of the traceroute given above, you see two IP addresses. This is a common “one packet left, one packet right” setup where two identical lines are sharing the load and this one sees different interfaces of the next hop router. Which IP address should one put into the parent host declaration then? Later Nagios versions supposedly are able to handle multiple parents to a host, but the docs of course don’t cover this complex configuration and I didn’t yet find the time to find out how this mechanism works and whether it can be used to represent a network layout like that in Nagios. Unpingable Routers For some network operators, ICMP echo request packets (ping) pose a significant load on their network equipment. To remedy that load, they have disabled ICMP echo reply transmission on these machines to keep the load down. This makes the router still show up in a traceroute (as this is done by sending packets with short TTL values and making them expire in transit, resulting in an ICMP TTL exceeded message being sent back), but it cannot be pinged. Hop Number 5 on the traceroute above is such a box: It shows up fine in the traceroute, but pinging it will always return “DOWN”. Currently, I simply omit such hosts from the Nagios configuration, but this may result in extra and inaccurate alerts once the unpingable host itself fails. A different possibility would be to check the host’s availabilty by sending an appropriately TTLed packet either to the host itself or to a host that is “behind” that host. The latter introduces even more complexity since one needs to find out a host “behind” the unpingable box, but this may be necessary since in the case of Hop Number 5 above, the IP address of the hop does not even seem to be in AS3320’s internal routing and tracing to the hop itself stops well before the expected place of the host regardless of from where one traces. Conclusion This is a surprisingly hard issue if one wants to do network monitoring while generating accurate alerts. Surely, it’s a topic that needs to be addressed in network monitoring, so I am quite interested in how other people tackle this. Please comment! Thanks in advance.

29 October 2008

Benjamin Mako Hill: An Invisible Handful of Stretched Metaphors

The following list is merely a small selection of scholarly articles listed in the ISI Web of Knowledge with "invisible hand" in their title: And, finally:

27 October 2008

Steve Kemp: Bring me everyone.

Recently I've been hacking around on GNU screen. I've fixed a few bugs and added a few new features. One of the earliest features I added was the ability to source every file in a directory. One of the later additions was to add simple conditionals to the dotfile, via the new if primitive. Today I had an epiphany moment. Rather than adding either of these two features I should have altered the behaviour in the far simpler manner.
If we allow ~/.tscreenrc to be an executable we immediately gain lots of things for free.
Consider this ~/.tscreenrc file:
#!/bin/sh
for i in ~/.tscreen/*; do
    if [ -e $i ];
       echo "source $i"
    fi
done
That gives us the effect of a "source directory/" primitive. Similarly I can do complex tests without the need for an if primitive if I were to write this:
#!/bin/sh
# common config
cat ~/.tscreenrc.common
# per host config?
file=~/.tscreenrc.$(hostname --fqdn)
if [ -e "$file" ]; then
   cat $file
fi
# if we have lynx define an alias for it + map it to a key
if [ -x /usr/bin/lynx ]; then
   cat <<EOF
# Surf the web with <Ctrl-a f>
alias web screen -F -t web /usr/bin/lynx
bind w web
EOF
fi
So as of v0.4.7 tscreen allows you to have your configuration file be:
A normal file:
In which case it is parsed as you'd expect.
An executable file:
In which case it is executed and the output is parsed.
The code change is trivial, just an extra stat call and the use of popen vs. fopen, but the payoff is significant. ObFilm: L on

Decklin Foster: We could customer care less

(And now, a cathartic "I hate this company and I am never patronizing them again, please don't either" post. I should have done ones for at least Speakeasy/Covad and IBM's server division last year. Ah well.) I went to go register a new domain yesterday (announcement soon! Probably this weekend). I've been using Joker for a while, IIRC on the principle that the cooks were using it so it must be decent enough. While registering, I had a bunch of problems with the horrid, useless "Verified by Visa" popup [1] that you see everywhere these days, and eventually this must have looked like suspicious activity to the bank so my card was declined. I only actually found this out when I got mail saying my order was canceled. Okay, sure. I wrote back and explained what I thought was going on and that I'd like to resolve it. Another half hour later, I got this response:
Hello,
please use
   https://joker.com/goto/support/
for all support inquiries.
Regards, your Joker.com team
This is complete and utter bullshit [2]. If a company is going to mail me, I expect to be able to mail them. I have a mail client; it manages communication the way I want it to, and runs my preferred editor to compose messages (which is, in fact, how I am writing this very blog post). I am sick of dicking around on JavaScript-requiring web forms that all work differently and typing in postage-stamp-sized little textareas. Anything I do type in them is lost, because unlike my email client, web forms don't save sent messages unless the authors feel like letting you have a Cc:. When a company forces me to do this, I take it as a sign of disrespect. I tolerate a web browser [3] for reading pages; "applications" are universally painful [4]. One of the things I used to like about Joker was the PGP mail interface. AFAIK, they have not killed it (I didn't bother to check), but with automatic "we don't want to listen to you unless you inconvenience yourself" bounces like this, what's the point? I surmise that there is, or was, some smart person there who understood how (and more to the point, why) to hook a pseudo-mailbox up to a software system, and that they have been overridden by someone in management who realized it's much easier to have dime-a-dozen webmonkeys hook a form up to the same system since 90% of users just don't care (and even people who do notice and dislike this, but are not as inflamed as I, have come to expect it because everyone else refuses mail, so, y'know, pick yr battles son, etc.). Not the sort of culture I put faith my in. The irony of it all was that I was registering this domain to run a service I had decided to create specifically because of another site refusing mail and directing me to an even lamer web form. That would take incoming mail and, you know... process it with software. Suffice it to say, I am no longer going to be their customer. In deciding who to use instead, I figured I'd do a survey of where the domains in that "Subscription" column [5] on Planet Debian were registered, but... WHOIS is basically useless. Every server just returns free text, formatted differently by (apparently) every implementation under the sun. Cheaply parsing something out from .com/.org/.net is possible, but InterNIC kindly blacklists your IP after making more than a few requests in a few minutes. I guess I'm just gonna go with Gandi (but other suggestions would be welcome). In somewhat unrelated developments, I went to nic.at to update my nameservers for Where the Bus At? last week. There was no authentication or anything on the request form, so I just filled it in and sent it off. I got some automatic mail saying I need to print out a PDF, sign it, and fax it internationally. Annoying, and hardly as secure as mailing them with PGP, but whatever. But then, also yesterday, I got another mail saying the update was complete (lo and behold, it was). I am now somewhat concerned about the security of my domain: it seems like anyone can come by and put something in the form and if I'm not around to notice the courtesy mail and ask that they stop the request, it'll eventually go through, no questions asked. I have not yet written them to figure out what the deal is, though. Kinda burned out. I guess I didn't really have high hopes for dealing directly with a ccTLD registrar (this was the first time I've done it... I can't believe I blew 60 on a cutesy domain name) rather than a reseller who competes in a market, but then, I go and google "domain registrar" and look at all the AdWords dollars spent trying to compete with GoDaddy [6] and just kind of want to put my head in my hands. On DJB's DNS pages there's this bit about setting up a domain. It doesn't say "How to (buy register whatever) a domain name". It says, "How to receive a delegation from .com". Which is of course, how it works. And what I want to buy. I don't want "parking" or even gratis nameservers. Just a delegation from .com. Please. No AdWords came up when I googled for that phrase to copy the link. Sometimes I guess markets just sink to the bottom. Anyway. I feel like there's a free-software angle here. My continuing irrational hatred of using other people's forms, web-based mailing-list substitutes, nameservers, etc. stems not so much from their suckage but from the fact that there is no longer any software there, in front of me, for the four freedoms to possibly apply to. Being able to run your mail reader for any purpose doesn't win you much if no one uses mail. I don't really know what to do about this.
[1]It was only twelve dollars! If I go to hipster market or some other place with brand-new POS systems they don't even make me sign a paper slip for less than $20 or so. But this is the sort of thing dreamed up by people who think good security is setting a cookie to denote that I've answered "what was your first dog's name" or whatever. IF YOU WANT TO BREAK INTO MY BANK ACCOUNTS: I've set the answer to every single one of these questions to "security theater". Easy to remember.
[2]Not to mention a glaringly RESTless URI.
[3]Also, as a rule I normally try not to have anything up on my desktop that I can't close and re-open at any time, thanks to screen, MPD, emacsclient, actually using my browser's bookmark function and resisting the lure of tab-bar.js, etc. Web browsers are supposed to suck at preserving state; HTTP is stateless. See also here (and for further reading on that in the Haskell world, check out Yi. I'm hoping to switch to it someday).
[4]Debbugs, for example, may not have the slickest interface, but if I want to do flags, labels, archiving, threading, or whatever, I can; I'm not at the mercy of some front-end web developer. But we've all heard this litany before.
[5]Thanks, Hpricot!
[6]Even if GoDaddy's customer service were completely hacker-friendly, I would not use them, because their president Hates America.

Chris Lawrence: Newspeak, Yglesias style

I think this quote (regarding the California High-Speed Rail Initiative) is far more revealing than Matthew intends it to be:
[I]t seems to me that the sad reality of politics is that it would be irresponsible for advocates of any large-scale infrastructure project to do anything other than present unrealistically optimistic measures.
Translation into English: it would be irresponsible for advocates of at least some policies Matthew Yglesias prefers to tell the truth. Oxford’s New American Dictionary defines “responsibility to” as “a moral obligation to behave correctly toward or in respect of.” So Yglesias believes it would be immoral for advocates of some of Yglesias’ preferred policies to be honest. I’m glad we have that cleared up.

Romain Beauxis: About democracy (revisited)

After my last post about the ongoing debate on the new process to accept and handle debian project members, Rapha l Hertzog proposed an alternative organisation which could be a solution, but misses the most important fact: how the people in charge of the process would be chosed and dismissed. Rapha l Hertzog wants that we consider a group of skilled and trustfull people in charge of giving and revoking powers to lower class of developers, on a per-event basis. Their procedure would be an internal vote amongst this group, and they would be called the "Debian Community Managers". Although it could be a good idea, it really misses the MOST IMPORTANT FACT: how they are chosed and to whom are they responsible. As a reply to my comment, Rapha l propose that they would be elected at first, and then nominated/revoked on the basis of the decision procedure mentioned above. Not only is it exactly what have been in place for the last years in the various core teams, but also it is a dangerous naive vision of how powers and regulations must happen. Before the Debian project started to consider these issues, the various ideas to build a system where the majority is ruled by a minority and the means to prevent the most important issues has already been studied, in the field of Law and how to write a Constitution for a democratic system. The goal of a democratic system is to put some higher power in the hand of several, but prevent as much as possible any issue. And preventing means act before shit happens, not after. Furthermore, power has to be divided into several domains, where the people in charge of these domains are strongly seperated and share as less common interest as possible. Hence, the goal of a constitution is to weaken power and put barreers, even if this leads to slow and frustrating reform processes. In the same idea, elections, which redraw the positions, are planed on a regular basis, and if the previously elected people were good, they are relected, not the opposite, in which if they aren't good they are dismissed. Again, we prevent issues, so the requirement to be responsible for what you did is implicit. And, last, it is well known that the less direct a decision process is, the less democratic it is. Hence, one should always prefer direct elections to indirect nominations. Now, coming back to Debian, we can have a very similar distinction in the various powers available: Now, the propositions, and all the various discussions are motivated by either the fact that there are issues with some developper's behaviour, which falls into the justice side and for which we already have a wide history of long debates before we act whatever the act is, or the executive power to give rights and introduce a new member in the project. Yes, we clearly miss a role in the project for applying rules and sanctions and deciding about these issues. However, we really ought to fix it the right way. In particular, never should we, in any way, give any justice power to someone in charge of any of the other power, in particular core teams. And the same for the right to appoint new members. For instance, to name an issue, the Frans vs. Sven issue would have been really different if there wasn't any kind of personal interest and power in the people in charge of the decisions. In real social systems, the right to apply a sanction or give new rights is a very dangerous power. It suppose a high level of separation between your personal interest, and the decision you have to make, as well as a high level of responsability against the people who trust you. We used to claim that Debian was not a democracy, but a meritocracy where technical skills are the ultimate ranking for deciding who's good or bad when giving reponsabilities. I have never been convinced by this approach, which I consider, just as anarchy, as valid for a small group of developers, but completely naive for a big group. Now, it is clear that the issues that we are dealing with in this situation have nothing to do with technical skills. In particular, the original proposition creates a class of non technical contributors, documentation writers, or translators etc... Furthermore, if you look back in the past, there have been a lot of situation where the issue, and its solution had nothing to do at all with technical issues, like issue mentioned above, or the Duck Tank or whatever it was called. We really should drop this naive idea that technicals skills are the only way to put on decision on the project. That is no longer how it works, nor a solution to the human issues that we face now.

26 October 2008

Chris Lawrence: Inside baseball

I’ve been remiss in pointing my readers recently to Zachary Schrag’s Institutional Review Blog, which patiently documents the overreach and misapplication of federal regulations regarding the protection of human subjects to the social and behavioral sciences, including research that by federal regulation is exempt from review by IRBs. While Schrag is cautiously optimistic that the new head of the Office of Human Research Protections will be an improvement, the continued domination of the process at most levels by biomedical researchers—along with the general sense that, as Schrag notes, “researchers cannot be trusted to apply the exemptions themselves”—is still troubling to those of us who want to conduct human subjects research, particularly secondary data analysis. Technically speaking (even though I dare say most social scientists observe this requirement in the breach), even the analysis of secondary data collected by others and fully anonymized before we see it (e.g. use of data such as the General Social Survey, American National Election Studies series, the Eurobarometer series, etc.) requires IRB oversight and approval beforehand.

Joerg Jaspert: Archiving sarge AKA oldstable

And finally I started to move our good old release sarge to archive.debian.org. It will actually be visible there whenever it is completly synced, but rsync is running. Tomorrow I will delete the sarge parts in dists/ for ftp.debian.org (and its mirrors) and in the next days all the associated source and binary packages will slowly get moved out of the mirror. Im using a scheme that tells dak to delete about 1000 source packages on one day only, to not have too many files to delete at once. While that will make up a few thousand files going away at once (after the usual deletion delay), it should be under normal deletion limits mirrors have. (The Debian internal mirroring scripts do stop deletions if more than 40000 files are killed.) While doing this, I’m also finally archiving sarge-backports and sarge-amd64. Both will be archived on archive.debian.org too, for the simple reason that both have been very near to Debian. sarge-amd64 for example had security support and backports will, at some not too distant point, surely exist behind backports.debian.org. Comments: 0

Ond&#345;ej &#268;ert&iacute;k: Google Mentor Summit II

On Saturday morning I met Steve McIntyre and Dirk Eddelbuettel, Steve took us by car to Google. Well, it was overwhelming.

For example we met there two other Debian developers, Jeff Bailey and Daniel Burrows. There are developers from all the famous projects, like git, Wine, Turbogears, Jython, ... There are still people I wanted to meet but didn't manage yesterday, need to fix that today. My plan is to get SymPy running on top of Jython, or at least do some more progress to take the advantage, that Philip Jenvey from Jython is here. Also I wanted to fix some RC bugs in Debian when Steve is here, to make some progress on my NM finally. We'll see how it goes.

There was also an excellent presentation from people behind Android. One thing I was curious if it's going to run native C applications, like Python and it seems it will happen eventually, all the sources are out there, so someone just needs to push it forward. Another very cool thing they did that I was always looking for is Gerrit for reviewing patches (see review.source.android.com for example how it looks like) -- basically a fork of Guido's codereview, but it has many nice features, like automatically applying the patch to the git repository as a new topic branch and one can then easily pull it, as well as review it over the web interface. When I get back to Prague I am going to install this for SymPy.

25 October 2008

Ben Armstrong: Wifi roaming on the move

Preface: legal stuff Depending on where you live, use of random open wifi networks might be considered illegal. Although I know of no law in my country against doing this, where you live, things may be different, so educate yourself before following my example. Wifi roaming on the move For the past year I have used my Eee PC on the metro transit bus, as it is the perfect size for this. When I can, I take advantage of open networks to connect back home. In this article I will show how you can actually use such access, will recommend which software works best and will explain how to set it up. So, what can I really do with the net while in motion? How about irc? No kidding! This shell one-liner does the job:
while ! ssh -t 10.9.8.7 'screen -UDr' 2>/dev/null ; do echo -n "." ; sleep .1 ; done
We’re concerned about privacy and security on other people’s networks, so we use ssh. Inside that screen session, keep irssi running for a continuous irc presence. Every 10th of a second, the script tries to resume your session. Once a the net passes by, typing “[Enter]~.” drops you back out to retry again. The row of dots serves as a progress bar. If you want to get fancy, you could replace that with an ASCII ‘spinner’. I leave that as an exercise for the reader. :) Come on, is that really usable? Certainly. As the good folks on #eeepc at irc.freenode.net and #debian-eeepc at irc.oftc.net can attest, even a half dozen brief connections can be enough to provide tech support, rough out some development ideas, or just carry on some friendly chat. If your spouse or housemate is online too, it can even help you make some last-minute grocery-list changes. :) While the script is working, enjoy some offline things such as blogging, reading a cached Planet Debian feed or a PDF book. OK, so what else do I need to make it work? Well, you’ve seen so far we need on a server: On the Eee, you should also have: But what do I need wpasupplicant for if I only use open networks? Well, wpasupplicant is really handy for fast control of networks in Roaming Mode (as per /usr/share/doc/wpasupplicant/README.modes.gz). A GUI is just too slow. For example, you may need to filter out ‘junk’ open wifi nets: pay-per-use hotspots or nets that hide their name. You’ll not only want a “catch-all” stanza for any open network, but also a number of the most commonly found default network names, e.g.
# Catch-all; associates with any open network:
network= 
     key_mgmt=NONE
 
# Commonly found default network names:
network= 
     ssid="default" 
     key_mgmt=NONE
 
network= 
     ssid="linksys" 
     key_mgmt=NONE
 
# etc. by watching scan_results closely you'll find several more
While the connect script is running, keep a separate tab open in gnome-terminal for wpa_cli. Use ‘disable_network 0’ to drop the catch-all and let the other stanzas kick in and ‘enable_network 0’ after filtering is no longer needed. Isn’t it really slow to get connected? Without some tweaks, yes. But here are a few things I have found by trial and error that help. One issue is that dhclient takes too long to retry, so you drop the delay between retries back to 1 second in /etc/dhcp3/dhclient.conf:
backoff-cutoff 1;
initial-interval 1;
If the signal is very weak, you’ll want the transmit power turned up to the maximum value for your hardware. For the Eee PC 4G this is 50mW, so you set this in /etc/network/interfaces for ath0, your wireless interface:
wireless-txpower 50mW
Finally, while you’re in motion you are constantly leaving no-longer-usable access points behind. The driver needs to discard them as quickly as possible and scan for new ones. So again in /etc/network/interfaces for ath0, you bring the default scanvalid 60 seconds down to 10 with:
pre-up /sbin/iwpriv ath0 scanvalid 10
Conclusion The netbook has changed how we use the net. Now that we can take it everywhere, we either pay through the nose for expensive cell network access or else use the patchy wifi coverage blanketing most urban areas. A few lucky cities have such things as municipal wifi nets, but the rest of us have to scrape what access we can wherever we go. You are now equipped to try this out on the bus. If you find any other tips that can help, I’d love to hear from you.

24 October 2008

Biella Coleman: Hacker practice: Moral genres and the cultural articulation of liberalism

So I usually don’t announce my publications on my blog and for various reasons. The main one is that I am more than a little embarrassed that some of them are behind walled gardens (but being I am a junior prof, I am not in a position to negotiate otherwise). Otherwise, some of my pieces are semi-jargony (in the academic sense) and may not be of interest to readers who I think are more geek than academic. Finally, the process of publishing is so slow, so long, and so painful, I try not to think about it, much less write about it, if I can help it. But I decided to announce this
piece , which is on hackers (surprise surprise) as it might be of interest to some readers and because people can download it for free here for the rest of the month (but registration is required ) Co-written with Alex Rex Golub, I am pretty happy to see in print although it is far more academic in its tone, argument, and language than most of everything else I have written. This is in part because the article is more theoretical than ethnographic (hence the journal, Anthropological Theory) and tackles the question of liberalism alongside hacking. It seeks to demonstrate that these can be talked about 1) together and in cultural terms 2) that we we can identify some cohesive elements to hacking and liberalism, in part by placing them in conversation with each other 3) and yet we can also locate plurality and diversity within liberalism and hacking as well. This is a lot to tackle and cover in one piece under 35 pages and I am sure it could have been pulled off better but I think it is is a decent start to thinking about these questions. If you are interested but are allergic to academicalese, sticking to the Introduction, the Hacker Ethical Practice: Three Examples section, and Conclusion, will give you a taste of the arguments while avoiding most of the jargon. The irony of this article is that even if it hits at some pretty theoretical issues, it was provoked by a mundane conversation and disagreement I had with one hacker, Karl Fogel, over another hacker, Kevin Mitnick. After returning from the hacker conference, HOPE, I had dinner with Karl and told him about Kevin Mitnick’s keynote speech, which I found particularity enjoyable and entertaining. After calling Mitnick a hacker, Karl responded with the following: Kevin is not hacker. He is a cracker. Though I think I convinced him that cracker may not be the best word for him (and he convinced me there are differences between hacking, noting perceptively that his primary motivation seemed to be getting access to something he wasn’t allowed to have access to that is, it was more about breaking the rules and the thrill of crossing a social line, than about learning a technical system. ), I decided that I wanted to write a piece that squarely addressed tensions and differences among hackers instead of whitewashing them away as most authors, journalist, and even some hackers do.
Although most of the time, it seems like it is the Karl-type hackers who accuse the Mitnick-type hackers of not being true and authentic, recently I have been in a few situations where the tables were turned. For example, last year I was having coffee with a 2600-type who insisted that hacking on Linux was not hacking at all (not innovative enough, according to his world view). Another example I came across was in a recent Phrack issue where the prophiled hacker, the Unix Terrorist, takes a swipe at (well honestly at everyone and everythin) but when he is talking trash about who is and who is not a hacker, he singles out F/OSS developers:
Linus Torvalds isn’t a hacker! Richard Stallman isn’t a hacker! Niels Provos
isn’t a hacker! Fat/ugly, maybe! Hackers, no! And what is up with
the use of the term “cracker”? As far as I’m concerned, that term
applies to people that bypass copyright protection mechanisms.
Vladimir Levin? HACKER. phiber optik? HACKER. Kevin Mitnick? OK,
maybe a gay/bad one, but still WAS a “hacker.” Hope that’s clear.
Of course, one can play the game of defining the authentic hacking (and it makes sense for many to do this!) but my interest as an anthropologist has never been to draw a bright and clear boundary between good hackers and bad hackers. or “real and fake hackers,” but instead to describe and grapple with the tension points and internal ambiguities among hackers (my whole course is designed around this theme, in fact). This is not to say that anything goes in the world of hacking (that is, I don’t consider any computer break in a hack; I often just call it a crime) but if there is a group of people calling themselves hackers and thinking to some degree of the ethical implications of their actions, as an anthropologist, this is enough “social evidence” to start asking some questions about the political and cultural significance of their actions.

21 October 2008

Matthew Palmer: Load Balancing FTP Servers

While it's a protocol we all love to hate, and wish it would go away and die a quiet death, sometimes someone has a good reason for supporting FTP. (In my case, it's usually because that reason has a lot of money to provide to my employer). But what if you want your FTP servers load balanced (because downtime is for suckers)? Obviously, you need to have some sort of shared filesystem behind all your load balanced FTP servers, but that's a rant for another day (but let me just say: if you're running GFS, especially on a busy site, may $DEITY have mercy on your soul). Because of the silly random port games that FTP likes to play, it's not a trivial job to load balance an FTP service amongst multiple hosts. You can't just throw a round-robin on port 21 and hope to get anything useful going. Ironically, while "active" FTP is a pain in the arse for most people, it's a lot easier to load balance, because the initial connection comes in on a well-known port which can be load-balanced, while all the other "random" connections are server-initiated and your standard routing/NATing/whatever you're doing for outgoing connectivity should be able to handle it. However, passive FTP is a bigger pain. The problem is pretty simple to understand -- the FTP client will want to connect to a high port on the "virtual" (load-balanced) IP, and without serious traffic sniffing, your load balancer won't be able to map that incoming connection on port 54321 to the real server that actually wanted the connection. The solution, thankfully, is fairly straightforward. You allocate a range of high ports (maybe a thousand or so) to each real server, with a different port range for each real server. You then tell the load balancer to send all traffic for each range of ports to the corresponding real server, and then configure that real server to put all it's passive connections into that port range (I'm fairly sure most FTP servers can support that bit of config). So, unfortunately, you can no longer disallow FTP support on the basis that you can't load balance it. No shortage of other reasons, though.

17 October 2008

Jaldhar Vyas: Plumbing the Depths

Wow this Joe the Plumber phenomenon really seems to have Democrats spooked as they are now scrambling to find any possible dirt on the guy who dared to question Dear Leader. One might think people with a solid 6-10% lead wouldn't need to be so desperate but Adam is probably well aware of the Democratic partys penchant of snatching defeat from the jaws of victory. A lot of these progressive types are still nursing resentment for the "swiftboating" of John Kerry and wary that it will happen again so todays strategy is pre-emptive douchebaggery before Karl Roves evil minions can sully the pristine reputation of their fair candidate. What they don't realize is that calling Kerry an America hating traitor worked because there was reasonable evidence that he threw his medals away, and made speeches denouncing his country which are typical of acts people associate in their minds with America hating traitors. The 527s exaggerated but the exaggeration would not have worked if there was not an element of truth behind it. Now no one is disputing that Obama actually did make the "share the wealth" remark. Whether the person he said it to is a republican plant or some other sort of nogoodnik is immaterial. Obama is a redistributionist and that is precisely the reason why liberals want to him to be president. And how pathetic is the "dirt"? He owes backtaxes? Gee I wonder why someone who already owes money would be apprehensive about having to pay more? A lot of people owe money at one time or another and even have liens placed as a result. Perhaps it is relevant to mention that for someone in public office (like oh, say, Charles Rangel who I'm sure Adam will discuss in his next post.) but for a private citizen? Isn't that one of the "chilling effects on free speech" we were going to be subjected to in Bush's America? The other one one was how is not a real plumber. Apparently he is not licensed but, sit down for this one, it is actually possible to do work without a piece of paper from the government. Really! I've seen it happen. Is it always a good idea to ignore licensing regulations? Well they often serve to protect the public from malpractice but then again they often prop up cartels. Here in the NY/NJ area plenty of people of all political persuasions seem to be willing to take the risk of hiring unlicensed plumbers and other tradesmen because at the end of the day, it's the, you know plumbing, that makes you a plumber nothing else. And none of this has any bearing on Obamas policies or what they mean for America. So if you like socialism and think its what America needs, feel free to make the case to the voters and perhaps they will agree with you or perhaps not. But stop with with the ad hominems against people who point that out.

14 October 2008

Bdale Garbee: YikStik

As some of you know, the first weekend in October was a big deal for me, because it was NCR's Oktoberfest launch event. My son and I spent the weekend camped out on the prairie with Keith Packard and many of our other friends. Keith successfully went from nothing to a "level 2" high power certification, which was pretty cool. I wasn't quite so lucky. On Saturday morning, I flew my custom-designed rocket YikStik for a "level 3" certification attempt. The name comes from the word my wife uses to describe lipstick. The rocket was built from a mixture of custom and Giant Leap parts, including 98mm Dyna Wind airframe, a 98-75mm tail cone retainer, and a Pinnacle nose cone. All the centering rings were cut on my 3-axis CNC milling machine, and the fins were custom 7-layer composite layups using plywood, carbon fiber, fiberglass, and epoxy... all vacuum bagged using a kitchen food saver appliance. Painted red, gold, and black, with a custom 8 foot main parachute sewn by my wife Karen from the Team Vatsaas design in red and black rip-stop nylon. The motor selected was an Aerotech M1297W reload. This is a 75mm diameter motor 66.5cm in length with 2722 grams of propellant yielding 5417 Newton-seconds of total impulse. It was also on sale earlier this year for cert attempts. My simulations said YikStik should have flown to about 14,800 feet above ground level at the NCR north site on this motor. The launch went perfectly, and the rocket was stunningly beautiful under boost. It disappeared into some high clouds, but we continued to have strong signals from the two tracking transmitters installed in the payload bay behind the nose cone. About the anticipated time after launch, we saw a rocket descending under chute in the distance, and headed in that direction. A few minutes later, we abruptly lost both tracking signals, and that's when things took a turn for the weird. In hindsight, I think we suffered an apogee deployment of the main chute, and the rocket we saw descending was someone else's. YikStik was designed to deploy a streamer at apogee, then descend fairly quickly to about 1500 feet above ground where a second set of ejection charges would fire to separate the nose cone on a 3 foot drogue parachute that would pull a deployment bag containing the main chute out of the airframe and then pull the bag off the chute. The nose cone, payload bay with the tracking transmitters, and deployment bag would then descend under the drogue chute and the remainder of the rocket would descend under the big chute. In the world of deployment bags, this is called a 'free bag' configuration. With deployment at 1500 feet, the two bits should have landed within sight of each other. But that didn't happen. It wasn't until late Sunday afternoon, after we had to leave to get Keith to the airport, that some friends finally located the nose cone assembly about 3.5 miles down range from the launch site, over a couple rises and past an area of rough terrain. By then it was cold, windy, and rainy, and so I really appreciated the effort they put in locating the nose, and wasn't too surprised that they didn't immediately see the rest. Since the bulk of the rocket under the main should have had a slightly higher descent rate than the nose cone, I expected to find the rest of the rocket somewhere near a line between the launch rail and where the nose cone was discovered. So last Wednesday I spent about 5.5 hours walking around the area searching... but no luck. Since then, several other people have been out looking for my rocket, including two friends who flew over the area today in a light plane looking down into all the washes. Still nothing. I posted some signs in the area with a photo of the rocket and my contact info, I hope someone calls eventually. In the meantime, the bulk of YikStik remains missing, and of course I did not achieve a successful level 3 certification. Lessons learned for next time are that tethering the deployment bag to the main chute instead of flying in a "free bag" configuration might have been a better choice, and it's kind of silly having two tracking transmitters in one of the two pieces of your rocket and none in the other... Ray LaPanse took some stunning photos of the launch. He will likely post better versions with color correction and so forth at some point, but in the meantime, I've put a few up on my Garbee Rockets web site. She sure was a beauty!

10 October 2008

Bastian Blank: Ubuntu, Ubuntu

I was forced to try Ubuntu Hardy in the new university pool. The setup includes one Linux server dedicated for the pool, one Windows AD for Kerberos authentication, one Windows fileserver with user data and 20 clients. The clients are new HP machines with a Radeon Xpress 200 card. First problem was nasty, the X server turned the display black and then crashed, leaving an unusable console behind. Even a blacklist of the radeon module does not work. Somehow the Xorg radeon driver loads the module on its own, ignoring the modprobe blacklist. Only a hard blacklist using install radoen /bin/false in the modprobe config was able to prevent this. Lets hope that the endeavors to remove much priviledges from the X server goes good. For the homes two setups was tested: The first one just produced an error that some Gnome component was unable to lock ~/.ICEauthority. This could be worked around in the Xsession. Otherwise it was usable to slow, which may be a problem with the Windows server. The later, plus a reinstallation with fglrx, produced first unresponsive OpenOffice.org windows and then a complete unusable Gnome desktop. I would not completely vote against a problem with fglrx or even a broken installation, but the amount of problems exceeded the threshold. Now we will try Lenny and see if this also happens there. Especially home via nfs is not that uncommon that we can let it broken in a release.

9 October 2008

Felipe Augusto van de Wiel: 10 Oct 2008

Random news

/back
Yes, I was away... long and sad story involving health issues. :-( I'm trying to get back, hopefully everything will be fine. Let me publicly apologize to some people that was expecting some work from me and I postponed it, not because of slackness but because I was unable to do it. I'm catching up with a lot of tasks and trying to solve long standing issues, feel free to ping me to get some update on a specific matter. I am really sorry!


Slogan
Do you know about the poll to choose a slogan for the release of Debian 5.0, also known as "lenny"?

No!? Shame on you! :-)

People behind Debian Art started a discussion to get opinions! After some input they prepared a poll, maybe they should try to use a doodle. Right now, The Universal Operating System is quite popular, but a lot of people did some nice suggestions, and some of them would like to see a slogan some way related to the Toy Story (tm) character Lenny:



The discussion is distributed across three lists: Debian Desktop, Debian Publicity and Debian Curiosa, I would also point to the comments made by Gustavo Noronha da Silva (here) and Andre Felipe Machado (here).

If you didn't say anything so far, please do!

Eddy Petri&#537;or: Nokia has your data

As a beta tester for the new email application from Nokia, you will have to give your mail account password:



and agree that they will get your data, too [1].




Really unimpressive, Nokia.


[1] I haven't checked the "Nokia privacy policy", but is enough for me to say no, thanks, and start to wonder if they do anything behind my back with the phones they sell.

8 October 2008

Rob Taylor: Wizbit ars d

So it seems ars technica picked up on Codethink’s little pet project! Obviously the little amount of info on the wiki isn’t enough for everyone who’s interested and enough has changed since the GUADEC talk that I should write a bit here to clarify what’s going on and where we’re going. First off, we’re currently not using GVFS or FUSE - the core Wizbit component is simply a versioning, distributed object store. The current plan is to later hook up with a metadata service, maybe tracker, and use this to export a FUSE filesystem using the metadata. This core Wizbit service is just a library with its own api, maybe hooking up to gio streams for ease of use from GLib based applications. The current focus of our work is solidifying this store and the synchronization between multiple machines. We’re prototyping its use in Tomboy. Karl is also working on making some of these pretty widgets for navigating history work. We’re not actually using Git underneath, but using our own implementation of concepts from both Git and Bzr. This is for a number of reasons, partially that making a library from git’s code proved more trouble than just reimplementing the concepts (as things like JGit found). Also the nature of the problem is sufficiently different that things like the packed format don’t behave in a suitable way for general file system usage. The work on packing is yet to be started but we’ll probably use Robert Collin’s groupcompress idea from bzr. I promise we’ll make the wiki a bit better when the code’s stabilised a bit!

Russell Coker: Future Video Games

I just watched an interesting TED.com talk about video games [1]. The talk focussed to a large degree on emotional involvement in games, so it seems likely that there will be many more virtual girlfriend services [2] (I’m not sure that “game” is the correct term for such things) in the future. The only reference I could find to a virtual boyfriend was a deleted Wikipedia page for V-Boy, but I expect that they will be developed soon enough. I wonder if such a service could be used by astronauts on long missions. An advantage of a virtual SO would be that there is no need to have a partner who is qualified, and if a human couple got divorced on the way to Mars then it could be a really long journey for everyone on the mission. VR training has been used for a long time in the airline industry (if you have never visited an airline company and sat in a VR trainer for a heavy passenger jet then I strongly recommend that you do it). It seems that there are many other possible uses for this. The current prison system is widely regarded as a training ground for criminals, people who are sent to prison for minor crimes come out as hardened criminals. I wonder if a virtual environment for prisoners could do some good. Instead of prisoners having to deal with other prisoners they could deal with virtual characters who encourage normal social relationships, prisoners who didn’t want to meet other prisoners could be given the option of spending their entire sentence in “solitary confinement” with virtual characters, multi-player games, and Internet access if they behave well. Game systems such as the Nintendo Wii [3] would result in prisoners getting adequate exercise, so after being released from a VR prison it seems likely that the ex-con would be fitter, healthier, and better able to fit into normal society than most parolees. Finally it seems likely that someone who gets used to spending most all their spare time playing computer games will be less likely to commit crimes. It seems to me that the potential for the use of virtual environments in schools is very similar to that of prisons, for similar reasons. Update: Currently Google Adsense is showing picture adverts on this page for the “Shaiya” game, the pictures are of a female character wearing a bikini with the caption “your goddess awaits”. This might be evidence to support my point about virtual girlfriends.

7 October 2008

Russell Coker: The Security Benefits of Being Unimportant

A recent news item is the “hacking” of the Yahoo mailbox used by Sarah Palin (the Republican VP candidate) [1]. It seems most likely that it was a simple social-engineering attack on the password reset process of Yahoo (although we are unlikely to learn the details unless the case comes to trial). The email address in question had been used for some time to avoid government data-retention legislation but had only been “hacked” after she was listed as the VP candidate. The reason of course is that most people don’t care much about who is the governor of one of the least populous US states. Remote attack on a mailbox (which is what we presume happened) is only one possible problem. Another of course is that of the integrity of the staff at the ISP. While I know nothing about what happens inside Yahoo, I have observed instances of unethical actions by employees at some ISPs where I have previously worked, I have no doubt that such people would have read the email of a VP candidate without any thought if they had sufficient access to do so. If an ISP stores unencrypted passwords then the way things usually work is that the helpdesk people are granted read access to the password data so that they can login to customer accounts to reproduce problems - this is a benefit for the customers in terms of convenience. But that also means that they can read the email of any customer at any time. I believe that my account on Gmail (the only webmail service I use) is relatively safe. I’m sure that there are a huge number of people who are more important than me who use Gmail. But if I was ever considered to have a reasonable chance of becoming Prime Minister then I would avoid using a Gmail account as a precaution. There is a rumoured Chinese proverb and curse in three parts:
May you live in interesting times
May you come to the attention of those in authority
May you find what you are looking for [2]
In terms of your email, everyone who has root access to the machine which stores it (which includes employees of the companies that provide warranty service to all the hardware in the server room) and every help-desk person who can login to your account to diagnose problems is in a position of authority. Being merely one of thousands of customers (or millions of customers for a larger service) is a measure of safety. As for the “interesting times” issue, the Republican party is trying to keep the issue focussed on the wars instead of on the economy. The problem with basing a campaign on wars is that many people will come to the conclusion that the election is not about people merely losing some money, but people dying. This could be sufficient to convince people that the right thing to do is not to abide by the usual standards for ethical behavior when dealing with private data, but to instead try and find something that can be used to affect the result of an election. Mail that is not encrypted (most mail isn’t) and which is not transferred with TLS (so few mail servers support TLS that it hardly seems worth the effort of implementing it) can be intercepted at many locations (the sending system and routers are two options). But the receiving system is the easiest location. A big advantage for a hostile party in getting mail from the receiving system is that it can be polled quickly (an external attacker could use an open wireless access-point and move on long before anyone could catch them) and that if it is polled from inside the company that runs the mail server there is almost never any useful audit trail (if a sysadmin logs in to a server 10 times a day for real work reasons, and 11th login to copy some files will not be noticed). One of the problems with leaks of secret data is that it is often impossible to know whether they have happened. While there is public evidence of one attack on Sarah Palin’s Yahoo account, there is no evidence that it was the first attack. If someone had obtained the password (through an insider in Yahoo, or through a compromised client machine) then they could have been copying all the mail for months without being noticed. It seems to me that your choice of ISP needs to be partly determined by how many hostile parties will want to access your mail and what resources they may be prepared to devote to it. For a significant political candidate using a government email address seems like the best option, with the alternative being to use a server owned and run by the political party in question, if you can have the staff fired for leaking your mail then your email will be a lot safer!

Next.

Previous.