Search Results: "reg"

4 August 2008

Marcela Tiznado: When did we start attacking each other?

So, I should be at DebCamp, but I'm back home after driving 800km in one day.  
Why? I still don't know.

The main reason for this post is the irrational and unilateral response I got
from the DebConf Orga Team, with no right to replica of any kind, and with
the violence and humiliation we were treated with. I've helped to make
3 DebConf's possible, and have been involved in many ways for the past years
in Debian, so this shocked me deeply.

The short story is that there was an extra bed in the room I was staying in, the
person who was suppose to be in that bed is a close friend of mine, so I asked
if someone else could use it while they weren't, since that meant I could take
the necessary equipment that I managed to get for DebConf, and also introduce
to Debian someone who is very active and well known in our local community
(and also part of the umbrella foundation used for local finance issues).
I was excited about getting there, like every year. Just to make this extra
clear, this person had already booked the full week of DebConf, just not
DebCamp, as he previously thought he couldn't attend. When he found out he
could, he was thrilled to be able to go and help setup. So, I made the mistake
of not notifying the Orga team about the switch. I did this because it truly
was harmless action, where a bed which would otherwise be wasted would get
used, and, I did not notify the Orga team because they've been very
aggressive, inflexible and unhelpful throughout the planning of the
conference. This doesn't justify it, just explains why someone who generally
is helpful decides to take the wrong path to solve something.

Up to here, nothing very exciting. What made this special, is that when one
of the organizers, Margarita Manterola, found out about the switch, instead
of coming to talk to me, even though she's known me for *years*, she went
and informed the hotel that somebody had committed a crime, and checked in
under a different name, as if me or the person that came with me where
some random stranger. All I can say is, WTF?

Let me stress this, the email that was sent out[1] twisted the facts, to the
extent that some of them are a lie, like the problem arrived at check-in,
when it actually happened while we where napping a few hours after we had
arrived, and any effort made by the Orga team with the hotel where wasted,
as it was one of them who had originally created the problem.

Instead of solving this among us as a group, and, again, "solve" is a
bureaucratic thing, because no one was being harmed, Marga decided to
actually *harm* me personally, the person who I had brought, and DebConf
as a group. What got solved? Nothing. I left, along with someone who
would of otherwise been helping out build DebConf, while the Orga team
demanded a ridiculous fee for me to stay in the hotel.
Rules are rules, I understand, but I also understand everybody listens to
downloaded music, people in Germany install[2] nmap, and a very long list
of rules that we tend not to follow because they're unreasonable or
unnecessarily complicated.
Is this really what DebConf is turning into?

All I can say is I'm very sad and shocked that the people I've worked with
for so many years decided to condemn me over such a meaningless issue, and
especially that the local team, Martin Ferrari, Damian Viano, Maximiliano
Curia and Margarita Manterola would do such thing to "one of there own",
and that the international Orga team would mindlessly follow through with it.

I apologized to the hotel, I do want to apologize to the innocent people who
had to deal with this, and, even though my intentions where good and unselfish,
I regret what happened.

Despite all of this, I'm still deeply committed to Debian, have worked during
the year and deserve to relax and enjoy it, so I will be there for DebConf
as a regular attendee.

See you there!

[1] http://lists.debconf.org/lurker/message/20080802.231856.66c7d3fd.en.html
[2] http://it.slashdot.org/article.pl?sid=07/05/31/1629259&from=rss

3 August 2008

Russell Coker: Used Car Prices

There is an interesting article in The Age about the effect of petrol prices on the poorer people in Melbourne [1]. The article claims that people are unable to sell large old cars and buy smaller cars. To investigate that claim I did a price search on Ford Falcons and Holden Commodores on the web site www.drive.com.au . The Ford Falcon and Holden Commodore were for a long time the two leading marques of cars sold in Australia - both of them large cars. It seems that if I wanted to buy a Falcon that is less than 20 years old with an engine of 4.0L (or bigger) then I would have many choices available with list prices under $2500, including some cars in that price range which are as little as 10 years old (the average age of a car that’s registered for use in Australia). For Commodores there seems to be less choice, there are a few of them with 4L engines that are just over 10 years old being advertised for just under $5000 and a significant number being advertised in the $5,000 to $7,500 range. I don’t know whether the increased asking price for Commodores is due to greater optimism by the owners or a greater demand. One thing that we have to keep in mind is that due to the low price of advertising on the web site and the duration of the advert (which permits changing the price at any time) the sensible strategy is to start the advert with an optimistic price, and then gradually drop the price if there is little interest by the buyers. There are also some Falcons on auction on Ebay that are going fairly cheaply, one example is less than $6000 for a 2000 Falcon with only a few minutes to go. The HSV (Holden Special Vehicles) cars are listed on Drive as a different make on Drive (it’s just Holden’s range of faster vehicles), and surprisingly their prices are quite strong. There is only one vehicle on offer for less than $5000, and only a few for less than $10,000. Now when it comes to buying a small car, on ebay there are a number of Toyota Corollas on sale, two 1997 models are on sale for just under $9,000 and just under $10,000. It seems that you could sell a 2000 model Ford Falcon on ebay and not receive enough money to buy a 1997 Toyota Corolla! For the Corollas advertised on Drive the majority of them seem to be advertised for around $15,000, but the volume on sale is great enough that there is a significant minority advertised for lower prices. There are 173 Corollas advertised for between $2,500 and $5,000 it might be possible to find one of those that has no significant problems. So it seems that ebay is not the place to buy a Corolla! So it seems that the main premise of the article (that you can’t sell a second-hand large car and buy a small car) is correct. If you were to sell a 1990’s Falcon or Commodore and buy a Corolla (which cost about half as much as a high-end Falcon or Commodore when new) of the same age then you would be lucky to get more than half the Corolla purchase price. Then of course there’s a 4% “stamp duty” tax to pay and the risk that a second-hand car you buy might have some hidden problem (the cheaper cars are unlikely to have been well serviced).

Wouter Verhelst: Rijksregister access through Belgian electronic ID card

On the mijndossier website, it is possible to view your own file in the belgian 'rijksregister' (state register), provided you have an electronic ID card and a computer set up to use it. I should note that the website uses a certificate that iceweasel on Debian, in its default configuration and after installing and configuring the necessary packages for using the electronic ID card, still warns about the certificate being 'not safe'. I should check what's going on there. But that is not what this post is about. What it is about, however, is the fact that this website contains a "death" chapter. Now, by definition, this "death" chapter can never be filled in, since one can only access their own data. And I can hardly do that if I'm death, can I? Oh well, not that I care or anything.

2 August 2008

Russell Coker: On Talking to Police

The lecture by Professor James Duane about why you should not talk to the police (in the US at least) is doing the rounds at the moment. The Google video site doesn’t work for me, so I downloaded it from youtube with the following references:
part 1 [rVq6N0xAEEM]
part 2 [-Z0bpj3EEHI]
part 3 [44-GSZofXIE]
part 4 [zSvxiaO-TG8]
part 5 [gzYHnWrqfWg]
part 6 [BErNzdOnWGY] The first thing that struck me about this is that it’s the first time I’ve ever seen someone clearly state the problem with the excessive number and complexity of the laws. It’s impossible to know whether you are breaking the law. This is obviously wrong and it should be a legislative priority to reduce the number of laws and the complexity of the laws. If for every law they sought evidence regarding whether it helped people or helped preserve the state then that would be a good start. The excessive number of laws is not just a problem due to the risk of accidentally breaking a law, but also due to the fact that a malicious cop could arrest anyone that they wished - it would merely be a matter of following them for long enough. In the second half of the lecture Officer George Bruch from the Virginia Beach Police Department gives his side of the story. At one point he cites an example of the road laws where he can follow a car and find a legitimate reason for booking the driver if he wishes. Virginian law allows the police to destroy primary evidence. If they tape an interview then they can transcribe it to a written record and then destroy the original tape. If the transcription removes some of the content that has meaning then the defendant is probably going to suffer for it. It’s often stated that on the net you have to make extra effort to make your meaning clear as jokes can’t be recognised by the tone of voice. It seems that the same effort would need to be made in a police interview (but without the possibility of going back and saying “sorry I was misunderstood” that you have in email). It’s also legal for police to lie to suspects. While I can imagine some situations where this could be reasonable, it seems that at a minimum there should be some protection for child suspects against being lied to by police (there have been some travesties of justice stemming from children trusting police in an interview room). It seems that if someone doesn’t get a good lawyer and refuse to talk to the police then they will be likely to be convicted regardless of whether they are guilty or innocent. Officer Bruch says that he tries to avoid interviewing innocent people. So I guess whether someone ends up in jail or not will depend to some extent on the opinion of a cop who may or may not interview them. While I guess a high rate of success at securing convictions is in most cases a good thing, the fact that convicting an innocent person is the absolute best way of letting a criminal escape justice seems to be forgotten. Another issue is the fact that a witness may have reason to believe that they could be a suspect. The advice that a suspect should never talk to a police officer seems to logically imply that intelligent people will be hesitant about providing witness statements in situations where they may be a suspect. I wonder how the legal system in Australia compares to the US in regard to these issues. I know that we have far too many laws and too many complex laws which can not be understood and obeyed by a reasonable person.

1 August 2008

Erich Schubert: Google impressively quick index updates

Today, I uploaded a new version of my firewall configuration tool, pyroman, to Debian unstable.About 4 hours later I googled for "Pyroman Debian" and was surprised to find the upload notification in the top results. The first hour of this was probably spent with me doing some package function tests (I don't want to upload broken packages, after all), then the announcement was distributed to the -changes mailing list at Debian, which in turn was picked up by Google Groups.However that might be due to groups.google.com getting special treatment, though. For this resource, Google can actually trigger an update instead of having to have a spider frequently re-crawl all the contents.Still I find it pretty impressive to have such new data already in their main index. I was used to this e.g. for blog and news search, but not for regular web search.

John Goerzen: The Eee 901: Awesome

An Eee 901 showed up here recently, and I've had a (little) time to play with it.

What an awesome little machine that thing is. The keyboard is better than I expected, and so is the screen.

I got annoyed at the lack of things like Emacs on the default Xandros install, so decided to zap it and install Debian. But first, I wanted to take a backup of it.

I was thinking to myself that this is a Linux environment, but I can't just boot up a Linux rescue thingy to get stuff off it because it's not a regular PC.

Oh wait. It IS a regular PC. It is so small that I wasn't even thinking about it in the right terms. So a little dd, gzip, and nc later I have my backup image.

Debian went on smoothly -- booted from a 16MB image on a USB drive. X, suspend/resume, etc. all worked out of the box. Compiled the wifi driver and it works.

This is, I think, the perfect laptop size. Also the price is good, it's solid... what's not to love?

Eddy Petrișor: Recommending the MSI MegaBook PR200WX-058EU laptop to Linux users

I recently bought a new MSI laptop and I am really pleased with my choice so far.

Since with the previous laptop I managed to kill two of my desired features, long battery life and pretty portable, I decided is time to look really well and see what the market has to offer.

I settled on a MSI PR200WX-058EU which has the following:
  • built on a Centrino platform
    • Intel(R) Core(TM)2 Duo CPU T8300 @ 2.40GHz
    • Intel Corporation PRO/Wireless 4965 AG or AGN
    • Intel mobile chipset
  • 3GB of memory (yes, I would have enjoyed 4, but it seems the 32 bit barrier still decides hardware configurations)
  • 320GB HDD
  • DVD+/-RW
  • Mobile GM965/GL960 Integrated Graphics Controller
  • 12" wide screen (1280x800)
  • 1 Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet
  • 8 cell battery by default (long battery life)
  • 1 USB 2.0 Camera - uses luvc driver
  • bluetooth
  • 1 card reader
  • 3 USB port, 1 HDMI, 1 D-sub 15 connector, 1 PCI Express port, modem port
  • fingerprint reader
  • an advertised weight of 1.8kg (I weighted it at 2.1kg with the 8 cell battery)

In other words a small and mobile powerhouse for which I payed 3800 RON (approx. 1100 ). I'd say not too bad at all.

Thanks to Gon ri Le Bouder and some searches on the internet I concluded that
the brand is not bad at all, and now that I have it I really am sure.

Of course, I installed Debian Lenny on it (I also sent an installation report), and, in spite of the initial problems, I managed to make the laptop work pretty nice, but I am especially excited about the webcam, which works with the linux-uvc driver.


There were some issues, but I managed to fix some them while I have been ignoring some other. The LaptopTestingTeam page for MSI PR200 on the ubuntu wiki was very helpful.
What have I been ignoring?
  • it seems that from time to time the battery charge status isincorrect, or acpi report that the AC is plugged in
  • headphones don't automatically turn off the speakers
  • fingerprint reader is not used yet, but I intent to experiment at some point with it (authentication via the fingerprint would be cool)
  • the keyboard seems a little bit too hard (but I hope it will loose up with time)
  • modem isn't probably working, but I don't think I'll ever try
  • there are some issues in gnome-power-manager which cause strange behaviour and grief wrt screen brighness
  • sleep doesn't work,but hibernation does



What would you do if I'd tell you that the battery lasts 4 hours or even more while the wlan is on and working (browsing and stuff like installing new packages, configs) with the brightness set to minimum?


I am really excited about this and I can say that I think I have found my next generation laptop, so if you're thinking of a cheap mobile powerhouse on which Linux must run, this laptop might be for you.

I find the following to be selling points (for a Linux buyer or others):
  • comes with FreeDOS, so no extra money for an OS you don't use
  • wifi works
  • webcam works with luvc
  • no big problems during install (the most severe are already fixed)
  • long battery life, even when using wifi (4+ hours in browsing+some package installation mode, according to my tests)
  • light enough to carry around easily (2.1kg, 2.4kg with charger)
  • nice design - some people asked me if I bought a MacBook
  • 4 state kill switch for all possible combinations for wifi/bluetooth
  • hibernate works with 2.6.24 or newer (sleep doesn't, but I will try a few things later)
  • there's no mechanical latch for the lid, there is a magnet, so there's no plastic to be broken, the laptop is more robust
  • the 8 cell battery is thicker than the regular one, allowing better ventilation
  • it seems it doesn't get too hot to put on my lap (still, I am a little afraid of blocking its ventilation due to the fabric of my clothes, so I'll probably try to carry around a hard paperboard or something like that)
  • the big resolution 1280x800 (for this screen size) seems to partly compensate for the reduced physical size of the screen (12")
  • bright screen

So, thanks again to Gon ri, Debian Installer team, LVM2 maintainers, Ubuntu Laptop Testing team, linux uvc developers, Lilo developers and maintainers, all the nice people who made and still make Debian possible.

Peter Van Eynde: wireless in 2.6.26 considered bad for europeans

After upgrading to 2.6.26 I could not associate with my AP anymore. After searching I noticed that the amount of channels reported by iwlist wlan0 channel had changed. And the channel that my AP was using (13) just disappeared.

I openeded a bug with the iwl people and the end result is: in 2.6.25 the card selected the region for the wireless, in 2.6.26 the cfg80211 system is doing so and the default is 'US'.

So if you are in Europe you need to add a file /etc/modprobe.d/cfg80211-region with as contents:

options cfg80211 ieee80211_regdom=EU

31 July 2008

Russell Coker: selinux-activate

I have written a script for Debian named selinux-activate which is included in selinux-basics version 0.3.3+nmu1 (which I have uploaded to Debian/Unstable). The script when run with no parameters will change the GRUB configuration to include selinux=1 on the kernel command-line and enable SE Linux support in the PAM modules for login, gdm, and kdm. One issue with this is that if you run the command before installing kdm or gdm then you won’t have the pam configuration changed - but as it’s OK to run the script multiple times this shouldn’t be a problem. The new selinux-basics package will also force a reboot after relabelling all filesystems. I had tested “umount -a ; reboot -f” but discovered that “reboot -f” causes filesystem corruption in some situations (my EeePC running an encrypted LVM volume on an SD card had this problem). So I now use a regular “reboot“. If no-one points out any serious flaws I plan to ask the release team to include this version of selinux-basics in Lenny. I believe that it will make it significantly easier to install SE Linux while also reducing the incidence of systems being damaged due to mistakes. If you edit the GRUB configuration file by hand then there is a risk of a typo making a system unbootable. The package in question is already in my Lenny repository, see my previous post about Lenny SE Linux for details [1].

Russell Coker: Installing SE Linux on Lenny

Currently Debian/Lenny contains all packages needed to run SE Linux apart from the policy. The policy package is missing because it needs to sit in unstable for a while before migrating to testing (Lenny), and I keep fixing bugs and uploading new versions. I have set up my own APT repository for SE Linux packages (as I did for Etch [1]). The difference is that it’s working now (for i386 and AMD64) while I released my Etch repository some time after the release of Etch. gpg --keyserver hkp://subkeys.pgp.net --recv-key F5C75256
gpg -a --export F5C75256 apt-key add - To enable the use of my repository you must first run the above two commands to retrieve and install my GPG key (take appropriate measures to verify that you have the correct key). deb http://www.coker.com.au lenny selinux Then add the above line to /etc/apt/sources.list and run “apt-get update” to download the list of packages. Next run the command “apt-get install selinux-policy-default selinux-basics” to install all the necessary packages and then “touch /.autorelabel” to cause the filesystems to be labeled on the next boot. Edit the file /boot/grub/menu.lst and add “selinux=1” to the end of the line which starts with “# kopt=” and then run the command update-grub to apply this change. Then reboot and the filesystems will be relabeled. Init will be running in the wrong context so you have to reboot again before everything is running correctly (I am thinking of having the autorelabel process automatically do the second reboot). For future reference please use the page on my documents blog - I will update it regularly as needed [2]. This post will not be changed when it becomes outdated in a few days.

30 July 2008

Jacobo Tarrío Barreiro: Reviewing Galician debconf template translations

Running the Galician debconf template translation as an one-man show has an obvious problem: translations don’t get reviewed. Being only one, I would only catch typos, and the odd thinko, which is not very useful. The real use of reviews is to see if the grammar is sound, see if the translation sounds natural or forced, etc., and it has to be someone else who does it. If I review my own translations, of course they’ll be perfect. When someone else picks those translations up after I stop doing them, it would be useful to make a full review. Fortunately, I’ve been keeping a compendium of (almost) all debconf template translations, so doing the review is as simple as downloading that single file and reading it. I’d recommend that one single person read the full document and makes notes of grammatical/orthographic mistakes, common patterns, vocabulary choices, etc., and then those notes should be used to go through the compendium again and fix and update everything. The result would be useful for two things: First, it is a very big collection of examples you can point people to when they don’t know what style to use to translate. So, when someone asks in the mailing list about the best way to translate Couldn’t create temporary file , you can search for similar sentences, see how they were translated and suggest the same solution. Second, you can use that compendium to apply the results of the review to all translated packages very quickly. The idea is to regenerate the .PO file from the compendium. You can do it actively (see what packages have had their debconf templates translated into Galician, download .POT files, apply compendium, upload .PO files) or reactively (when you have to update a .PO file, download the .POT instead and apply the compendium, then update the resulting .PO file).

Pablo Lorenzzoni: DNS mess and what I think about DNSSEC

I am following closely this new DNS mess. In fact, there s nothing really new in that. DNS has been attacked lots of times over the years as a result of not being designed with security in mind from the ground up -, just this new one is a combination of known attacks against known security flaws. The quick fix is not a real fix, and just incorporate old ideas into the most used DNS software, strengthening it to face the attack. The details leaked, and there s already at least one public exploit (and who knows how many in the wild). The new buzzword is DNSSEC. I don t like DNSSEC. I never did. The first time I heard of it, around year 2001, it was a centralization of a decentralized database: A proposed company (called Network Solutions) would serve as a central authority, signing every root DNS entry. It was a joke! Come on! DNS is suppose to be decentralized! Having a central company anywhere is just a huge step back in decentralization (not to mention a huge step back in security). Time passed, and the DNSSEC specs evolved to a more decentralized way of thinking. The state it is now, and the implementations we saw so far are not good. No! I am not talking about security I am talking about the KISS principle: DNSSEC turns something really simple to deploy into a full-time job, with frequent key roll-overs and re-signing everytime you change the zone a huge mess! Yes, there are automated tools, but, come on! you still have to wait for TTL to expire before publishing this part or that part of the cryptographic machinery And, if we are talking about real security, are we going to build some automated tool fire-and-forget -style and not follow it? If we are not looking at it as it goes, and it fails, we could end up with a completely wrong set-up or (even worse) a non-validating zone. And I haven t yet mentioned the increase in payload I am not completely convinced that this alone would not lead to DoS attacks just by compromising the responsiveness of the servers (and DoS attacks are already available for quite some time maybe the DNSSEC-medicine is worse than the disease ). The root ( . ) servers are not even DNSSEC-aware, and there s a whole class of other stuff to work-around the fact that they may not be DNSSEC-aware for quite some time yet. There has to be a simpler way! I can imagine at least three ways to fix the problem until we can fix DNS in a KISS way And they re all KISS also:
  • Change Transaction ID field. This is the first Achiles heel of this crisis. Let s increase the length of this field to 2048 bits, or even larger. Better yet, let s make it variable, so every system administrator can set his servers own size. Yes, I know this leads to replacing ALL the DNS infrastructure, but isn t that what we are doing right now, anyway?
  • Deactivate in-bailiwick injection. Over the years, DNS have been expanded to allow a lot of things other than translation of names into numbers (or to ease this translation). The second Achiles heel is the ability to inject the IP address for WWW.VICTIM.COM while consulting for 10294DKGJSDL.VICTIM.COM since both name-addresses are in the same bailiwick (in-bailiwick). Let s take a step back, and deactivate all this Before 1995, the same thing could happen with any addresses, including those out of bailiwick , and it was fixed to only allow those in-bailiwick Let s fix it again to not allow it at all!
  • Good, and old iptables. Couldn t we just use iptables LIMITS to stop this attack and blacklist the attacker? We ve been doing this for a lot of other things (SYN-floods, ICMP attacks, etc). Can t we just do the same. Again: this is not a new thing it relies on multiple attacks in a short period of time, just like other attacks we ve seen and successfully blocked with these techniques
Maybe some of those three solutions are flawed Maybe none are flawed and can be deployed together Maybe I am wrong and DNSSEC is the only way to go But let s not panic, let s cool our minds and begin thinking it through. I still don t think DNSSEC is the holy grail Now I already spent more time than intended on this let me go back signing some zones ;-)

Steve Kemp: I know how to make a Holy Bartender

I've made a new release of my sift IMAP utility, which now adds a few new types of rules:
  • Match message bodies against regular expressions.
  • Match recipients against regular expressions.
All the "searching" rules now allow negation too, so that "from:foo@bar.com" and "!from:foo@bar" work as you'd expect. Finally each of the searching rules, which require the download of the complete IMAP message, will use a local disk-cache to avoid undue overhead. All in all I'm pretty pleased with the way the tool is being used in the wild. Each of these changes were the result of a direct user request, or suggestion. ObMovie: Dogma

MJ Ray: SPI Election Result and Apology

Regular readers may remember that I stood in the board election of Software in the Public Interest, the main democratic free software corporation, a few weeks ago. Well, the result is posted with David Graham and Jimmy Kaplowitz are re-elected. Well done and good luck to both. Thanks to the other board members for running the election and restarting the voting machine as necessary. The postponed July meeting might happen in irc.oftc.net #spi today (Wednesday) at 1900UTC, but I expect they’ll announce it in the usual place before it happens. Naturally, I’m disappointed that more news, members’ panels and the annual report weren’t attractive enough to get more votes, and that old untruths were being reposted to some forums, but I can’t get too upset about this year’s result because both elected candidates had fine manifestos. I’m glad that Jimmy Kaplowitz’s platform includes posting more news and look forward to seeing that. Slightly worrying are the low turnout (down for the third year) and that over 80% of those few voters were from debian (my estimate). I’ve my suspicions why, but I’d love any non-voters to leave me a comment telling me why you think it is. The apology: the summary of responses to my questions about SPI membership will appear next week because I made a mistake on one site, set the closing date a week late and I don’t see any way to edit surveys after they’ve opened. Oops. Sorry. (Now, if that site was running free software, I’d see if I could fix the user interface to allow previews.) (Aside: I was going to include a bar chart of the voting, like last year, but Wordpress’s stupid post editor strips style attributes from li tags. I’ll go looking for that with a hack-axe Real Soon Now, before it causes me serious trouble.)

28 July 2008

Russell Coker: Biba and BLP for Network Services

Michael Janke has written an interesting article about data flows in networks [1], he describes how data from the Internet should be considered to have low integrity (he refers to it as “untrusted”) and that as you get closer to the more important parts of the system it needs to be of higher integrity. It seems to me that his ideas are very similar in concept to the Biba Integrity Model [2]. The Biba model is based around the idea that a process can only write data to a resource that is of equal or lower integrity and only read data from a resource that is of equal or higher integrity, this is often summarised as “no read-down and no write-up“. In a full implementation of Biba the OS would label all data (including network data) as to it’s integrity level and prevent any communication that violates the model (except of course for certain privileged programs - for example the file or database that stores user passwords must have high integrity but any user can run the program to change their password). A full Biba implementation would not work for a typical Internet service, but considering some of the concepts of Biba while designing an Internet service should lead to a much better design (as demonstrated in Michael’s post). While considering the application of Biba to network design it makes sense to also consider consider the Bell LaPadula model (BLP) [3]. In computer systems designed for military use a combination of Biba and BLP is not uncommon, while a strict combination of those technologies would be an almost insurmountable obstacle to development of Internet services I think it’s worth considering the concepts. BLP is a system that is primarily designed around the goal of protecting data confidentiality. Every process (subject) has a sensitivity label (often called a “clearance”) which is comprised of a sensitivity level and a set of categories and every resource that a process might access (object) also has a sensitivity label (often called a “classification”). If the clearance of the subject dominates the classification of the object (IE the level is equal or greater and the set of categories is a super-set) then read access is permitted, if the clearance of the subject is dominated by the classification of the object then write access is permitted, and the clearance and classification have to be equal for read/write access to be permitted. This is often summarised as “no write-down and no read-up“. SGI has published a lot of documentation for their Trusted Irix (TRIX) product on the net, the section about mandatory access control covers Biba and BBLP [4]. I recommend that most people who read my blog not read the description of how Biba and BLP works, it will just give you nightmares. The complexity of either Biba or BLP (including categories) is probably too great for consideration when designing network services which have much lower confidentiality requirements (even the loss of a few million credit card numbers is trivial compared to some of the potential results of leaks of confidential military data). But a simpler case of BLP with only levels is worth considering. You might have credit card numbers stored in a database classified as “Top Secret” and not allow less privileged processes to read from it. The data about customers addresses and phone numbers might be classified as “Secret” and all the other data might merely be “Classified”. One way of using the concepts of Biba and BLP in the design of a complex system would be to label every process and data store in the system according to it’s integrity and classification/clearance. Then for the situations where data flows to processes with lower clearance the code could be well designed and audited to ensure that it does not leak data. For situations where data of low integrity (EG data from a web browser) is received by a process of high integrity (EG the login screen) the code would have to be designed and audited to ensure that it correctly parsed the data and didn’t allow SQL injection or other potential attacks. I expect that many people who have experience with Biba and BLP will be rolling their eyes while reading this. The situation that we are dealing with in regard to PHP and SQL attacks over the Internet is quite different to the environments where proper implementations of Biba and BLP are deployed. We need to do what we can to try and improve things, and I think that the best way of improving things in terms of web application security would involve thinking about clearance and integrity as separate issues in the design phase.

27 July 2008

Russell Coker: New Net Connections

On Thursday my new InterNode ADSL2+ service was connected [1]. I needed to get a connection with a larger download cap and a better upload speed because one of my clients wants me to transfer some significant amounts of data as well as hosting some Xen DomU’s for him. Strangely InterNode couldn’t offer a regular ADSL service but could offer Naked DSL (which means DSL without a phone service on the same pair of wires). So I now have Naked ADSL 2+[2] although unfortunately the line speed is reported as being 8263/814 Kbps - ADSL2 speed. For the moment this will do, but I’ll investigate the possibility of improving this eventually. Another strange thing about this is that Optus is the carrier for the ADSL line, Telstra is the monopoly telco with the vast majority of local-loop copper pairs so it’s surprising that I end up with Optus owning my copper - the wires in question were used by the previous owner of my house for a Telstra connection! On Friday I converted my network to using the new ADSL link and on Saturday I got my SE Linux Play Machine online again [3]. I could have managed the transition without ~20 hours of down-time for the Play Machine, but as I only get a few logins per day it didn’t seem to be worth the effort of rushing it. Also on Friday I got a new 3G modem from Three [4]. They advertise that the USB or PC-Card modem will cost $5 per month on a 24 month plan, but when I ordered it I discovered that as I have an existing mobile phone plan with them the $5 per month is waived. So all that I have to pay is $15 per month for a 1GB data allowance (which is about the best deal available). A client is paying for this so that I can provide remote support for his network. I had previously written about my search for an ideal mobile SSH client [5], I ended up getting an EeePC 701 which cost $300, an 8G SD card and 8G USB stick (for expanding the internal storage and for moving files around respectively) which cost $83, and now $15 per month over 24 months for net access. That gives a total of $743 for two years of mobile net access. This compares well to the $960 that an iPhone would cost over two years and provides a lot more utility (while admittedly not fitting into a pocket). Dave Hall [6] gave me a lot of great advice about selecting and using 3G modems. He recommended that I get the E220 modem as it’s easy to configure (mine was easy on Debian/Lenny but didn’t work with a Debian/Etch kernel as the necessary driver was not available). Three also sells another model the E169G which is apparently tricky to set up. There was one mistake made in the design of the E220, the cable is installed in such a way that the LED which indicates connection status is going to be face-down when connected to almost any laptop which has horizontally mounted USB ports (which includes all the thinner ones). Here is the PPP chatscript for use with an E220 modem (suggested file name /etc/chatscripts/three):

ABORT 'BUSY'
ABORT 'NO CARRIER'
ABORT 'ERROR'
'' AT
OK ATQ0V1E1S0=0&C1&D2+FCLASS=0
OK 'AT+COPS=0,0,"3TELSTRA",2'
OK AT+CGATT=1
OK AT+CGDCONT=1,"IP","3netaccess"
OK ATDT*99**3# Here is the ppp configuration file which references the above chatscript:
/dev/ttyUSB0
230400
noauth
defaultroute
usepeerdns connect "/usr/sbin/chat -v -f /etc/chatscripts/three"

Romain Francoise: emacs-snapshot 20080727-1

After two weeks of well-deserved vacation and other delays, I'm back to doing regular updates of emacs-snapshot. Here's a quick summary of the notable changes in Emacs CVS since my last post:
  • longlines-mode was replaced by a more complete and reliable implementation of the same concept, visual-line-mode. It's based on a new low-level change to the display engine to support line wrapping at word boundaries.
  • Fonts can now be customized on a per-buffer basis. S-Mouse-1 shows a new menu which allows to change the font used in the buffer, increase/decrease its size, or reset it to the default font setting (Options > Set Default Font). A new minor mode variable-pitch-mode enables non-proportional fonts in the current buffer, which is useful in Gnus articles or Info buffers.
  • There's a new NeXTSTEP port which provides support for GNUStep (on GNU/Linux) and Cocoa (on Mac OS X).
  • M-s is a new global binding for all things related to search like Occur, Hi-Lock, etc.
  • Serial port access: Emacs can now be used as a serial terminal (like minicom), see M-x serial-term.
  • Project-local variables: like file variables but for directories.
  • New SVG splash screen images for Emacs and Gnus.
  • New packages: proced.el, zeroconf.el, xesam.el, linum.el, ...

26 July 2008

Matthew Garrett: Further Foxconn fun

Ryan kindly sent me a copy of the ACPI tables for his motherboard, so I've had the opportunity to look at them in a little more detail. There's nothing especially surprising. The first method of interest is OSFL, which I've annotated below:
   Method (OSFL, 0, NotSerialized)
     
        If (LNotEqual (OSVR, Ones))
         
            Return (OSVR)
         
This block simply skips the checks if they've already been evaluated and returns the cached value
        If (LEqual (PICM, Zero))
         
            Store (0xAC, DBG8)
         
If the programmable interrupt controller has been set up in PIC mode rather than APIC mode, 0xAC is written to i/o port 0x80. This would then show up on a plug-in card if one were attached. Simply debug code
        Store (One, OSVR)
Set OSVR to 1, which in this case clearly means "Unknown OS"
        If (CondRefOf (_OSI, Local1))
This checks whether the OS supports the _OSI method. If it does, the following block is executed. If not, the older _OS method is used to detect the OS
         
            If (_OSI ("Windows 2000"))
             
                Store (0x04, OSVR)
             
Newer versions of Windows will also claim to support the interfaces defined in older versions, so this set of checks is done in release order
            If (_OSI ("Windows 2001"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001 SP2"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2001.1 SP1"))
             
                Store (Zero, OSVR)
             
            If (_OSI ("Windows 2006"))
             
                Store (Zero, OSVR)
             
If we've got this far, OSVR is now set to 0. Linux will claim to support all of these interfaces, and so OSVR should be 0 on Linux systems. Note that there is no _OSI check for Linux - the 2.6.24 change to remove Linux from the set of claimed interfaces is therefore irrelevant
         
        Else
         
Linux supports _OSI, so we should never be here. But if we somehow are...
            If (MCTH (_OS, "Microsoft Windows NT"))
             
                Store (0x04, OSVR)
             
Linux has responded to _OS with "Microsoft Windows NT" since 2.6.9. MCTH is simply a string matching routine defined elsewhere in the DSDT. So, worst case here is that OSVR is 4
            Else
             
                If (MCTH (_OS, "Microsoft WindowsME: Millennium Edition"))
                 
                    Store (0x02, OSVR)
                 
                If (MCTH (_OS, "Linux"))
                 
                    Store (0x03, OSVR)
                 
..because this could never be true unless you're running 2.6.8.1 or earlier. But even so, getting here would still indicate failure - we've supported _OSI since before then, and so should never come anywhere near this code block.
             
         
        Return (OSVR)
     
In summary, we end up with the following values:
ValueOS
0Windows XP, 2003 or Vista. Linux (assuming absence of bugs)
1Unknown OS
2Windows ME
3A version of Linux that doesn't implement _OSI and is from before 2.6.9
4Windows NT 4 and 2000. A version of Linux that doesn't implement _OSI and is 2.6.9 or later (I don't believe any such version exists

Now, where is this used? The majority of the OSFL checks only check whether the return value is 1 or 2, which will only be true for an OS that (a) doesn't claim to be Windows or (b) is Windows ME. Linux doesn't fall into either of these categories, so we can ignore them. The first interesting hit we have is in the HPET code, where _STA will return 0xf (device present and working) if OSFL is 0 and 0xb (device present and working, but should not be shown in the UI) otherwise. This is just to keep the HPET from showing up in versions of Windows that don't know what it is. The only other interesting hit is the following code from the PCI bus initialisation pathway:
 
                               If (LEqual (OSFL (), Zero))
                                 
                                    Store (0x59, SMIC)
                                 
                                Else
                                 
                                    If (LEqual (OSFL (), 0x04))
                                     
                                        Store (0x5A, SMIC)
                                     
                                    Else
                                     
                                        Store (0x58, SMIC)
                                     
                                 
This writes different values to SMIC (which turns out to be i/o port 0xb2) depending on the OS. 0xb2 is the standard(ish) way to trigger a system management interrupt, which causes the CPU to execute some code from a memory region that can't be accessed by the OS. This isn't that unusual, but it's a little weird. In any case, note that there's no check for whether OSFL is 3 here (which would be true if the _OS call returned Linux), and so Linux is being treated identically to Windows ME and any unknown OS. In reality, Linux will be treated identically to either Vista or 2000. This block provides no evidence of conspiracy. Finally, the OS version flag is written to a region of memory before suspend and read back afterwards. Nothing appears to be done with this information - it's conceivable that the low-level resume code in the BIOS has conditionals based on this, but I suspect that it's just boilerplate code that's ignored.

To summarise:
  • There is no code in this DSDT that could determine that the system is running any Linux kernel of 2.6.9 or later. This may even be true of earlier versions - I'm not sure when _OSI support was added
  • Even if the code did manage to determine that the system was running Linux, there are no codepaths that are Linux specific. Every piece of code is run on at least one version of Windows
What's the problem, then? I've no idea. The only "significant" issue is that the OEMB table provided by the BIOS has an incorrect checksum. Given that the OEMB table is never used by Linux (it's a vendor extension of some kind, with the best hint I've been able to find being that it can be used to pass information from the BIOS to the OS - kind of like the rest of ACPI, then...), this is pretty unimportant. And given that the OEMB table isn't part of the ACPI spec, it's certainly entirely irrelevant when it comes to determining whether the system is ACPI compliant or not.

Are there ACPI issues with Ryan's system? It sounds like it. The "Error attaching device data" complaints indicate some kind of failure on the part of the kernel to work out how the devices correspond to the ACPI namespace, but I strongly suspect that this is a Linux bug. Failure to reboot after suspend? Could be anything (I'd need direct access to the hardware to figure it out properly), but again it's almost certainly a Linux bug. The standard way Linux reboots systems is to bang the keyboard controller, and it's conceivable that something we're doing on resume is leaving the keyboard controller in a slightly confused state. We're clearly doing something wrong there, given that my Dell comes up without a keyboard about one resume in twenty - I just haven't had time to look into it yet.

The only remaining thing is the mutex handwaving. I've got no clue what's going on there. Ryan's suggested change (from Acquire (MUTE, 0x03E8) to Acquire (MUTE, 0xFFFF)) simply means that the OS will wait forever until it acquires the mutex - in the past it would only wait a second. The reason the compiler generates a warning here is that the firmware never checks whether it acquired the mutex or not! Bumping the timeout to infinity obviously fixes this warning (there's no need to check the return code if you're happy to wait forever rather than failing), but the original code is merely stupid as opposed to a spec violation.

Take home messages? There's no evidence whatsoever that the BIOS is deliberately targeting Linux. There's also no obvious spec violations, but some further investigation would be required to determine for sure whether the runtime errors are due to a Linux bug or a firmware bug. Ryan's modifications should result in precisely no reasonable functional change to the firmware (if it's ever hitting the mutex timeout, something has already gone horribly wrong), and if they do then it's because Linux isn't working as it's intended to. I can't find any way in which the code Foxconn are shipping is worse than any other typical vendor. This entire controversy is entirely unjustified.

Matthew Garrett

As an update to this, it turns out that I can't read and talking about _OSI isn't very helpful when the DSDT in question is calling _OS, but it does leave me somewhat more confused - Linux has claimed to be Windows NT since approximately forever. Without the original DSDT I've got absolutely no clue what's going on, but comments like:

Find and replace all seven occurences of Acquire (MUTE, 0x03E8) and replace with Acquire (MUTE, 0xFFFF), it appears they're trying to crash the kernel by locking a region of memory that shouldn't be locked, but without access to their source code comments, I can only speculate, this tells it to lock a memory address that is always reserved instead. ;)

don't give me a lot of confidence in any of this being a correct diagnosis given that the second argument to Acquire is a timeout and not an address (0x03e8 gives a timeout of a second, while 0xffff is "Block on acquiring this mutex forever").

In any case, it's highly unlikely that this is any attempt by Foxconn to prevent Linux from working. The majority of checks for Linux in ACPI tables are copy and pasted from reference tables that Intel (and other manufacturers) have provided at various points - even the Intel Macs attempt to check for Linux! Most vendors will never attempt to boot Linux on their boards or validate them appropriately, so it's entirely conceivable that they'll end up screwing things up in such a way that the only tested paths are the ones that are run by Windows. This is why we now attempt to ensure that Linux reports itself as Windows. If we're running Linux-specific code in the DSDT, then that's a bug in Linux.

Anyway. Accusing companies of conspiring against us when the most likely explanation is simply that they don't care is a fucking ridiculous thing to do and does nothing to get rid of the impression that Linux users are a bunch of whining childish hatemongers. Next time, try talking to someone who actually understands this stuff first?

Philipp Kern: Stable Point Release: Etch 4.0r4 (aka etchnhalf)

Another point release for Etch has been done; now it's the time for the CD team to roll out new images after the next mirror pulse. The official announcements (prepared by Alexander Reichle-Schmehl, thanks!) will follow shortly afterwards. FTP master of the day was Joerg Jaspert, who did his first point release since Woody, as he told us on IRC. We appreciate your work and you spending your time that shortly before going to Argentina. This point release includes the etchnhalf update introducing a new kernel image (based on 2.6.24) and some driver updates. Additionally the infamous openssl hole will be fixed for good, even for new installs. Again I want to present you a list of people who contributed to this release. It cannot be complete as I got the information out of the Changed-by fields of the uploads.
  • akira yamada
  • Alexander Sack
  • Alexander Schmehl
  • A Mennucc1
  • Andrea De Iacovo
  • Andres Salomon
  • Aurelien Jarno
  • Charles Plessy
  • Christian Perrier
  • Christian Welzel
  • Colin Watson
  • dann frazier (indefatigable kernel worker, most sourceful uploads)
  • Darren Salt
  • Devin Carraway (3rd place of sourceful uploads, due to security work)
  • Emmanuel Lacour
  • Eric Dorland
  • Fabio Tranchitella
  • Faidon Liambotis
  • Fathi Boudra
  • Florian Weimer
  • Francesco Paolo Lovergine
  • Francois Marier
  • Frank Lichtenheld
  • Frans Pop (thanks for your d-i work!)
  • Frederic Peters
  • Gregory Colpart
  • Holger Levsen
  • Jan Wagner
  • Jay Berkenbilt
  • J r my Bobbio
  • Joey Hess
  • Joey Schulze
  • Josselin Mouette
  • Julien Cristau
  • Kai Hendry
  • Kurt Roeckx
  • LaMont Jones
  • Laszlo Boszormenyi
  • Martin Pitt
  • maximilian attems
  • Michael Biebl
  • Michael Koch
  • Mike Hommey
  • Moritz Muehlenhoff
  • Noah Meyerhans
  • Ola Lundqvist
  • Otavio Salvador
  • Patrick Matth i
  • Petter Reinholdtsen
  • Philipp Kern
  • Pierre Habouzit
  • Raphael Hertzog
  • Rene Engelhard
  • Robert Millan
  • Roberto Lumbreras
  • Roland Mas
  • Romain Beauxis
  • Russ Allbery
  • Sean Finney
  • Stefan Fritsch
  • Steffen Joeris
  • Stephen Gran
  • Steve Kemp
  • Sune Vuorela
  • Thijs Kinkhorst (2nd place of sourceful uploads, due to security work)
  • Thomas Viehmann
  • Toni Mueller
  • Tzafrir Cohen
From the Release Team we had dann frazier (who drove the important kernel part of etchnhalf), Luk Claes, Neil McGovern, Andreas Barth, Martin Zobel-Helas and me working on it. ;-)

Next.

Previous.