Search Results: "ema"

21 September 2008

Wouter Verhelst: SSL "telnet"

A common way to debug a network server is to use 'telnet' or 'nc' to connect to the server and issue some commands in the protocol to verify whether everything is working correctly. That obviously only works for ASCII protocols (as opposed to binary protocols), and it obviously also only works if you're not using any encryption. But that doesn't mean you can't test an encrypted protocol in a similar way, thanks to openssl's s_client:
wouter@country:~$ openssl s_client -host samba.grep.be -port 443
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
verify return:1
---
Certificate chain
 0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
   i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDXDCCAsWgAwIBAgIJAITRhiXp+37JMA0GCSqGSIb3DQEBBQUAMH0xCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5ncmVwLmJlMR0wGwYJKoZI
hvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTAeFw0wNTA1MjEwOTMwMDFaFw0xNTA1MTkw
OTMwMDFaMH0xCzAJBgNVBAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQH
EwhNZWNoZWxlbjEUMBIGA1UEChMLTml4U3lzIEJWQkExFDASBgNVBAMTC3N2bi5n
cmVwLmJlMR0wGwYJKoZIhvcNAQkBFg53b3V0ZXJAZ3JlcC5iZTCBnzANBgkqhkiG
9w0BAQEFAAOBjQAwgYkCgYEAsGTECq0VXyw09Zcg/OBijP1LALMh9InyU0Ebe2HH
NEQ605mfyjAENG8rKxrjOQyZzD25K5Oh56/F+clMNtKAfs6OuA2NygD1/y4w7Gcq
1kXhsM1MOIOBdtXAFi9s9i5ZATAgmDRIzuKZ6c2YJxJfyVbU+Pthr6L1SFftEdfb
L7MCAwEAAaOB4zCB4DAdBgNVHQ4EFgQUtUK7aapBDaCoSFRWTf1wRauCmdowgbAG
A1UdIwSBqDCBpYAUtUK7aapBDaCoSFRWTf1wRauCmdqhgYGkfzB9MQswCQYDVQQG
EwJCRTEQMA4GA1UECBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNV
BAoTC05peFN5cyBCVkJBMRQwEgYDVQQDEwtzdm4uZ3JlcC5iZTEdMBsGCSqGSIb3
DQEJARYOd291dGVyQGdyZXAuYmWCCQCE0YYl6ft+yTAMBgNVHRMEBTADAQH/MA0G
CSqGSIb3DQEBBQUAA4GBADGkLc+CWWbfpBpY2+Pmknsz01CK8P5qCX3XBt4OtZLZ
NYKdrqleYq7r7H8PHJbTTiGOv9L56B84QPGwAzGxw/GzblrqR67iIo8e5reGbvXl
s1TFqKyvoXy9LJoGecMwjznAEulw9cYcFz+VuV5xnYPyJMLWk4Bo9WCVKGuAqVdw
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=svn.grep.be/emailAddress=wouter@grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1428 bytes and written 316 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 65E69139622D06B9D284AEDFBFC1969FE14E826FAD01FB45E51F1020B4CEA42C
    Session-ID-ctx: 
    Master-Key: 606553D558AF15491FEF6FD1A523E16D2E40A8A005A358DF9A756A21FC05DFAF2C9985ABE109DCD29DD5D77BE6BC5C4F
    Key-Arg   : None
    Start Time: 1222001082
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
HEAD / HTTP/1.1
Host: svn.grep.be
User-Agent: openssl s_client
Connection: close
HTTP/1.1 404 Not Found
Date: Sun, 21 Sep 2008 12:44:55 GMT
Server: Apache/2.2.3 (Debian) mod_auth_kerb/5.3 DAV/2 SVN/1.4.2 PHP/5.2.0-8+etch11 mod_ssl/2.2.3 OpenSSL/0.9.8c
Connection: close
Content-Type: text/html; charset=iso-8859-1
closed
wouter@country:~$ 
As you can see, we connect to an HTTPS server, get to see what the server's certificate looks like, issue some commands, and the server responds properly. It also works for (some) protocols who work in a STARTTLS kind of way:
wouter@country:~$ openssl s_client -host samba.grep.be -port 587 -starttls smtp
CONNECTED(00000003)
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
verify return:1
---
Certificate chain
 0 s:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
   i:/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDBDCCAm2gAwIBAgIJAK53w+1YhWocMA0GCSqGSIb3DQEBBQUAMGAxCzAJBgNV
BAYTAkJFMRAwDgYDVQQIEwdBbnR3ZXJwMREwDwYDVQQHEwhNZWNoZWxlbjEUMBIG
A1UEChMLTml4U3lzIEJWQkExFjAUBgNVBAMTDXNhbWJhLmdyZXAuYmUwHhcNMDgw
OTIwMTYyMjI3WhcNMDkwOTIwMTYyMjI3WjBgMQswCQYDVQQGEwJCRTEQMA4GA1UE
CBMHQW50d2VycDERMA8GA1UEBxMITWVjaGVsZW4xFDASBgNVBAoTC05peFN5cyBC
VkJBMRYwFAYDVQQDEw1zYW1iYS5ncmVwLmJlMIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQCee+Ibci3atTgoJqUU7cK13oD/E1IV2lKcvdviJBtr4rd1aRWfxcvD
PS00jRXGJ9AAM+EO2iuZv0Z5NFQkcF3Yia0yj6hvjQvlev1OWxaWuvWhRRLV/013
JL8cIrKYrlHqgHow60cgUt7kfSxq9kjkMTWLsGdqlE+Q7eelMN94tQIDAQABo4HF
MIHCMB0GA1UdDgQWBBT9N54b/zoiUNl2GnWYbDf6YeixgTCBkgYDVR0jBIGKMIGH
gBT9N54b/zoiUNl2GnWYbDf6YeixgaFkpGIwYDELMAkGA1UEBhMCQkUxEDAOBgNV
BAgTB0FudHdlcnAxETAPBgNVBAcTCE1lY2hlbGVuMRQwEgYDVQQKEwtOaXhTeXMg
QlZCQTEWMBQGA1UEAxMNc2FtYmEuZ3JlcC5iZYIJAK53w+1YhWocMAwGA1UdEwQF
MAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAAnMdbAgLRJ3xWOBlqNjLDzGWAEzOJUHo
5R9ljMFPwt1WdjRy7L96ETdc0AquQsW31AJsDJDf+Ls4zka+++DrVWk4kCOC0FOO
40ar0WUfdOtuusdIFLDfHJgbzp0mBu125VBZ651Db99IX+0BuJLdtb8fz2LOOe8b
eN7obSZTguM=
-----END CERTIFICATE-----
subject=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
issuer=/C=BE/ST=Antwerp/L=Mechelen/O=NixSys BVBA/CN=samba.grep.be
---
No client certificate CA names sent
---
SSL handshake has read 1707 bytes and written 351 bytes
---
New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
Server public key is 1024 bit
Compression: NONE
Expansion: NONE
SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 6D28368494A3879054143C7C6B926C9BDCDBA20F1E099BF4BA7E76FCF357FD55
    Session-ID-ctx: 
    Master-Key: B246EA50357EAA6C335B50B67AE8CE41635EBCA6EFF7EFCE082225C4EFF5CFBB2E50C07D8320E0EFCBFABDCDF8A9A851
    Key-Arg   : None
    Start Time: 1222000892
    Timeout   : 300 (sec)
    Verify return code: 18 (self signed certificate)
---
250 HELP
quit
221 samba.grep.be closing connection
closed
wouter@country:~$ 
OpenSSL here connects to the server, issues a proper EHLO command, does STARTTLS, and then gives me the same data as it did for the HTTPS connection. Isn't that nice.

Christian Perrier: Between 60 and 64 languages supported in Debian Installer

(including English!) The string freeze of Debian Installer officially ended at 23:59 yesterday (Sept. 20th). Indeed, this was extended a bit to today, with agreement by Otavio Salvador who I thank for this. That allowed Zak to "save" Tagalog and also the Welsh and Latvian translators to polish their work. We now have to decide about some of these languages: those that failed to meet the release criteria but were formerly activated in D-I. There are four such languages: Amharic, Welsh, Estonian and Northern Sami. Please find below the mail I just sent to debian-i18n and debian-boot. I promised that this discussion would happen in public. It will (but it will be short as we can't delay the release of the installer for ages....and I think that my proposals are reasonable!)
First of all, the numbers as of Sunday Sept. 21st 09:32 UTC (date of
the last commit with an l10n update):
Languages meeting the release criteria: 59
------------------------------------------
Already activated and complete for level 1: 51
 Arabic, Belarusian, Bulgarian, Bosnian, Catalan, Czech, Danish,
 German, Dzongkha, Greek, Esperanto, Spanish, Basque, Finnish, French,
 Galician, Gujarati, Hebrew, Hindi, Croatian, Hungarian, Indonesian,
 Italian, Japanese, Georgian, Khmer, Korean, Lithuanian, Latvian,
 Macedonian, Malayalam, Marathi, Norwegian Bokm l, Nepali, Dutch,
 Norwegian Nynorsk, Punjabi, Polish, Portuguese, Brazilian Portuguese,
 Romanian, Russian, Slovak, Albabian, Swedish, Tamil, Thai, Turkish,
 Vietnamese, Simplified Chinese, Traditional Chinese
Already activated and complete for sublevels 1 and 2: 6
Bengali, Kurdish, Slovenian, Tagalog, Ukrainian, Wolof
Not yet activated languages complete for sublevels 1 and 2: 2
 (the mail in -i18n and -boot says 3 but this is an error by me)
Irish, Serbian
Languages failing to meet the release criteria: 15
--------------------------------------------------
Activated languages: 4
Amharic, Welsh, Estonian, Northern Sami
Not yet activated languages: 11
Afrikaans, Persian, Armenian, Icelandic, Kazakh, Kannada,
Malagasy, Malay, Telugu, Urdu, Xhosa
Discussion
----------
(careful people will notice that I moved Welsh down to "failed to meet
the release criteria" as this is what is technically correct)
Nothing to discuss for the 57 already activated languages that meet
the defined criteria. They'll be kept or first activated in the RC1
release of Debian Installer.
Similarly, nothing to discuss for the 11 languages that were not
activated and haven't made it. They will remain unactivated.
Two languages should be activated as they have met the release
criteria for the first time during the string freeze: Irish and Serbian.
This adds more load (and size changes) to D-I but I really don't see
any reason to not follow our own rules there.
The discussion comes for the 4 languages that fail to meet the release
criteria. Here are my proposals with some rationale:
Amharic: 
  I would really dislike deactivating Amharic because it's highly
  symbolic to have the language of Ethiopia activated. We have so few
  African languages. Also, the translation is nearly complete and the
  translator was well coping with updates until July. The missing
  stuff for Amharic in sublevels 1 and 2 are messages about loading
  drivers or firmware from removable media, the rescue mode stuff for
  the graphical installer and some messages that briefly appear during
  finish-install. A little bit more important is the message warning
  that the boot partition is not ext2 or ext3, added in August by
  tbm. I think this is not enough to drop out one year of efforts for
  the translator
  As a consequence, I propose to KEEP Amharic.
Welsh:
  Only five strings are missing in sublevels 1 and 2 because of the
  small experience of PO files by the person who completed the
  translation during last week. One will make the regular user login
  name screen to be in English and others will make the GRUB password
  screen to be in English as well, that's all.
  Additionnally, we can safely assume that all potential users of
  Welsh have good skills in English...and will therefore very easily
  cope with these screens.
  As a consequence, I propose to KEEP Welsh.
Estonian:
  The translation had NO update since Etch. The last update is dated
  back to Feb. 17th 2007. I haven't got any sign of life from the
  translator and no Estonian users have volunteered to maintain the
  translation.
  Missing strings are in many places, including several screens that
  appear in default installs. Even though one can assume that the
  skills of the average Linux user in Estonia is fairly good, I think
  this is not enough to throw users in a big mix of English and
  Estonian.
  As a consequence, I propose to DROP Estonian.
Northern Sami:
  The translation is very incomplete. With about any other language,
  that would be a reason to drop the translation.
  However, a few reasons make me suggest keeping it:
   - Northern Sami is mostly used in Norway and D-I will fall back
     to Norwegian Bokm l which is understood by all potentials users
     as it is teached in all Norwegian schools. 
   - Users will be warned, *in Sami*, about this situation
   - The choice of Sami will be kept in localechooser even if the
     translations are dropped. This is on request of Debian Edu
     developers to avoid them to develop a special boot floppy
     to offer the choice of Sami (a requirement for Norwegian
     schools). I personnally think this is a reward to Debian Edu and
     its ancestor Skolelinux for their initial involvement in the
     development of D-I
  As a consequence, I propose to KEEP Northern Sami.
I understand that these choices may be debatable and some may sound
slightly subjective. I however think this is the best way to be fair
with translators' efforts without compromising the quality of D-I.
Please note that the final word on this will be by D-I release
managers...but advices are very much welcomed.

Biella Coleman: Software Freedom Day

Parties around the world were held yesterday to celebrate Software Freedom Day. I went to the NYC party which attracted an impressive number of people who were mingling and celebrating on the beautiful rooftop of Limegroup/Limewire office. Here are a few pictures and a short video of Eben Moglen who has done a whole lot to make software freedom a reality today.

20 September 2008

Joey Hess: pawnshop row

Leaving Doc Watson early, I headed up State St. in a hurry, taking the sidewalk to avoid the crowd in the road. But I had to stop to listen to a few classics from a five-piece string band, sitting under the awning of Uncle Sam's Loan Office, in front of the display of old stereos and swords. Bunch of real old-timers. Pulled myself away only to pass by an even better, six-piece band in the entrance to The Gold Man pawn shop. The fiddle was played by a girl who couldn't be older than ten. I wanted to listen to them some more, but I managed to pull myself away in time to get into the Paramount and get a good seat for the Red Stick Ramblers. Conclusion: This town needs more pawn shops. And it's Rhythm and Roots time in Bristol. Best bands so far: Mike Marshall's trio, Cephas and Wiggins, Larry Keel and Natural Bridge, Chatham County Line.

Biella Coleman: No Regulation to Lots (oh!!!) Regulation

The other night I was relishing in the irony that during the era when the American government became most regulation averse, fully touting and embracing the idea of free markets, it also had to save a core sector of our market, leading effectively to a partially nationalized financial sector. I was going to write about the irony made visible by our current financial crisis but Karl beat me to it and said it better than I could or did. Most papers have not mulled over this irony but here is one place where it was raised

19 September 2008

Francois Marier: Choosing the right license for your new Free Software/Open Source project

Writing the software is only one component of a successful Free Software project. If you want to build a community around your pet project, there are a number of important things you need to do but which typically fall outside of the "coding" job. One of these tasks is choosing a license.

A license choice is very personal since it involves putting in writing the permissions and protections that you want to give with respect to your code. However, your choice of license will have a number of implications.
"A license can ruin a perfectly good piece of software"
- Jon Stevens
Whenever possible, try to avoid:
  1. writing your own license
  2. choosing a license which is incompatible with the GPL
To make sure that your project can be included in a Free Software distribution like Debian and to make your code most useful to other people, it is highly recommended that you choose a standard license. Common ones include the GPL, LGPL, the Modified BSD license and the Apache license. You can find a more exhaustive list on the Free Software Foundation website.

Common licenses are well understood by the community and have stood the test of time. Their compatibility with other licenses are also much clearer. This is important if you'd like your code to be reused inside other projects, but also if you want to include code from other sources inside yours.

The standard licenses are also more likely to make sense in different countries. The latest version of the GPL, for example, was reviewed by lawyers from all over the World. Whatever you come up with is unlikely to have this level of scrutiny. If you think that the existing licenses don't fit your needs, please write to licensing@fsf.org to discuss your specific situation and avoid practical problems.

So take the time to familiarize yourself with common licenses and then decide for yourself what protections you want to give to your code. Then, add the following to your tarball before you publish your source code online:
  1. a copy of the license
  2. a clear copyright statement in a file like README
Here's an sample copyright statement for a piece of software under the latest version of the GNU General Public License:
Email-Reminder - Receive emails for events like birthdays and anniversaries
Copyright (C) 2004-2008 by Francois Marier (fmarier@gmail.com)

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see http://www.gnu.org/licenses/.
This helps distributors and contributors by explicitly stating the license version as well as the name and contact details of the copyright holder.

Next up: some tips and ideas about what to provide along with your source code

Adrian von Bidder: So We Progress

Whether it is progress is certainly debattable, but I've finally given up on cobbling together a blog system with email submissions, for now, and just installed Serendipity. I'll probably never convert the Nanoblogger-based content from my old blog, though, so those entries will stay available on the old location.

Lucas Nussbaum: Looking for cliques in the GPG signatures graph

The strongly connected set of the GPG keys graph contains a bit more than 40000 keys now (yes, that’s a lot of geeks!). I wondered what was the biggest clique (complete subgraph) in that graph, and also of course the biggest clique I was in. It’s easy to grab the whole web of trust there. Finding the maximum clique in a graph is NP-complete, but there are algorithms that work quite well for small instances (and you don’t need to consider all 40000 keys: to be in a clique of n keys, a key must have at least n-1 signatures, so it’s easy to simplify the graph — if you find a clique with 20 keys, you can remove all keys that have less than 19 signatures). My first googling result pointed to Ashay Dharwadker’s solver implementation (which also proves P=NP ;). Googling further allowed me to find the solver provided with the DIMACS benchmarks. It’s clearly not the state of the art, but it was enough in my case (allowed to find the result almost immediately). The biggest clique contains 47 keys. However, it looks like someone had fun, and injected a lot of bogus keys in the keyring. See the clique. So I ignored those keys, and re-ran the solver. And guess what’s the size of the biggest “real” clique? Yes. 42. Here are the winners:
CF3401A9 Elmar Hoffmann
AF260AB1 Florian Zumbiehl
454C864C Moritz Lapp
E6AB2957 Tilman Koschnick
A0ED982D Christian Brueffer
5A35FD42 Christoph Ulrich Scholler
514B3E7C Florian Ernst
AB0CB8C0 Frank Mohr
797EBFAB Enrico Zini
A521F8B5 Manuel Zeise
57E19B02 Thomas Glanzmann
3096372C Michael Fladerer
E63CD6D6 Daniel Hess
A244C858 Torsten Marek
82FB4EAD Timo Weing rtner
1EEF26F4 Christoph Ulrich Scholler
AAE6022E Karlheinz Geyer
EA2D2C41 Mattia Dongili
FCC5040F Stephan Beyer
6B79D401 Giunchedi Filippo
74B11360 Frank Mohr
94C09C7F Peter Palfrader
2274C4DA Andreas Priesz
3B443922 Mathias Rachor
C54BD798 Helmut Grohne
9DE1EEB1 Marc Brockschmidt
41CF0322 Christoph Reeg
218D18D7 Robert Schiele
0DCB0431 Daniel Hess
B84EF12A Mathias Rachor
FD6A8D9D Andreas Madsack
67007C30 Bernd Paysan
9978AF86 Christoph Probst
BD8B050D Roland Rosenfeld
E3DB4EA7 Christian Barth
E263FCD4 Kurt Gramlich
0E6D09CE Mathias Rachor
2A623F72 Christoph Probst
E05C21AF Sebastian Inacker
5D64F870 Martin Zobel-Helas
248AEB73 Rene Engelhard
9C67CD96 Torsten Veller
It’s likely that this happened thanks to a very successful key signing party somewhere in germany (looking at the email addresses). [Update: It was the LinuxTag 2005 KSP.] It might be a nice challenge to beat that clique during next Debconf ;) And the biggest clique I’m in contains 23 keys. Not too bad.

Biella Coleman: If I were in Manchester, I would go

To this… (and I know there are readers of the blog in Manchester and close by who just may be interested in the a one-day seminar and evening lecture on the 1858 cable and later transatlantic communications link). Full details below. ***
2008 marks the 150th anniversary of the first communications link laid beneath 1600 nautical miles of the Atlantic Ocean. That telegraph cable was the first in a series of cutting-edge technologies enabling fast and accurate communication between Britain and the United States of America, linking the old and new worlds. To mark the occasion, the IET in conjunction with the Museum of Science and Industry, Manchester, are holding a one-day seminar and evening lecture on the 1858 cable and later transatlantic communications links, including wireless and satellite, on Tuesday 28th October 2008. Both events are open to the public and admission is free of charge, but pre-booking is a must. The programme is given below. Both events will be held in the Cardwell Theatre, MOSI and there will be a small exhibition on the history of transatlantic communications to accompany the event. To register for the seminar and/or the lecture, please contact Anne Locker (details given at the end of the email). SEMINAR 1000-1030 Arrival and coffee 1030-1045 Bob Martin-Royle :Chairman s welcome, introduction and overview 1045-1115 Neil Barton: First steps to transatlantic - crossing the Irish Sea 1852-1854 1115-1130 Donard de Cogan: Background to the 1858 telegraph cable 1130-1145 Pauline Webb: John Pender and Manchester s contribution 1145-1215 Donard de Cogan: Insights into the landing of the 1858 cable 1215-1230 Pat Wilson: Lord Kelvin s contribution to submarine telegraphy 1230-1300 Questions and discussion 1300-1400 Lunch 1400-1430 Bob Martin-Royle: Marconi and the first transatlantic wireless links 1430-1515 Phil Kelly: TAT1 (includes film) - the first telephone cable 1515-1545 Tea 1545-1615 Des Prouse: Telstar - the birth of transatlantic satellite communications 1615-1630 Transatlantic communications: the present and future 1630-1700 Questions, discussion and closing remarks EVENING 1800-1830 Light refreshments 1830-1930 Nigel Linge: An interactive public lecture on The Transatlantic Telegraph Cable - the birth of global communications 1930- 2000 Questions and closing remarks Regards, Anne Locker
IET Archivist The Institution of Engineering and Technology
IET

Savoy Place
London
WC2R 0BL
United Kingdom

Jan Wagner: Migrating Mails from Dovecot to Cyrus what a pain!

Today I had to move an Inbox of some Gig mail to transfer from a dovecot to a cyrus imap server. I thought using imapsync would just do the trick, but no it doesn’t. Many of the messages wasn’t transferable cause “Message contains invalid header”.
I tried to upgrade imapsync, dovecot and cyrus to the latest version, but nothing fixed the problem. Digging around in the ned did lead me after hours to Renes
How to fix emails for Cyrus LMTP and IMAP
. I did throw his script on the Inbox of the dovecot server, but this did lead me into getting “FETCH for mailbox got too little data” in the dovecot server log and breaking down the connection of the imap client to the server. This could be fixed while removing corresponding dovecot.index.cache and restarting the server.

18 September 2008

Biella Coleman: The Onion delivers

Ok, this is really funny

MJ Ray: Spam Revenge: Stopping Joe-job Floods in qmail

Myself and a colleague were both getting Joe-jobbed yesterday. I had an easy time telling Exim to reject mine at SMTP time, but the colleague receives mail on our only Plesk server, so it’s using qmail. I’ve noticed before that qmail admin tools are primitive and incomplete, so I looked for the appropriate rocks to bang together to put this fire out. (I think I just sprained a metaphor.) My best attempt so far is to edit the user’s .qmail file to start with a pipe to a command that exit 100s if it detects an error for an email which the user obviously didn’t send (wrong email client or whatever). qmail understands code 100 as a hard error, so I think that should generate an SMTP error, but I didn’t figure out from the logs whether it was SMTP-time or later and my testing was inconclusive. I suspect Plesk will remove my pipe when the user next edits their email account, too. How do qmail/Plesk users not drown in spam? In related news, I’ve started getting “Challenge Response” emails from users of Merak Mail Server Software for emails I never sent. I’m answering the challenges so that challenge-response users get spam if their server spams me. Challenge-response is evil - I don’t want spam from your mailserver just because you accepted spam that said it was from me. If you are using Merak Mail Server Software, change away now! One of my current anti-spam tactics is to read my email in batches (which Suw suggests is a good idea) and group messages which look “similar”. Very similar messages appear for very few reasons: people resending messages, mailing list threads, stuff from spam-nets and a few others. Apart from spam-nets, most of the others match one of a few keywords. My current method of doing this is part-automatic and part-human. Are there automated anti-spam tools which exploit this local similarity? I think DCC used to include this idea, but then there were software patents and hoo-ha and I stopped paying so much attention. Finally, a small discussion has broken out in the comments of Is Yahoo Now Even Worse On Spam? about whitelisting and business-critical uses of free webmails.

Russell Coker: Installing DKIM and Postfix in Debian

I have just installed Domain Key Identified Mail (DKIM) [1] on my mail server. In summary the purpose is to allow public-key signing of all mail that goes out from your domain so that the recipient can verify it’s authenticity (and optionally reject forgeries). It also means that you can verify inbound mail. A weakness of DKIM is that it is based on the DNS system (which has many issues and will continue to have them until DNSSEC becomes widely adopted). But it’s better than nothing and it’s not overly difficult to install. The first thing to do before installing DKIM is to get a Gmail account. Gmail gives free accounts and does DKIM checks. If you use Iceweasel or another well supported browser then you can click on “Show Details” from the message view which then gives fields “mailed-by” and “signed-by” which indicate the DKIM status. If you use a less supported browser such as Konqueror then you have to click on the “Show Original” link to see the headers and inspect the DKIM status there (you want to see dkim=pass in the Authentication-Results header). Also Gmail signs outbound mail so it can be used to test verification of received mail. The next thing to do is to install the DKIM Milter. To make things exciting this is packaged for Debian under the name dkim-filter so that reasonable searches for such functionality (such as a search for milter or dkim-milter - the upstream project name) will fail. After installing the package you must generate a key, I used the command “dkim-genkey -d coker.com.au -s 2008” to generate a key for my domain. It seems that the domain is currently only used as a comment but I prefer to use all reasonable parameters for such things. The -s option is for a selector, which is a way of specifying multiple valid signing keys. It’s apparently fairly common to use a different key every year. But other options include having multiple mail servers for a domain and giving each one a selector. The dkim-genkey command produces two files, one is named 2008.txt and can be copied into a BIND zone file. The other is named 2008.private and is used by the DKIM signing server. Here is a sample of the most relevant parts of the config file /etc/dkim-filter.conf for signing mail for a single domain: Domain coker.com.au
KeyFile /etc/dkim/2008.private
Selector 2008 The file /etc/default/dkim-filter needs to be modified to specify how it will listen for connections from the MTA, I uncommented the line SOCKET=”local:/var/run/dkim-filter/dkim-filter.sock”. One issue is that the Unix domain socket file will by default not be accessible to Postfix, I devised a work-around for this and documented it in Debian bug report #499364 [2] (I’ve hacked a chgrp command into the init script, ideally the GID would be an option in a config file). A basic configuration of dkim-milter will sign mail for one domain. If you want to sign mail for more than one domain you have to comment out the configuration for a single domain in /etc/dkim-filter.conf and instead use the option KeyList file to specify a file with a list of domains (the dkim-filter.conf(5) man page documents this). The one confusing issue is that the selector is taken to be the basename of the file which contains the secret key (they really should have added an extra field). This means that if you have an obvious naming scheme for selectors (such as the current year) then you need a different directory for each domain to contain the key. As an example here is the line from the KeyList file for my domain:
*@coker.com.au:coker.com.au:/etc/dkim/coker.com.au/2008 Now one problem that we have is that list servers will usually append text to the body of a message and thus break the signature. The correct way of solving this is to have the list server sign the mail it sends out and have a header indicating the signature status of the original message. But there are a lot of list servers that won’t be updated for a long time. The work-around is to put the following line in /etc/dkim-filter.conf:
BodyLengths yes This means that the signature will cover a specified number of bytes of body data, and any extra which is appended will be ignored when it comes time to verify the message. This means of course that a hostile third party could append some bogus data without breaking the signature. In the case of plain text this isn’t so bad, but when the recipient defaults to having HTML email it could have some interesting possibilities. I wonder whether it would be prudent to configure my MUA to always send both HTML and plain-text versions of my mail so that an attacker can’t append hostile HTML. It’s a pity that Gmail (which appears to have the most popular implementation of DKIM) doesn’t allow setting that option. So far the only message I have received that failed DKIM checks was sent from a Gmail account to a Debian mailing list. Ideally it would be possible to have the messages sent to mailing lists not be signed or have the length field used. That would require a signing practice based on recipient which is functionality is not available in dkim-milter (but which possibly could be implemented as Postfix configuration although I don’t know how). Implementing this would not necessarily require knowing all the lists that mail might be sent to, it seems that a large portion of the world’s list traffic is sent to addresses that match the string “@lists.” which can be easily recognised. For a service such as Gmail it would be easy to recognise list traffic from the headers of received messages and then treat messages sent to those domains differently. As the signature status is based on the sending address it would be possible for me to use different addresses for sending to mailing lists to avoid the signatures (the number of email addresses in use in my domain is small enough that having a line for each address to sign will not be a great inconvenience). Most MUAs have some sort of functionality to automatically choose a sender address that is in some way based on the recipient address. I’ll probably do this eventually, but for the moment I’ll just use the BodyLengths option, while it does reduce the security a bit it’s still a lot better than having no DKIM checks.

Julien Danjou: blah mail

Following my first idea of a blah script for irssi, I've wrote the same thing in Python for filtering some mail. IMHO, it's better than killfile.
  1 #!/usr/bin/python 
  2  
  3 import email, sys, re 
  4  
  5 def blaahw(match): 
  6     w = match.group(0) 
  7     l = len(w) 
  8     if l == 1: 
  9         return "o" 
 10     elif l == 2: 
 11         return "he" 
 12     elif l == 3: 
 13         return "lol" 
 14     a = "a" * (l - 3) 
 15     return re.sub("\w+", "bl%sh" % a, w) 
 16  
 17 def blaah(text): 
 18     rc = re.compile('\w+') 
 19     return rc.sub(blaahw, text) 
 20  
 21 mail = email.message_from_file(sys.stdin) 
 22  
 23 mail.replace_header("Subject", blaah(mail["Subject"])) 
 24  
 25 def blaah_payload(pl): 
 26     if type(pl) == list: 
 27         for i in range(len(pl)): 
 28             if pl[i].get_content_type() == "text/plain": 
 29                 pl[i].set_payload(blaah(pl[i].get_payload())) 
 30         return pl 
 31     elif type(pl) == str: 
 32         return blaah(pl) 
 33  
 34 mail.set_payload(blaah_payload(mail.get_payload())) 
 35 print(mail) 
Then can use a procmail rule like:
:0 fw
* ^From: asshole <asshole@asshole.com>
  $HOME/bin/blahmail.py
EDIT: I've updated it to a more robust version which support multipart messages.

17 September 2008

Biella Coleman: Smiles all around

I needed a little humor to offset what has been a pretty grueling and trying and tiring week of work so today’s visit to the bosom of American Freedom was quite welcome. Stephen Colbert is as great to see in person/live as he is on his show (or better). His energy seems bottomless, though of course his large crew of helpers and assistants I am helps sustain his energy. The last time I saw a T.V. show being taped was also on my birthday, my 8th one to be exact, when I went to watch one of the first boy toy bands Menudo as they strutted their stuff for a bunch of screaming girls. Though Colbert has *nothing* on these fine shiny Menudo outfits (no one really can), he has a lot else to offer, like his biting wit. It is well worth the time, trip, long wait on line, and freezing conditions of the studio. For those also in a week of bottomless work and in need of some humor, take a look here

Chris Lamb: Debian Developer

A few days ago I was awarded official Debian Developer status. Many thanks to: For posterity, my first experience with the Debian development process was with #400550. Never underestimate the importance of giving credit in changelog entries.

Gerfried Fuchs: Batman: Dark Knight

Wow, don't even remotely remember anymore when I was last blogging about going to the cinema. Granted, I wasn't that often in recent times, but I haven't mentioned some movies... Whatever. Yesteday I have been to cinema again, and we watched "The Dark Knight". To be honest, I regret to have gone. The movie is as dark in its setting as the title says, even darker than what was common in previous Batman movies. They turned Batman into James Bond style, turning Morgan Freeman into Q, and using cheap Eminem quotes. I feel sorry for Heath that this was his last movie to star in. Even his great performance wasn't able to save the movie, and it's sad that this should be the movie people will remember him with... You deserve better, buddy.

Miriam Ruiz: Indirect aggression is NOT a female form of aggression

A research conducted by Noel A. Card at the Universities of North Carolina and Kansas, that appears in the September / October issue of journal Child Development, challenges the popular misconception that indirect aggression is a female form of aggression. The meta-analysis is based on 148 studies of aggression in children and adolescents in schools, involving on the whole about 74,000 children and adolescents. Direct aggression is what we might call physical aggression, and indirect aggression includes covert behaviour designed to damage another individual’s social standing in his or her peer group. Based on the analysis, the researchers suggest that children who carry out one form of aggression may be inclined to carry out the other form. This is seen more in boys than in girls. The popular myth that girls are more likely to be socially aggressive has been proven wrong by this analysis, even though it has persisted among teachers, parents, and even among researchers, probably because of social expectations and recent movies and books portraying girls as mean and socially aggressive. They also found ties between both forms of aggression and adjustment problems. Direct aggression is related to problems like delinquency and ADHD-type symptoms, poor relationships with peers, and low prosocial behaviour such as helping and sharing, while indirect aggression is related to problems like depression and low self-esteem, as well as higher prosocial behaviour (perhaps because a child must use prosocial skills to encourage peers to exclude or gossip about others).

Mark Brown: EIFF 2008

It’s been so long since the film festival that I keep on forgetting half the good films I saw there when talking to people about it, so for the record here’s a brief list of my personal highlights: As far as the EIFF moving to June goes… I’m not convinced. I didn’t notice any dramatic improvement in the quality of the programme and while it did avoid the rain that Edinburgh suffered in August there’s nothing quite like the atmosphere you get during the main festival.

Patrick Schoenfeld: Call me Mr. Raider, call me Mr. Wrong, ...

I know, I know. The "Its name is..." bandwagon, initiated by madduck, is already over. But I've seen so many interesting hostnames, that I'd like to contribute my hostnames as well. For my personal systems I usually use names of characters from the simpsons family: maggie, homer, moe is what I currently have. For systems in the company for which I work, the naming schema is usually more pragmatic: Starting with a three-character-string (the initials of the company I work for), followed by a dash and a suffix which identifies more or less the usage of the server or something that makes it special. An example for this scheme is imr-wsvn which is a VM hosting a web-svn tool. But there is also at least one exception to that scheme: I called my desktop at work teekanne (which is a german word meaning teapot) for no special reason.

Oh and there is another exception: Till yesterday I made a 2-weeks experiment using Fedora on my notebook in order to learn something about this system. I called this fedora system fixit.

Next.

Previous.