Search Results: "spa"

4 October 2008

Russell Coker: Getting Started with Amazon EC2

The first thing you need to do to get started using the Amazon Elastic Compute Cloud (EC2) [1] is to install the tools to manage the service. The service is run in a client-server manner. You install the client software on your PC to manage the EC2 services that you use. There are the AMI tools to manage the machine images [2] and the API tools to launch and manage instances [3]. The AMI tools come as both a ZIP file and an RPM package and contain Ruby code, while the API tools are written in Java and only come as a ZIP file. There are no clear license documents that I have seen for any of the software in question, I recall seeing one mention on one of the many confusing web pages of the code being “proprietary” but nothing else. While it seems most likely (but far from certain) that Amazon owns the copyright to the code in question, there is no information on how the software may be used - apart from an implied license that if you are a paying EC2 customer then you can use the tools (as there is no other way to use EC2). If anyone can find a proper license agreement for this software then please let me know. To get software working in the most desirable manner it needs to be packaged for the distribution on which it is going to be used, as I prefer to use Debian that means packaging it for Debian. Also when packaging the software you can fix some of the silly things that get included in software that is designed for non-packaged release (such as demanding that environment variables be set to specify where the software is installed). So I have built packages for Debian/Lenny for the benefit of myself and some friends and colleagues who use Debian and EC2. As I can’t be sure of what Amazon would permit me to do with their code I have to assume that they don’t want me to publish Debian packages for the benefit of all Debian and Ubuntu users who are (or might become) EC2 customers. So instead I have published the .diff.gz files from my Debian/Lenny packages [4] to allow other people to build identical packages after downloading the source from Amazon. At the moment the packages are a little rough, and as I haven’t actually got an EC2 service running with them yet they may have some really bad bugs. But getting the software to basically work took more time than expected. So even if there happen to be some bugs that make it unusable in it’s current state (the code for determining where it looks for PEM files at best needs a feature enhancement and at worst may be broken at the moment) then it would still save people some time to use my packages and fix whatever needs fixing.

Share This

3 October 2008

Michal Čihař: Gammu stable version 1.21.0

Good news everyone, after long time of inactivity and huge development over past month, new stable Gammu release is out. Since 1.20.94, there are only minor fixes in handling some corner cases in AT parser, but full list of changes since last stable 1.20.0 is quite long: You can download from usual place: http://cihar.com/gammu/, Binary packages will be available soon.

Russell Coker: DKIM and Mailing Lists

Currently we have a problem with the Debian list server and Gmail. Gmail signs all mail that it sends with both DKIM and DomainKeys (DomainKeys has been obsoleted by DKIM so most mail servers implement only one of the two standards although apart from space there is no reason not to use both). The Debian list servers change the message body without removing the signatures, and therefore send out mail with invalid signatures. DKIM has an option to specify the length of the body part that it signs. If that option is used then an intermediate system can append data to the body without breaking the signature. This could be bad if a hostile party could intercept messages and append something damaging, but has the advantage that mailing list footers will not affect the signature. Of course if the list server modifies the Subject to include the list name in brackets at the start of the subject line then it will still break the signature. However Gmail is configured to not use the length field, and a Gmail user has no option to change this (AFAIK - if anyone knows how to make Gmail use the DKIM length field for their own account then please let me know). I believe that the ideal functionality of a sending mail server would be to have the configuration of it’s DKIM milter allow specifying which addresses should have the length field used. For example I would like to have all mail sent to an address matching @lists\. have the length field used (as well as some other list servers that don’t match that naming scheme), and I would also like to be able to specify which recipient addresses should have no DKIM signatures (for example list servers that modify the subject line). I have filed Debian bug #500967 against the dkim-filter package requesting this feature [1]. For correct operation of a list server, the minimal functionality is implemented in the Mailman package in Lenny. That is to strip off DKIM and DomainKey signatures. The ideal functionality of a list server would be that for lists that are not configured to modify the Subject line it would leave a DKIM header that uses the length field and otherwise remove the DKIM header. I have filed Debian bug #500965 against lists.debian.org requesting that the configuration be changed to strip the headers in question in a similar manner [2] (the Debian list servers appear to use SmartList - I have not checked whether the latest version of SmartList does the right thing in this regard - if not it deserves another bug report). I have also filed Debian bug report #500966 requesting that the list servers sign all outbound mail with DKIM [3]. I believe that protecting the integrity of the Debian mail infrastructure is important, preventing forged mail is a good thing, and that the small amount of CPU time needed for this is worth the effort. Also the Debian project is in a position of leadership in the community. We should adopt new technologies that benefit society first to help encourage others to do the same and also to help find and fix bugs.

Share This

2 October 2008

Simon Richter: A design question

As some of you may or may not be aware, I'm hacking on a new build tool that has a purely descriptive language for project descriptions, with lots of sensible defaults. Right now, the only thing I really require users to do is to declare the name and type of the project, for example Program: foo This will just take all files in this directory that it understands, compile them, and link them to an executable called "foo" (or "foo.exe"). So far, so good. However, there are more complex examples, specifically those where multiple outputs are installed to different directories, for example in the case of libraries: Library: foo
Public: foo.h, foo.c I've omitted the library versioning stuff from the example, because it isn't necessary to understand the problem. This means "take all compilable files, link them to "libfoo.so" (resp. "foo.dll") and only mark the symbols defined in foo.c as exported (not listing code generating files will fall back to exporting everything); then install foo.h into /usr/include (or make it available as <foo.h> to dependent projects). Now, I'd like to add an optional parameter to place a "published" resource into a namespace. How that is defined is dependent on the type of the resource (exported symbols could be tagged with a symbol version, while include files would be installed into a subdirectory of /usr/include). And this is where I would like to get some input. How should such a declaration look like in the project description file? The file is in RFC822 style format, with one section per project (multiple projects in a single directory are permitted if you list the inputs explicitly), and I'd rather keep it that way. Ideas so far:
  1. Public[foo]: foo.h
    Public[FOO_1_0]: foo.c
This means multiple lines and dividing .c and .h files since their "namespace" attributes mean something entirely different.
  • Public: foo.h [foo], foo.c [FOO_1_0]
    • This ends up becoming pretty repetitive if I have a lot of header files. Neither of these looks as "clean" as I'd like a new file format to look. I'm pretty much sure "built-in" tagging of certain things will be handled by separate top-level tags (similar to automake): User-Public: userdoc.sgml
    Developer-Public: devdoc.sgml     I'm open to criticism on this one as well though.

    Martin Michlmayr: Differences between paid and volunteer FOSS contributors

    There's a lot of debate these days about the impact of the increasing number of paid developers in FOSS communities that started as volunteer efforts and still have significant numbers of volunteers. Evangelia Berdou's PhD thesis "Managing the Bazaar: Commercialization and peripheral participation in mature, community-led Free/Open source software projects" contains a contains a wealth of information and insights about this topic. Berdou conducted interviews with members of the GNOME and KDE projects. She found that paid developers are often identified with the core developer group which is responsible for key infrastructure and often make a large number of commits. Furthermore, she suggested that the groups may have different priorities: "whereas [paid] developers focus on technical excellence, peripheral contributors are more interested in access and practical use". Based on these interviews, she formulated the following hypotheses which she subsequently analyzed in more detail:
    1. Paid developers are more likely to contribute to critical parts of the code base.
    2. Paid developers are more likely to maintain critical parts of the code base.
    3. Volunteer contributors are more likely to participate in aspects of the project that are geared towards the end-user.
    4. Programmers and peripheral contributors are not likely to participate equally in major community events.
    Berdou found all hypotheses to be true for GNOME but only hypothesis two and four were confirmed for KDE. In the case of GNOME, Berdou found that hired developers contribute to the most critical parts of the project, that they maintained most modules in core areas and that they maintained a larger number modules than volunteers. Two important differences were found in KDE: paid developers attend more conferences and they maintain more modules. Berdou's research contains a number of important insights: Personally, I'm also wondering why there are some significant differences between GNOME and KDE. For example, about 67% of contributors where paid to work on GNOME whereas only 38% were paid to work on KDE. Why do some projects attract more commercial involvement whereas other projects continue to be mostly volunteer based? (Originally published on FOSSBazaar)

    Russell Coker: How Many Singularities?

    There is a lot of discussion and speculation about The Singularity. The term seems to be defined by Ray Kurzweil’s book “The Singularity Is Near” [1] which focuses on a near-future technological singularity defined by significant increases in medical science (life extension and methods to increase mental capacity) and an accelerating rate of scientific advance. In popular culture the idea that there will only be one singularity seems to be well accepted, so the discussion is based on when it will happen. One of the definitions for a singularity is that it is a set of events that change society in significant ways such that predictions are impossible - based on the concept of the Gravitational Singularity (black hole) [2]. Science fiction abounds with stories about what happens after someone enters a black hole, so the concept of a singularity not being a single event (sic) is not unknown, but it seems to me that based on our knowledge of science no-one considers there to be a black hole with multiple singularities - not even when confusing the event horizon with the singularity. If we consider a singularity to merely consist of a significant technological change (or set of changes) that change society in ways that could not have been predicted (not merely changes that were not predicted) then it seems that there have been several already, here are the ones that seem to be likely candidates: 0) The development of speech was a significant change for our species (and a significant change OF our species). Maybe we should consider that to be singularity 0 as hominids that can’t speak probably can’t be considered human. 1) The adoption of significant tool use and training children in making and using tools (as opposed to just letting them learn by observation) made a significant change to human society. I don’t think that with the knowledge available to bands of humans without tools it would have been possible to imagine that making stone axes and spears would enable them to dominate the environment and immediately become the top of the food chain. In fact as pre-tool hominids were generally not near the top of the food chain they probably would have had difficulty imagining being rulers of the world. I’m sure that it led to an immediate arms race too. 2) The development of agriculture was a significant change to society that seems to have greatly exceeded the expectations that anyone could have had at the time. I’m sure that people started farming as merely a way of ensuring that the next time they migrated to an area there was food available (just sowing seeds along traditional migration routes for a hunter-gatherer existence). They could not have expected that the result would be a significant increase in the ability to support children and a significant increase in the number of people who could be sustained by a given land area, massive population growth, new political structures to deal with greater population density, and then wiping out hunter-gatherer societies in surrounding regions. It seems likely to me that the mental processes needed to predict the actions of a domestic animal (in terms of making it a friend, worker, or docile source of food) differ from those needed to predict the actions of other humans (who’s mental processes are similar) and from those needed to predict the actions of prey that is being hunted (you only need to understand enough to kill it). 3) The invention of writing allowed the creation of larger empires through better administration. All manner of scientific and political development was permitted by writing. 4) The work of Louis Pasteur sparked a significant development in biology which led to much greater medical technology [3]. This permitted much greater population densities (both in cities and in armies) without the the limitation of significant disease problems. It seems that among other things the world-wars depended on developments in preventing disease which were linked to Louis’ work. Large populations densely congregated in urban areas permit larger universities and a better exchange of knowledge which permitted further significant developments in technology. It seems unlikely that a population suffering the health problems that were common in 1850 could have simultaneously supported large-scale industrial warfare and major research projects such as the Manhattan Project. 5) The latest significant change in society has been the development of the Internet and mobile phones. Mobile phones were fairly obvious in concept, but have made structural changes to society. For example I doubt that hand-writing is going to be needed to any great extent in the future [4], the traditional letter has disappeared, and “Dates” are now based on “I’ll call your mobile when I’m in the area” instead of meeting at a precise time - but this is the trivial stuff. Scientific development and education have dramatically increased due to using the Internet and business now moves a lot faster due to mobile phones. It seems that nowadays any young person who doesn’t want to be single and unemployed needs to have either a mobile phone or Internet access - and preferably both. When mobile phones were first released I never expected that almost everyone would feel compelled to have one, and when I first started using the Internet in 1992 I never expected it to have the rich collaborative environment of Wikipedia, blogging, social networking, etc (I didn’t imagine anything much more advanced than file exchange and email). Of these changes the latest (Internet and mobile phones) seems at first glance to be the least significant - but let’s not forget that it’s still an ongoing process. The other changes became standard parts of society long ago. So it seems that we could count as many as six singularities, but it seems that even the most conservative count would have three singularities (tool use, agriculture, and writing). It seems to me that the major factors for a singularity are an increased population density (through couples being able to support more children, through medical technology extending the life expectancy, through greater food supplies permitting more people to live in an area, or through social structures which manage the disputes that arise when there is a great population density) and increased mental abilities (which includes better education and communication). Research into education methods is continuing, so even without genetically modified humans, surgically connecting computers to human brains, or AI we can expect intelligent beings with a significant incremental advance over current humans in the near future. Communications technology is continually being improved, with some significant advances in the user-interfaces. Even if we don’t get surgically attached communications devices giving something similar to “telepathy” (which is not far from current technology), there are possibilities for significant increments in communication ability through 3D video-conferencing, better time management of communication (inappropriate instant communication destroys productivity), and increased communication skills (they really should replace some of the time-filler subjects at high-school with something useful like how to write effective diagrams). It seems to me that going from the current situation of something significantly less than one billion people with current (poor) education and limited communications access (which most people don’t know how to use properly) to six billion people with devices that are more user-friendly and powerful than today’s computers and mobile phones combined with better education as to how to use them has the potential to increase the overall rate of scientific development by more than an order of magnitude. This in itself might comprise a singularity depending on the criteria you use to assess it. Of course that would take at least a generation to implement, a significant advance in medical technology or AI could bring about a singularity much sooner. But I feel safe in predicting that people who expect the world to remain as it is forever will be proven wrong yet again, and I also feel safe in predicting that most of them will still be alive to see it. I believe that we will have a technological singularity (which will be nothing like the “rapture” which was invented by some of the most imaginative interpretations of the bible). I don’t believe that it will be the final singularity unless we happen to make our species extinct (in which case there will most likely be another species to take over the Earth and have it’s own singularities).

    Share This

    Neil Williams: Time pressures

    It's been really strange coming back from DebConf then Extremadura and having to fit my code time around paid work and housework and general stuff again. I keep wondering why I'm not getting things done and then realising that I've only got so many hours a week nowadays compared to the entire week during the worksessions. What makes it worse is the short gap between the conferences. I misjudged the length of time without income and didn't make any days available for paid work between DebConf and Extremadura. OK, it was only about a week but it was a further week without income followed by the week getting to and from Spain.
    I'm now doing extra days to recover from the extra time without income and it makes the contrast even more noticeable. The tiredness from the extra work then makes it hard to get started on what I thought I'd get done. I've done a little bit on emdebian-tools and apt-cross, I've done a little bit on a few RC bugs and I've not done a load of stuff I thought I would have done by now.
    If you're wondering why something I said I'd do has not been done, file a bug and I'll get to it. (The bug lists for buildd.emdebian.org or emdebian-tools are my main ToDo lists, if it appears in that list of bugs, I'll not forget. If it appears in an email, I probably will forget.)

    Arnaud Cornet: Realtek's 8187se driver

    Here is a module-assistant friendly source package for realtek’s driver for 8187SE boards found in MSI U100 at least. It’s pretty much as ugly as what you would get in a binary only driver, but it’s GPL and it works. Recipe: 
    wget http://nohar.t1r.net/debian/rtl8187se-source_1016.0716.2008_all.deb
sudo dpkg -i rtl8187se-source_1016.0716.2008_all.deb
sudo m-a a-i rtl8187se
    It’s a copyright mess, and the package still needs work. Btw, hello planet.

    MJ Ray: The Trouble With Big Webmail

    So last week, a relative commented to me that a solicitor sent a letter in reply to an email. I suggested that it might be because the email reply address was on one of the major free web email providers. “What’s wrong with my webmail?” So I explained… First of all, as far as I know, no Big Webmail service supports encrypted email (and there are complications in how you’d provide such a thing on webmail anyway) and it can be fairly easy to trick the webmail service into giving access to other people. My relative was sceptical, but within a day, US vice-presidential candidate Sarah Palin’s Yahoo mail was cracked and splashed across the news. (By the way - gov.palin counted as a personal email address? Huh? Her name isn’t “gov”.) Even without passwords going astray, there’s no telling that the intended recipient is the only person reading the email. Here’s a fun paragraph from the Google Mail Terms:-
    “Google maintains and processes your Gmail account and its contents to provide the Gmail service to you and to improve our services. The Gmail service includes relevant advertising and related links based on the IP address, content of messages and other information related to your use of Gmail.” (emphasis added)
    The Electronic Privacy Information Center suggests this includes wiretapping. There’s finally a growing awareness that free webmails are not safe, built on artificial anti-competitive encouragements like “you need a Yahoo!ID to subscribe to this yahoogroup” (no - the old “stick -subscribe after the group name, before the @” still works, just like it did before they bought it from egroups). Internet Psychologist Graham Jones writes:-
    “It’s time to review your online security and think about whether you actually need Google and its like at all. Probably not.” (source)
    I agree with that. Both of my phone companies (The Phone Co-op agency and 3) include webmail - although I have some personal domains (for long-term contactability), those webmails are fine for lists and short-term use. The sort of thing most people seem to use Big Webmail for. The other main point in my argument was that free webmails are unreliable, thanks to tactics like Yahoo’s shoddy anti-spam attacks on other mailservers. There’s no telling whether the email will get through such bad behaviour and delivery-receipts are unreliable. I can quite understand why a solicitor won’t send email to the likes of hotmail, even if I think it’s just as probable that the solicitor doesn’t “get” email. “Oh” said my relative. I think she’s still using Big Webmail though.

    1 October 2008

    David Moreno Garza: New York BSP personal to-do list

    So, as it was previously anounced (and recently re-invited by Micah), this weekend is the debiannyc BSP. This makes me think on my lack of involvement on the technical part of Debian (I’m still socially involved with friends and groups) for the last couple of months. So, for the sake of encouraging others to join us on Saturday if you in the city (or the tri-state area, or beyond!), here it is, my personal list of tasks I’m willing to work on: See you at Vireo! UPDATE: The BSP was a lot of fun. Striking now the things I actually did from my list.

    Axel Beckert: NSLU2 in a Tux Case

    It started harmless when Thomas asked on Linux User Group Switzerland mailing list if someone knows a tux-shaped alarm clock. But the topic of that thread quickly moved to two other things in tux shape: the Tux Droid, a device similar to the Nabaztag, but needs a Linux host with USB, and ACME Systems’ Tux-Server, a ETRAX CRIS based Foxboard inside a tux-shaped case. We found out that Telion, the Swiss importer for Foxboards, also imports ACME Systems’ Tux Case — although the Tux Case is not mentioned on their website. Even better: They had a few old Tux Cases in stock which don’t fit anymore on current Foxboards since the position of the power socket changed. (So only one hole in the case was missing.) And they wanted to get rid of them quite fast: They offered us the Tux Cases for 10 CHF (6€) each instead of 28 CHF each (17€) if we buy all of them. Of course we couldn’t reject this offer and bought all five remaining cases. Another part of the thread was about performance. Although ETRAX CRIS is used by its inventor AXIS in many of its products (they’re famous for the Linux based web-cams) many were not sure if the board’s performance would be sufficient for their ideas. Another disadvantage of the ETRAX CRIS architecture is that no mainstream Linux distribution supports it. Another point was the Foxboard’s price (169€, ca. 268 CHF). Bones just mentioned that an NSLU2 costs only about 100 CHF (60€). Probably on IRC someone (probably Bones, too) wondered if it’s possible to fit a NSLU2 into such a quite inexpensive Tux Case. We took Wikipedia’s picture of the NSLU2 board, compared the size of the USB ports on that picture, compared them with real-life USB ports and found out the size of the board that way. And when I got my Tux-Case I noticed that the NSLU2 board really could fit into the Tux-Case. Since I’m already building a bigger NAS-like home server, I have no use for another, much slower NAS. But since I more or less gave up the also ARM-based Thecus N4100, another ARM-based machine in my hardware collection wouldn’t be bad. So it didn’t took long and the idea was born to build the NSLU2 board into a Tux-Case and let the website tux.ethz.ch run on it. (I inherited its administration from Beat and it’s currently just a virtual host on one of our webservers.) Then it would be a server named Tux, serving Tuxes, looking like a Tux and running Tux’ operating system Linux. :-) I ordered an NSLU2 at Brack for 117.60 CHF (ca. 70€). Played around with the original firmware for a moment, but it’s horrible from a security point of view: You can’t even change the admin password (default: “admin”) if no USB harddisk is attached. And no, a USB stick doesn’t suffice. So I didn’t wait long and tried to install Debian’s “armel” (ARM, Little Endian) port on it. But the NSLU2 refused the “new firmware” with the error message “Upgrade: no enough free space.”. While this is not in the Debian specific NSLU2 FAQ, it is mentioned in the general troubleshooting FAQ. As described in there, first upgrading to the most recent firmware version and then uploading the Debian installer worked fine. After I had successfully installed Debian Lenny on a pqi 4 GB USB sticked into the NSLU2 and verified that everything is working fine, I opened the NSLU2 case and checked if it really would fit into a Tux Case. It does, but very, very close. You’ll have to drill some holes and the ethernet socket will stick out Tux’s shoulder, but everything else should fit perfectly after a few mounting parts inside the Tux Case have been removed. As a proof of concept I laid the NSLU2 board on the Tux Case’s back:
    Pictures taken with my Nokia E51
    So later the LEDs will be in Tux’ one shoulder while the network socket will be in his other shoulder. And the USB stick will be inside his paunch via a USB hub.

    Russell Coker: Could we have an Open Computing Cloud?

    One of the most interesting new technologies that has come out recently is Cloud Computing, the most popular instance seems to be the Amazon EC2 (Elastic Cloud Computing). I think it would be good if there were some open alternatives to EC2. Amazon charges $0.10 per compute hour for a virtual machine that has one Compute Unit (equivalent to a 1.0 to 1.2GHz 2007 Opteron core) and 1.7G of RAM. Competing with this will be difficult as it’s difficult to be cheaper than 10 cents an hour ($876.60 per annum) to a sufficient extent to compensate for the great bandwidth that Amazon has on offer. The first alternative that seems obvious is a cooperative model. In the past I’ve run servers for the use of friends in the free software community. It would be easy for me to do such things in future, and Xen makes this a lot easier than it used to be. If anyone wants a DomU for testing something related to Debian SE Linux then I can set one up in a small amount of time. If there was free software to manage such things then it wuld be practical to have some sort of share system for community members. The next possibility is a commercial model. If I could get Xen to provide a single Amazon Compute Unit to one DomU (not less or more) then I wouldn’t notice it on some of my Xen servers. 1.7G of RAM is a moderate amount, but as 3G seems to be typical for new desktop systems (Intel is still making chipsets that support a maximum of 4G of address space [2], when you subtract the address space for video and PCI you might as well only get 3G) it would not be inconceivable to use 1.7G DomUs on idle desktop machines. But it’s probably more practical to have a model with less RAM. For my own use I run a number of DomUs with 256M of RAM for testing and development and the largest server DomU I run is 400M (that is for ClamAV, SpamAssassin, and Wordpress). While providing 1.7G of RAM and 1CU for less than 10 cents an hour may be difficult, but providing an option of 256M of RAM and 0.2CU (burstable to 0.5CU) for 2 cents an hour would give the same aggregate revenue for the hardware while also offering a cheaper service for people who want that. 2 cents an hour is more than the cost of some of the Xen server plans that ISPs offer [3] but if you only need a server for part of the time then it would have the potential to save some money. For storage Amazon has some serious bandwidth inside it’s own network for transferring the image to the machine for booting. To do things on the cheap the way to go would be to create a binary diff of a common image. If everyone who ran virtual servers had images of the common configurations of the popular distributions then creating an image to boot would only require sending a diff (maybe something based on XDelta [4]). Transferring 1GB of filesystem image over most network links is going to be unreasonably time consuming, transferring a binary diff of an up to date CentOS or Debian install vs a usable system image based on CentOS or Debian which has all the updates applied is going to be much faster. Of course something like this would not be suitable for anything that requires security. But there are many uses for servers that don’t require much security.

    Share This

    Decklin Foster: Your internet access is going to get suspended

    So today I recieved another batch of backscatter spam (it comes in waves; my email address will forever be on these lists). Normally there are several rejections from mailing lists where only subscribers can post, etc. But this time: 
    The following lines in your email message did not appear to be
Lyris ListManager commands and were skipped:
> unsubscribe confirm
>  -> You did not specify a valid mailing list name to unsubscribe from.
    Disturbing. Now they're trying to take me off legit mailing lists! Perhaps they think I won't notice and it'll reduce the amount of ham I have for my Bayesian filter. Little do they know I'm still subscribed to -devel :-)

    Alastair McKinstry: The Night Sessions, by Ken MacLeod

    "Are you saved ?"
"yes"
"Are you prepared to die ?"
    The Night Sessions, Ken MacLeod's latest novel is set in the near future, after the "faith" (or oil) wars, when religion is barely tolerated by political society, distained and tainted; and the police and state have a policy of 'official non-cognisance' of religious activities. It's a police thriller, where the victims are, apparently, being killed for their religious beliefs.

    read more »

    Tags ,

    30 September 2008

    Gunnar Wolf: Doublespeak, prior judgement and Soviet tactics: IMPI (Instituto Mexicano de Propiedad Intelectual)

    I just sent a letter to the very well-known national newspaper El Universal. At least I think I did, as their contact form is a sad excuse of unusability.
    The reason I contacted them is the publication, over a week ago, of a note where they invite children to take part in a contest by IMPI towards fighting piracy. But not only they engage in doublespeak and prior judgement by further pushing the term piracy for an action that has nothing to do with it, they also expect children to denounce their parents and teachers if they engage in such a destructive activity. Think Josef Stalin for a while, and you will get the picture.
    Anyway - This will not be the first letter sent on this topic, and I know most of my readers know and share my arguments. I am not translating it into English. But if you are a Spanish-speaker (or a Spanish-reader), you might find it interesting.
    Please read my open letter to El Universal and to Jorge Amigo Casta eda, Director General del Instituto Mexicano de Propiedad Intelectual, and help me get it through to as much media as possible.
    What is a pirate? Tired of being treated as a criminal for sharing music online? Digital Freedom

    Axel Beckert: Mini-ITX based Home Server: Planning and Hardware

    Ever since my former desktop machine gsa died and I started using only laptops at home, I noticed a need for a home server for storing all my MP3s, holiday pictures, games, and backups of my other machines. And I also want a filtering web proxy at home again. Current situation Currently my Norhtec MicroClient Jr. “c2” with it’s 120 GB 2.5" harddisk does some of these jobs (mostly storage and backup), but it neither has the disk space nor the performance to do all the things I want. For storage I once bought a TheCus N4100, the big brother of the popular and officially Debian supported N2100. Unfortunately there are a few things different than in the N2100 (NIC without MAC) which makes it much more difficult to get Debian on it and the original firmware doesn’t support NFS at all. *grmpf* I had hints from others who managed to get Debian on this NAS, but I didn’t find the time and leisure to really dig into cross-compiling kernels. (Although with the new 1.3.06 firmware, so called modules became possible also for the N4100 and a SSH module has been posted with which a Debian chroot could be installed and the required kernel build on the machine itself.) I though wasn’t very angry when the N4100+ came out shortly after I bought the N4100, because the N4100+ was no more an ARM based device but had a Celeron processor inside instead. And a NAS which is built on average PC hardware wasn’t as appealing as some device based on some more exotic architecture mainly used in embedded devices. :-) The Mini-ITX Appeal This view changed rapidly, when Raffzahn showed me a few Mini-ITX boards and cases. I surfed around on Mini-ITX.com store and stumbled upon the NAS-like ES34069 case from Chenbro featuring four S-ATA hotswap 3.5" slots, a slim-line CD-ROM drive slot, a SD card reader, and enough space for an additional 2.5" hard disk and a low profile Mini-ITX board. Additionally, the VIA EPIA SN series of Mini-ITX boards sports 4 S-ATA ports and either a passively cooled 1 GHz C7 processor or an actively cooled 1.8 GHz C7 processor. That should be enough power for a small multi-purpose home server while still keep the power consumption low. And I’m not the only one having this idea, Mini-ITX.com suggests this combination and Chenbro officially supports the VIA EPIA SN boards. Additionally, Debian 5.0 Lenny seems to run fine on the SN series, only lm-sensors seems to have problems with SN18000G and SN10000EG (but not SN18000 and SN10000E). So when the Chenbro ES34069 case showed up in digitec’s online shop, I ordered one there and a VIA EPIA SN18000G board at Brack. I didn’t order any disks since for data storage I plan to use the four Samsung 400 GB 3.5" S-ATA disks I bought for the N4100, and for the system I plant to use the 2.5" disk I initially bought for my MicroClient JrSX “c1”, but then continued to use it only with the CF card. Not yet sure, if I’ll also equip the slim-line optical drive slot, too. The case took several weeks to deliver and the mainboard hasn’t arrived yet. Instead I got an e-mail from Brack that VIA products are currently very difficult to get in Switzerland. Reason is said to be that VIA tries to channel the distribution of their products to a single distributor. (Sounds somehow similar to what Apple tried with the iPhone and failed.) Mini-ITX boards and power consumption So I now have a nice case without a board. There aren’t that many Mini-ITX boards out there sporting 4 S-ATA ports. One which cleary stood out was the new Intel DG45FC Mini-ITX board with LGA775 socket. (In Switzerland neither available at Brack nor at digitec, but e.g. at PCP.) But reading the specs of this board it was also clear that it wasn’t thought for NAS systems but high-performance HTPCs — the focus seems to be on multimedia performance which a NAS doesn’t need. Its newer sister, the Intel DQ45EK Mini-ITX board is focussed more on office and business PCs than on multimedia. But Intels remote adminstration is not really a plus for me (don’t need it, I’ve got SSH ;-) and it’ neither cheaper than the DG45FC nor has it significantly lower power-consuption. Despite the 120W power-supply there are people who already combined the Chenbro ES34069 with the Intel DG45FC or DQ45EK board, e.g. one of the administrators of the German NAS-Portal forums built such a machine and this German guy who wants to build a Windows Home Server based on such a combination. At least the NAS-Portal administrator found out that the board consumes so much power that together with the 4 S-ATA disks the included 120W power supply doesn’t suffice and the system is not stable in this configuration. Trusted Reviews review of the DG45FC explains why: It’s one of the first Mini-ITX board not following the MoDT idea, has a desktop chipset instead a mobile chipset and therefore hasn’t all of the power-saving features of those mobile chipsets. But it’s easy to see anyway: Most of the CPUs supported by the DG45FC and DQ45EK boards have a TDP of 65W. Offically the processor cooler delivered with the case supports processors with up to 65W, but 65W is already more than the half of what the power supply delivers and according to the Trusted Reviews review, the board itself consumes another 35W itself. So for the four 3.5" S-ATA disks — which are usually not as economical as notebook disks — about 20W are left. This can’t work! The guy from NAS-Portal.org plans to solve the problem by using a universal 180W notebook power supply instead of the original one. In comparison to the 100W of the both Intel boards, VIA’s SN18000G consumes only 26W (the fanless SN10000EG even only 22W) and that’s board and processor! That’s about ¼ of what the Intel board consumes. Imagine the difference between having a 100W light bulb (suffices for a whole small room) shining 365 days a year compared to a 25W light bulb (often used in bedside lamps) in a year. Other Mini-ITX mainboards with 4x S-ATA include the following ones: Conclusion For now, I decided to wait a little bit more for my VIA EPIA SN18000G board which still seems to be the best board for the Chenbro ES34069 case although not really cheap. But if I once in a not that distant future decide to have a desktop at home again, I’m quite sure it’ll sport a cute Mini-ITX case (perhaps a nice black-orange HFX micro M1 case by mCubed — unfortunately the M2 is no more available in a color combination including orange ;-) with an Intel DG45FC or Kontron 986LCD-M/mITX and a decent Core 2 Duo processor. Software Plans Of course my home server will run Debian GNU/Linux 5.0 Lenny on it, with software RAID-5 and LVM2 over the 1.6 TB of S-ATA disks resulting in 1.2 TB available disk space which will be offered using at least NFS, SMB and SSH (think sshfs). Planned software includes BackupPC (a very fine pulling backup system for machines which are not online 24/7) and Privoxy. I’ll perhaps also install Tor and a caching proxy like Squid or Polipo. Another idea is to run Mediatomb on that machine. :-)

    Adeodato Sim : French lessons

    I’m practically 4 courses away from finishing my degree (the course I failed in June, I passed a couple weeks ago). 4 courses which I loathe, but that I’ll get done this year. After them, I still have to prepare something akin to a “final project”, but that doesn’t worry me much, since it’ll be something I enjoy. Apart from these 4 courses, I also have to take a couple non-computer science ones, whichever I want. I’ve decided to go for French lessons, since I’ve always wanted to learn French. I’m very excited for this. Today was my first day. I had some previous, incredibly rudimentary notions of French already, but that didn’t help not to find it a bit daunting at first: there’s so much to learn. (I can’t remember at all how I felt when I started studying English, but alas, I was a kid, when you’re taught stuff you know zero about.) I decided, though, to look it from a positive note, and make a pleasant experience out of it: not everyday one has the opportunity to dive into something completely new. I remained excited for the rest of the class, and I’m sure my classmates thought, “Why is this guy stupidly smiling from time to time?” (These are courses designed for freshmen, and I felt out of place. It seems 8 years it’s a lot of time.) Incidentally, my sister speaks French, and she’s lent me some books and dictionarys from her time as a student. Some of these were books from Le Petit Nicolas series; I had read all of them during my childhood, in Spanish. I glanced through the French versions, and recognizing every single picture in them as something I had already seen, albeit fifteen years ago, was a very weird feeling.

    Michael Schutte: Very direct marketing

    At the end of every month, I check the catch-all mailbox for the domain of my class homepage to remove half a million of spam messages and see whether there are webmasterism-related mails in there (some people skip the Imprint section which spells out my true address). This time, I found a gem whose content can best be described as unsolicited commercial e-mail. It received some bonus points for not qualifying as bulk, so I decided to read it. In an early 2008 blog entry by a classmate of mine, he explains why he is fed up with how class photography was handled last school year. Someone at an Austrian company has apparently read the rant which they, as pointed out at the beginning of their mail, found hilarious. They happily join in bashing the company criticised in the post, then submit an offer. They pick some random student who has coincidentally written about the topic of class photography, and submit an offer. They didn t even bother to find out which school the student they thought they were writing to actually attends, let alone trying to contact the people in charge. Needless to say, the message is text/html. It is addressed to my classmate s Jabber ID. They misspelt it.

    Holger Levsen: RC bug a week - week 6

    Sorry, no news or RC bugs touched from me this week, I have simply been to busy with other stuff. And actually it hasn't been a full week since last "RC bug a week" post, but I decided to post today anyway, to come back to blogging this on tuesdays.

    The bug count has been going further down to 129 bugs, which is still 129 too many ;-) So please, if you have some spare cycles, look at the list and contribute to getting it down, rather sooner or later! /me wants new features, but that needs a lenny release first! :-)

    29 September 2008

    Luciano Bello: the root of all mistake: the overgeneralization

    Yes, it’s me again with this DSA-1571 exploitation issue. The discovery, explanation and exploitation of the bug is now part of my final coursework for my postgraduate degree career. So, yes… sorry. Some weeks ago I started suspecting about the attack to PFS in SSL with EDH. The key point is: the key space is dependent of the PRNG state. The bug affects the initialization of the PRNG, but the random string has not a pattern by it self. If you ask for many random numbers to the PRNG, you gonna get numbers that differ among them, since they are the output of a hash function of them self. So each random number depends on, besides the PID, the state of the PRNG pool in the moment (in other words, amount of bytes that you already pull from the PRNG pool before) The explained attack was based in a fixed list of private exponents (which are selected randomly during the DHE handshake), presupposing that all the application call RAND_bytes() the same number of times before get it. To make the list of exponent I ran the openssl s_client with all the possible PIDs, hoping that all the applications behaves the same way. After more tests I notice that that was an overgeneralization. The proof is in the pudding: wget and cURL, two simple CLI file retrievers, gets different exponent between them, even running with the same PID. I was working on this when I accidentally found a really nice Eric Rescorla’s post which is deeply related with this. The post goes further and analyzes the interaction between how Apache forks off and how it generates SSL handshakes. So, I made lists of secret exponents for wget, curl, openssl s_client and openssl s_server with a modification version of libssl (appling this patch) and running scripts like this: 
    for i in $(seq $((2**15)));
do
  export MAGICPID=$i;
  LD_LIBRARY_PATH="openssl.broken/" LD_PRELOAD="./getpid.so" \
     wget --no-check-certificate https://localhost/ -q  -O /dev/null ;
  echo $i ;
done
    As you can see, I used the HD Moore’s GetPID faker shared library and a normal local Apache with mod_ssl. The broken libssl (which is in .openssl.broken/) store up in /tmp/data.key a csv with command name, PID and all the DH components (g, x, y and p). But this way is farly unconfortable for others SSL deamon servers. Have you got any better idea?

    Next.

    Previous.