Search Results: "ron"

10 October 2007

Russell Coker: Execmem and SE Linux

Eddy writes about problems getting the game oolite to run under SE Linux [1]. Strangely after I fixed the shared object issue with libffcall1 (as described in my previous post [2]) it appeared to work for me. Eddy asked how to allow one application to create write and executable memory regions without allowing such access for all programs. This can be done, in the targeted policy the type unconfined_execmem_exec_t triggers a transtion to the domain unconfined_execmem_t which permits the execstack and execmem operations. For example if the program /usr/bin/foo needs such access then the command chcon -t unconfined_execmem_exec_t /usr/bin/foo will change the type and the next time the program is launched from an unconfined session (a user login session, cron job, or daemon which is not constrained) then the change will apply.

Jeff Bailey: Groovin' with Leif to Confessions on a Dance Floor

Armed with cereal, music, a mirror, a hand full of toys, and 30 minutes of Judge Judy (whom I consider to be an excellent role model =P), I'm having my first evening where should he get hungry, he's totally mine to feed. We introduced solid food on the trip out here, and I haven't had much in the way of relaxing evenings at home where we haven't all wanted to just hang out. Angie's found a yoga class not too far from here and has gone off. So far we're doing well! I think I might plan this around a visit to the used book store down the street.

We told the relocation lady that we want to be within a mile of either Mt. View, San Antonio or Palo Alto Caltrain. Hoping to hear soon whether we'll have any luck, but hopefully we'll settle into this area for at least the next year and start to meet folks. It'll be nice to have our own furniture back finally. I'm ready to not feel like I'm travelling anymore.

I'm heading to Toronto this weekend for the Ontario Linux Fest. Later this month, I'll be at the Ubuntu Developers Summit in Boston. I'm looking forward to seeing people at both!

Erinn Clark: Whatever

Here are some random links.

Adam Rosi-Kessel: MBTA Out of Order

Steve points out that the T has been falling apart lately. My own experience gives it a solid D minus as well. Over the three years I’ve lived in Roslindale, I’ve been quite satisfied with the commuter rail. Unlike other lines (e.g., Worcester), the Needham Heights line does not share tracks with other carriers, and thus does not regularly get tens of minutes off schedule waiting for freight or other traffic to pass. (Why freight gets priority over passengers is a question for another day.) I live about 90 seconds walk from the commuter rail station, and I could calibrate my departure to be within one minute of the train every time. Over the past few months, however, it has been a steady downhill slide. None of these complaints are novel, but I’ll enumerate them anyway: Trains have been canceled without notice (you didn’t really need to be at work by 9am, did you?). Nearly every train is late — I’ve started thinking of the 8:23am as the “8:30″ because it hasn’t arrived before that time since early in the summer. Many trains are missing cars, so the remaining cars end up being standing-room only. Almost every day the train needs to wait for a free track at South Station, no matter which train I’m on. (I’ve never understood why this happens with 12 tracks, many of them empty.) Trains are often short conductors, which means not all the doors open at stops, which further exacerbates delay. And my personal favorite complaint: the PA system is often so loud that passengers have to cover their ears. Except when it’s broken and you can’t hear any announcements. I hate to kvetch, but there must be something wrong here beyond technical glitches. Perhaps the most frustrating part is having no clue about the inner machinations that provide this result. Other complaints from today (about different parts of the system).

Axel Beckert: Group packages by origin in aptitude

I always wondered how others recognise non-Debian packages in the aptitude package tree. I also missed the additional priority level in the hierachy well-known from good old dselect. For the last one, I quickly found out that you can set the priority as subsection — it’s straight forward after you’ve read the documentation: Just add ,priority at the end of the default grouping method for package views under “Options → UI Options” in the aptitude menu. Getting the origin as given in the Release file of the repository a package originates from is a little bit more difficult. You need to use the pattern() group function with the appropriate search pattern: pattern(~O) Since already the default default grouping method for package views doesn’t fit into the dialog, I nowadays just edit /etc/apt/apt.conf directly for changes on aptitude’s default grouping method for package views. It now looks like this on several of my machines:
Aptitude::UI  
  Default-Grouping "filter(missing),status,section(subdir,passthrough),pattern(~O),section(topdir),priority";
 ;
In aptitude this looks like this:
[...]
  --- text - Text processing utilities
  --\ utils - Various system utilities
    --- Debian
    --- Mowgli
    --- volatile.debian.org
  --\ web - Web browsers, servers, proxies, and other tools
    --- Debian
    --- Opera Software ASA
  --\ x11 - The X window system and related software
    --\ Debian
      --- contrib - Programs which depend on software not in Debian
      --\ main - The main Debian archive
        --- Priority optional
        --- Priority extra
      --- non-free - Programs which are not free software
    --- Mowgli
[...]
Unfortunately this doesn’t work with all non-Debian repositories since a few repository maintainer, e.g. those from Emdebian, arrogate to just keep “Debian” as their packages’ origin. This could be solved, if there’s a possibility to group by e.g. repository URL (host and/or path). Another problem I haven’t solved yet is that grouping by origin does neither work with locally created nor virtual packages nor tasks — probably since all of them lack an origin. Those branches are just empty or don’t even show up anymore with this configuration. I probably have to dig a little bit more in the aptitude documentation to resolve this.

Now playing: E-Rotic — Max don’t have sex with your ex

9 October 2007

Axel Beckert: Plugins in the Blosxom Project CVS

Since yesterday, my Blosxom plugins are versioned in the Blosxom Project CVS repository together with those of most other Blosxom developers. Cause for this is, that — besides first steps towards Blosxom v4 (we better forget about v3… ;-) and intergrating existing patches (e.g. the Debian config file patch) to Blosxom v2 — the Blosxom developers want to release a Collection of common Blosxom Plugins as a Plugin distribution so that no one needs to gather the often needed plugins from various sites on the net but get them from first hand and also in some kind of a supported way. A first release candidate is on it’s way. And for those who thought good ol’ blosxom is dead: There never was so much traffic on the blosxom developer’s list like in the past two months — over 160 mails each!

Now playing: Eiffel 65 — Blue

Chris Lamb: Top 10 interactive shell anti-patterns

In general, if you’re doing a repetitive task by hitting lots of keys, you’re doing it wrong. Not only are you wasting time, you’re wearing out your keyboard and damaging your wrists and fingers. Here are the ten most common anti-patterns (actually amelioration patterns) that I commonly see in other people’s line editing:
  1. Repeating a command by retyping it
    Press Ctrl-p and Enter, or “!!“. Zsh users get “r” as well. You can even get the command n times before, use “!-1“. Using the arrow keys is obviously flawed - find out how to unmap them in your shell.
  2. Manually changing back to your previous directory
    Give “cd -” a whirl.
  3. Typing a long command (or sequence of commands) excessively often
    Obviously wrong, but I see it so often it’s worth mentioning. Try using an alias and put it in your shell’s startup file. If the command is parameterised, you could construct a simple function. If you are writing software, look into the build systems available for your language - the basics of GNU Make can be mastered within 20 minutes or so, and have many other benefits too.
  4. Opening another shell when the current process blocks
    (e.g. You realise the command you started is going to take a lot longer than you thought) Pause the current process with Ctrl+z and then put the job in the background with bg. fg will bring it to the foreground again. Fewer shells mean you stay focused on what you were trying to achieve.
  5. Searching history by grep’ing ~/.bash_history, or Up Up Up … etc.
    Use CTRL+r (or “/” in vi-mode) for search-as-you type. You can immediately run the command by pressing Enter.
  6. Adding a prefix to a command with Up Home $command Space
    (e.g. You ran a command that really needed sudo). Try: $prefix !!
  7. Changing a command with Home Right Right Right Right … BkSpace BkSpace … etc.
    (e.g you accidentally ran chown instead of chmod) Try: $new_command !*
  8. Retyping significant parts of the previous line
    $ command arg1 /long/path/to/file
    $ command2 arg2 /long/path/to/file
    $ command3 arg1 arg3 /long/path/to/file
    Try using !$ to get the right-most argument on the previous line (you can also use !:2 to get the second argument, etc.):
    $ command arg1 /long/path/to/file
    $ command2 arg2 !$
    $ command3 arg1 arg3 !$
  9. Using Home/End to move to the beginning/end of the line
    This is how you completely ruin your wrists. Use Ctrl+a and Ctrl+e.
  10. Hitting tens of keys to make a substitition
    (e.g. you made a trivial mistake in the middle of your previous command). Use ^foo^bar. If you forget the other nine, try this one - stop punishing yourself for making mistakes! :)

Russell Coker: A Long Laptop Lifetime

Paul Russell writes about his 3-yearly laptop replacement at IBM [1]. It probably makes some sense to replace laptops periodically for a large company, but if you are buying for personal use then it makes sense to try and get a longer life out of an expensive machine. I think that aiming for 6 years is quite reasonable with today’s hardware - you should be able to buy a new machine now and have it last 6 years or buy a 3yo second-hand machine and hope to have it last 3 years (most second-hand laptops on sale in every place other than Ebay were trophies for managers and never had any serious use). If you are going to buy a second-hand laptop the first thing to consider is PAE support. If you get a laptop without PAE support (I think that means all Pentium-M CPUs) then you will not have proper Xen support (it seems that all distributions have abandoned Xen support for PAE for the moment). This may not be a big deal if you don’t want Xen, but if you are a programmer then you probably do want Xen (even if you don’t realise it yet). The next issue is support for the AMD64 instruction set. 32bit laptops are going cheap at the moment but if you buy one you will be significantly limited as to what software you can run at some future time (my 32bit laptop is doing well at the moment apart from the lack of PAE support). If you are buying a new laptop then the first thing to consider when planning a long life is the warranty. In my experience most computer gear does not need a long warranty, if it survives 3 months then it’ll probably last until it’s well obsolete. Laptops however periodically wear out if used seriously, I average one warranty replacement of a Thinkpad keyboard every two years and I have had a few motherboard replacements (the lighter Thinkpads flex and they eventually break inside if you use them on enough trains, trams, buses, planes, etc). On one of the Lenovo T series Thinkpads that I saw advertised (one that I would consider if I wanted a new laptop now) there was an offer to spend an extra $350AU to get extend the warrantee from 1 year to 5 years (according to my understanding of the confusing text on the web site) on a laptop that cost $3050. An increase in the purchase price of 12% for the extra warranty is a bargain (I know that for my use they would lose money on the deal). Repair of a laptop is generally very expensive, any serious damage to a laptop that is more than 18 months old will generally mean that the replacement cost is less than the repair cost. The next thing to consider is the screen resolution. After purchasing a laptop you can upgrade the RAM and the hard drive, the CPU power of all modern machines is great enough that for most typical use it’s difficult to imagine any need to upgrade. But screen resolution is something that can never be good enough and can never be improved after purchase. Lenovo is offering T series Thinkpads with 1920×1200 resolution for $4000AU and 1680×1050 resolution for $3050AU. That’s 31% more pixels for 31% more money and seems like a good deal to me. I believe that a larger display can significantly increase productivity [2] so it seems that the extra expense would be a good investment if you plan to earn money from work you do on your laptop. As a point of reference a desktop monitor from Dell (who seems to be the cheapest supplier for such gear) with resolution of 1920×1200 will cost at least $1000AU. The hard drive capacity should not be an issue, it seems that 100G is about the minimum size. The 60G drive in my current Thinkpad is adequate for my development work (including several Xen instances and some ISO files for a couple of distributions) so unless you plan to collect MPEG4 files of TV series and store them on your laptop I can’t imagine 100G being much of a limit. Also external storage is getting quite cheap, 2GB USB flash devices are now in the bargain bin of my local electronics store and USB attached hard drives with capacities of 40G or more are getting cheap. Also with a Thinkpad replacing a hard drive is really easy and does not risk damage to the drive or the rest of the laptop (I don’t know how well other brands rate in this regard). For RAM you can buy a model with a large memory module in socket 0 (or attached to the motherboard). Adding new RAM later is easy to do. Just try and avoid purchasing a memory capacity that involves having all sockets filled with modules that are not of the maximum size - it’s annoying if you have to try and sell modules on Ebay after you buy a memory upgrade. Finally one mistake I made in the past was to not get all the options for the motherboard. Make sure that every option for Ethernet ports and 802.11 type protocols is selected. It might sound like a good idea to save $100 or so on not getting one of those options, but if you end up repeatedly plugging a CardBus or USB device for many years you will regret it. Also external devices tend to break or get lost. Rusty documents his laptop replacement as a time for spring-cleaning. I use LVM for the root filesytem on my Thinkpad so that I can easily install a new distribution (or a new version of a distribution) at any time. I’ve been through that spring-cleaning a couple of times on my current Thinkpad without needing new hardware. From a quick view of the Lenovo site it seems that an ideal new Thinkpad that would last me 6 years would cost about $4500 while one that would last me 2 years would cost $1600 (and have a significantly lower screen resolution). A Thinkpad that would last 6 years and not be so great (but still better than the cheap option) would cost about $3500. Update: One significant issue is the life expectancy of laptop batteries. If you use a laptop for mobile use (as opposed to just moving between desks occasionally) then you are probably familiar with the problem of laptop batteries that discharge after 10 minutes. Last time I checked the warranty on Thinkpad batteries was 1 year or 300 charges (whichever comes first). My experience is that after 300 full cycles a Thinkpad battery will only last for a small fraction of the original charge time. When buying a laptop I suggest getting a spare battery at the time of purchase. The spare battery may last longer than the battery that is shipped with the laptop and two batteries means that you have twice the number of charge cycles before they are both useless. Batteries apparently don’t last long if completely discharged, so charge them up before storing them and periodically charge them if they have been left unused for any length of time (maybe every second or third month). With a Thinkpad it seems quite safe to change the battery while the machine is plugged in to mains power and running (I expect that Lenovo doesn’t recommend this though). You should probably plan to have a battery die every three years of use (or sooner if you do a lot of travelling). So one spare battery may last you 6 years of use but you will need two spare batteries if you travel a lot.

Adrian von Bidder: Microsoft declares Bankruptcy

Intellectually, I mean. According to some Media outlets Ballmer (once again) declares war on the Free Software community. The technical “we are better” argument is apparently completely dropped (honesty, at last) and replaced by the pure “we have more money and patents”, this time not even thinly veiled in marketing speak. But I don't think PJ is right when she sais that “FOSS can't survive in an IP regime such as Ballmer has laid before our eyes.”. We've all seen how successful the sue your own customers business model is. At this time, I think it's safe to say that most big Linux users are also big Microsoft customers because Linux in the enterprise still means primarily Linux on the Server, Windows on the Desktop, so going after the big Linux users will be exactly that. Going after the small Linux users is just not interesting. Going after hobbyist FOSS developers will not work because only using patented works commercially actually violates the patent, as far as I understand patent law. Going against the commercial Linux developers will work to some degree, so let's look at this closer: Software patents are strongest in the U.S., so in Europe it will be much harder for MS for one thing. And, Novell and Red Hat excluded (and IBM, who should be big enough to take on MS, especially since their lawyers by now have had extensive training in what Linux is abaut), the commercial Linux space is still dominated by small companies, so MS would have to overload the judges with thousands of small lawsuits all over the world, and since no two companies do exactly the same thing I doubt the lawsuit templating technique adapted by the RIAA for music downloads will work. And, finally, the nice thing about Open Source Software (using this term here on purpose): it's out in the open. So kill one company, its former employees will found three new ones because the former customers (even if they're scared and would like to get rid of their Free Software) will still need support because they can't all switch (back) to MS based environments immediately. And I haven't even talked about public opinion and what antitrust offices might have to say, because those are extremely hard to predict and their effects are uncertain.

8 October 2007

Neil Williams: dpkg-cross 2.0.0 - fragility expected!

OK, changes in dpkg-dev 1.14.7 have forced my hand a little and dpkg-cross 2.0.0 has now been uploaded to Debian unstable (not experimental).
apt-cross 0.2.9 has been uploaded to Emdebian unstable - dependent on
dpkg-cross >= 1.99
apt-cross 0.3.0 has been uploaded to Debian unstable but will spend some time in the NEW queue (hence the 0.2.9 upload to Emdebian). apt-cross 0.3.0 is functionally identical to 0.2.9
emdebian-tools 0.3.9 has been uploaded to Emdebian unstable - dependent on apt-cross >= 0.2.9 and dpkg-cross >= 1.99
All three comprise extensive rewrites. apt-cross, in particular, is barely recognisable. dpkg-cross is a shadow of the former package and v2.0.0 signals the beginning of the long goodbye to both packages. dpkg developers expect to be able to merge all dpkg-cross functionality into dpkg before Lenny. Once that is done, it should be trivial to merge apt-cross behaviour into apt.
Only the new libcache-apt-perl package (containing the modified NorthernCross code from virtuoso) will persist. Once this whole transition is over, I'll upload Cache::Apt::* to CPAN so that it can become its own source package in Debian once apt-cross is removed.

IMPORTANT
dpkg cross-building support is HIGHLY EXPERIMENTAL!
Significant changes are still pending, including remapping the build paths during the
dpkg-buildpackage build and utilising the updated dpkg-shlibdeps code which is a decade ahead of what we had in dpkg-cross 1.39.

  1. dpkg 1.14.7 included dpkg-buildpackage as a perl script instead of shell which breaks dpkg-cross <= 1.39 but the new code to support dpkg-cross >= 1.99 is not implemented yet.

  2. The breakage that Zumbi experienced when using the dpkg version from
    experimental will now occur in unstable.
    http://lists.debian.org/debian-embedded/2007/09/msg00067.html. Note that this breakage would be severity "critical" if filed as a bug because it prevents not only cross-builds but normal Debian builds.

  3. dpkg-cross 2.0.0 fixes this issue. Hence the urgency in uploading dpkg-cross 2.0.0

  4. dpkg-cross 2.0.0 removes the old diversions of dpkg-buildpackage and dpkg-shlibdeps.

  5. dpkg is set to support the removal of the dpkg-cross diversions and code to support this is coming this weekend. This means that there will be a GAP where cross-built packages will fail to find the correct shared libraries. HOWEVER, installing dpkg-cross 2.0.0 restores the ability to build normal Debian packages whilst keeping dpkg-cross installed. This is a far more important gain than a temporary problem in packages that hardly anyone is using yet (our Emdebian crossbuilt packages).

When dpkg-dev 1.14.8 becomes available, apt-cross, dpkg-cross and emdebian-tools will be updated to depend on this version.
Everyone: please note - cross-building support in Debian will be "fragile" for the next week or so. The rewritten packages are being uploaded against experimental dpkg support I expect bugs. :-(

The benefits of these changes are:
  1. The removal of diversions that are a decade out of date.

  2. The implementation of virtuoso's NorthernCross code that transforms apt-cross and fixes lots of awkward bugs.

  3. The incorporation of cross-building support in the heart of dpkg.

  4. The beginning of the long goodbye to dpkg-cross and apt-cross.


RESULTS
With the new packages installed, some packages will produce:
 emdebuild: ERROR /usr/bin/ contains files for the wrong architecture!


i.e. the build appears to succeed but until dpkg-dev 1.14.8 includes support for looking for the correct libraries in /usr/$arch/lib instead of /usr/lib, we get unusable packages. This at least means that packages can be test built and the patches updated.

Russell Coker: I Am #40 in Don Marti s List

Don Marti has written his own equivalent to Technorati based on links from blogs that he reads, and my blog comes in at #40 in the list (last place) [1]. Don does note the fact that such lists mean little and links to a post by Doc Searls [2] which makes the same point more strongly. But it’s still interesting to note. Also if Don chose to release the Perl script in question (or host is as a cgi-bin script) to allow other people to make their own top 40 list then I’m sure that many people would appreciate it (I’ll write such a script myself and release it if he doesn’t). He notes when publishing his list that a blog may be included even if he never reads it. I believe that if a blog is highly ranked according to links from blogs that you read then it’s quite likely that you will be interested in reading it, it may be a blog that is opposed to your beliefs (for example I’m sure I’m not the only person in the Linux community to link to an official Microsoft blog) but if it gets enough links then it would be worth reading at least once (if only to discover why you don’t like it). While I can’t tell Don to read every blog on his top 40 list I’ll certainly read every blog on my top 40 list at least once when I create the list.

Steve Kemp: Oh, didnt i, didnt i, didnt I see you cryin?

Curse you Debian! Your programs are too secure... So I was looking over some setgid binaries last night, seeing if there were any obvious security bugs. Up popped omega-rpg - a fun game I've recently been playing. Unfortunately it is mostly OK: The only thing that I can is persuade the game to die with a SIGSEG if I manaully edit a save-game file, then load it. I'm sure with care and patience it could be coerced into running shellcode. In theory this is a security hole. In practise it is hard to take seriously! On the other hand I'm not convinced the game should be setgid(games)..

Theodore Ts'o: Sous Vide, Revisited

In a previous post, I had recommended the 4130 NIST-Traceable Temperature Controller to control the temperature in a slow cooker. Unfortunately, that particular controller has a range that tops out at 60 degrees C / 140 degrees F, which is enough for cooking beef for long periods of time, but not enough for say, cooking duck confit, which for which a sous vide temperature of 80 degrees C is recommended. In addition, the 4130 is pretty expensive; almost $150. It’s possible to add a resistor to change the range of the 4130, but the temperature displayed by the controller is no longer correct, and you have manually create a conversion table between true temperature and the temperature as seen by the controller. I’ve recently come across a cheaper and better possibility, the Ranco ETC-111000-000 Temperature Controller which is only half the price and comes with a much larger working range (-30 to 220 degrees F). The price with the AC cord already wired in is $75; and the version which just has a 120VAC SPDT relay is only $60. A bit more about food safety. There has always been a lot of concern about bacteria growth and botulism, for good reason — and so therefore the recommendations for cooking temperature have a lot of safety margin in them — to the point now that the USDA recommends that steaks be cooked to at least 145 degrees F, which is well within what had traditionally been called “medium”, and chicken to at least 165 degrees F, which is enough to really destroy taste and texture. Sous vide cooking, especially some of the more low temperature variants, have raised a lot of concerns, to the point where a few years ago New York City (temporarily) banned it, causing a great outcry in the foodie community, since many top restaurants use sous vide techniques. First of all, any recommendation about internal temperatures and food safety that doesn’t also factor in time is massively oversimplifying the problem. Here is a table taken from “Food Safety Hazards and Controls for the Home Food Preparer”, published by the Hospitality Institute of Technology in 1994:
Temperature, F Time, 5D kill Time, 6.5D kill
130 86.42 minutes 112.34 minutes
135 27.33 minutes 35.53 minutes
140 8.64 minutes 11.23 minutes
145 2.73 minutes 3.55 minutes
150 51.85 seconds 1.12 minutes
155 16.40 seconds 21.32 seconds
160 5.19 seconds 6.74 seconds
165 1.64 seconds 2.13 seconds
This table lists the time to reduce bacteria concentrations of Salmonella and E. coli from 100,000 to 1 (5D) or 3,162,277 to 1 (6.5D). The FDA and USDA recommend cooking hamburger to 5D destruction. Since it is extremely unlikely for there to be more than 100 Salmonella organisms per gram of meat, a 5D kill will reduce Salmonella concentrations to no more than 1 organism per kilogram. So whether you cook a piece of meat to an internal temperature of 165 degrees for 1.64 seconds, or hold it at 130 degrees for 90 minutes, the effect on Salmonella and E. coli bacteria will be the same.Of course, one concern is that in many forms of cooking, particularly oven roasting and grilling, the temperature of the food as it heats up may not be even; so how do you guarantee that all parts of the food product has been brought up to the requisite 165 degrees? One way that recipe authors, fearful of liability concerns, have done so is to tell people to cook meat to much higher internal temperatures, to provide that extra safety margin at the expense of dessicated, horribly tasting turkey or chicken. But the advantage of sous vide cooking is by immersing the food in a water bath, the excellent heat conductivity of water helps guarantee that the entire body of meat will get raised to desired temperature relatively quickly. (How quickly depends on the thickness of the meat, obviously). So if you hold a roast beef that has been vacuum packed in a Foodsaver bag for five or six hours, there should be no question that all of the common bacteria has been inactivated, and that amount of time at 130 degrees F should be sufficient to inactivate 99.9 percent of all botulism toxin molecules (not there should be any in a fresh piece of meat, of course!) However, sous vide temperatures are not enough to kill bacterial spores, in particular C. botulinum, which is responsible for botulism. This requires temperatures far in excess of boiling water at sea level. For example, home canning protocols recommend holding the food product at 250 degrees F for at least 15 minutes. This is an issue in the restaurant business because very often food would be cooked sous vide, and then stored in the vacuum sealed bags for potentially weeks (yes, you could be eating an extremely expensive meal at a top-end French restaurant that had been cooked several weeks ago, and reheated just before serving; yummy, no?). If the food packages aren’t cooled quickly enough, and then allowed to warm to the danger zone, it’s possible that in the anerobic environment the C. botulinum spores could germinate and then start producing toxin. But, if you are cooking home sous vide where you are serving the food right after it has been cooked, this shouldn’t be a concern.

Russell Coker: Can SE Linux Stop a Linux Storm

Bruce Schneier has just written about the Storm Worm [1] which has apparently been quietly 0wning some Windows machines for most of this year (see the Wikipedia page for more information [2]). I have just been asked whether SE Linux would stop such a worm from the Linux environment. SE Linux does prevent many possible methods of getting local root. If a user who does not have the root password (or is not going to enter it from a user session) has their account taken over by a hostile party then the attacker is not going to get local root (unless there is a kernel vulnerability). Without local root access the activities of the attacker can be seen by a user logged in on another account - processes will be seen by all user sessions if using the SE Linux targeted policy and files and processes can be seen by the sys-admin. If while a user account is 0wned the user runs “su -” (or an equivalent command) then in theory at least the attacker can sniff this and gain local root access (whether enough users do this to make attackers feel that it’s worth their effort to write the code in question is something I couldn’t even guess about). If the user is clueless then the attacker could immediately display a dialog with some message that sound urgent and demand the root password - some users would give it. If the user is even moderately smart the attacker could fake the GUI dialogues for installing updated packages (which have been in Red Hat distributions for ages and have appeared in Debian more recently) and tell the user that they need to enter the root password to install an important security update (oh the irony). In conclusion I think that if a user is ill-educated enough to want to run a program that was sent to them in email by a random person then I expect that the program would have a good chance of coercing them into giving it local root access if the user in question had the capability of doing so. Even if a Linux trojan did not have local root access then it could still do a lot of damage. Any server operations that don’t require ports 1024 (which means most things other than running a web, DNS, or mail server) can still be performed and client access will always work (including sending email). The trojan would have access to all of the user's data (which for a corporate desktop machine usually means a huge network share of secret documents). If a trojan only attempts to perform actions that SE Linux permits (running programs from the user's home directory, accessing servers for DNS, HTTP, IRC, SMTP, and other protocols - a reasonable set of options for a trojan) then the default configuration of SE Linux (targeted policy) won't stop it or even log anything. This is not a problem with SE Linux, just a direct result of the fact that in every situation a trojan can perform all operations that the user can perform - and if the trojan only wants to receive commands via web and IRC servers and send spam via the user's regular mail server then it will be a small sub-set of the permitted operations for the user! If however the trojan tries more aggressive methods then SE Linux will log some AVC messages about access being denied. If the sys-admin has good procedures for analysing log files they will notice such things, understand what they mean, and be able to contain the damage. Also there have been at least two cases where SE Linux prevented local root exploits. Finally, in answer to the original question: SE Linux will stop some of the more aggressive methods that trojans might use. But there are still plenty of things that a trojan could do to cause harm which won't be stopped or audited by SE Linux policy. When Linux gets more market share among users with a small amount of skill and no competent person to do sys-admin work for them we will see some Linux trojans and more Linux worms. It will be interesting to see what methods the trojan authors decide to use.

7 October 2007

Biella Coleman: Open another coffee shop in PR with free wireless, please

Somewhat unbelievably (to me at least) there is still wireless in my mother’s backyard and it has only gotten better and stronger. But let’s face it, writing in garden lounge chairs among the frogs, birds, sun, rain and wind are sub-optimum for thinking and writing, so I am always looking for good and, most especially, gratis wireless. I was pretty psyched to find a new cafe, Camilles Cafe that had decent looking food and proudly advertises Free WiFi. So I went there this afternoon, ordered my cafe con leche, sat down, and ran dhlcient to get my IP address and it served me one in a jiffy. I opened my xchat, said hello to my fellow chatters, and then proceeded to login to my email and I never got further than that because they disabled access to any page that requires a password. I went up to the counter to ask why and the answer I got was “porque un hacker nos ataco.” It is totally retarded that the can’t reenable whatever they turned off after adding some basic security measures. They are losing tons and mean tons of business. One quick visit to the “other” cafe down the street with free wireless Me. Starbucks shows there is much business to be made if you provide free wireless. It is Sunday and there are 12 people here with computers and people of all stripes and backgrounds and they come because the wireless is cheap and fast. Be warned: logging on to the wireless here is totally non-obvious. When you try to log in, you are routed to a corporate Centennial web page that asks for an user-id/password or asks you to create one. So you of course think that it will cost money to do so. But in fact you just create a name, password etc. and then the site never asks you for mullah (nice). There is no sign, instructions, giving you these instructions. You gotta know or you gotta ask one of your neighbors. This odd system has been in place for years and I just wonder when the only free wireless in a coffee shop (at least that I know of) will be snatched away. Hopefully never and hopefully someone else will get the bright idea that if they open another coffee shop and also provide free wireless, they will make a killing. This place is always always, and I mean always, packed. p.s.: make sure to bring headphones/music too unless you are great at working with plently of background noise, which includes the usual starbucks music (about as good as its coffee, not), people chatting, people video-chatting sans headphones, and people watching shows like South Park. It is downright cacophonous..

Simon Huggins: My stomach and me

I'm sure I am only have legs and a brain so that I can keep my stomach happy. Food rules my life. I don't understand people that can miss breakfast; my stomach would be moaning at me if I did. It does have a good side though as it means I really enjoy food and I enjoy cooking it too. Since I have some more time on my hands these days, I've been experimenting a little more and trying some more things out so I thought I should post about them. Bread maker I asked for a bread maker for my birthday. I worked from home and ate bread all the time for lunch but it always went off quickly and supermarket bread isn't always amazing. The machine has been great. The even rapid bake loaves it churns out in just two hours are great. It has a timer so you can put a loaf on over night and come down to lovely fresh bread smells. The dry ingredients are easy to keep around and you just bung them all in the pan, hit a few buttons and later on a loaf appears as if by magic. I especially like the granary loaves especially if I add a little rye flour but all the standard recipes seem good. The French bread one seems to give the right texture and taste but it's odd eating it in a loaf shape so I might have to make that one as dough and then shape and bake it separately one day. I didn't like the olive and passata loaf; it came out an interesting orange colour flecked with the chopped olives but didn't really taste of tomatoes or olives. There's a tomato foccacia that uses sundried tomatoes that I might try out though. There's a croissant recipe which seems to be a quantity of French dough that you put butter in, wrap around butter, and then more butter. How can it possibly go wrong? I need a free morning to try it but I think I will soon. Basically if you don't have a bread machine you probably want one. Pasta I watched a series of cooking programmes on BBC (Kitchen Criminals) and they seemed to be making pasta from scratch every two minutes so I was intrigued to try it. I mentioned it to my Mum and she had a machine that she'd never used that I borrowed. Sadly it's not quite as easy as it looks after TV editing. Basically the first bit is really easy: whizzing flour, olive oil, an egg and some salt in a food processor, kneading it a bit and making it into a ball. Bung it in the fridge to rest and then the fun begins of trying to make it into a flat sheet. Lots more flour (in fact my kitchen was covered with it) and lots of patience and many attempts got me something that was vaguely what I wanted. Every time I got close it would stick together or it would rip or it would go in at an angle and I didn't have enough hands to fix all these problems at once. Even using smaller amounts of the dough is tricky. I was making ravioli the first time and it was nice but took lots of time and I didn't feel it was entirely worth the effort. I tried just simple tagliatelle last night but again it took a long time and you end up thinking that you could have just bought fresh pasta in a bag and be grabbing a handful of it instead of spending 40 minutes faffing just to get some strands. It might be worth it if you had some amazing idea for ravioli filling but I think I'll give Mum her machine back and not buy one. Cheescake I've always really loved Pizza Express's cheesecake but never really understood how they did it especially with the texture at the edges. I'd always thought cheesecakes were just an assembly job really; my standard one is lime and mascarpone and icing sugar and it is tasty but not the same. Chatting to various people it seems the Pizza Express one is baked so I tried a recipe from a book Mum had lying around that I was flicking through. It was a chocolate baked cheesecake and it sort of worked but was almost a little too chocolately and didn't have enough other interest. It probably wants some zest or some stem ginger or something through it. It's a terrible hardship but I think I might have to make another one to perfect it. Plans Like I said, I want to try croissants and I've always been looking for a good recipe for gingerbread; I really love ginger as a flavour. I never really cook with pastry much so I should perhaps try some pies or similar whilst I'm not working and have time to do these things. Any other suggestions welcome.

6 October 2007

Christian Perrier: RWC: England "scrums" Australia

The English front players were the key of that though match. By dominating the Australian players, particularly in a few key scrums and mauls, they logically and brilliantly won that first 1/4th final. Despite a non optimal Johnny Wilkinson in kick play (maybe the only question for England in that game), England qualifies (12-10) while Australia will probably regret a few lost balls by their rear lanes in 2nd half time. Anyway, congratulations to both teams for this very intense first match of our rugby marathon for this week-end. Now, let's hoipe we'll have the same intensity tonight for the much awaited New Zealand-France in Cardiff....and of course, I hope for another victory for a northern hemisphere team.

Tore S. Bekkedal: Oslo Byaksjon - P Parti Med Byen?

A party calling themselves Oslo Byaksjon this year entered the elections, with the tagline “P parti med byen” (roughly, “On the city’s side”, or “With the city”). Their platform wasn’t horrible, and I briefly entertained the notion of voting for them. In the end I didn’t, for some important reasons; but that’s not very relevant. A Norwegian tradition is for the political parties to set up stands leading up to the election, along Karl Johans Gate (Main street, the street between the Royal Palace and the Storting (the parliament building), and this year was no exception. However, almost a month after the September 10th city elections, Oslo Byaksjon still haven’t removed the fiber boards after taking the thing apart. They’re now an orange eyesore in the middle of Oslo’s main street. Ironic! (More pictures here) Update: ZOMG, I am on Planet Debian. Hello, friends :)

5 October 2007

Biella Coleman: On Traveling, Airports, and Thinking

After 6 weeks of teaching and over 2 months in my new apartment, I am making a short escape from NYC to visit my mom and sister in PR. In my Impacts of Technology class, we just finished a week on large-scale and complex technological systems, with a focus on industrial farming. We read a few sections of Micahel Pollan’s fanstastic book, The Ominvore’s Dilemma, which combines the odd qualities of being seductively alluring (thanks to his exquisite writing) and repulsive (thanks to the content, well at least the part on factory animal “farming”). I can’t recommend it enough and look forward to reading the rest, when I find the (magical) time to do so. Now that I am at the airport, I am struck at how little I know about this place, which is also a large and complex technological system and I bet revealing its technological and cultural innards would provide as fascinating (although not quite as gross) of a story as that of factory animal farming. There are many questions I would love answered: How exactly is coordination secured and what are the toughest elements to airport coordination? Where are the lines of cooperation and those of competition between airlines? What factors and values go into the design of the airport? (I know that for one thing, in American airports, there rarely seems to be enough electrical jacks; I am now sitting under the telephones, the only place with jacks in terminal 8 at JFK, and the funny thing is that there are a row of 7 unused phones and only one jack and I am sure it would be more useful to have 1 pay phone and a row of 7 jacks, instead). What sorts of airport technologies have put people out of jobs? What technologies have created new job opportunities? What sorts of social hierarchies are there in airports? Like who runs the big show? Is it a CEO? Or is something more like a university provost? What is standardized by the FAA, and what elements are more flexible, and thus different airport to airport? Is there a sense of camaraderie among airport employees, or are loyalties built primarily among employees of one airline or among the classes of workers? Given that unions are quite strong among airport employees and from the top (pilots) down (food workers), what is the political culture of airports/employees like? (I remember once overhearing a group of machinist and ground crew talking about the ugly face of globalization and NAFTA over coffee and I was dumbfounded and pretty psyched too). Are airports one of the few last remaining places in th US that provides for decent job security? Why do so many of the ground crew have such athletic, bulging calves? :-) Is it a result of the physical demands of the job? Or is it that the type of job ( outdoors with lots of heavy lifting), attract the athletic types? Do they have to pass certain physical standards as to pilots? Was there always first class seats? Or did that come about when flying became cheaper? Are employees trained to deal with irate passengers? In what ways do pilots bitch about the long waits/delays they also have to endure? What can they do when they are waiting, as we did for an hour last night, during the massive traffic jams that are especially noxious in NYC-area airports? Do pilots have any say in the way airports are run? Why do they consistently provide less chairs than are needed in lounges, even in new terminals, as the one I was in tonight? Do air traffic controllers ever meet face-to-face with pilots or do they largely have a virtual relationship? Are programmers who patch, improve, and build traffic control systems housed in the airports, or elsewhere? Airports are not only fascinating for technological and sociological reasons but I reckon there is a lot of interesting psychological work that must happen in airports. I imagine that during those long, endless waits in the lounge, on the security lines, on the tarmac, people must often take the time to reflect, on where am I going, where am I coming from, and not in the literal sense but the metaphorical one. I know that I have spent many hours in airports letting my mind wander to places and thoughts in ways that don’t happen as easily or often elsewhere. And in many instances, I don’t think that this propensity to indulge in some reflective thinking, is a matter of time, that is waiting. For me at least, it is the fact that many times when I fly, I am moving between worlds. While I have flown hundreds of times, I never have been shed of the sense of awe I feel about planes and their ability to shrink space and time so quickly. For me, it is less the act of flying itself (that feels boring, tiring, annoying, mostly because of the insane waits and delays and I never seem to get the right amount of sleep the night before) but the visceral contrast it brings. In the morning my life is of a particular tone and rhythm, currently situated in NYC and by evening, I am back at home in PR, surrounded by thick humidity and the loud sound of coquis. Once there, my as currently configured in NYC, has little direct bearing to those around me. Planes don’t just transport, they shift and convert your inner and outer world… So, if anyone (who got this far) knows of a good social history of the airport, do tell. I would love to read it.

Michal &#268;iha&#345;: Wammu 0.23

I just released version 0.23 of Wammu. This is again mostly bug fix release, which fixes various bugs reported by users. There is still no binary for Windows. I don't have time and environment for debugging crashes that happen there. Volunteers are welcome!

Next.

Previous.