The stdarg API, which allows you to use a variable number of arguments to a function in C, is pretty fun. However, it's also pretty limited in what it allows, to a degree that it invites people to try and find workarounds to things you can't do with the API as it is documented. Unfortunately, this almost always breaks when the software is compiled on hardware that happens to be not your own, as there is a reason why stdarg is implemented the way it is: portability. A (not so) recent discussion on #debian-devel on OFTC showed to me how this confuses many people. Don't worry—it confused me too, the first time I had to think about it. The problem is that in order for stdarg to be able to do what it does, it needs to read function arguments from whereever they are stored. Where that actually is depends on the operating system and the hardware you're using; it could be on the stack, but e.g., the SPARC architecture actually has a mechanism to pass parameters using processor registers (although those are most likely not used when stdarg is in use, since the number of parameters that can be passed that way is obviously pretty limited). If parameters are on the stack, then you may be able to just access the memory as you would access any random variable; but it could also be the case that you need to take some specific steps to access the stack, or perhaps your architecture or operating system has some protection for stack-based security attacks, which would make it impossible to directly access memory on the stack that is actually part of another subroutine. So if you try to do anything that isn't defined in the stdarg api (like trying to figure out the number of arguments by peeking inside the va_list data type, or passing a va_list to another function without using the C99 va_copy macro) will break. Yes. Very sorry.

I've decided it's been enough. Rock has been running 2.6.12 for ages. Not because I didn't want to upgrade, but since 2.6.12 was the last Debian-packaged kernel that would actually boot on rock. You see, this machine is a rather old SMP system, and there seems to be something wrong with its interrupt system. It would boot if I used a uniprocessor kernel instead, but then it's pretty silly to have a box with two processors, and only use one of them... At first I ignored it, assuming it would get fixed some time soon. Unfortunately, that didn't happen. And since we're at 2.6.18 right now, and the kernel team has done away with uniprocessor or SMP-only kernels, that means I can't even upgrade to the latest kernel anymore, even if I'd want to. I've been using git-bisect for the last few days in an attempt to find the issue, so that I can report it... only today I realized that I did remember 2.6.13 not to work, but that perhaps it failed for reasons not related to my current problem. Downloading that package from snapshot.debian.net and verifying showed that this is, indeed, the case. Grmbl. So I had to start all over again... Not fun. After starting that, I suddenly found out that make-kpkg didn't want to be friends anymore:

LC_ALL=C make-kpkg --initrd --config oldconfig --rootcmd fakeroot kernel-image
exec debian/rules  DEBIAN_REVISION=2.6.13-10.00.Custom  INITRD=YES  ROOT_CMD=fakeroot  kernel-image 
debian/ruleset/targets/source.mk:34: *** target pattern contains no  %'.  Stop.
wouter@rock:/usr/src/linux-2.6$ 

Hate. Grmbl.

I’m trying to set up a laptop which needs as much security and privacy as I can get. It turns out the main problem is that I want and need dual-boot: Windows XP Professional and Linux (Debian Etch). Now, Encrypting of all partitions used (except /boot of the Debian installation) is a must. Without dual-boot, this won’t be any problem, but not with the wish to dual-boot. The Linux side isn’t a real problem, I simply use a dm-crypt’ed partition as the only “physical” volume in an LVM volume group, which contains three logical volumes: Swap, / and /home. This means I only need to enter my LUKS/dm-crypt password once during boot. Shared partitions (shared between Windows and Linux) are also encrypted with dm-crypt/LUKS and decrypted by FreeOTFE (which is a really nice little OpenSource tool BTW), formatted as FAT32. The Windows side on its own won’t be too much of a problem either, since BestCrypt, PGP Whole Disk Encryption as well as DriveCrypt PlusPack (this probably isn’t a complete list) allow encryption of the Windows boot partition, but at least the latter two need their pre-boot authentication part (which is needed to be able to decrypt the Windows boot partition) to be installed into the MBR. Now, I wasn’t yet able to get Linux installed to the disk without breaking the Windows decryption. If anyone knows a program which allows encryption of the Windows boot partition and dual-booting into Linux, I would welcome a hint. Preferably, this solution should use grub as the primary boot manager.

In the past and for my hacker course, I have taught Paul Ceruzzi’s History of Modern Computing but the book was a little too dry to fly high with first year students but thanks to Joe Reagle’s excellent syllabus on the Impacts of Technology, I read a short but very sweet (and teachable) piece by him entitled An Unforseen Revolution: Computers and Epectations that not only gives a window into the early history of the computer but provides a very nice conceptual entry as to why it is hard for inventors of a new technology, such as the computer, to foresee and fully come to terms with its future uses, full range of capabilities, and utlimately its impact. Basically the context of invention combined with the training of inventors (which in this case, the first American digital computer, the ENIAC was invented by a physicst and an engineer for mathematical computing) stitches and thus initially limits the vision (and thus use) of the technology largely to its original purpose, while precedding technologies provide the conceptual juice drunk to understand the meaning of new technologlogies. So while today we clearly think of computers as a meta-machine, that can be whatever-machine-in-the-world-we-so-desire (so long as someone programs it to be that machine), in its time, with people so accustomed to machines as having one function, the cultural imagination was stuck. As Ceruzzie humorously conveys, a machine having such general capabilities seemed absurd, like a toaster that could sew buttons on a shirt. But the computer was just such a device; it could do many things its designers never anticipated. p. 126 With the passing of time came new innovations (Ceruzzi identifies new developments in programming as key in this regard) and use in new settings (notably businesses), the stitches were loosened and finally unraveled so that the computer came to take on the meaning it has acquired today. One perennial topic of inquiry in the field of STS concerns how particular contexts and other factors shape new meanings, visions, and uses, or just limit them, along with unearthing the labor that goes into making new inventions or scientific theories more generally accepted. This is a great little piece to teach incoming students about some of these concerns in STS, and without a lot of heavy-handed anything. And to make the project of teaching really fun, add this short clip from the Muppets, where Dr. Bunsen Honeydew totally ignores the Very Large Gorilla about to gobble him up because of his blind faith in technology.

The last time I made any serious contributions to Wikipedia was back in 2001 or 2002. The community was exciting, friendly, and welcoming, and I enjoyed spreading the word as most non-technical people I knew had never heard of wikis or Wikipedia. Since then, I may have corrected the occasional typo or fixed a legal error, sometimes anonymously and sometimes under my account (apparently I “clarified the 13(c) protective arrangement issue” in the Urban Mass Transportation Act of 1970 back in the Fall of 2003, although I have no recollection of having done so), but I hadn’t started any new entries since the early days. At a recent presentation I attended by Sun’s Hal Stern, I learned that his eating club (Colonial Club) at Princeton University has a Wikipedia entry (as do all the other eating clubs). On further investigation, I learned there were no entries for any of the student cooperatives or other upperclassman eating options. To the uninitiated, it may be hard to understand why this matters beyond the insular Princeton community, but — suspend your disbelief just for a moment — the eating clubs have been called Princeton’s “peculiar institution” (a side-long reference to slavery) and have a storied and controversial history going back at least to the 1870’s (see, for example, this summary of the historical record from 1888-1993). It seemed to me that omitting the student cooperatives was akin to having a Wikipedia article on political parties that includes links to both the Republican and Democratic parties but leaves out any mention of the Green Party. Of course, the Green Party doesn’t wield the influence of either of the main parties, but its existence provides insight both into the American political system and the character of the two main parties. If no mention of the Green Party were included in Wikipedia, a foreign researcher attempting to learn about the American party system would come away with an incomplete and misleading understanding. The fact that the Green Party has not been particularly successful nationwide is, itself, interesting, useful, and relevant information. Although I wouldn’t pretend Princeton is as important or interesting as the American political system, it’s still a subject of scholarly investigation, and a topic that a fairly significant number of people are interested in learning about. I thought I would start basically a stub article for the Two Dickinson Street Co-op and spend a couple of days building it out and asking knowledgeable experts to contribute and add sources. Within a few seconds after I created the article, however, it was “speedily” deleted. A bit surprised, I tried to start an explanation as to why the entry warranted at least consideration for inclusion, and the article was deleted again and I found this message on my “talk” page:

This is your last warning.
The next time you vandalize a page, you will be blocked from editing Wikipedia. Diez2 14:55, 9 November 2006 (UTC)

I had gone from citizen to felon in two minutes flat! There then ensued several attempts to at least allow a debate on the deletion, but the article was unilaterally speedily deleted several times by several different editors. Even after one admin restored the article as not appropriate for “speedy deletion,” another admin stepped in and speedily deleted it again. I received some fairly acerbic retorts to my attempts — e.g. this: “We don’t have a page for every club in the world. If you want free web-hosting check out Myspace or usenet. Also anonymous postings do not make a topic notable or important.” (I’m not sure why he accused me of posting anonymously — I didn’t. Also, does “usenet” offer “free web-hosting?”) Finally, the deletion of the article was converted from a “speedy deletion” to a nomination as an “article for deletion” (‘AfD’), which allows at least for some discussion on the topic. The debate is ongoing — see it here — and some of the comments continue to be fairly corrosive. For example, one editor wrote:

• Strong Delete Fails WP:N, WP:V. It should be noted that on User_talk:Eagle_101 the editor of the article hs refused to give even just one reliable source of the article to assert it’s verifiability and notability. That alone should speak volumes for the article’s worth. Wizardry Dragon ^{(Talk to Me) ((My Contributions) (Page Moves) (Support Neutrality on Wikipedia)} 23:01, 10 November 2006 (UTC)

Another editor called the debate a “pointless waste of time” over a “vanity article,” although I can’t find that comment any longer. I admit that I created the article without knowing much about the process, and certainly with little understanding of the numerous acronyms, flags, and the several different ways an article can be killed. Apparently, I didn’t contest the speedy deletion properly, although it wasn’t clear to me from the deletion notice exactly what I was supposed to do, and I assumed the restoration of the article by another admin meant that it would persist for at least a few days. I thus deserve some of the blame for not doing more pre-posting diligence, but I was relying for the most part on my 2001-2002 experience where you could create an article, spend a few days improving it, invite others to contribute, etc., and articles with a colorable argument for inclusion would generally stay in. It seems the new Wikipedia is a much less kind and less gentle Wikipedia. As another participant in the process wrote to me:

This whole situation is so strange. It makes me feel like I just stumbled into somebody else’s trench warfare. The defenders of notability! I wonder how long the constant vigilance of volunteers will hold out…

Of course, a similar phenomenon has occured with many open source projects. Initially, the doors are wide open and everyone’s contributions are, if not welcome, then at least tolerated. I suppose it is a sign of Wikipedia’s success that the front gates are locked so tightly. Still, I wonder how many potential good faith contributors are now permanently alienated by an initial bad experience such as this one, and whether Wikipedia will ultimately suffer from it. Low barriers to entry have traditionally been a key element to attracting participants to peer production efforts, but they seem to break down in direct relationship to the project’s external importance. Incidentally, Stern’s edit to the Colonial Club entry, mentioning F. Scott FitzGerald’s characterization of the club, was quickly reverted by another editor as “nonsense.”

A while back, my brother's computer had issues. It would dump core of random programs, and would produce a BSOD under Windows at random times, too. Running memtest86 showed that something was wrong with the memory, so we replaced it. Unfortunately, that didn't help; so the conclusion I made was that there was something wrong with something between the processor and the RAM—the cache (L1 or L2), some data or address line degrading, or perhaps even the memory controller. In any way, that didn't matter; what mattered is fixing the issue. So we replaced the mainboard and the processor with something newer. He's now got a pretty modern mainboard, with all the interesting bits and pieces found in such a thing, and a Dual Core Pentium4 at 3.4Ghz. Occasionally, I must say that the socket 775 is pretty... weird. But I digress. Upon installing everything, I found that trying to run the system with broken memory had managed to corrupt whatever was on the hard disk; his ReiserFS superblock thought the filesystem was some incredible amount larger than it really was, and Windows would turn up a BSOD before even booting. The first was pretty easy to fix; I hit 'e' in the grub menu, added init=/bin/bash to the end of the kernel command line, and instructed some tool from the reiserfs toolkit to fix the filesystem. After that finished, and after a subsequent exec /sbin/init finished, Debian was up and running again. That took all of a few minutes. Having booted it, I proceeded to install the security updates that had accumulated for Sarge since the time his system had started to break down (which is a few months). Then I realized that I had to reconfigure the system to understand the new mainboard. Only that had already happened. Hotplug, discover, and perhaps some friends, had all done their work and there was nothing to be done anymore. Isn't that nice. The same couldn't be said for Windows. Booting from the install medium and choosing "recovery" in the install menu didn't fix things. Even reinstalling the system without formatting the hard drive didn't get us any further. The only thing we could do was to wipe the drive clean and reinstall. Windows better hardware support? My ass.

I am very passionate about open source (or free software, or whatever you want to call it) software. In one way or the other, it seems I'm always drawn back to it, whatever else I'm supposed to be working on. I get a good feeling from the community aspects of it, believe in the potential for technological benefits, and appreciate that being open is often the best way to advance the state of the art. One thing that has always been something of a mystery though, is how the whole thing works in economic terms. There is no doubt in my mind that open source works in terms of creating value, but what isn't so simple is how it sustains itself, and where it makes sense. Some people, like Richard Stallman, sustain that all software should be free. Others take a more laissez faire attitude. Aside from philosophical debates, though, there is a very pragmatic question of how it works in practice, and if the process could be made more efficient, and in which cases should one simply decide to 'go proprietary' in terms of maximizing monetary returns. In the proprietary software world, this is all rather "simple" - (well, conceptually at least - it's not actually easy for anyone). If you write some software that you then sell, and people like it, they'll buy it, which in turn gives you money that you can funnel back into improving the product. If it stinks, you won't get any money, and presumably you'll move on to something you are more qualified for. It's a pretty simple and direct feedback loop. With free software though, it gets much more complex, because there is not necessarily an economic link between users and developers, which might mean that while the software provides very real economic benefits in terms of flexibility, avoiding vendor lock in, and low costs, none of those benefits necessarily flow to the person or people who actually wrote the software. This, in turn, means that they may have to support themselves in some other way and may not be able to dedicate much time to working on the code. This system is thus 'inefficient', because there is a disconnect between the value and the person who created it. A lot of thought has been dedicated to "solving" this problem, but it doesn't seem to have a satisfying answer just yet, although there are several free software companies that clearly do function, with a variety of models. One of the original ideas about how people would live in an entirely free software based economy, proposed by Stallman, is services. In other words, the software is free, but you get money to fix it, teach people about it, improve it, provide support for it, customize it and so on. While riding my bike around the Colli Euganei the other day, it occured to me that a pure services business is a lot like running. The minute you have fewer clients, go on vacation, or otherwise ease up... revenue drops proportionately, just as if you had slowed from a run to a walk. Ease off on the effort completely, and the money is gone, because you have no way of carrying your momentum forward. With a bicycle, on the other hand, it's more like a product-based business. It's certainly still an effort, and you have to be strong to beat your competitors, however, you can stop pedaling for a moment now and then, and you do get the descents after riding up the hills, and for a few meters at least, you can stop pedaling altogether and coast. What prompted me to think about products versus services was a small web application I developed recently. It's a nice ajaxy to-do list/time-tracker that I started developing with Ruby on Rails. My first instinct, and the easiest thing to do, of course, would be to open source it and let it go at that, but... I also wonder if I could make a little bit of money at it if I were to commercialize the product somehow. Not "get rich quick" money, but enough to pay me back for the time I sunk into making it work, and enough to let me justify doing more work on it to meet people's needs and requests. A couple of strategies come to mind:

• Just open source it and be done with it.
• Sell google adsense. I don't think that would cover it though, because it's a reasonably resource intensive system.
• Sell access to an advanced version that allows group collaboration, sharing/trading of tasks, and so on.
• Sell a downloadable version that people can run locally, perhaps on an intranet.

Whatever ends up happening with it, I'll be sure to post further information as it becomes available.

I often need to do list-like operations on files in shell, for example:

• substract lines in one file from the lines in another file
• add lines from two lines, suppressing duplicates
• keep only lines which are not in both files
• keep only lines which are in both files
• etc

Such operations are easy to do with a combination of sort, uniq, cut, diff, etc. But they are so basic operations that it is a bit annoying to write the small shell script each time I need to do one of them. Isn’t there a tool out there already providing all of them ? Also, it would be great if such operations could be achieved considering only the first n characters or words (a bit like uniq -w, or the removed uniq -W option). It would be an easy way to do :

i1 c1
i2 c2
i3 c3
i4 c4

minus

i2
i4

Comments are opened. Update: many people pointed me to moreutils‘ combine. It looks good, bug not exactly what I need, so I filed wishlist bugs #398187 (combine: provide aliases for set theory operators) and #398193 (combine: allow to compare only on a subset of the lines). I won’t have time to provide patches, so if somebody want to work on them ….

There are basically two kinds of setups for mailing lists managed using Mailman, regarding posts from non-members :

• Accept posts from non-members. This lead to quite a lot of spam on the list, but also to no work for the moderators.
• Put posts from non-members in a moderation queue. This result in a spam-free mailing list, but also in a lot of work for moderators, and in posts delayed for days.

It would be great if Mailman could ask the sender for confirmation (either email-based or web-based) before accepting the mail or putting it in the moderation queue. This would greatly reduce the amount of spam on the list or in the moderation queue. This is also known as Mailman feature request #673265. A similar feature has apparently been in Sympa for nearly 4 years.

Today, I continued chasing easy apache2 bugs. The following bugs seem to be easy to fix (and should be fixed in my opinion prior to Etch).

• #396782: apache2.2-common: Upgrade adds "default" virtual host; breaks existing config: the problem is that apache2.2-common is new in any case, as we had apache2-common in sarge. One possible fix would be to detect if any site is active in /etc/apache2/sites-enabled (e.g. via find) and add the default site only if none is there at all.
• #396265: apache2: mod_proxy_ajp connection reuse bug: This problem is perhaps not specially easy, but - there is a patch upstream, and it seems to have some security impact as well.
• #395936: Apache2 SSL service stopped working since upgrade to 2.2.3-2: -D SSL went amiss when apache2 and apache2-ssl were merged - in case we can't fix that with reasonable effort, it should be documented in the etch release notes
• #391813: apache2.2-common: man page for apache2 missing in apache2.2-common: obvious fix
• #338472: apache2: Move /server-info and /server-status conf to mods-available: obvious fix, but that's a policy decision

Some more bugs were obviously outdated, so I closed them. I also started collecting information for the release notes about apache2.

I finally got myself a nice digital camera. Nice as in, it fits in a pocket, it takes reasonably good-looking pictures, ant it's not a Canon so I can access it as an USB mass storage device. (For those who care, it's a Kyocera/Contax U4R.) So I've started using F-Spot (which is tremendously cool) and Gallery a bit more intensively than previously, and I noticed something curious: my pictures had wrong times. I thought that digital cameras stored them inside the picture files... Hmm. On to investigate. Time passes as I follow the threads of the information flow (use the source, Luke). Then I scream in horror. Then I go see something I hope is authoritative and therefore likely to have been well thought-out (read the spec, Luke). Then I scream some more. Let it be widely known that the Exif specification, which is the standard for embedding metadata into image files from digital cameras, encodes the date and time of the picture as a string. A fat, ugly, 20-character string. More precisely, the format is YYYY:MM:DD HH:MM:SS. I don't have anything against strings, they are rather easy to parse by humans (as demonstrated by strings /home/roland/images/photos/contax-u4r/kicx0700.jpg head). But they should be done right. In this case, it would have made a lot of sense to enlarge that string to 26 characters and add +ZZZZ or something similar. So as to be able to encode, say, a timezone, for instance, in order to, say, have dates and times that actually mean something, instead of something that may or may not be the current time plus or minus a random number of hours and minutes. I thought I could cheat by starting F-Spot with TZ=UTC f-spot (among my electronic gadgets, those that can't cope with timezones are set to UTC, with the exception of my alarm clock). The result is bizarre: the date is shown as being one hour late. I could understand if it were two (I'm at UTC+2 these days), but where does that one come from? I suppose I'll have to cheat differently, by keeping a patched version of F-Spot that interprets the TimeDate data from Exif as UTC, instead of using the current timezone. Or maybe I could do that in my hotplug script: it already rsyncs images from the digicam to the harddisk then makes sure the digicam's memory has at least $foo megabytes of free space on the card memory. I suppose it could also fiddle with the Exif tags on the fly. Anyway. People need to learn: text without encoding information is useless, cryptography without a web of trust is useless, and date/times without timezone info is useless. If one of my esteemed readers happens to be (or know) a member of the Exif specification group (I understand it's called "JEITA"), please tell them that this needs to be fixed in a future version of the spec. I suppose I'll have to live with it with my current digicam, but maybe the next one will be better in that regard. The pictures themselves are nice, though.

One of the annoying features of reading several planets, is that you end up reading entries from people you otherwise respect, who seem to have various complexes about nonsensical issues. We all saw the month in which half of Debian decided it was cool to rip on Ubuntu, and now apparently it's the new cool thing to do if you work on Fedora.

According to a particularly obnoxious entry, the quality or otherwise of Ubuntu's kernel[0] does 'damage to the free software community'. Now, they've focussed on binary drivers. Which is fair enough: I am personally quite uncomfortable with binary drivers, and extremely unimpressed with Ubuntu's recent move towards binary drivers by default. While I respect the fact that they still encourage users to install free drivers, providing them by default is not a winning move, in my opinion. But I'm not going to discuss this further right now, because if I do, the terrorists win.

The reason the terrorists win, is because some people like to furiously handwave and make strawmen. Apparently now, everyone who's ever touched Ubuntu is rabidly for binary drivers, but the problem here is the handwave from criticism of Fedora's alleged community into yet another ramble about the kernel tree and binary drivers.

I certainly hope the Fedora community is more mature than this, both in general, and in their ability to have a constructive debate about the level of its community involvement. Right now, it is not even disputed that there is effectively none. At first glance, they may appear similar, but if you look further, the similarities vanish. Anyone can come in and get involved in the decision making in Ubuntu, but more important than that, the process is at least completely transparent, so you can see what's going on, on public lists, at every step. Fedora does not have this: decisions magically appear On High from RHEL types. This is not necessarily a bad thing, and does not necessarily result in a lower-quality distribution, but if everyone could just accept this as being true and move on, rather than bitterly baiting a successful community distribution about it, I think everyone would be a lot happier.

The biggest difference is -- yes, basically all the Ubuntu core developers are employed by Canonical. These people were handpicked from the Debian community originally, and now a great deal of them start as Ubuntu community members, and are employed by Canonical because having them work full-time on this stuff would be awesome. The process is still entirely transparent: being employed is a mark of recognition (sorry), and a request to continue working on this even more, rather than a pre-requisite to being able to do anything. Witness Fedora Core vs. Fedora Extras, for example: there are quite a few packages that non-Red Hat employees are prevented from meaningfully contributing to.

So, the summary in a nutshell: binary drivers bad (and Ubuntu moves towards promoting same even worse), Fedora 'community' not at all, handwaves bad, refusal to get involved with a meaningful debate about community governance and structure without engaging in petty mudslinging and pointless handwaves inexcusable.

(Disclaimer: I am not involved with any distributions, nor do I have any professional affiliation with them either. I'm just an irritated observer.)

[0]: I don't claim to have any insider knowledge here; the only point at which its quality or otherwise has become an issue for me lately, is a random hang in gettimeofday() in a corner case recently, which I've been too lazy to isolate and report as a proper bug; I worked around it in the X server anyway.

One issue that is rarely considered is how to deal with office break-ins for the purpose of espionage. I believe that this issue has been solved reasonably well for military systems, but many of the military solutions do not apply well to civilian systems - particularly the use of scary dudes with guns. Also most office environments don't have the budget for any serious security, so we want to improve things a bit without extra cost. Finally the police aren't interested in crimes where an office is burgled for small amounts of cash and items of minor value, it gets lost in the noise of junky burglaries, so prevention is the only option.

Having heard more information about such break-ins than I can report, I'll note a few things that can be done to improve the situation - some of which I've implemented in production.

The most obvious threat model is theft of hard drives. The solution to this is to encrypt all data on the drives. The first level of this is to simply encrypt the partitions used for data, support for this is available in Fedora Core 6 and has been in Debian for some time. The more difficult feature is encrypting the root filesystem, encrypting root means that important system files such as /etc/shadow are encrypted. Also if the root filesystem is encrypted then an attacker can't trivially subvert the system by replacing binaries. An unencrypted root filesystem on a machine that is left turned off overnight (or for which an unexpected reboot won't be treated seriously) allows an attacker to remove the drive, replace important system files and then re-install it. If the machine is booted from removable media (EG USB key) which contains the kernel and the key for decrypting the root filesystem then such attacks are not possible. Debian/unstable supports an encrypted root filesystem, but last time I tried the installer there did not appear to be any good support for booting from USB (but given the flexibility of the installer I think it's within the range of the available configuration options). I have run Fedora systems with an encrypted root filesystem for a few years, but I had to do some gross hacks that were not of a quality that would be accepted. With the recent addition of support for encrypted filesystems in Fedora it seems likely that some such patches could be accepted - I would be happy to share my work with anyone who wants to do the extra work to make it acceptable for Fedora.

Once the data is encrypted on disk the next thing you want to do is to make the machines as secure as possible. This means keeping up to date with security patches even on internal networks. I think that a viable attack method is to install a small VIA based system in the switch cabinet (no-one looks for new equipment appearing without explanation) that sniffs an internal (and therefore trusted) network and proxies it to a public network. This isn't just an issue of securing applications, it also means avoiding insecure protocols such as NFS and AoE for data that is important for your secrecy or system integrity.

An option for using NFS is to encrypt it with IPSEC or similar technology. AoE can be encrypted with cryptsetup in the same way as you encrypt hard drive partitions, it doesn't use IP so IPSEC won't work but it is a regular block device so anything that encrypts block devices will work. I have been wondering about how well replay attacks might work on an encrypted AoE or iSCSI device.

Security technologies such as SE Linux are good to have as well. An attacker who knows that a server has encrypted hard drives might try cracking it instead. A thief who has stolen a laptop and knows that it has an encrypted drive can keep it running until future vulnerabilities are discovered in any daemons that accept data from the network (of course if you have enough technology you could sniff the necessary data from the system bus and from RAM while it's running - but most attackers won't have such resources). I have considered running a program on my laptop that would shut it down if for a period of 48 hours I didn't login or un-blank the screen, that would mean that if it was stolen then the thief would have 48 hours to try and crack it.

Prevent access to some hardware that you don't need. If you allow the system to load all USB drivers then maybe a bug in such a driver could be exploited to crack it. Remember that in a default configuration USB drivers will be loaded when a device is inserted (which is under control of an attacker) and the device will use data from the attacker's hardware (data of low integrity being accessed by code that has ultimate privilege). Turning off all USB access is an option that I have implemented in the past. I have not figured out a convenient way of disabling all USB modules other than the few that I need, I have considered writing a shell script to delete the unwanted modules that I can run after upgrading my kernel package.

Once these things have been done the next issue is securing hardware. Devices to monitor keyboard presses have been used to steal passwords. The only solution I can imagine for this is to use laptops on people's desks and then store them in a safe overnight, unfortunately laptops are still quite a bit more expensive than desktop machines and consequently they are mostly used as status symbols in offices. Please let me know if you have a better idea for solving the key-logging problem.

For servers there is also a problem with keyboard sniffing. Maybe storing the server's keyboard in a safe would be a good idea.

Security monitoring systems are a good idea, unfortunately they can be extremely expensive. There has already been at least one recorded case of a webcam being used to catch a burglar. I believe that this has a lot of potential. Get a webcam server setup with some USB hubs and cameras and you can monitor a small office from all angles. When the office is empty you can have it GPG encrypt pictures and send them off-site for review in the case of burglary. You could also brick the server into a wall (or make it extremely physically secure in other ways) so that the full photo record would be available in the case of damaged phone lines, and to give more pictures than the upload bandwidth of an ADSL link would allow (512Kb/s doesn't allow uploading many pictures - no-where near the capacity of a few high-resolution web-cams).

This is just a few random thoughts, some things I've done, some things I plan to do, and some that just sound like fun. I expect comments telling me that I have missed some things. I may end up writing a series of articles on this topic.

PS I've uploaded day 32 of the beard (which was taken yesterday). Last night at a LUV meeting I was asked to stand in front of the audience to show them my beard. I had imagined that they might have seen it enough through my blog, but apparently not.

Things my PhD has taught me. Number 17 in an occasional series
How to remove a pair of fruitfly ovaries in under 10 seconds

The 5th International GPLv3 Conference will hold in Akihabara, Tokyo, Japan, Nov 21-22, 2006. I am a board member of FSIJ (The Free Software Initiative of Japan), and the organization is hosting the conference. I'm also working to prepare the conference. The most major usage of GNU/Linux is for embedded system in Japan. I think many people know "Zaurus", a linux-based PDA. And other many embedded systems are here and there in Japan. So we will discuss about embedded system and Free Software. I consider to broadcast the conference by Ogg/Vorbis and Theora, XCAST6 with vic and rat, and IRC. I hope that many people see the conference via network and directly. BTW, the blog's category is not match to the subject. I need to make other category...

Today at work, I wondered about xfs, which logged the following warnings via syslog: xfs xfs: ignoring font path element /usr/lib/X11/fonts/cyrillic/ (unreadable)
xfs xfs: ignoring font path element /usr/lib/X11/fonts/CID (unreadable) After investigation, I found them to be configured in /etc/X11/fs/config, which look sane even though those paths don’t exist. However, searching through all the Debian packages available to my system (which include several non-free repositories), I was only able to find one package providing fonts in …/fonts/cyrillic, but none providing fonts in …/fonts/CID. I would be interested to know why that path was included in the default search path for xfs. Not even the evil msttcorefonts package installs any fonts in that path. Could anyone refer to anything that uses (or used) that path? Granted, x-ttcidfont-conf refers to CID fonts, but no other package seems to mention them, so why is that path in the default config? I admit I’m quite puzzled.

I’ve been working on archive rebuilds lately (rebuilding all etch packages inside etch). It generates a lot of data to analyze (failed build logs), and the work could easily be split between several developers. For each package which fails to build, I add a line in a Gnumeric spreadsheet with the package name, the version I tried to build, the output of a script which tries to guess the reason for the failure using regexps, and the “resolution” (was a bug filed ? a new package not yet in testing ?) (example here) Instead of doing this locally in Gnumeric, I’d like to do that online, using wiki-like editing, so other people could investigate different failures concurrently. My ideal piece of software would:

• be efficient to use (something AJAX based would be great)
• allow for line-based locking, so people can just lock the line they are working on
• allow for CSV-export/import, so I could fetch the whole data, add new failures using a script, and import it back

Does this exist ?

Kiss or diss, a rather spontaneous project of a few friends of mine and I, has officially launched. It basically works like famous Hot or Not, except we're doing video, have a much better user interface and are also trendier. Hot or not is so... web 1.0 :-) You get to see girls and boys (choice is up to you) trying to impress you (or more likely making fool of themselves). To continue to the next video, vote on them. Really simple, but quite addictive because of the contents. There are lots of videos with people dancing. There are some pretty good singers inbetween. If you don't filter out males, you'll occassionally get some nice guitar playing... There is a certain amount of Ajax in it already, more web 2.0 goodness to come. Tags and such. Ajax is quite useful here, because you can comment or share a video without the page reloading - and thus the flash movie restarting. Definitely a plus in user experience. And since you need flash, your browser should have javascript anyway. There is no way we'll do a Lynx version with aalib, sorry. :-) P.S. Not all of these videos are "safe for work". Youtube does delete quite some videos, so they all should be okay (though still maybe "inappropriate"), but YMMV. Don't blame us if you get into trouble for watching videos at work. Do it in your lunch break or so. :-) P.P.S. And don't blame us for wasted hours watching stupid videos, either!