Search Results: "swan"

9 July 2013

Daniel Pocock: Enabling Elliptic Curve Cryptography in OpenWRT and strongSwan VPNs

OpenWRT currently ships an OpenSSL package with Elliptic Curve Cryptography (ECC) disabled. This is very inconvenient as ECC is now standard in other distributions like Debian and Ubuntu and it is necessary to solve certain problems such as making IPsec VPNs work reliably It is relatively easy to enable it, this also provides a useful opportunity to see how the OpenWRT build system works. Preparing the build environment The build was done on a Debian 7 (wheezy) workstation. It is necessary to install some packages that provide tools needed for the build:
apt-get install gcc binutils flex make unzip gawk libz-dev linux-libc-dev
Rebuild the OpenSSL and StrongSwan packages This was tested with an ar71xx CPU-based router. You can easily change the config (run make menuconfig just before make defconfig) for other variations of router.
Running strongSwan IPsec on a router requires a router with plenty of flash, RAM and CPU power. Cheap routers with limited flash will not be able to install the packages at all. I tested on the Buffalo WZR-HP-AG300H-EU which has 32MB flash and 128MB RAM Here are the commands executed on the Debian build workstation:
mkdir ~/ws
cd ~/ws
svn checkout svn://svn.openwrt.org/openwrt/trunk openwrt-trunk
cd openwrt-trunk
./scripts/feeds update -a
./scripts/feeds install -a
wget -O .config \
  http://danielpocock.com/sites/danielpocock.com/files/openwrt.config.txt
sed -i -e 's/no-ec//' package/libs/openssl/Makefile 
make defconfig
make -j 13
The "make" command will build all the packages. It takes some time. Copy the packages to a router The actual location of the packages in your source tree depends on the CPU architecture you chose to build for. You can find them with a command such as:
find . -name '*.ipk'
Here we look at how to copy the packages for the ar71xx based router into the /tmp directory on the router. The router IP is 192.168.1.1 below:
cd ./bin/ar71xx/packages/
scp libopenssl_1.0.1e-1_ar71xx.ipk strongswan*.ipk root@192.168.1.1:/tmp
Installing the packages It is relatively easy to install the packages using the opkg utility on OpenWRT. When using self-compiled packages, you are likely to get errors about the checksums. OpenWRT compares the checksum of the package to the checksum from the package catalog file. You can delete the catalog file (e.g. rm /var/opkg-lists/attitude_adjustment) and then opkg will install the package without complaining. The file is automatically placed there each time you run opkg update so there is no harm in deleting it. In my earlier blog, I looked at how to link Android clients to the strongSwan VPN. Unfortunately Android has a bug in ECC support too and must still be used with RSA certificates. Nonetheless, the OpenWRT VPN will be quite happy talking to Linux laptops and servers - you may need to rebuild OpenSSL and StrongSwan on any Fedora, Red Hat or CentOS systems that require ECC support too. As you migrate from RSA to ECC certificates it is quite feasible to have both types of certificates in use at the same time. strongSwan supports this type of hybrid environment. To make the migration to ECC go smoothly it is desirable to ensure all boxes have ECC support at the earliest opportunity.

25 June 2013

Daniel Pocock: Configuring strongSwan on Debian, RHEL and Fedora with the Android client

In my earlier blog post about VPNs, I looked at a range of VPN options. The strongSwan wiki documentation is generally quite good but it doesn't describe the exact procedure for an Android user anywhere. This blog aims to fill that gap. Here I am sharing some working examples of how to configure and use RSA certificate authentication between a Linux box and an Android phone using strongSwan. There are several commands to execute for each step, but they can be easily scripted. Here are the versions in play: Certificate creation: private certificate authority "example.org CA root" For production, I would highly recommend creating your own root CA on a smart card and managing it from a clean machine without any network connection. To start quickly for testing, just create a CA using the steps from the strongSwan wiki, in particular:
umask 0177
ipsec pki --gen > caKey.der
ipsec pki --self --in caKey.der \
   --dn "C=CH, O=Acme Ltd, CN=example.org CA root" \
   --ca > caCert.der
Certificate creation: VPN gateway machine vpn.example.org Now you need to create a key for the server. The key thing to observe here is the use of the "--san" argument: the Android client expects a subjectAltName in the certificate from the server. The VPN gateway has the hostname vpn.example.org:
ipsec pki --gen > vpnKey.der
ipsec pki --pub --in vpnKey.der   \
   ipsec pki --issue --cacert caCert.der --cakey caKey.der \
  --dn 'CN=vpn.example.org' \
  --san vpn.example.org > vpnCert.der 
cp vpnKey.der /etc/ipsec.d/private/
cp vpnCert.der /etc/ipsec.d/certs/
Certificate creation: mobile user For the Android client, it is necessary to create a private key and certificate and then embed them together with a copy of the root certificate in a PKCS#12 file. We will need OpenSSL or GnuTLS for some of these steps. The pkcs12 command will prompt for a password: make up a long, obscure password, you will only use it once when importing the certificate into the phone. Here is a script you can use for each client certificate you want to create:
#!/bin/bash -e
umask 0177
TARGET_HOST=$1
DOMAIN=example.org
IPSEC=/usr/sbin/ipsec
KEY_FILE="$ TARGET_HOST Key.der"
CRT_FILE="$ TARGET_HOST Cert.der"
if [ -f $ KEY_FILE  ];
then
  echo "$KEY_FILE exists"
  exit 1
fi
$ IPSEC  pki --gen > $ KEY_FILE  
$ IPSEC  pki --pub --in  $ KEY_FILE    \
  $ IPSEC  pki --issue \
  --cacert caCert.der --cakey caKey.der \
  --dn "CN=$ TARGET_HOST .$ DOMAIN " > $ CRT_FILE 
[ -f caCert.pem ]   \
   openssl x509 -in caCert.der -inform der -out caCert.pem -outform pem
openssl rsa \
   -in $ KEY_FILE  -out $ TARGET_HOST Key.pem -inform der
openssl x509 \
   -in $ CRT_FILE  -inform der \
   -out $ TARGET_HOST Cert.pem -outform pem
openssl pkcs12 \
   -export \
   -in $ TARGET_HOST Cert.pem \
   -inkey $ TARGET_HOST Key.pem \
   -certfile caCert.pem \
   -out $ TARGET_HOST .p12
# delete the key files, leaving only the key in the p12 file:
rm $ KEY_FILE  $ TARGET_HOST Key.pem
Assuming you call that script make-client-creds, you would run it once for each Android device:
$ ./make-client-creds phone1
$ ./make-client-creds phone2
...
Loading the PKCS#12 file into the phone Copy the cert bundle (the p12 file only) to the SD card in the phone. You can mount the phone over USB or using ADB, e.g.
$ adb push phone1.p12 /sdcard/
Now go to the Android settings, select Security and Install from SD card. Follow the prompts. Setting up the VPN gateway Add the following line to /etc/ipsec.secrets
: RSA vpnKey.der
and add a stanza like the following to /etc/ipsec.conf
conn private-droid
	left=vpn.example.org
	leftsubnet=insert gateway IP here/32
	leftcert=vpnCert.der
	leftid=@vpn.example.org
	leftfirewall=no
	lefthostaccess=no
	right=%any
	rightsourceip=192.168.10.0/24
	auto=add
Finally, restart ipsec and you should be ready.
# service ipsec restart
Install the app on the phone Finally, install the app on the phone. This bit should be quite easy. Once installed, press the option ADD VPN, put in the DNS name of the VPN gateway (must match the name in the certificate, e.g. vpn.example.org from the example above) and tell it to use IKEv2 Certificate as the authentication type. Press to select a certificate and highlight the certificate that you installed earlier. Checking for problems You should see a message on the phone telling you it is connected to the VPN. If it fails, it will let you see the log messages. If you see the error Constraint check failed it often means that the subjectAltName was not included in the VPN gateway's certificate (see the steps above) or the DNS name doesn't match the name in the certificate. On the server side, this command shows who is connected:
# ipsec status
Making it secure with iptables Once the packets are decrypted by strongSwan on the VPN gateway, the kernel will route them appropriately just like any other packet. Use standard Linux netfilter/iptables rules to ensure that routing is restricted appropriately so that the clients can access the services they need and nothing else. Support and discussion Please feel free to post comments below or discuss on the strongSwan Users mailing list

24 June 2013

Daniel Pocock: Private WANs may be less secure than VPNs

The latest round of Snowden revelations concern a British GCHQ program dubbed "Mastering the Internet (MTI)". The program involves, among other things, tapping the world's under-sea fibre-optic cables and systematically monitoring all communications. One of the most significant facts that appears is the benefit of using IPsec and VPNs over the public Internet instead of trusting un-encrypted traffic to pass over private WAN connections. The definition of a private WAN connection is quite broad: many ISPs in the UK, for example, use the British Telecom OpenReach platform to tunnel DSL connections back to their data centers and offer virtual WANs to their business customers. Can any wifi be trusted? It should be assumed that all Wifi networks can be compromised at-will by a sophisticated attacker. This is another situation where VPNs may be part of the solution: even WPA2 secured wifi segments should be treated as untrusted public Internet networks and not bridged or routed onto any private subnets. Users with devices on a wifi network should be forced to use a VPN over wifi connection, even when the wifi is within the same building as the private network. Tor may be compromised by an attacker with this much data As I've mentioned in previous blogs with a focus on real-time communications there is no such thing as perfect privacy. Simply encrypting data with IPsec does not prevent the attacker knowing the volume of data transmitted or the time it was transmitted. Using a service like Tor for onion-routing provides some benefit. However, an attacker with sufficient infiltration of many points in the network may be able to deduce the real origins of a data transfer over Tor using some combination of packet sizes and timestamps. "Mastering the Internet (MTI)" may have sufficient coverage to achieve that. Tor could overcome this by putting dummy data into the network and adding fragmentation, but such schemes may add latency, reduce throughput and require significant effort to upgrade existing users. Gaining intelligence from encrypted data VoIP signals are typically compressed using some type of codec. These are dedicated, lossy compression schemes optimised for voice signals. Some codecs use a fixed compression ratio. Other codecs use a variable compression ratio (VBR): a simple example involves sending shorter packets to indicate a period of silence. Encrypting these packets prevents an attacker seeing what is inside them but the attacker can easily detect the lengths of the packets. Researchers have demonstrated that statistical techniques can be applied to VBR dataflows to identify syllables used in speech and then make a hypothesis about what has been said. (This would be an interesting hack to try and reproduce by collecting data with tcpdump and analysing it with R) Identifying phrases in encrypted VoIP using statistical analysis In many cases like those described, it is necessary to go beyond default encryption settings and put extra dummy data or frame padding into the data flow to gain a more fool-proof level of privacy. Simply connecting VoIP phones to an IPsec network doesn't automatically make them secure. The rise of the free-software VPN Even if the default configurations are not always universally resilient to every type of attack, many free software prodcuts provide an excellent building block for VPNs. Having the source code and specifications on hand, free software developers can then innovate to mix-and-match different technologies or add random data flows to mask the real activity on the network. In a recent hosting migration project, I successfully used the rather trivial VPN package tinc to bridge the ethernet segments between virtual machines in the old and new networks. This allowed virtual machines to be moved one-by-one over a period of a week. This is a remarkably simple solution that can protect the integrity of communications on a private subnet. A more comprehensive solution is strongSwan which provides support for industry-standard IPsec in various topologies. They now offer a full IPsec client for Android phones (hopefully it will be made available on f-droid: using a Google account to access Google Play may result in Google accidentally helping you "back up" your settings, including credentials, to their cloud, undermining the privacy of the system) An IPsec VPN can be deployed to all hosts on a network: then they can use opportunistic encryption for any type of communication without needing to worry about the underlying network. Furthermore, it is possible to add smart cards to further boost VPN security while using free software for the whole solution. For those interested in looking beyond Linux solutions, the *BSD range of operating systems, particularly OpenBSD provide a compelling alternative. This paper about OpenBSD's iked, which is also available on other platforms as OpenIKEd is very recent and provides a thorough overview of it's current status. One notable limitation is that their MOBIKE support is not yet complete. Many older VPNs likely to need an ugprade When I first started deploying Linux VPNs in the 90s the market was favourable for any type of Linux VPN. In extreme cases (which were surprisingly common at the time) companies accustomed to paying $20,000 per month for a leased line would happily pay a flat fee of $100,000 to purchase a VPN that was cobbled together using less than $10,000 of commodity hardware and some free software. Many of the first generation of these VPNs were built using RSA key lengths and algorithms no longer considered secure, such as DES. Some of these solutions (or products derived from them) may still remain in use today: managers may be slightly embarrassed to put aside their $100,000 VPN and replace it with a $50 router that is more secure. While that is the more extreme example, there are many intermediate solutions out there in the field. There are clear opportunities here to upgrade users to free software solutions.

12 January 2013

Russ Allbery: Review: Asimov's, April/May 2011

Review: Asimov's Science Fiction, April/May 2011
Editor: Sheila Williams
Issue: Volume 35, No. 4 & 5
ISSN: 1065-2698
Pages: 192
Williams's editorial this issue is about the tendency of SF to take a rose-colored view of the world, which on the surface seems odd given the tendency of recent SF towards dystopia. But she makes a good point that the portrayal of the past is rose-colored, linking that into the current steampunk trend. She doesn't take the argument quite as far as I'd like, but I'm glad to see editorials raising points like this. I'm inclined to think that a lot of the rose-colored frame of the past is because few of us want to read about real historic conditions at any length, even for edification, because the stench and discomfort isn't fun to read about. Silverberg's column is another discussion of programmatic plot generators, which mostly makes the point that plot ideas are the easy part of writing. James Gunn contributes an extended biography of Isaac Asimov that probably won't be new to long-time genre readers but may fill in some details (although it politely sticks to mostly flattering material). Spinrad's book review column is one of his better ones; it looks at two novels by China Mi ville and two by Ian McDonald and explores differences in world-building. Spinrad predictably makes the case in favor of science fiction with rules and against the New Weird, but the discussion along the way was worth reading. "The Day the Wires Came Down" by Alexander Jablokov: Speaking of steampunk, here's an example. There is even an airship, although the primary technological focus is suspended street cars. Jablokov postulates a city-wide transportation network of suspended carriages called telpher cars, along with a city built around the telpher cables: stores on roofs, windows displaying merchandise to passing cars, and even a history of heated competition and dirty tricks between competing telpher networks. The story is set, as the title would indicate, on the last day of the network. It's being shut down for cost, with some hints that progress is destroying something precious. There is a plot here, revolving around some mysteries of the history of the telpher network and the roles of several people in that history. But the story is primarily a celebration of old technology. It's a rail fan's story recast with a steampunk technology, featuring the same mix of fascination with mechanics and a sense that the intricate details are falling out of common knowledge (and perhaps usefulness). As a story, it's a bit slow-moving, but I enjoyed the elegiac tone. (7) "An Empty House with Many Doors" by Michael Swanwick: This is a very short story, more of an emotional profile, involving a man's reaction to the death of his wife. Oh, and parallel universes. It's sort of the inverse of Niven's classic "All the Myriad Ways." Similar to Niven's story, I found the idea vaguely interesting but the conclusion and emotional reaction unbelievable and alien. (5) "The Homecoming" by Mike Resnick: Resnick tends to yank on the heart-strings rather sharply in his stories, so I knew roughly what to expect when a father comes home to find his son is visiting. A son who, rather against his father's wishes, has been significantly altered to be able to live with aliens. Throw in a mother with serious dementia, and you can probably predict what Resnick does with this. Still, most of the story is a two-sided conversation, and I thought he succeeded in doing justice to both sides, even though one of them was destined to lose. (6) "North Shore Friday" by Nick Mamatas: Illegal Greek immigrants, a family-run system for getting them married off before the INS catch them, government psi probes and eavesdropping on thoughts, joint projects between computer and religion departments, secret government experiments, and even ghosts... this story is a complex mess, with numerous thoughts stuck into small boxes and scattered through the surface story. It's one of those stories where figuring out what's going on, and even how to read the story in a sensible way, is much of the fun. If you find that fun, that is; if not, it will probably be frustrating. I wished there was a bit more plot, but there's something delightful about how much stuff Mamatas packs into it. (6) "Clockworks" by William Preston: This is a prequel to Preston's earlier "Helping Them Take the Old Man Down". Like that story, it's primarily a pulp adventure, but layered with another level of analysis and thoughtfulness that tries to embed the pulp adventure in our understanding of human behavior and the nature of the world, although this one stays a bit more pulp than its predecessor. As with Preston's other story, we don't get directly in the head of the Old Man (here, just called the man, but identifiable from clues in both stories as Doc Savage); instead, the protagonist is a former villain named Simon Lukic who the man hopes to have fixed by operating on his brain. The undercurrent that lies beneath a more typical pulp adventure is the question of whether Lukic is actually healed. I think there was a bit too much daring-do and human perfection, but it's a perfectly servicable pulp story with some depth. (6) "The Fnoor Hen" by Rudy Rucker: If you've read any of Rucker's work before, you probably know what to expect: a mind-boggling blizzard of mathematically-inspired technobabble that turns into vaguely coherent surrealism. (You can probably tell that I'm not much of a fan, although the clear good humor in these stories makes it hard to dislike them too much.) There's a mutated chicken and some sort of alternate mathematical space and then something that seems like magic... I'd be lying if I said that I followed this story. If you like Rucker, this seems like the sort of thing that you'd like. (4) "Smoke City" by Christopher Barzak: At the start of this story, I thought it was going to be an emotional parable about immigration. The progatonist lives two lives: one in our world, and one in the Smoke City of industry, a world of hard labor, pollution, and little reward, with families in both. But nearly all of the story is set within Smoke City, and the parable turns out to be a caustic indictment of industry and its exploitation of labor. I kind of wish Barzak hadn't used rape as a metaphor, but when the captains of industry show up, I can't argue with how deeply and accurately the story shoves in the knife. There isn't much subtlety here, but it's still one of the better stories in this issue. (7) "A Response from EST17" by Tom Purdom: I'm very happy to see Purdom's writing appearing regularly. His stories are always quiet and matter-of-fact, and at first seem to miss emotional zest, but they almost always grow on me. He lets the reader fill in their own emotional reactions to events, and there's always a lot going on. This story is a first-contact story, except that the "humans" here are not human at all. They're automated probes sent by two separate human civilizations, with different programming and different governance algorithms, and they quickly start competing negotiations. The aliens they've discovered similarly have factions, who start talking to the different probes in an elaborate dance of gathering information without giving too much away. The twist is that this pattern has replayed itself many times in the past, and information itself can be a weapon. I enjoyed this one from start to finish. (7) "The One That Got Away" by Esther M. Friesner: Friesner is best known, at least to me, for humorous fantasy, and this story is advertised as such from early on. The first-person protagonist is a prostitute in a seaside town. She's bemused to finally be invited over by a sailor who's been eyeing her all evening, but that sailor has something else in mind than normal business. For much of this story, the fantasy element is unclear; when it finally comes, it was an amusing twist. (7) "The Flow and Dream" by Jack Skillingstead: This is a mildly interesting variation on the old SF story of hibernating humans (on a generation ship or elsewhere) waking up to a transformed world. Here, it's not a ship, it's a planet, and the hiberation was to wait for terraforming rather than for transit. The twist comes from an excessively literal computer and the fun of putting together the pieces. Sadly, the story trails off at the end without much new to say. (5) "Becalmed" by Kristine Kathryn Rusch: "Becalmed" takes place immediately before "Becoming One with the Ghosts" and explains the incident that created the situation explored in that story. The first-person protagonist of "Becalmed" is a linguist, an expert in learning alien languages so that the Fleet can understand the civilizations that it runs across. But something went horribly wrong at their last stop, something that she's largely suppressed, and now she's confined to quarters and possibly in deep trouble. As is the ship; they're in foldspace, and they have been for days. "Becalmed" is structed like a mystery, centered around recovering the protagonist's memories. It's also a bit of a legal procedural; the ship is trying to determine what to do with her and to what degree she's responsible. But the heart of the story is a linguistic and cultural puzzle. This is another great SF story from Rusch, whose name on a cover will make me eager to start reading a new magazine. I love both angles on the universe she's built, but I think I like the Fleet even better than the divers. The Fleet captures some of the magic of the original Star Trek, but with much more mature characters, more believable situations, and a more sensible and nuanced version of the Prime Directive. Rusch writes substantial, interesting plots that hold my interest. I'd love to see more like this. (8) Rating: 7 out of 10

22 October 2012

Yves-Alexis Perez: Debian, Xfce 4.10 and Xfce 4.11

It's been six months since Xfce 4.10 has been released. And it's been four months since Wheezy is frozen. Due to this timing (and the fact Squeeze has 4.6 and doing a 4.6 4.10 upgrade needed some tuning in various packages), it was decided to not try to push 4.10 into Wheezy that late in the release cycle. So Xfce 4.10 was uploaded to experimental instead, and as it needs a full rebuild of all panel plugins against 4.10 panel (another reason for not trying to push it to Wheezy), those have not been uploaded. You can try Xfce 4.10 using experimental, but you'll need to remove the xfce4-goodies metapackage and the various depending plugin (since they'll just crash if you try to load them on 4.10 panel). Multiple people asked me (either on IRC, by private or public mail) when 4.10 will be uploaded to unstable and transition to testing. Like last time, the answer is : not before Wheezy is released. Right now, we're more interested in stabilizing Wheezy and squashing the bugs there than adding new ones in unstable. So, if you want to have Xfce 4.10 in Debian sid/testing sooner, then the easiest and fastest way is to fix some release critical bugs so we can release sooner, and then start breaking sid by uploading a whole lot of new stuff there. Note that this is true also for other software like GNOME, KDE stack (I have no idea how to call it these days), the Linux kernel, strongswan or whatever. About development releases of Xfce 4.11 (like the recently released exo 0.9 and Thunar 1.5), well, since we already use experimental for 4.10, there's not much chance they get uploaded anytime soon. We could try to package them and let people build it themselves, or I could host it somewhere on my server for people to try. But as I already said, we're more interested in fixing bug in Wheezy right now, and people interested in finding bugs in Xfce development releases (so they are fixed for the final one) should build it themselves and report everything they find on the Xfce bugzilla. TL;DR: if you care about new, shiny stuff, please help fixing RC bugs in Wheezy.

16 October 2012

David Welton: The Dreaded Google Lockdown

It's one of those things that you read about, but are never really sure about: you think "maybe he was doing something fishy, and isn't tellling it straight in the public account of the incident". So I'll try to stick to "just the facts". A few weeks ago, I dug up some old book reviews I'd done, and posted to Facebook, and opened a site here: http://davids-book-reviews.blogspot.com/ as a way of collecting them. Naturally, I also added Amazon referral links, because, hey, it helps feed my reading habit! Last month I got enough to buy two whole Kindle books, so we're not exactly talking about "get rich quick" territory here. We're not even talking about anything remotely close to my day job, for that matter. But hey, if I can get a little bit extra to spend on books, it's nice. The reviews were basically quick notes on books I read. Nothing that I or the rest of humanity can't get along without, but I felt like writing up a little something for myself and people I know on the internet - maybe it'll help someone else find an interesting book to read. Several days later, I believe on October 8th, I woke up to find my phone was 'not signed in to Google', and, after repeated attempts, wouldn't sign in. Same thing with my Nexus 7. Logging in to my computer, in something of a cold sweat at this point, I find I can't get into Gmail or anything else, either. Luckily, on the computer, Google's system did redirect me to a page where they mentioned suspicious activity, and gave me the chance to reactivate things by sending an SMS to my phone. This did work quickly, and did a little bit to alleviate some of my stress. I understand that locking things down quickly is probably to my benefit as well as theirs in the event of an actual security breach of someone's account: it keeps the attacker from doing any more damage. However, it was sure a bad way to start a Monday morning. However, the actual 'blog' (sorry, I hate the word!) was still blocked. It too has a form to fill out to prove that you're human. Although: as a computer guy, you'd think that with all the clever people at Google, they would be able to tell from my access patterns to the site, browser footprint, IP addresses and so forth, that...well, I am me. In any event though, they promised to review the blog within two days. So, I waited patiently. A week later, still nothing. Then, the next day, I went back to check on the status, and they had reset the review request: it no longer said anything about October 8th, when I had originally made the reinstatement request. So I filled in their form again, asking to have my blog back. That was yesterday, we'll see what happens next. As far as I can tell, I did not violate their actual terms of conditions, which say nothing about referral links: http://www.blogger.com/content.g Since the people at Google are loth to speak with their users directly, it seems as if one of the best ways of getting support is to complain loudly and publicly about this kind of shennanigan. And to forestall the somewhat inevitable comments on anything related to Google: 1) Yes, I know I signed an agreement where they say they can do whatever the hell they want and I can f**k off if I don't like it. Try and do anything on line with a major company and not get a contract like that, or for even more entertainment value, try and negotiate the contract with t he company. Good luck. If you don't say yes, you're pretty much on your own; there doesn't seem to be much of a market for "more humane terms and conditions" out there. 2) I know, I know, relying on the Google beast is a great way to set yourself up for a big fall if anything ever goes wrong, because it's impossible to appeal, or pretty much even to talk with a human. But with a limited amount of time in my life, to date, Google has been a pretty good deal. I suppose it's something of a "black swan" situation: everything seems fine until one day WHACK, and Google pulls the carpet from under your legs. Conclusions? Well, I hope someone out there can help me recover my content. I wrote it myself, and I would like to save my book reviews somewhere. What alternatives are there to the Google colossus? Not too many that I can see that are anywhere at all as convenient. Edit: 2012-10-17: I don't know what did it, but they have reinstated the site. Strange and disconcerting, but I guess things are ok for the time being. Thanks to whoever it was at Google that finally had a look.

17 June 2012

Gregor Herrmann: RC bugs 2012/24

here's my weekly list of RC bugs that I've worked on:

28 April 2012

Russell Coker: Nando s Voucher Interpretation

Every year my parents buy a book of vouchers for various businesses in Victoria. It s one of those deals where businesses (mostly restaurants) pay for advertising space to have their tear-off vouchers in the book (which typically allow a discount of between $5 and $30) and the customers buy the book for something like $40 (I m not really sure as I don t pay). Every year I take my pick of the vouchers that don t suit my parents, the Nando s chain of chicken and chips restaurants that specialises in Peri-Peri spicy sauce [1] is one that doesn t suit my parents (they prefer the traditional English-Australian food). The Nando s vouchers say Enjoy one complimentary 1/4 flame-grilled peri-peri chicken item when another 1/4 flame-grilled peri-peri chicken item is purchased with no explanation of exactly what an item is. Every Nando s store that I ve been to in the past has interpreted item as chicken and chips, usually they include the drink that comes with the quarter chicken meal in the item that is free. I can do without a second soda as it s really cheap from the supermarket and I m not going to drink two at one meal anyway so I m not bothered when someone interprets the voucher as not involving a free drink. But the lack of chips is annoying. At the Nando s store on Swanston St between La Trobe St and Little Lonsdale St they interpret item as being just the 1/4 chicken. I think that most people would regard this as an unusual interpretation. If the intent was to only offer 1/4 chicken then the voucher could have stated that a free 1/4 chicken was offered and removed all doubt. The fact that the voucher says a free 1/4 flame-grilled peri-peri chicken item instead of offering a free Quarter Chicken (which is the description for chicken on it s own on the Nandos menus) seems to be a reasonable indication that more than just the free chicken is offered. I won t be attending the Nandos store on Swanston St again and recommend that others avoid it too. Failing to offer the full value on the voucher is annoying, it decreases the value for money (which is a problem given how expensive Nandos is), and it makes me wonder what other cost-saving measures might be used at that store. I ve got a stack of vouchers (many of which will expire before being used) and the Melbourne CBD has many places to eat. No related posts.

23 October 2011

Andrew Pollock: [life] Miss Representation

A few months after Zoe was born, it hit me that we didn't just have to raise a baby to grow up happy and healthy, we were raising a girl, and had to worry about making sure she had a healthy self-image and mind as well, and having to worry about how the world she was coming into was going to have an impact on that. I think it might have been around the time that I became aware of the book Cinderella Ate My Daughter that I had this realisation. I started taking more of an interest in, what I guess I'd call feminist issues. I became a seed funder for the Ada Initiative, and I tend to prick my ears up when I hear about feminist issues. So when an email went by on the parents list at work about a screening of an independent documentary film called Miss Representation, I watched the trailer, and since I'm currently swanning around sans wife and child, ponied up the $10 to go and see a screening of it in Palo Alto, which was followed by a Q&A session with the writer/director/producer. I basically went along on the strength of the trailer, and being a father of a daughter, and didn't do much more reading into the who the writer/director/producer was. It turns out that Jennifer Siebel is Gavin Newsom's wife. I didn't figure that out until I got home and did my homework, so some of the references she made in the conversation after the screening didn't make a lot of sense to me at the time. The documentary itself was very poignant, but I found that after about 40 or 50 minutes, I felt that the point was made, and I would have preferred to see more about what to do about it. But I guess what to do about it is to be aware of the problem. I had some trouble accepting the statistic quoted at the beginning of the film that the average teenager spends more than 10 hours each day consuming media. If they sleep for 8 hours, and go to school for 6 hours, that means they're spending every other waking minute consuming media, and I just don't buy that. Apparently Jennifer is working on a couple of related follow-up documentaries, so it'll be interesting to see what they're about and what they're like, and how they're presented to the viewing public. One of the things that disappointed me a bit was this film doesn't look like it's going to do any sort of mainstream theatre run. I'm not sure why, but it seems like the way they're going is for more of a grassroots, small screening thing, possibly as a way of trying to get it added to (I presume private) school curricula. It is getting a couple of showings on Oprah Winfrey's cable channel OWN, but that doesn't seem like enough to me. I think it'd really cause people to sit up and take notice if it got half-decent box office numbers and a bit more press coverage as a result. It's the kind of thing I could see going viral if it gets more exposure. The other thing that really disappointed me was the lack of men in the audience. I think I could have counted on both hands the number of men there. But I have to say that I wouldn't have heard about it (yet, anyway) if it weren't for that email that went by on the mailing list at work, so maybe it just doesn't have much of a profile yet. I view this documentary in the same calibre as Super Size Me, or anything that Michael Moore has put out. It's a documentary trying to highlight an issue with American culture. It should get as widespread a viewing as possible to get the conversation going. Instead, as best I can tell, there's two DVDs billed as "educational material", with what I consider prohibitive pricetags. I want to purchase a copy of the film for posterity (if nothing more, it'll be interesting to show Zoe a snapshot of American culture from around when she was born), but I'd also like to get my hands on the age-appropriate educational stuff so that I can use it with Zoe. The likelihood of Zoe going to a school that incorporates the material into its curriculum is slim (she'll be educated in Australia), so I'd really like to be able to use it at home. I'll end with this thought provoking article that also did the rounds of the parents list at work a few months ago.

17 August 2011

Joey Hess: summer trips wrapup

Finally back from a solid month away. For the past three days I've been coding, which feels good after all that time away.

4 February 2011

Marco d'Itri: Being an early adopter

This object from the old 6bone whois database is the earliest trace I could find of my IPv6-related activities:
inet6num:     3FFE:1001:210::/48
netname:      ILSWAN-NET-6BONE
descr:        Italian Linux Society geographically dispersed test network
country:      IT
admin-c:      MDI-RIPE
tech-c:       MDI-RIPE
rev-srv:      attila.bofh.it
rev-srv:      spock.linux.it
mnt-by:       MNT-ILS-6BONE
changed:      md@linux.it 20000530
changed:      md@linux.it 20010123
source:       6BONE

4 January 2011

Gregor Herrmann: RC bugs 2010/50 - 2010/52

the release team has started to usertag [0] the remaining RC bugs yeah, another step towards the release!

here are my small contributions around RC bugs: [0] if I got it right: update: all tags combined: http://tinyurl.com/squeeze-sort (thanks to the RT for the URL & to zack for the pointer)

3 November 2010

Scott Kitterman: Liquor and Guessing

Those of us who work in technical areas like to believe that because we are engaging in technical endeavors rather than social endeavors, our work is defined and predictable. This hints that we know the future. I think Scott Adams captured the thought well:
We should not be so cocky. While the technical world is more structured and predictable than other areas, it has its limits too. One can only see so far down into complexity before predictability is lost in the detail. That s where we get so called Heisenbugs . Looking out to the future we can only see so far as well. Recently I ve been reading The Black Swan. It is a useful reminder that the future isn t as linear and predictable as we d like to pretend it is. One idea that has stuck in my head is the idea that in order to take something into account that one will know in the future in one s predictions, one must already know it. There is an inherent limit to how far we can see. How is this relevant to distribution developers? Each time we set off to develop a new release, we make an assessment of how to best expend the available resources (our own, our company s, our group of people we can talk into doing stuff) to make things better . We do the best we can, but we must always be mindful of the fact that we press forward using our best engineering judgement, but as we look into the future, eventually this is all just liquor and guessing too.

Andrew McMillan: Something a little different

During my recent trip to Massachusetts for CalConnect XIX I passed back via New York, surfing a few nights on the couch at the Washington Cube Garden1. This was just enough time for my new Davis VantagePro2 to arrive by UPS ground (phew!) causing me much consternation, as the box was about twice as wide as I expected it to be. On opening it I discovered that the reason for the size was the physical dimensions of the rain gauge, leading me to realise that I had actually bought exactly what I wanted: a high quality weather station. Also leading me to wonder how the hell I was going to get it halfway around the world with me the next day. Unfortunately that extra wide carrying case was in no way going to fit inside my suitcase. Fortunately it came with a handle. And those wonderful people at Air New Zealand gave me a Koru Gold upgrade for a 50th birthday present, so it was time to put it to the test... Travelling on the subway out to JFK was it's own little adventure, but I made it out to terminal 5 and wandered around a bit before concluding I needed to be in terminal 7. Once I was in the right place I found the fancy people's check in counter and the nice lady there was only too happy for me to carry it to New Zealand, though she did aver that perhaps the security scanners would be dubious. Not a hitch there though: I guess they're used to letting everything through that's not specifically denied, so weather stations are fine because nobody would be silly enough to even think of doing that... Being Koru Gold really helped at this point though, because it enabled me to queue jump use the priority boarding line when getting onto the plane, and every airline in the US seems to have gone all-out for this "checked baggage costs more" approach, so the planes all fly with empty baggage holds and totally overstuffed overhead lockers. If this progresses I shouldn't wonder that the planes will get so top-heavy they roll over, but through the miracles of priority boarding I was able to commandeer all the locker space I needed before anyone else had even made it past row 40. I confess that I was a little worried that it wouldn't be quite such plain sailing getting through LAX. I mean we all know what reputation this delightful little exit port has. In the event it was totally anitclimactic. If it has a handle on it, and it's about the same size and shape as a largish carryon then it's fine. There have been no recorded stabbings with wind vanes anyway - at least on aeroplanes - so clearly they are perfectly safe. Finally back in my country of birth, thinking I was home free, I breathed a sigh of relief transferred my bags and nipped off to the Koru lounge for a much needed shower and change of clothes after I snuck the station through another scanner. By now the handle had broken, so it was looking decidedly more 'box' like and less 'carryon' like, and when I eventually rolled up at the gate with my boarding pass the attendant made a valiant attempt to relieve me of it, but she was too slow and I danced around her and swanned up the gangway to take my seat. I was slow, this time, having missed the first boarding call, and all overhead lockers were crammed full. There was no seat in front of me to put the weather station under. Fortunately a nearby cupboard proved fit for purpose and it was secreted there and we were underway. At this point the guy two seats over said "didn't I see that weather station in New York?". Of course being bright yellow does make it a little conspicuous I guess, and I'm not renowned for my own inconspicuousness myself. So that's how I got my new weather station home, and you can see right away that doing things the easy way would never even occur to me. Possibly this is why I run Linux: there just isn't enough challenge when you run a different operating system. On Windows someone has always written a program for your new weather station, and a Mac user wouldn't be seen dead with it because it's black and beige and comes in a bright yellow box! So now I had to find some code to write. I looked around and very rapidly discovered that some software called vproweather was available, which would happily talk to my weather station and download the data from it, write web pages, stuff it into a MySQL database and so forth. All, obviously, far too easy, so I thought aha! I could convert that to PostgreSQL, and then I would be happy and relax with the thought of a job well done. So I downloaded the code in question an impressive several hundred kb of C code, cranked open a text editor and started to crawl through it and see where I could add the magic pixie dust to make it work with PostgreSQL. But it was not to be. My eyes glazed over or scales fell from them or something, and I realised that this particular edifice was beyond my help. Back to square one. I downloaded the Vantage Serial Protocol docs from the Davis Instruments website did some quick googling and decided I should write a module to talk this protocol. And I should write it in Perl (it was a Thursday, and Perl always seems more sensible on a Thursday, and not because of Douglas Adams, either). I beavered away into the night. Rain threatened, so I raced outside and installed the new weather station on the roof in the hopes that it's magnificent rain collector would collect. I raced back inside and was able to count the first (and so far, only) tip of the bucket. And so I now release upon the world Davis::VantagePro my first perl module. Well, the first one I care to share with the world, anyway. I have stressed it with very little testing, lumbered it with no planning or design whatsoever and so I feel it only fair that I should cast it upon the world with very little thought for it's survival or existential goals.

1 I seem to recall one night we came up with some fantastic names for Micah & Biella's Washington Square apartment, but I couldn't remember any of the good ones and had to slap a new one on there. I should also mention my stay at the Acetarium in Boston, which was a fabulous few days, but it would pad this blog post needlessly, and I've already done that.

29 June 2010

Matthew Garrett: The paradox of choice

Searching for information on setting up an L2TP VPN takes me here, where I get to choose between OpenSWAN, KAME and some OpenBSD port. Searching for information on setting up a PPTP VPN takes me here, where I'm told exactly what I need to do.

Given choices, I chose the one that reduced my choices. THERE IS A LESSON HERE.

(Sadly, I'm now going to have to deal with L2TP anyway because something in the intermediate network is dropping GRE)

16 February 2010

Ingo Juergensmann: StrongSwan and L2TP/IPsec on Debian

Mac OS X and other operating systems are using L2TP/IPsec for VPN connections. I'm running StrongSwan as my IPsec stack of choice, so I wanted to setup a VPN between my Debian lenny server and OS X as my roadwarrior. There's a nice howto on nielspeen.com. Everything is fine except for one thing:

Q: I want to set up strongSwan to interoperate with Microsoft Windows using L2TP/IPsec. I'm getting the error message "NAT-Traversal: Transport mode disabled due to security concerns" which results in strongSwan sending an encrypted notification BAD_PROPOSAL_SYNTAX

A: Here is a quote from strongSwan lead developer Andreas Steffen on how to deal with this problem:
NAT-Traversal with IPsec transport mode has some inherent security risks. Since Microsoft doesn't care about this please compile strongSwan with the option

./configure --enable-nat-transport


So, there's the inherent security risk, but without --enable-nat-transport L2TP/IPsec doesn't work at all with StrongSwan on Lenny. Is there anything I can do, dear LazyWeb, to be able to use L2TP/IPsec VPN connection with OS X and Linux (StrongSwan) to have a really secure connection? Being able to use Windows as VPN roadwarrior clients is optional, but no requirement.

24 September 2009

Adrian von Bidder: IPSec: Hopelessly confused

Yes, this is a dear lazyweb... I'm more and more confused about IPSec on Linux. Has anybody done a more or less recent summary about IPSec and Linux? All I find is quite old and probably doesn't apply anymore... About the only thing I'm sure about is that FreeS/WAN is officially dead. But otherwise? Openswan vs. strongSWAN vs. KAME (or is that ipsec-tools?) And what about the kernel side? Are they now all using the same code or are there still patches? It would probably best if the hypothetical knowledgeable person would not comment here but insert a relevant notice at the top of http://wiki.debian.org/IPsec, to avoid having yet another obscure page (mine) show up in Google...

22 April 2009

Russell Coker: Links April 2009

P. W. Singer gave an interesting TED talk about the use of robots in war [1]. He briefly covered some of the ethical and social issues related to robot soldiers as well as showing many pictures of existing robots. Since November 2007 there has been a request for Google Gears to support Iceweasel (the Debian name for Firefox due to trademark issues)[2]. Apparently supporting this different name is not easy for the Google people. If you visit the Google Gears Terms and Conditions page [3] then it will work with Iceweasel on the i386 platform - but not for AMD64 (or at least not my Debian/Lenny AMD64 system). Charles Moore gave a disturbing TED talk about the Great Pacific Garbage Patch [4]. Pollution in the oceans from waste plastic is worse than I realised. Ressuka documented how to solve the Time went backwards problem on Xen DomUs [5]. Run echo jiffies > /sys/devices/system/clocksource/clocksource0/current_clocksource or use clocksource=jiffies in your DomU kernel boot parameter list. Nassim Taleb [6] has written Ten principles for a Black Swan-proof world [7], this is in regard to the current US financial crisis. It s worth noting that he made a significant amount of money due to successfully predicting some aspects of the crisis. James Duncan Davidson has some good advice for speakers based on his experience in filming presentations [8]. Some of the ones that were not obvious to me were:
Take off your name-tag - it doesn t look good
Stay in the part of the stage with the best light

16 March 2009

James Morrison: Recent Bands

13 Mar 2009
White Swan, Black Swan: nice vocals, I only caught a couple songs

The Donkeys
Decent band, fun to listen to. A good whale joke:
Two whales are sitting at a bar
one says to the other [long whale noises]
The other says, "man you are trashed."

Quick to get on stage and play

Phosphoressence
Good country rock band. Slow to start playing and some assholes decided to pop into the front of the crowd, they were tall so they blocked a bunch of peoples view. Then they gained an extra 3 people and started moving backwards. For once someone actually got inside my bubble.

7 Mar 2008 -- Red Devil Lounge
* "Three of" (good luck googling these guys) -- very good
* A, b, and C -- not good, the lead singers voice cracked a lot, they did look like they should be in the movie "That thing you do" (my first date was at this movie).
* Moonlight Sexy -- ok, Andy didn't like these guys
* Marcy Playground -- Great!

14 Mar 2008 -- Writers with drinks
S.G Browne with Breathers: A zombie's lament. The chapter he read was really funny. I think this was the best part of the night. The host was also really good, but the host could be described as slightly scripted talking out of her ass.

11 September 2008

Martin F. Krafft: Host naming theme

Init Seven, my favourite Swiss ISP, has offered to collocate one of my machines in their racks with native IPv6-connectivity. I am now searching for a name for this new host. A recent discussion has made me curious about how many people can deduce my host naming theme from the set of names of currently operational machines under the madduck.net domain:
albatross, bell, brick, cigar, cirrus, clegg, diamond, echo, embryo, eugene, fishbowl, gerald, gnome, lapse, lust, mother, pict, pig, piper, pulse, seamus, sheep, time, vera, wall.
If you know what ties this list together, please help me christen the new machine! Update: the responses have been overwhelming, 183 people have written in so far, and 149 of them knew what s going on (though some admitted to cheating with a search engine). Thanks to everyone! In addition to the common theme, which most guessed correctly, I have a few other restrictions, mainly that the words have to be singular names or nouns, and that they have to feel right . Here are the suggestions I ve received which passed my filters, in decreasing order of frequency:
emily, lucifer, fletcher, lunatic, arnold, flesh, gig, bike, moon, brain, hand, balloon, hope, alan, marmelade, wing, heart, summer, thunder, sam, tropez, sky, stethoscope, khyber, lotus, jugband, cymbaline, remergence, dawn, hell, desert, worm, eclipse, dog, sysyphus, julia, scarecrow, sun, overdrive, vizier, matilda, eiderdown, babe, pillow, funkydung, atom, fore, shout, breast, domine, swan, charade, grantchester, money.
Curiously, I forgot about worm and wing, which are in use, so those are out. Some of them are not candidates because I d mistype them all the time ( stethoscope , cymbaline , sysyphus , remergence , scarecrow , eiderdown , marmelade , grantchester ). Some just don t seem right ( tropez , shout , overdrive , flesh , breast , sky , jugband , eclipse , lucifer , money ) Some are not appropriate as hostname for computers ( brain , heart , damage , hell , lunatic , babe ). Those who suggested machine were referred to my SMTP servers greeting banner. I have to scratch fletcher and desert because of their source. I have to do the same to thunder , unfortunately. And I ought to retire pulse , although not really. Noone suggested grimble and crumble . As there are so many, and so many more, I am changing my rule to significant, enigmatic, and memorable singular nouns and names , which brings us down to:
arnold, gig, bike, moon, alan, khyber, lotus, julia, sun, vizier, matilda, atom, domine, swan, charade, grimble, crumble.
Given that list, I think I will be launching gig, khyber, lotus, charade, vizier, domine, and/or swan in the near future. Or if it s a pair, it ll be grimble and crumble. Thanks all, this was fun. PS: you may use the same naming scheme for your hosts, but you take full responsibility in case you and I ever have to fuse networks in any way. NP: Riverside: Out of Myself

Next.

Previous.