Blog Archive: December 2015
Shame on PayPal!
In the past I've complainedwith justificationabout ANZ Bank's non-existent amazingly lax online security practices. But it seems that they're not the only offenders: this story shows that PayPal can do just as well. ANZ wants to know secrets like date of birth and address, while PayPal, being in the USA, wants the last 4 digits of the social security number and a random credit card account. And in either case, you can ring up and say that you have forgotten your password, and they'll reset it for you. What help high-tech protection when it's not the line of least resistance? ACM only downloads articles once.
Cory Doctorow on Software Security and the Internet of Things
Cory Doctorow has a good essay on software integrity and control problems and the Internet of Things. He's writing about self-driving cars, but the issue is much more general. Basically, we're going to want systems that prevent their owner from making certain changes to it. We know how to do this: digital rights management. We also know that this solution...
Another Scandal Resulting from E-mails Gone Public
A lot of Pennsylvania government officials are being hurt as a result of e-mails being made public. This is all the result of a political pressure to release the emails, and not an organizational doxing attack, but the effects are the same. Our psychology of e-mail doesn't match the reality. We treat them as ephemeral, even though they're not. And...
Security, Microsoft style
After creating the user root on dischord, went to give him a passwword. No, wait, don't do that, says Microsoft: You are creating a password for root. If you do this, root will lose all EFS-encrypted files, personal certificates and stored passwords for web sites or notwork resources. To avoid losing data in the future, ask root to make a password reset floppy disk. Floppy disk! I'm amazed! For reference, this is Microsoft Windows 7 Ultimate (or, as the Germans would say, das Letzte ).
Ashampoo, next try
So yesterday Ashampoo's Photo Optimizer 6 and UnInstallu were not able to recover whatever the problem was. But there are other deinstallers around there, including Revo Uninstaller Pro , which I had used, ultimately with a measure of success, last September. Tried again, and how about that, it found a reference deep in the registry: Removed that, and a couple of other odds and ends, but still not the short cut on the task bar. This time, however, it didn't start the program. So far, so good.
PayPal Authentication Still Substandard
Brian Krebs has the story. Bottom line: PayPal has no excuse for this kind of stuff. I hope the public shaming incents them to offer better authentication for its customers....
DMCA and the Internet of Things
In theory, the Internet of Things -- the connected network of tiny computers inside home appliances, household objects, even clothing -- promises to make your life easier and your work more efficient. These computers will communicate with each other and the Internet in homes and public spaces, collecting data about their environment and making changes based on the information they...
Removing Ashampoo
Yvonne has been processing her photos with essentially the same tools as I use. The only exception has been the optimize step, where I work around the limitations of Ashampoo® Photo Optimizer 6 to (generally) improve the images. But my last attempt to set it up for her ended in disaster: the program crashed at start, presumably due to hidden configuration information that weathers a deinstall/reinstall cycle. My support request ended in the usual /dev/null. OK, how about removing it manually? But despite claims by relatively sane software such as Emacs and cygwin, I don't have access to directories like C:\Users\yvonne\AppData\Local\Appliction Data, where I suspect the data.
Mobile Counter-theses
This is in response to 16 mobile theses by Benedict Evans of Andreesen Horowitz, a firm thats central to Bay Area VC culture. I think the theses are about half wrong. Ill run through his theses one-by-one. But first, I think our differences center on two things; one thats predictable given who I am, namely the cloud. The second is perhaps surprising: Whether keyboards matter. Here we go; you might want to flip back and forth a bit because I reproduce Mr Evans subtitles but not his arguments. 1: Mobile is the new central ecosystem of tech Tech is bicentric, these days: Cloud and Client.
NSA/GCHQ Exploits Against Juniper Networking Equipment
The Intercept just published a 2011 GCHQ document outlining their exploit capabilities against Juniper networking equipment, including routers and NetScreen firewalls as part of this article. GCHQ currently has capabilities against: Juniper NetScreen Firewalls models Ns5gt, N25, NS50, NS500, NS204, NS208, NS5200, NS5000, SSG5, SSG20, SSG140, ISG 1000, ISG 2000. Some reverse engineering maybe required depending on firmware revisions. Juniper...
Origin of the term shell
Warren Toomey recently asked on the mailing list of the Unix Heritage Society: So what is the etymology of the word "shell"? I see that Multics has a shell. What the user interface in CTSS also called a shell? Interesting question. I have sources of a kind of CTSS (they're really listings), so I went looking. Difficult to find anything in unfamiliar (IBM 7090) assembler code, but the answer seemed to be no . And the Oxford English Dictionary states that it came from Multics.
Motorized Desk Tour
For office workers: If youre among those (relatively few now, I think) who havent had a chance to try a sit/stand desk, I totally recommend them. Heres mine, cranked up: This looks weirdly sterile because it manages to show the only wall segments of my office that arent whiteboards covered with scribbles and diagrams. Plus theres a nice little table and chairs around it. These things are becoming ubiquitous in high-tech offices. I decided to give one a try because I have occasional pain in my upper-back and neck caused by decades of looking down at laptops. Amazon gave me a consult with an ergonomist, who said its not that sitting is bad and standing is good, its that you want to avoid being in one position all the time.
Christmas Decorations
I hope that lots of you are having an excellent Christmas; I am. Heres an illustrated card featuring Vancouver Christmas visuals. We took our visiting Prairie relatives for a waterfront Christmas-eve walk, and it struck me that putting Christmas lights on barbed-wire looks dystopian by day, but is probably pretty at night. Just around the corner was a little nautical structure, and a dinghy in Christmas colors. Then Christmas came, and heres a bit of orgy-of-materialism hangover. Christmas day had the only sun of the week so between presents and turkey we took a stroll in a local hilltop park.
Dumb search engines
Since moving to Stones Road, I haven't unpacked my CDs. When I do, I intend to copy them to disk so that I can access things more easily. But first I need to find a way to organize them. But today I wanted to play Bach's Christmas Oratorio. Simple: get it from the Naxos music library (free via the State Library of Victoria). So I typed in Bach Christmas Oratorio . The helpful engine: did you mean Beach Christmas Oratorio? . Surely these things can be tuned to be more context-sensitive. ACM only downloads articles once.
Firefox hang
Yvonne called me in to her office today to tell me that she couldn't start firefox: it claimed still to be running. We've seen that many times in the past, but not for a while. But sure enough, a process was still there, and kill -9 wouldn't get rid of it. ps -l showed it to be in T (stopped) state. What happened there? Puzzled a bit and, since Yvonne wasn't there, went off to do something else. Some time later I got the nightly cleanup mail from lagoon, Yvonne's computerabout 15 hours late. And then it twigged: yesterday I had mounted two teevee file systems on lagoon, and I had forgotten to umount them when I shut down teevee.
Friday Squid Blogging: Squid Christmas
Squid sighting in this Christmas cartoon. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. And Happy Christmas for those who celebrate it....
Podcast: Happy Xmas! (guest starring Poesy)
It’s been a year since I sat down at the mic, but it’s Christmas and we have a tradition to uphold. Now we’re settling in here in Burbank and I’ve got a new computer, I’m hoping to get everything running again and get back to a regular schedule. MP3
Burglary Footage Turned into Commercial
Earlier this month, a Las Vegas taco shop was robbed in the middle of the night. The restaurant took the surveillance-video footage and turned it into a combination commercial for their tacos and request for help identifying the burglars....
Police Dog Sniffs for Hard Drives
This weird story describes a "porn dog" that is trained to find hidden hard drives. It's used in child porn investigations. I suppose it's reasonable that computer disks have a particular chemical smell, but I wonder what it is....
What does cron mean?
Everybody knows cron, of course, unless they're using Linux, when they might spell it anachron. But what does it mean? I had always assumed that it was related to the Ancient Greek word ÇÁ̽¿Â (chronos), but it seems that people have at various times expanded it to be an abbreviation of Command Run On Notice or Commands Run Over Night , both of which suggest that the authors have no idea of Ancient Greek. Both of these claims have found their way into Wikipedia. Doug McIlroy agreed, checked with Ken Thompson via Brian Kernighan, and updated the page. But it was private communication, so he didn't have a published reference, and the change was backed out within 11 minutes.
Upgrading mpayer
Nearly 9 years ago I hacked mplayer to do a number of things I wanted: better on-screen display, display times for Program Streams better, and save position on exit. And I've been using that version ever since. mplayer has evolved, of course, and now it's time to apply the changes. I kept the changes under RCS at the time, but I seem to have made a real mess of the matter. In particular, the base release doesn't seem to be related to the version that I patched. In addition, the original main file mplayer.c has spawned a number of header files, including (relevant to me) mp_osd.h and mp_core.h.
Ping times revisited
Why did I get such unreliable ping times the other day, even though I'm not experiencing other network problems? Clearly something to investigate further. Tried it with mtr and discovered: Worst case time 2.855 s! And best was 43 ms to the final destination. It would be nice to blame it on I'm too lame for reverse DNS 216.239.41.77, but even my own National Broadband Network link showed a worst time of 428 ms, and it had a higher average time than any of the intermediate hops.
If you think self-driving cars have a Trolley Problem, youre asking the wrong questions
In my latest Guardian column, The problem with self-driving cars: who controls the code?, I take issue with the “Trolley Problem” as applied to autonomous vehicles, which asks, if your car has to choose between a maneuver that kills you and one that kills other people, which one should it be programmed to do? The... more
The Bookshelf Project
Using Law Against Technology
On Thursday, a Brazilian judge ordered the text messaging service WhatsApp shut down for 48 hours. It was a monumental action. WhatsApp is the most popular app in Brazil, used by about 100 million people. The Brazilian telecoms hate the service because it entices people away from more expensive text messaging services, and they have been lobbying for months to...
A shampoo for Yvonne
Yvonne processes her photos basically the same way that I do. One exception is optimization with Ashampoo® Photo Optimizer 6, and it shows. So today I showed her how to use it. Not a complete success: the subsequent comparison scripts couldn't find any evidence of the old images. That's because they were stored on local disk, where the script couldn't find them. You can fix that. Well, I fixed it for myself in the past. When I tried today, this horrible interface wouldn't accept the location. In the end it crashed. But then, what do you expect from a Microsoft-space product?
More Writings on the Second Crypto Wars
Two things to read: "Wanting It Bad Enough Won't Make It Work: Why Adding Backdoors and Weakening Encryption Threatens the Internet," by Meredith Whittaker and Ben Laurie. "The Second Crypto War is Not about Crypto," by Jaap-Henk Hoepman....
Network ping times
For reasons I didn't really understand, some people on IRC today were comparing ping times to Google's name server google-public-dns-a.google.com., IPv4 address 8.8.8.8. OK, I can do that too: === grog@eureka (/dev/pts/14) ~ 28 -> ping -c20 8.8.8.8 ... round-trip min/avg/max/stddev = 38.503/51.678/62.721/5.839 ms That's reasonable. But they wanted it with full-size (1400 octet) packets. That looked very different: round-trip min/avg/max/stddev = 40.133/185.440/437.621/117.997 ms round-trip min/avg/max/stddev = 35.029/161.284/402.501/127.614 ms Why is that so slow?
Understanding processors
Over the past year or so I've noted that teevee, our (still) current TV display computer, and the old lagoon (Yvonne's computer) both had the same processor, a slower-than-molasses AMD Sempron 145 with a CPUmark of 800. Saw a request on Freecycle yesterday: somebody looking for an ATX power supply, with or without case. OK, I have old, mouldy but functional stuff lying around, so why not give him a complete computer? The person in question was Chris (surname still unknown), who was here earlier in the year. Checked and found that it was the old laogon. Fired it up mainly to check how much memory was in it (only 1 GB).
More Android pain
Time for our yearly Christmas letter, which kept me busy much of the day. Part of it, of course, is getting a photo with as many animals as possible. And that requires remote control. Once upon a time that was easy: my first two Olympus cameras had an infrared remote control (well, I had to buy the control, but they understood it). That was small and unobtrusive enough that I could use it and it was barely visible, like here in the 2012 letter: But then I got the new, modern Olympus OM-D E-M1, and clearly infrared is too old-fashioned for that.
The Wrath of Heaven
May it afflict intermittent left-channel outages, and an audiophile neighbor who lives for operetta, on the gormless enthusiasts who maladjust the audio in the car-share cars so everything sounds like a Bad Hair Band. Modern car-audio systems are tuned by professionals to sound reasonable out of the box. Maybe you like a little more punch in the bass, good on ya. Maybe youre listening to talk radio in a staticky zone, you want to lift the mid-range and back off the treble; who could object? But what is the pervasive pathology that leaves approximately 50% of all car-share vehicles with the bass and treble cranked right up, and the fader dialed to the back-seat?
"The Medieval Origins of Mass Surveillance"
This interesting article by medieval historian Amanda Power traces our culture's relationship with the concept of mass surveillance from the medieval characterization of the Christian god and how piety was policed by the church: What is all this but a fundamental trust in the experience of being watched? One must wonder about the subtle, unspoken fear of the consequences of...
Back Door in Juniper Firewalls
Juniper has warned about a malicious back door in their firewalls that automatically decrypts VPN traffic. It's been there for years. Hopefully details are forthcoming, but the folks at Hacker News have pointed to this page about Juniper's use of the DUAL_EC_DBRG random number generator. For those who don't immediately recognize that name, it's the pseudo-random-number generator that was back-doored...
Activate your Windows
Also on Thursday I was surprised when the disk from dischord (containing Microsoft Windows 7 Ultimate ) cleanly migrated to a new machine. No comments or anything. But today I got a message: You must register your Windows today . OK, how do you do that? It seems that any time you have a question about Microsoft, you ask Google. The results contain a surprising amount of superstition and guesswork, but if you can weather that, it's generally easier than Microsoft's help. Of course, it only works if you really need to do it. If I recall correctly, it's Control Panel / Action Centre to find the message, then click on Activate online (or some such), and it's done!
Checking the teleconverter
Somehow I'm not convinced by the new EC-20 2× teleconverter. The photos taken with it don't give the impression of exceptional sharpness. One reason might be DxO Optics Pro : it happily converts photos taken with it and the Zuiko Digital ED 70-300mm F4.0-5.6as long as the total focal length is not greater than 300 mm. Beyond that, it claims not to have any suitable correction modules. That suggests that the software may be ignoring the teleconverter and not converting optimally as a result. But first I need a way of comparing things. The tele lens isn't that long, but the combination is long enough that I really need a (missing) tripod mount for the lens.
Yet another power failure!
Woke up at 5:15 this morning and looked at the clock. Nothing. Another bloody power failure! Damn Powercor! Then I looked at the door. Air conditioner was on, showing this irritating blue LED. No power failure. Into the garage. Yes, the RCD had tripped for no apparent reason. Damn Jim! The circuitry that's supposed to ensure that we don't have any interruptions has interrupted us again. Recovering wasn't overly difficult. I need to set eureka's BIOS so that it powers on immediately when power is restored; as it was, it waited for me to get up. Getting eureka up and running after a power failure is always a tricky business.
Friday Squid Blogging: Penguins Fight over Squid
Watch this video of gentoo penguins fighting over a large squid. This underwater brawl was captured on a video camera taped to the back of the second penguin, revealing this unexpected foraging behaviour for the first time. "This is completely new behaviour, not just for gentoo penguins but for penguins in general," says Jonathan Handley, a doctoral student at Nelson...
GCHQ Holiday Puzzle
If you like puzzles, GCHQ has one for you. Just don't let it distract you from fighting the UK legislation giving the GCHQ new surveillance powers....
25th Anniversary of the Landmark Unix Security Book
Gene Spafford writes about the history of Practical Unix Security....
VPC NAT gateways : transactional uniqueness at scale
This is a guest blog post on Perspectives from Colm MacCarthaigh, a senior engineer on the Amazon Web Services team that designed and built the new VPC Network Address Translation Gateway service that just went live yesterday. Over the last 25 years, Network Address Translation (NAT) has become almost ubiquitous in networks of any size. The...
Hello damnation
To Napoleons to pick up my new computer, a ThinkCentre with an Intel Core i5-2400 CPU and Microsoft Windows 10. This was my first exposure to Windows 10, and it wasn't pleasant. I'm left with the feeling that they've gone and moved the paradigms even further from what makes sense, and replaced the familiar user interface with an unfamiliar one, at least skin deep. Underneath, if you know how to find them, things seem to be much the same, though they've gone and rearranged some things so that you can't find them any more. The paper clip is back: I'm Cortana.
Catalog of Police Surveillance Equipment
The Intercept has "a secret, internal U.S. government catalogue of dozens of cellphone surveillance devices used by the military and by intelligence agencies." Lot of detailed information about Stingrays and similar equipment....
User Errors Often Compromise Encryption
This should come as no surprise: users often compromise their own security by making mistakes setting up and using their encryption apps. Paper: "On the Security and Usability of Crypto Phones," by Maliheh Shivanian and Nitesh Saxena, Proceedings of ACSAC 2015....
Ugh.
My credit union tells me their website will be down Saturday night for upgrades. This not only means that they don't have a good DevOps-style rapid release CI/CD system, but that they have no respect for their IT group who should not have been required to spend this week and the entire weekend planning for the upgrade. They should be spending this weekend at the movie theater watching the force awakens. This is disrespectful of their employees and shows a lack of good management. How could management expect people to focus on a critical upgrade this week? DevOps isn't just a software release methodology.
Music Nights
Been going out a bit more than usual; four nights of live music in the last month. The object of the game here is to convince a few more of you to get off the sofa and go hear people play. The entertainment was Big Sugar, Patricia Barber, Muse and a carol sing. Each was magic. Big Sugar Unless youre Canadian you probably dont know about them. Theyve never quite decided whether theyre folkies or rastas or bluesmen; have had a couple of hits over the years, you might have heard Diggin a hole. As the inset makes obvious, this picture isnt by me.
DOS Attack Against Los Angeles Schools
Yesterday, the city of Los Angeles closed all of its schools -- over 1,000 schools -- because of a bomb threat. It was a hoax. LA officials defended the move, with that city's police chief dismissing the criticism as "irresponsible." "It is very easy in hindsight to criticize a decision based on results the decider could never have known," Chief...
Preparing for multimedia upgrade
I've bought Yet Another Microsoft box, also a used Lenovo ThinkCentre. It has an Intel Core i5-2400 CPU, running at 3.1 GHz, and currently rated with a CPU Mark of 5827, more than half the speed of eureka. Now I have: Machine Processor Clock CPUmark eureka Intel Core i7-4771 3.50 GHz ...
Another net outage!
Since changing all the hardware for my National Broadband Network service, I haven't had a further outageuntil today. But to make up for it, it was nearly 1½ hours: Start time End time Duration Badness from to (seconds) 1450098184 1450103337 5153 0.006 # 15 December 2015 00:03:04 15 December 2015 01:28:57 That's not the symptom of the outages I have been having, which are typically in the order of 60 seconds.
More sprinkler fun
One of the things that I hadn't expected was that I would be woken at 4:00 every morning when the sprinklers outside my bedroom window start. Still, that's not a big deal, and I should get used to it. But this morning I was woken again at 5:30 when they started again! Why? My guess is a software bug. The device has two programmes , each of which is launched at a certain time of the day. Or are they? Each sprinkler has an entry in each programme, but I have to specify the start times individually, which seems to be a funny way to do it.
We can solve the terrorist encryption problem with this one simple solution!
*Lately there has been a renewed debate over the use of encrypted communication. Terrorists could be using encryption to hide their communication. Everyone knows this. The problem is that encryption is required for ecommerce and just about everything on the web. Should encryption be banned? regulated? controlled? Lately there have been a number of proposals, good and bad, for how to deal with this. Luckily I have a solution that solves all the problems! My solution: (which is obvious and solves all problems) My solution is quite simple: Every time a website asks you to create or change a password, it would send a copy to the government.
Attack Against DNS Root Servers
Has anyone been following the attack against the DNS root servers two weeks ago? Details. I can't precisely explain why, but this feels like someone testing an attack capability. For defense: it's long past time to implement source address validation in the DNS system....
Twitter Numbers
I still think Twitters interesting; it informs me and pleases me in ways no other service comes near. Also, it lets me talk to the world, and when you do that, you find yourself asking is anyone listening? Fortunately, Twitter will tell you. The numbers are big enough that the stats might be of general interest. Of course, Social Media Professionals all have known all this stuff for years, but most of us arent those. Where the stats are On Twitter Im @timbray, so my stats are at ads.twitter.com/user/timbray/tweets (you cant see that, youll need to plug in your own handle).
How can sysadmins devalue themselves?
The new edition of ACM Queue Magazine is out. My column (called "Everything Sysadmin") answers 1-2 questions per issue. This issue's questions are: Q: Dear Tom, How can I devalue my work? Lately I've felt like everyone appreciates me, and, in fact, I'm overpaid and underutilized. Could you help me devalue myself at work? ...and... Q: Dear Tom, We have a very simple on-call schedule, but all the substitutions needed during December make it quite complex. How should we organize it better? For example, our team has a week-long on-call schedule [Monday to Monday]. During November and December, however, there is a flurry of e-mail with people requesting to trade days to accommodate various family and holiday responsibilities.
Good Swatting Story
The New York Times Magazine has a good story about swatting, centering around a Canadian teenager who did it over a hundred times....
RIP Jürgen Lock
One of the more frequent visitors to our IRC channel was Jürgen Lock, a FreeBSD committer whom I have known for nearly 20 years. In July he was diagnosed with advanced seminoma and was operated. He popped up on IRC shortly after that, but since 4 August we haven't heard anything more of him. Peter Jeremy asked on an internal FreeBSD list, but didn't get any reply. Jürgen was in many ways a very private person. We have a map of the locations of the participants on IRC, but Jürgen didn't want to have his location known. Instead, we put him on a tour of Germany, and currently he's in the Händel-Haus in Halle an der Saale.
Fixing Salado problems
Spent some time today trying to get SaladoPlayer to work on the new eureka, ultimately without success. The obvious first step was to check if there's a new version. No, I didn't find one. In fact, just about every link I tried failed. There's a page on GitHub with a lot of links, all of them broken. The download page is on openpano.org, which returns 404 for all pages. Then there are linkes to panazona.com, which doesn't have any DNS. Spent some time looking for alternatives, but given the pain I went through getting SaladoPlayer to work the way I wanted, I'd rather fix that than change.
NYC DevOps: Bridget Kromhout and Casey West - Sometimes you feel like a Docker...
This month's NYCDevOps meeting (hosted at the StackOverflow.com HQ) has special guest speakers Bridget Kromhout and Casey West talking about running Docker images in Cloud Foundry's Elastic Runtime and orchestrating containerized workloads on Lattice. Date: Tuesday, December 15, 2015 Time: 6:30 PM Place: The Stack Overflow HQ (near Wall St.) You must RSVP and bring an ID to get into the building. You should join me at this Meetup. Check it out and RSVP! http://meetu.ps/2QNDCg
Interview on Paul Holdengrabers Call from Paul podcast
I appeared on the current episode of “A Call From Paul” (MP3), a podcast created by Paul Holdengraber, who curates the NY Public Library’s amazing interview series. Paul and I talked about London, UK politics, class war, education, and books.
Raspberry Pi vs USB vs Mac Audio
The audio hardware of Raspberry Pi is known to produce relatively poor sound quality. I bought a cheap USB sound card to try as an alternative. Here is what I found.
Browser redux
Over the last couple of weeks I've run into an amazing number of problems with web browsers. It's all the more amazing when you consider that the web browser has become the central piece of software for most people. Admittedly, I'm much more fussy than the average user, but silly things like text size must get on everybody's nerves. Chromium in particular seems to have regressed. There seems to be only one setting for text size, and it gives me smaller fixed-width than standard fonts, meaning that I can no longer display pages like this diary with usable font sizes. In addition, by default it displays images larger than their original size.
Java pain
For some years I've been using SaladoPlayer, a Java application, to animate panoramas. Lately I haven't had any to do, and today was the first time since I upgraded eureka. It didn't work. How I love these silly programs that produce their output in their own tiny window. In this case, it set off, displayed something, and then shut the window before I could read what it had had to say. How do I recover that? It's a log, but it's not a file. Ran ktrace to catch the output, but of course it was several megabytes, and I didn't know what to look for.
Why ld?
Modern programming toolchains have two main components: a translator (assembler or compiler), which produces object modules, and what is generally called a linker, linkage editor or similar. It joins them together to produce an executable program that can then be loaded into memory, a page at a time when required, by the kernel. But in UNIX, the linkage editor is called ld, which stands for load. How come? People have been discussing that on the Unix Heritage Society mailing list for the last few days. From my understanding, the name comes from historical evolution. In the early days the main tool was the compiler, which ran much faster than modern compilers in terms of processor instructions: it had to in order to complete in an acceptable time.
Friday Squid Blogging: Rare Octopus Squid Video from Hawaii
Neat: While the Dana octopus squid may lack a squid's trademark trailing tentacles, it makes up for them in spectacular lighting equipment, with two of its muscular arms ending in lidded light organs called "photophores." About the size of lemons, these photophores are the largest known light-producing organs in the animal kingdom, said Mike Vecchione, a zoologist at the NOAA...
What I told the kid who wanted to join the NSA
In my latest Guardian column, I tell the story of my recent lecture at West Point’s Cyber Institute, where a young cadet took me aside as asked what I thought of their plans for joining the NSA. The cadet had good reasons to want to join the NSA: they were justly concerned about the Internet... more
Resilient Systems News: End-of-Year Trends Webinar
I'll be participating in an end-of-year trends and predictions webinar on Thursday, December 17, at 1:00 PM EST. Join me here. In other news, Resilient has joined the IBM Security App Exchange community. And we're still hiring for a bunch of positions....
Hit-and-Run Driver Arrested Because Car Reported Accident
A Florida woman drove away after an accident, but her car automatically reported it anyway. She was arrested....
New issue of acmQueue is out!
I write a column in ACM Queue magazine called "Everything Sysadmin" (guess where I got the idea for the name?). It appears 3 times a year. The new issue is out and contains a column that answers 2 questions: one is "How can I devalue my work?" and the other is about scheduling substitutions for oncall schedules. Queue is free to ACM members (use your ACM account username/password). You can purchase a 1-year subscription for $19.99 or buy a single issue for $6.99. To read the issue online or via the Queue App (iPhone and Android), go here: http://queue.acm.org/app/landing.cfm
How People Learn about Computer Security
Interesting research: "Identifying patterns in informal sources of security information," by Emilee Rader and Rick Wash, Journal of Cybersecurity, 1 Dec 2015. Abstract: Computer users have access to computer security information from many different sources, but few people receive explicit computer security training. Despite this lack of formal education, users regularly make many important security decisions, such as "Should I...
imake and modern compilers
I still haven't got Keith Packard's kgames working on FreeBSD. It was coming on nicely until I upgraded from release 9 to release 10. And then I got error messages like: === grog@eureka (/dev/pts/33) /home/ports/x11/kgames/kgames-1.0 88 -> xmkmf mv -f Makefile Makefile.bak imake -DUseInstalled -I/usr/local/lib/X11/config In file included from Imakefile.c:15: In file included from /usr/local/lib/X11/config/Imake.tmpl:316: /usr/local/lib/X11/config/Imake.rules:1674:27: warning: empty character constant [-Winvalid-pp-token] for flag in ${MAKEFLAGS} '; do \ @@\ What went wrong there?
Who finds this diary interesting?
The RSS feed of my diary is syndicated on the ACM queue blog roll. Sometimes I think it doesn't fit there; the diary (and specifically not a blog ) is primarily for my own use, but I share. And the topics are sometimes boring enough that I explicitly exclude from from acmqueue. But today I heard from Kirk McKusick, who is on the ACM board. It seems that one of my articles is the all-time most popular posting, with 20,000 views per year. Considering it's nearly 3 years old, that surprises me. ACM only downloads articles once.
Terrifying Technologies
I've written about the difference between risk perception and risk reality. I thought about that when reading this list of Americans' top technology fears: Cyberterrorism Corporate tracking of personal information Government tracking of personal information Robots replacing workforce Trusting artificial intelligence to do work Robots Artificial intelligence Technology I don't understand More at the link....
7 signs you're doing devops wrong
Adam Bertram wrote an excellent piece in InfoWorld: 7 signs you're doing devops wrong
More mutt and firefox problems
Somehow my interface between mutt and firefox is still not right. To get it to work at all reliably, I needed to hack the mutt source. And then today, instead of the normal broken HTML display, I got: XML Parsing Error: not well-formed Location: file:///home/grog/mutt-eureka-yTle9kDR Line Number 152, Column 76: style="background-color:#eaf2f1; width: 10px;">FFFF</td> </td> ---------------------------------------------------------------------------^ The FFFF was in fact two 0xff bytes, but I can't put them in a web page without triggering the same error again.
Ever run a Novell network?
If you ran a Novell network, especially in the late 80s or early 90s, I hope you watched The Late Show with Stephen Colbert last night when he interviewed Steve Carell and talked about their brief work for Novell.
How Israel Regulates Encryption
Interesting essay about how Israel regulates encryption: ...the Israeli encryption control mechanisms operate without directly legislating any form of encryption-key depositories, built-in back or front door access points, or other similar requirements. Instead, Israel's system emphasizes smooth initial licensing processes and cultivates government-private sector collaboration. These processes help ensure that Israeli authorities are apprised of the latest encryption and cyber...
NBN site visit
Mick and Jordan from some National Broadband Network contractor company arrived this afternoon for the planned site inspection. They were as puzzled as I had been, but we agreed that it probably helps to do the simple things first. So they replaced the NTD, the power supply and the ODU (outdoor unit, i.e. antenna). In the process I discover that they also refer to the NTD as IDU (indoor unit). Replacing the NTD requires registering the new NTD with Ericsson , presumably the part that actually manages the wireless network. That didn't go as smoothly as planned: they had apparently connected it to the wrong cell (antenna) on the tower, resulting in an error indication of red ODU lamp alternating with orange in the two leftmost signal strength indicators.
Cascadia IT Conference CFP Reminder
Call for Participation is open at http://casitconf.org/casitconf16/cfp/ The conference will be in Seattle, WA, on March 11-12, 2106. Submit your proposal by December 25th. If you've never given a presentation at a conference before, consider submitting to a regional conference like Cascadia. It is less intimidating and the audience is very friendly!
Forced Authorization Attacks Against Chip-and-Pin Credit Card Terminals
Clever: The way forced authorisation fraud works is that the retailer sets up the terminal for a transaction by inserting the customer's card and entering the amount, then hands the terminal over to the customer so they can type in the PIN. But the criminal has used a stolen or counterfeit card, and due to the high value of the...
CJ's new computer
CJ has a new computer. He bought one last year, but it didn't have a printer. Recently he was given an old Dell machine with printer, and he wanted to know how to connect to the Internet, and how to move his files across. I asked him to bring the computers when he came, and I would see what I could do. So he showed up with only the new computer. It has a Pentium IV processor! And only 1 GB of memory. By contrast, his old computer has 2 GB of memory and a processor faster than mine . Mine (stable) is Intel Core 2 Duo E6550 with a CPUmark specification of (currently) 1501.
Selling lenses again
Christmas is on its way, a potentially good time to sell some of the camera lenses I've collected and then decided against over the past two years: the Olympus M.Zuiko Digital 14-42mm f3.5-5.6 II R that came with Yvonne's Olympus E-PM2, the Olympus BCL-1580 15 mm f/8 Body Cap Lens and the M.Zuiko Digital 17mm F2.8 Pancake: It took nearly 2 hours, first taking the photos, then putting them up on eBay.
Tom speaking at BackBayLISA in January (Boston)
I'll be giving a presentation called "Transactional System Administration Is Killing Us and Must be Stopped" at the January 2016 meeting of BackBay LISA (BBLISA). This is the same talk I presented recently at LISA, which was very well received. It includes a preview of material from our upcoming 3rd edition of The Practice of System and Network Administration. For more information about the talk, directions to the meeting, and so, on, visit the BBLISA website at http://www.bblisa.org/calendar.html
Still more mutt pain
More investigation of my mutt issues today, without gaining much more understanding. In the end solved the missing file problem the easy way: --- handler.c~ 2015-12-04 14:39:52.352712000 +1100 +++ handler.c 2015-12-05 13:44:48.648690000 +1100 @@ -1419,8 +1419,8 @@ if (piped) safe_fclose (&fpin); - else - mutt_unlink (tempfile); +/* else + mutt_unlink (tempfile); XXX */ But I still have the issue that the OED word of the day displays incorrectly. That's mainly their fault: they supply the message only in HTML (don't get me started), and it's invalid: it doesn't specify the character encoding, which in fact is UTF-8.
Debugging mutt
With some messing around I managed to get urlview to work with mutt. But I still can't display HTML attachments correctly: it just shows me the plain HTML text. Couldn't find anything about that in the documentation, so ran some ktraces, which showed that mutt didn't even try to access mime.types or mailcap. Why not? According to the manual: In order to handle various MIME types that Mutt can not handle internally, Mutt parses a series of external configuration files to find an external handler. The default search string for these files is a colon delimited list set to ${HOME}/.mailcap:/usr/local/share/mutt/mailcap:/etc/mailcap:/etc/mailcap:/usr/etc/mailcap:/usr/local/etc/mailcap where $HOME is your home directory.
Friday Squid Blogging: North Korean Squid Fisherman Found Dead in Boats
I don't know if you've been following the story of the boats full of corpses that have been found in Japanese waters: Over the past two months, at least 12 wooden boats have been found adrift or on the coast, carrying chilling cargo -- the decaying bodies of 22 people, police and Japan's coast guard said. All the bodies were...
BlackBerry Leaves Pakistan Rather Than Provide a Government Backdoor
BlackBerry has chosen to shut down operations in Pakistan rather than provide the government with backdoor access to encrypted communications. Pakistan is a relatively small market, but still....
User-friendly error messages
Seen in Chromium today, after I entered an incorrect URL: This web page is not available DNS_PROBE_FINISHED_NXDOMAIN Isn't that amazing? It's been decades since web browsers did that. ACM only downloads articles once. It's possible that this article has changed since being downloaded, but the only way you can find out is by looking at the original article.
The Moral Dimension of Cryptography
Phil Rogaway has written an excellent paper titled "The Moral Character of Cryptography Work." In it, he exhorts cryptographers to consider the morality of their research, and to build systems that enhance privacy rather than diminish it. It is very much worth reading....
Worldwide Cryptographic Products Survey: Edits and Additions Wanted
Back in September, I announced my intention to survey the world market of cryptographic products. The goal is to compile a list of both free and commercial encryption products that can be used to protect arbitrary data and messages. That is, I'm not interested in products that are specifically designed for a narrow application, like financial transactions, or products that...
xterm icons: finally!
These funny xterm icons with truncated texts irritate me more than I expected. More investigation today, with something like a solution. In misc.c there's the code (abridged): */ void xtermLoadIcon(XtermWidget xw) { #ifdef HAVE_LIBXPM Display *dpy = XtDisplay(xw); ... #else (void) xw; #endif } Was it that HAVE_LIBXPM? Mutilated the name and tried again. Success! The image above with the truncated text is the old icon, and the text below is the new one. That's produced by the x11/xtset program. If I run the cursor over the graphical icon, it displays the entire text, but that doesn't help much.
Civil disobedience or malware?
A week or two ago I found a site that offered noise as a service to help reduce the effectiveness of data retention programmes. The idea is simple: in each page you add this line: <script src="//squawk.cc/squawk.js"></script> According to the page, Deploying this code will cause your web site visitors to make a single request to a random IP address, for every request that you serve with the script tag, in order to add noise to the logs being kept by Australian ISPs.
NBN error recovery
Call from Will at Aussie Broadband this afternoon. The National Broadband Network can't correlate my outage data with their logs, so they think it's a site issue. They want to come and investigate. OK, why not? I think it's a lack of monitoring on their part, but I could be wrong, and at least they're doing something. We made an appointment for Monday 13:00. I'll be interested to see what happens. In the meantime, the dropouts continue: Date Outages Duration Availability Date (seconds) 1449028336 1449028393 57 0.026 # 2 December 2015 14:52:16 2 December 2015 14:53:13 1449035540 1449035597 57 0.504 # 2 December 2015 16:52:20 2 December 2015 16:53:17 1449044086 1449044121 35 0.424 # 2 December 2015 19:14:46 2 December 2015 19:15:21 1449044692 1449044738 ...
New SDHC card
My new SDHC card for my camera has arrived. After spending quite a bit of time determining whether it was genuine, it seemed a good idea to investigate it more closely. The package looked just like in the advertisement. Only read speed specified: But hidden on the back side was an indication of the write speed: Why do they go to such lengths to hide it?
Free talk on surveillance, copyright and DRM tomorrow in Berlin: PINEAPPLE!
I’m in Berlin to speak at OEB, a conference on technology and education. It costs a hefty sum to attend the whole event, but my talk tomorrow at 1200h, “No Matter who’s Winning the War on General Purpose Computing, You’re Losing ” is free. Just show up at the Hotel Intercontinental on Budapester Strasse and... more
Security vs. Business Flexibility
This article demonstrates that security is less important than functionality. When asked about their preference if they needed to choose between IT security and business flexibility, 71 percent of respondents said that security should be equally or more important than business flexibility. But show them the money and things change, when the same people were asked if they would take...
I Cant Let You Do That, Dave: why computer scientists should care about DRM
I have an editorial in the current issue of Communications of the Association of Computing Machinery, a scholarly journal for computer scientists, in which I describe the way that laws that protect digital locks (like America’s DMCA) compromise the fundamentals of computer security. At the Electronic Frontier Foundation, we’re anxious to talk with computer scientists... more
Removing xterm icons
Woke up with the realization that if the xterm icons include the BSD daemon, it must have been added in the port. Off to take a look, and sure enough, the Makefile contained: DISTFILES= ${DISTNAME}${EXTRACT_SUFX}:src1 \ bsd-xterm-icons-${ICONVERSION}${EXTRACT_SUFX}:src2 There was also a post-extract target that moved the files into place. Fine, remove the post-extract and try again. The BSD icons was gone, of course. But replaced by a generic X icon. I'm still no closer to being able to read the icon texts. ACM only downloads articles once.
Samba problems
Into the office this morning to quickly process yesterday's photos. No do: all of eureka's file systems were no longer accessible (via samba) from despair. Why? How can you tell? The only clue was that really nothing had changed since the last access except for having despair hibernate. Or maybe this entry in the log files: Dec 1 07:56:39 eureka smbd[99525]: [2015/12/01 07:56:39.274663, 0] ../source3/lib/messages.c:346(messaging_reinit) Dec 1 07:56:39 eureka smbd[99525]: messaging_dgm_init failed: Permission denied Dec 1 07:56:39 eureka smbd[99525]: [2015/12/01 07:56:39.281132, 0] ../source3/lib/util.c:480(reinit_after_fork) Dec 1 07:56:39 eureka smbd[99525]: messaging_reinit() failed: NT_STATUS_ACCESS_DENIED Dec 1 07:57:06 eureka smbd[99539]: [2015/12/01 07:57:06.728100, 0] ../lib/util/pidfile.c:153(pidfile_unlink) Dec 1 07:57:06 eureka smbd[99539]: Failed to delete pidfile /var/run/samba4/smbd.pid.
One Amazon Year
December first made it a year here at Amazon Vancouvers engineering castle in the sky. Im working with good people in a cool office on interesting stuff. Its at the white-hot center of server-side computing but surprisingly unsurprising. Making vs talking It turns out that building and shipping nontrivial software is a lot harder work than evangelizing it and writing about it. I come home awfully damn tired some days. Im less engaged in the Internet conversation and miss that some, but Ive tasted more of that joy than almost anyone. And then the actual stuff Im working on making AWS more useful while keeping it reliable is so blindingly obvious that it doesnt really need evangelizing.
Tracking Someone Using LifeLock
Someone opened a LifeLock account in his ex-wife's name, and used the service to track her bank accounts, credit cards, and other financial activities. The article is mostly about how appalling LifeLock was about this, but I'm more interested in the surveillance possibilities. Certainly the FBI can use LifeLock to surveil people with a warrant. The FBI/NSA can also collect...
Wide-ranging interview (surveillance, DRM, copyfight, climate, class war) in the Sydney Morning Herald
Chris Zappone’s published a long, wide-ranging interview with me in the Sydney Morning Herald where I try to connect the dots between digital rights, surveillance, climate change, and wealth disparity. Doctorow points to the internet itself and inequality two things that have a surprising link. “I think wealth inequality is related to the internet... more
Unacceptable network performance
I've complained in the past about the reliability of my National Broadband Network connection. Since I started keeping logs 21 months ago we have had 205 outages! Today alone there were 9, and since 26 November 2015 there have been 16: Date Outages Duration Availability Date (seconds) 1448476513 1448476526 13 0.009 # 26 November 2015 05:35:13 26 November 2015 05:35:26 1448498696 1448498752 56 0.162 # 26 November 2015 11:44:56 26 November 2015 11:45:52 1448587783 1448587822 39 0.040 # 27 November 2015 12:29:43 27 November 2015 12:30:22 1448595997 1448596022 25 0.440 # 27 November 2015 14:46:37 27 November 2015 14:47:02 1448599962 1448600008 46 0.914 # 27 November 2015 15:52:42 27 November 2015 15:53:28 1448712959 1448712972 13 0.032 # 28 November 2015 23:15:59 ...