Back at my alma mater, one of the students (who thought he was clever) founded an ISP that provided 802.11b wireless access to apartments on campus. Inevitably, the WEP key he used was compromised, and student account passwords were sniffed and abused. Now, common sense would dictate that he shouldn't be responsible for what a criminal does with his network; but common sense does not reign supreme in the ivory tower of academia. What happened next was shocking: the student was disciplined, expelled, and sued for damages by the state college. Although he certainly could have won his case in front of a jury, he settled because he could not afford $15k to hire a good trial lawyer. Right now he has no degree, can't get into a good school, and is pumping gas for a living.
So, if you are considering rolling out a notoriously insecure network architecture (such as 802.11[ab]), consider the fact that you may be personally liable for anything bad that a crook does with your network. Be afraid.
I know that defending the right of corporations to enforce intellectual
property rights here is nearly suicidal, but I feel I must comment on this
matter. Philips and friends lose literally millions of dollars a year to
companies who make DVD players without licensing the patents behind the
players. What's more, these players often have serious compatibility
problems which cause headaches for users and content providers alike:
They don't run native code. Most DVD players support a modified
version of the Z-80 instruction set which DVDs can use to render menus,
omit scenes when a ratings limit is lowered, and handle substitution of
audio without mis-synching actors' lips. These bootleg DVD players do not
properly implement all of the instructions and may not work right with many
DVDs.
Content protection. Macrovision is an unbreakable encryption system
that keeps pirates from copying DVDs onto VHS tapes or video CDs. Many
bootleg players do not implement it so we can expect the rate of piracy to
skyrocket.
Compatibility with layers. Most bootleg DVD players have serious
trouble handling two-layer discs, meaning that the users' experiences are
affected in a very bad way.
Hackability. Most bootleg players run an embedded unix operating
system, like linux, and can be tampered with easily by malcontents.
It is for these reasons that we must all stand up and oppose the
manufacture and sale of unlicensed DVD players.
This move represents the latest step that Darren Reed has taken to attempt
to gain control over open source operating systems that incorporate his
packet filter. He has expressed the belief, on many newsgroup postings,
that he deserves a place on the *BSD teams (as at least a committer)
because of the way that his product has increased market share for the
BSDs. And he continues to attempt to hold those distributions hostage
until they bend to his will. His eventual goal is to release a
closed-source BSD that incorporates his filter, because he cannot stand to
give the public the right to modify and redistribute his precious code.
Well, Darren, we have news for you: your packet filter is not "all that."
IPtables and Rusty's Netfilter code has been kicking ipfilter's proverbial
ass since the first release of Linux 2.4, both in terms of features and
security. Linux has not had issues dealing with the simple
cases that have caused your firewall to fail. Theo de Raddt and the
ipfw team have come up with far superior solutions to your product, and
your attempted coup will hurt your market share even more.
Darren, listen to your users - change your license or perish.
One of my buddies is a manager at SGI and he's not quite as optimistic as
the P.R. folks are. He said that there were several reasons for their
business slowdown, and none of them were easy to solve:
Consumer-grade video hardware has quickly outpaced SGI's best
offerings. A GeForce3 has the same processing power as their best
offerings from just two years ago, and doesn't cost as much as a new
car.
Management issues cripple the company. The lack of profits through the
year 2000 weren't a result of low demand; they were a result of running a
bloated, disorganized company that didn't know what their resources were
or how to use them.
Morale is at an all-time low. Coupled with the fact that the market
for high end hardware is very weak headed into 2002, they are going to have
at least a few more rough quarters.
Expenses are killing them. They spend millions of dollars a year
supporting Windows NT clients, open source efforts, and R&D into doomed
technologies like the Itanium. Since few of these things will ever pay off
in our lifetime, the money is as good as wasted.
The market has spoken, and the message is clear: proprietary technologies
are on the way out. Even Sun, the mother of all vendor lock-in schemes,
has started to use standard PC components in building their machines. SGI
can still sell to their niche market, but they need to severely narrow
their focus and cut a good deal of fat before they can be profitable
again.
For over a year and a half, I worked toward a Master's degree in Economics.
I did my thesis on the Euro conversion, as the subject had come up numerous
times during the course of my studies. The great mystery behind the Euro
was the question of why the European banks felt the need to even bother
with an expensive, difficult conversion to a single currency. After all,
different currencies for different countries made a lot more sense: the
value of each country's currency fluctuated based on the relative trading
strength of the nation. It was a very fair, consistent system. And the
introduction of the Euro would hopelessly skew or destroy the currency
markets that brought prosperity to so many speculators and traders.
But now we understand the true intent of the Euro advocates: control.
Giving the consumer choice in the currency in which he deals, and giving
him the sole discretion in the use of his currency, has been something the
banks have opposed for decades. Like the RIAA and intellectual property
holders, the banks didn't just want to control the flow of money;
they wanted to be able to control its use as well. Imagine the
possibilities: marketing, based on cash usage; retroactive invalidation of
paper currency, based on your credit history; tracking of every move you
make, even if you shun the "smart cards" and other intrusive,
privacy-invading inventions. When you can't use anonymous cash and
bartering is rarely an option, you have no choice but to allow the banks to
keep you under their watchful gaze. And when the government wants to know
where you're spending your money, the banks won't hesitate to let them
know.
This is why we must all reject the Euro, before it is too late. We must
standardize on the dollar, a symbol of freedom and privacy. The USA,
despite its poor track record under the current administration, is the only
country I would trust not to invade our lives through the currency we use.
Given that the USA has more civil rights organizations than most countries
have citizens, we are in very good shape here and can be assured that the
dollars of the future will not have embedded RF transmitters.
I took a computer ethics course once. One of the cliches that I learned
there was that "just because we can do something with technology
doesn't mean we should."
As a computer security professional, I am often reminded of that quote when
I read about new networking technologies. And I stop to ask myself: is the
added convenience of adopting this technology really worth the potential
risk of allowing complete strangers who might not have our best interests in mind to access
our networks and see our traffic?
The classic counterargument that I usually hear to my pessimitic remarks is
something along the lines of "encryption is a panacea," in so many words.
But is it really? Is the HomePlug(tm) product really designed well enough
to keep intruders from peeking into my personal life? Well, let's think
about a couple of points:
Encryption schemes get weakened or broken. That makes a
"useless" collection of your sniffed packets very useful for the snoop who
hasn't erased his logs yet.
40 bit WEP didn't work. 128 bit WEP was broken soon after it was
introduced. Apparently more bits doesn't help when there are easier ways
to break these systems than with brute force.
Traffic patterns can easily be deduced from encrypted communications.
I'm not a big fan of Solar Designer, but I'll admit that the work he did in
analyzing SSH and guessing passwords based on keystroke timing was
brilliant. Who's to say that somebody won't find a way to do that for some
sort of wireless transmissions?
This does nothing to prevent DoS attacks. So if you anger your
next-door neighbor, he will probably try to flood your network with crap.
As a computer geek, I know this would make my life miserable.
And that just scratches the surface. When will people ever learn that
shared mediums (the RF spectrum, power lines, and the like) are just not
good solutions? Maybe people just need to get off their asses and run
Cat5e through their houses like the rest of us do. It will save them
countless headaches in the future.
We, as (mostly) educated computer professionals, understand the importance
of researching nanotechnology. Nanotechnology will inevitably help cure
diseases, create "smart" materials like insulation and clothing, and
generally wean us off our dependence on hard-to-produce, expensive natural
resources like body tissues and cotton.
Unfortunately, our current Congress and administration is not as fortunate
as we are. Stuck in the 19th century, the successors of Newt have shown us
that they are not interested in civil rights, advancements in medicine,
or pretty much anything that doesn't involve increasing pork-barrel
spending on defense. I would be surprised to find out that more than a
handful of Republicans in Congress actually have college degrees. They
don't need to think; everything is a matter of dollars and cents.
Although this should come as no surprise to a nation that voted Republican
for the past few years, our leaders' refusal to act like they are living in
the 21st century is going to have a very negative impact on science, as
their core constituencies have no
interest in keeping the USA's status as the most advanced nation in the
world.
So, these nanotech lobbyists would be well advised to keep a low profile
until Gore returns to the White House in 2004. Otherwise, they may be
headed to Washington with their hands out and leaving Washington with their
research banned. And that would not be good for science.
And 'rpm -U' doesn't say a single word when I install an unsigned package. By the time I could see that the package was unsigned (and potentially a copy of magiclantern-i386.rpm), it would be too late.
Distributions should reject packages that aren't signed with a trusted key by default. And make the user specify the --really-install-an-untrusted-package flag in order for the package manager to accept it.
Installing a new program could take several extra hours if I were forced to download, audit, and compile the source.
The super-paranoid will be safe from Magic Lantern because they probably don't upgrade software often and they probably patch security holes themselves. But for the rest of us who want to *use* our computers, this is an enormous problem.
As an administrator of several Linux boxes at work and at home, I was
wondering whether or not I could be affected by the "Magic Lantern"
program. The results came in, and quite frankly, I am frightented.
To start, I talked with my colleague's brother, "Joe," who is a criminal
defense attorney. Joe told me that he has been following the Magic Lantern
debate very closely, because his sources indicate that the FBI will be
using it in many, many cases to prevent the possibility of seizing
equipment with undecryptable data on it. In fact, it has been rumored that
the proposed new FBI policy regarding searches of premises requires agents
to attempt to use Magic Lantern (which technically counts as a consensual
search) prior to even obtaining a warrant, if the warrant is to seize
computer hardware.
Joe is not very familiar with computer technology, but he did say that a
large part of the Magic Lantern program involves contacting ISPs to allow
the FBI to alter network data destined for the suspect's computer. I will
take that at face value because they seem to have no problem pulling rank
on ISPs. I suspect that their "do it or we'll arrest you" attitude plays a
big part in this.
With all of that in mind, I decided to find out just how vulnerable I was.
I set up a stock Debian 2.2r3 box, and a stock Red Hat 7.2 box. Both used
the installation CDs produced at least a few months ago, so they were both
vulnerable to the wu-ftpd exploit and would need to be upgraded for
production use.
My goal was simple: I needed to play the part of the FBI, and trick my
machines into accepting a trojaned version of the new wu-ftpd package.
First, I set up a transparent proxy on my gateway box, which is used to
split my cable modem connection amongst my home machines and those of
several neighbors. I used a program called "squirm" to rewrite URLs ending
in.deb or.rpm so that they would be redirected to my local web server,
from which the trojanned.deb and.rpm files would be served.
Second, I produced trojaned.deb and.rpm files. The.deb file was
trivial to modify, as only a checksum stood between me and a valid hacked
version. The.rpm was a bit more difficult, because RedHat signs their
packages with a PGP key. However, once I rebuilt the package and did not
sign it with PGP, I had a fixed package.
Third, I went to the Debian box and typed 'apt-get update ; apt-get
upgrade'. After a few routine prompts, none of which triggered security
alerts, the box was rooted by my "custom" package.
Fourth, I went to the Redhat box and did an 'rpm -U' pointed at the
updates.redhat.com server. I got my trojanned RPM back, with no warnings
or prompts to tell me it hasn't been signed. And I had an ftp server with
a new backdoor up in a matter of minutes.
So, to summarize: the FBI can easily set up a transparent proxy between you
and the Internet, and trick your OS into installing malware. You're damned
if you do and you're damned if you don't, because you need to download the
wuftpd-of-the-week sometime.
As a matter of comparison, my Windows 2000 box has no such vulnerability.
The first time I went to Windows Update, I checked the box that said
"always trust content from Microsoft Corporation." Therefore, only
Microsoft's real certificate will be accepted by my machine. Even if the
FBI forces Verisign to issue an impostor certificate, it will be detected
and thwarted.
Linux distributions need to band together and find a trusted individual who
will be responsible for signing all packages and verifying that they do not
contain backdoors. That is the only way to solve this issue. Personally,
I nominate Eric Raymond, because of his widespread respect from the
community and business leaders alike. Additionally, he is a staunch
libertarian and would not cave to government pressure to insert backdoors
into something that he has signed. I believe that by charging the
distribution vendors a small fee per package, ESR can again achieve
financial success for himself and his family.
This is a serious issue for Linux users and I believe it should have been
addressed years ago. That said, now is not too late and definitely not too
early. I look forward to seeing this feature in all future releases of the
major Linux distributions.
As a customer who was defrauded by a merchant who used Paypal, I believe
that Paypal would make good business sense for you and be very bad for your
customers. I bought a cordless phone from an ebay merchant who never
delivered it, and paid with Paypal about 3 months ago. Paypal only
recently *started* to investigate my claim, and I was forced to dispute the
charge with my bank instead. Their number (650-251-1100, culled from
whois) is not even on their site and the customer service reps are quite
useless.
If you ever "go bad" and decide to start screwing people, Paypal is your
weapon of choice. If you are a scrupulous merchant, Paypal is probably the
best way to go because there will be few complaints on either side of the
transaction. As I am also an ebay power seller who uses Paypal, things
have been just fine on that side of the table as well.
My Uncle Isaac used to work on the Passport team at Microsoft, but he
eventually got seriously fed up with the company is now a NT/UNIX sysadmin
elsewhere. He is very skeptical of the DoJ settlement and thinks that MS will
be with us for a very long time to come unless the terms are changed
substantially.
I spoke with Uncle Isaac on several occasions regarding his favorite stock
pick, MSFT. He
explained that from day one, he knew that Microsoft was one of the most
nimble companies that ever existed. Pointing out their rapid turnaround in
the browser wars and in internet integration, he said that with billg at
the helm, Microsoft would always prosper.
"What about.Net," I asked. "Do you really expect that thing to
succeed?"
".Net will put Microsoft in a position more powerful than any other company
in the nation." When I pressed for details, he explained what Microsoft
was planning to do:
.Net is not just about replacing web servers with web services..Net is
about promoting Passport. But what does Passport have to offer users?
Maybe a little convenience, but most users won't think the tradeoff is
worth it.
Passport, in fact, is going to be marketed to web site owners. Sure,
personal information is sometimes fun to have, but that isn't the main
attraction. Microsoft plans to offer Passport up as a system to facilitate
micropayments. They are targeting the owners of the manyunprofitableinformationsites that are being propped up by venture
capital (and pathetically meager ad revenues) today. This will
force users to use Passport and pay for the information they receive off
the web, with Microsoft taking a cut every time. Microsoft will become the
largest middleman in the world, and multinational banks will look on in
envy.
As a technical matter, this isn't a very difficult thing to do, but it
needs a strong, reliable company with a good name, like Microsoft, to hold
it up and to fund it during tough times. Microsoft has shown itself to be
willing to subsidize many unprofitable ventures (such as IE and Bob) in
order to attain a stronger position in the market, so it should come as no
surprise that Passport will work the same way.
And, after Passport has taken over, there will be no more need for
Linux/Apache on commercial sites. Microsoft can't compete with us
directly, so they will destroy our market share by making the economics
favor their product. We can give them Free software but Microsoft can sell
them a big profit.
We, as the open source community, need to come together to stop this plan
dead in its tracks. We can't rely on our government to do it for us, so we
need to innovate and find ways to stop Microsoft. Maybe a bunch of open
source hackers can get together and start producing macro virii and IIS
worms nonstop, so that users are more aware of the poor security afforded
by Microsoft products and services. Perhaps frequent DDoS attacks on
Passport-compliant web sites are in order. Or maybe something completely
different. Either way, we need to do something, so that Microsoft
does not use Passport to take the internet away from us.
My Uncle Isaac used to work on the Passport team at Microsoft, but he
eventually got seriously fed up with the company is now a NT/UNIX sysadmin
elsewhere. He is very skeptical of the DoJ settlement and thinks that MS will
be with us for a very long time to come unless the terms are changed
substantially.
I spoke with Uncle Isaac on several occasions regarding his favorite stock
pick, MSFT. He
explained that from day one, he knew that Microsoft was one of the most
nimble companies that ever existed. Pointing out their rapid turnaround in
the browser wars and in internet integration, he said that with billg at
the helm, Microsoft would always prosper.
"What about.Net," I asked. "Do you really expect that thing to
succeed?"
".Net will put Microsoft in a position more powerful than any other company
in the nation." When I pressed for details, he explained what Microsoft
was planning to do:
.Net is not just about replacing web servers with web services..Net is
about promoting Passport. But what does Passport have to offer users?
Maybe a little convenience, but most users won't think the tradeoff is
worth it.
Passport, in fact, is going to be marketed to web site owners. Sure,
personal information is sometimes fun to have, but that isn't the main
attraction. Microsoft plans to offer Passport up as a system to facilitate
micropayments. They are targeting the owners of the manyunprofitableinformationsites that are being propped up by venture
capital (and pathetically meager ad revenues) today. This will
force users to use Passport and pay for the information they receive off
the web, with Microsoft taking a cut every time. Microsoft will become the
largest middleman in the world, and multinational banks will look on in
envy.
As a technical matter, this isn't a very difficult thing to do, but it
needs a strong, reliable company with a good name, like Microsoft, to hold
it up and to fund it during tough times. Microsoft has shown itself to be
willing to subsidize many unprofitable ventures (such as IE and Bob) in
order to attain a stronger position in the market, so it should come as no
surprise that Passport will work the same way.
And, after Passport has taken over, there will be no more need for
Linux/Apache on commercial sites. Microsoft can't compete with us
directly, so they will destroy our market share by making the economics
favor their product. We can give them Free software but Microsoft can sell
them a big profit.
We, as the open source community, need to come together to stop this plan
dead in its tracks. We can't rely on our government to do it for us, so we
need to innovate and find ways to stop Microsoft. Maybe a bunch of open
source hackers can get together and start producing macro virii and IIS
worms nonstop, so that users are more aware of the poor security afforded
by Microsoft products and services. Perhaps frequent DDoS attacks on
Passport-compliant web sites are in order. Or maybe something completely
different. Either way, we need to do something, so that Microsoft
does not use Passport to take the internet away from us.
df
As a certified electrician...
on
Wiring A New House?
·
· Score: 5, Insightful
I have pulled cable in several new construction projects and I have a few tips that will save you a lot of headaches in the future:
Run conduit. Big conduit. There's a lot of space between your walls so why not leave yourself the room you will need to expand later?
You can buy 25-pair (!) Cat5e cable. It costs about twice as much as 4-pair but it is well worth it for expansion reasons. There's not a whole lot you can't do with 25 pairs.
Don't forget to buy plenum wiring, which does not emit toxic fumes when it burns. It's probably code in your area. I have seen bean counting managers cheap out and buy generic cable, and get fined thou$ands of dollars for it.
Coax isn't a bad idea, especially in a residential installation. You never know when you will want cable/DSS in a room.
Run a string between any two points where it makes sense, and mark the strings so you know what you're pulling later.
Don't bother with fiber. It is overpriced and will remain so for quite a while. Copper is good enough for gigabit ethernet and will provide all the bandwidth you need (within one building at least) for a very long time to come.
My roommate interviewed for a position at WebRing.org while they were in the middle of the Yahoo acquisition, and he revealed a dirty little secret that the interviewer let slip: Yahoo wanted to lay low for a little while to keep building critical mass, then implement interruption based advertising so that in order to get to the next site in the ring, users would be forced to sit through a 10-second Flash animation (probably coupled with a few pop-under X-10 ads).
Naturally, the waning popularity of webrings in general made it an economic reality that the ad revenues generated wouldn't even cover the cost of running the service. So, Yahoo dropped it, predictably enough.
What Yahoo! does makes a lot of business sense. However they are forsaking a large amount of goodwill as they acquire and corrupt various sites that used to be very nice resources. Alas, that is the way of the capitalist. I can't say I'll feel sorry when it comes back and bites them later.
df
P.S. My roommate got the job offer but, fearing imminent layoffs, did not accept.
One of my buddies works at a competing manufacturer and has some very promising news about these displays. Although I'm not sure what the case is for the Philips units, production and deployment of his company's product is scheduled to be ramped up in February, with consumer products hitting the market around March 15th. Some of the tidbits that he leaked to me were:
The baseline, mass market model will have a resolution of 64dpi and cost roughly $0.50 per square inch for displays between 6 and 24 square inches. This includes the circuitry required to interface to an 8051 or other mpu.
A serial interface (ideal for connecting to a PC or BASIC stamp) will be offered around September 2002.
Resolutions of 128dpi and 256dpi will be available, albeit at a substantially increased cost.
These units take about 0.003 uA/pixel, which is substantially less than current LCD and OLCD offerings.
Work is being done to make the drivers' jobs easier. For instance, advances have been made that allow the driver to get away with only refreshing static data once every 3.5 seconds.
If this becomes law, it will afford us a powerful weapon against telemarketers. Just as MAPS and ORBS (used to) maintain registries of problematic mail relays, we can maintian a registry of telemarketers. What can we do with this? Well,
Telemarketers are regulated under Federal law. If many people complain about a given telemarketer, their sworn statements could be use to severely increase the penalties to particularly abusive companies.
Statistics can be collected to create a "most annoying companies" list.
Blacklists can be created to discourage consumers from patronizing companies with evil telemarketing practices.
Users with an always-on connection can query a MAPS-like server in real time to determine whether to answer an incoming call with a handset or with a screeching 'ATA' modem tone.
Since so many of my friends show up as "unavailable" on my caller ID, I welcome this measure with open arms as a way to sort the wheat from the chaff.
As a long-time Omnisky customer, this is a very good thing for me. In Omnisky's final weeks, my service went from good to nonexistent. Apparently, routers and other equipment went down and nobody was left to reboot them. Getting through to customer service was next to impossible.
Start-ups are cute, but Internet access should be left to the experienced companies who have half a clue what they are doing (both on the service end and on the profitability end). Earthlink has an excellent track record, and as a sort of a charnel house for the corpses of dead ISPs (like Juno and such), it has a proven track record in providing services and making a profit at the same time.
I hope that Earthlink's abundance of clue will last for a long time and assure us Omnisky users quick, uninterrupted service for many years to come.
df
Hardly a panacea
on
Why ADCo?
·
· Score: 3, Interesting
My community has at least three ADCOs that I know of; they are all local
companies who want to offer broadband. Two are running copper lines and
one is running fiber. (For the record, I'm not quite willing to give up my
DSL line until these guys start turning a profit.)
One of the major problems with ADCOs is, predictably enough, running the
cables. Overhead and buried cables are usually prohibitively expensive,
which is why the only way the telecom/cable companies were able to afford
them was with subsidies and legislated monopoly status. Therefore the
companies are forced to use sewers and other undesirable underground
networks to run cable. And this is where the problems begin.
The sewers in my town are extremely old and small. There are frequently
"conflicts" among the carriers when installing and maintaining these
cables. Rain has proven to be an issue, as have insects and other much
larger creatures. Running these cables in sewers is decidedly jury-rigged
and isn't going to work out as a long-term solution.
One of the ADCO companies was considering transmitting signals through
water supply lines (!). They claimed that there was a significant amount
of potential bandwidth in the water supply network. I am not sure if that
ever came to pass.
But one thing is sure: whether it be 802.11b wireless or something else,
some other technology is going to be needed to replace the
sewer-and-heating-duct kind of cabling that ADCOs rely on.
df
This could be used to fight terrorism
on
Quantum Holography
·
· Score: 0, Troll
Currently, we are at war with an enemy we cannot see who lurks within our
borders. Our lawmakers want to try to find this enemy by relaxing the
government's self-imposed limitations on searches and seizures, so that it
is easier to determine whether a given individual is carrying items that
may be used in an act of violence.
This technology could change everything. Rather than giving law
enforcement officers the right to search and harass individuals who fit a
"profile" (which, by itself, tends to favor searching Arab and other Middle
Eastern types), the government could instead mandate the use of a
holographic device such as the one described in this article. The
advantages of this approach is that it is not invasive (people will not be
embarrassed or inconvenienced by needless searches) and that it would be
more effective because it could quickly be used to scan, say, every bag or
container in an airport.
This sort of device would also render body cavity searches obsolete.
Rather than training LEOs to probe peoples' orifices in a vain attempt to
find drugs or weapons, people could be seamlessly screened as they enter
"sensitive" buildings. These devices would do for terrorism what store
security cameras did for shoplifting: nearly stop it dead in its tracks.
I, for one, would rather see law enforcement widely deploy these devices,
rather than subject me to degrading searches. Certainly the majority of
Americans feel the same way. We can have our cake and eat it too.
I used to work closely with a development team that made the transition
from a proprietary (and, may I add, unmaintainable and unreliable) embedded
OS to Linux. Though some of the concerns in the article did come up,
especially speed and size issues, those didn't hurt us much. After all, we
could afford a better processor and more memory with the money we saved on
royalties and maintenance expenses - these were substantial.
Unfortunately, if the many features of Linux and the transition from
assembler to C didn't hurt us, the licensing did. Things went very
smoothly until we needed to make some big changes to the kernel to
accomodate a newer version of our hardware. At that point, there was a
schism in the group: some of the developers wanted to change the kernel and
release the product without source (the "who would find out?" crowd) and
the rest of us knew that Linux was not going to fit our needs anymore
unless we wanted to give our work away to competitors.
Well, the "who would find out?" crowd won the first round, and because of
release deadlines we "slipped" the kernel changes into the next version of
the product. And nobody knew. Except one of us told the legal department
about what happened and they became very agitated.
Now our software runs on embedded NetBSD. It wasn't quite as robust as
embedded Linux but it works well and we really can't complain.
Transitioning to a new OS took a lot of effort but it was a necessary evil.
After all, we couldn't risk getting sued out of existence to save a little
money.
But the question I draw from this is: why not relax the GPL restrictions a
bit for embedded applications? It seems like this area of the market will
never be dominated by Linux until companies can stop fretting about
licensing problems and start concentrating on coding instead.
A few years ago I worked as a sysadmin at a moderately large company. We
had a pretty big turnover problem because our company's marketing efforts
tended to attract job applicants who were "green" college grads, lazy,
troublemakers, and looking for a "fun" workplace with foosball tables and
free snacks. Needless to say, they did not fit in at the Fortune 500
company where I worked.
One of these employees got bored with his coding tasks and, with no
previous exposure to a broadband Internet connection, apparently decided to
become a script kiddie on company time. From all outward appearances, he
got pretty good at it, but one day it caught up with him: U.S. Marshals
came into my office and served me with a court order that asked for many,
many pieces of information that would tell them who had been cracking
systems from our corporate network.
I had no problem turning this information over, as the other choice was to
go to jail and let the hacker go free. However, I was appalled with the
way the marshals treated me: they knew that I was just the sysadmin,
not the perpetrator, but they still treated me like a criminal. When I
told them that our NAT setup doesn't keep logs of every single outgoing
connection from our network (as had been requested in the court order) they
got really pissed off and started threatening me. At that point I told
them that I was not going to do anything for them without talking to
counsel, and they backed off.
So, the moral of the story here is that law enforcement needs to show more
respect for sysadmins, and learn the difference between a network admin and
a criminal on the admin's network. Treating everybody as though they are
all guilty will only build resentment and get in the way of getting their
precious case solved.
Space, like so many other industries and programs throughout the years,
has seen tremendous advances in technology, accomplishments, and workforce
skill. It is often speculated that eventually many people will live for
years, or forever, on other planets or in human-friendly space stations.
This helps ease overcrowding of Earth, and helps people experience new
living environments.
However, it seems as though most nations' space programs don't feel the
same way about that egalitarian vision. They don't think space is the
final frontier for everyday citizens; they don't want space travel to
become commoditized. NASA, and now the Russian space agency, want to use
space as a perk to sell to very wealthy businessmen. They want money,
influence with politicians, or both. Regardless, these agencies are using
taxpayer money to pamper the rich, and it is high time to stop this
abuse.
Mind you, I am not against rich people. My brother has a net worth of over
three million dollars. I am simply against letting the government use its
considerable power to reward those who have already been rewarded by the
capitalist system. Why reward people twice for the same deed? I don't win
an award or see the government kissing my behind every time I collect a
paycheck. Why should really rich guys be any different?
Astronauts are hired because of their physical strength and courage, their
technical abilities, and their personalities. They should not be selected
on the basis of their bank account balances. We should work toward letting
astronauts do their jobs, without interference from wealthy joy-riders who
feel like they have to ride into space before they die, just because they
can.
The patent office needs to walk a fine line in cases like this. They
cannoy accept patents that are merely a difference in "scale" (for
instance: speed, convenience, size, and such) unless they can show that the
difference in scale is so substantial that it is really a difference in
kind: that the device is really different from its predecessors
because the scale has changed so dramatically.
For instance, an archive of VHS tapes and a computer would not be eligible
for a patent, because it is significantly more complex for the user (and
probably could not even be marketed). The Replay units are very easy to
use and small, and the technology that makes that possible is considered
eligible for patent protection.
I talked with one of our company's patent attorneys and he said that the
"scale" issue was not a problem here, but he doubted that such an obvious
patent would stand up in court. He expects SonicBlue to get whupped in
court, Rambus-style, if Tivo and the other competitors don't capitulate
first. (Good.)
Slashdot Mirror
Back at my alma mater, one of the students (who thought he was clever) founded an ISP that provided 802.11b wireless access to apartments on campus. Inevitably, the WEP key he used was compromised, and student account passwords were sniffed and abused. Now, common sense would dictate that he shouldn't be responsible for what a criminal does with his network; but common sense does not reign supreme in the ivory tower of academia. What happened next was shocking: the student was disciplined, expelled, and sued for damages by the state college. Although he certainly could have won his case in front of a jury, he settled because he could not afford $15k to hire a good trial lawyer. Right now he has no degree, can't get into a good school, and is pumping gas for a living.
So, if you are considering rolling out a notoriously insecure network architecture (such as 802.11[ab]), consider the fact that you may be personally liable for anything bad that a crook does with your network. Be afraid.
df
- They don't run native code. Most DVD players support a modified
version of the Z-80 instruction set which DVDs can use to render menus,
omit scenes when a ratings limit is lowered, and handle substitution of
audio without mis-synching actors' lips. These bootleg DVD players do not
properly implement all of the instructions and may not work right with many
DVDs.
- Content protection. Macrovision is an unbreakable encryption system
that keeps pirates from copying DVDs onto VHS tapes or video CDs. Many
bootleg players do not implement it so we can expect the rate of piracy to
skyrocket.
- Compatibility with layers. Most bootleg DVD players have serious
trouble handling two-layer discs, meaning that the users' experiences are
affected in a very bad way.
- Hackability. Most bootleg players run an embedded unix operating
system, like linux, and can be tampered with easily by malcontents.
It is for these reasons that we must all stand up and oppose the manufacture and sale of unlicensed DVD players.df
Well, Darren, we have news for you: your packet filter is not "all that." IPtables and Rusty's Netfilter code has been kicking ipfilter's proverbial ass since the first release of Linux 2.4, both in terms of features and security. Linux has not had issues dealing with the simple cases that have caused your firewall to fail. Theo de Raddt and the ipfw team have come up with far superior solutions to your product, and your attempted coup will hurt your market share even more.
Darren, listen to your users - change your license or perish.
df
- Consumer-grade video hardware has quickly outpaced SGI's best
offerings. A GeForce3 has the same processing power as their best
offerings from just two years ago, and doesn't cost as much as a new
car.
- Management issues cripple the company. The lack of profits through the
year 2000 weren't a result of low demand; they were a result of running a
bloated, disorganized company that didn't know what their resources were
or how to use them.
- Morale is at an all-time low. Coupled with the fact that the market
for high end hardware is very weak headed into 2002, they are going to have
at least a few more rough quarters.
- Expenses are killing them. They spend millions of dollars a year
supporting Windows NT clients, open source efforts, and R&D into doomed
technologies like the Itanium. Since few of these things will ever pay off
in our lifetime, the money is as good as wasted.
The market has spoken, and the message is clear: proprietary technologies are on the way out. Even Sun, the mother of all vendor lock-in schemes, has started to use standard PC components in building their machines. SGI can still sell to their niche market, but they need to severely narrow their focus and cut a good deal of fat before they can be profitable again.df
But now we understand the true intent of the Euro advocates: control. Giving the consumer choice in the currency in which he deals, and giving him the sole discretion in the use of his currency, has been something the banks have opposed for decades. Like the RIAA and intellectual property holders, the banks didn't just want to control the flow of money; they wanted to be able to control its use as well. Imagine the possibilities: marketing, based on cash usage; retroactive invalidation of paper currency, based on your credit history; tracking of every move you make, even if you shun the "smart cards" and other intrusive, privacy-invading inventions. When you can't use anonymous cash and bartering is rarely an option, you have no choice but to allow the banks to keep you under their watchful gaze. And when the government wants to know where you're spending your money, the banks won't hesitate to let them know.
This is why we must all reject the Euro, before it is too late. We must standardize on the dollar, a symbol of freedom and privacy. The USA, despite its poor track record under the current administration, is the only country I would trust not to invade our lives through the currency we use. Given that the USA has more civil rights organizations than most countries have citizens, we are in very good shape here and can be assured that the dollars of the future will not have embedded RF transmitters.
df
As a computer security professional, I am often reminded of that quote when I read about new networking technologies. And I stop to ask myself: is the added convenience of adopting this technology really worth the potential risk of allowing complete strangers who might not have our best interests in mind to access our networks and see our traffic?
The classic counterargument that I usually hear to my pessimitic remarks is something along the lines of "encryption is a panacea," in so many words. But is it really? Is the HomePlug(tm) product really designed well enough to keep intruders from peeking into my personal life? Well, let's think about a couple of points:
- Encryption schemes get weakened or broken. That makes a
"useless" collection of your sniffed packets very useful for the snoop who
hasn't erased his logs yet.
- 40 bit WEP didn't work. 128 bit WEP was broken soon after it was
introduced. Apparently more bits doesn't help when there are easier ways
to break these systems than with brute force.
- Traffic patterns can easily be deduced from encrypted communications.
I'm not a big fan of Solar Designer, but I'll admit that the work he did in
analyzing SSH and guessing passwords based on keystroke timing was
brilliant. Who's to say that somebody won't find a way to do that for some
sort of wireless transmissions?
- This does nothing to prevent DoS attacks. So if you anger your
next-door neighbor, he will probably try to flood your network with crap.
As a computer geek, I know this would make my life miserable.
And that just scratches the surface. When will people ever learn that shared mediums (the RF spectrum, power lines, and the like) are just not good solutions? Maybe people just need to get off their asses and run Cat5e through their houses like the rest of us do. It will save them countless headaches in the future.df
Unfortunately, our current Congress and administration is not as fortunate as we are. Stuck in the 19th century, the successors of Newt have shown us that they are not interested in civil rights, advancements in medicine, or pretty much anything that doesn't involve increasing pork-barrel spending on defense. I would be surprised to find out that more than a handful of Republicans in Congress actually have college degrees. They don't need to think; everything is a matter of dollars and cents.
Although this should come as no surprise to a nation that voted Republican for the past few years, our leaders' refusal to act like they are living in the 21st century is going to have a very negative impact on science, as their core constituencies have no interest in keeping the USA's status as the most advanced nation in the world.
So, these nanotech lobbyists would be well advised to keep a low profile until Gore returns to the White House in 2004. Otherwise, they may be headed to Washington with their hands out and leaving Washington with their research banned. And that would not be good for science.
df
Distributions should reject packages that aren't signed with a trusted key by default. And make the user specify the --really-install-an-untrusted-package flag in order for the package manager to accept it.
df
The super-paranoid will be safe from Magic Lantern because they probably don't upgrade software often and they probably patch security holes themselves. But for the rest of us who want to *use* our computers, this is an enormous problem.
df
To start, I talked with my colleague's brother, "Joe," who is a criminal defense attorney. Joe told me that he has been following the Magic Lantern debate very closely, because his sources indicate that the FBI will be using it in many, many cases to prevent the possibility of seizing equipment with undecryptable data on it. In fact, it has been rumored that the proposed new FBI policy regarding searches of premises requires agents to attempt to use Magic Lantern (which technically counts as a consensual search) prior to even obtaining a warrant, if the warrant is to seize computer hardware.
Joe is not very familiar with computer technology, but he did say that a large part of the Magic Lantern program involves contacting ISPs to allow the FBI to alter network data destined for the suspect's computer. I will take that at face value because they seem to have no problem pulling rank on ISPs. I suspect that their "do it or we'll arrest you" attitude plays a big part in this.
With all of that in mind, I decided to find out just how vulnerable I was. I set up a stock Debian 2.2r3 box, and a stock Red Hat 7.2 box. Both used the installation CDs produced at least a few months ago, so they were both vulnerable to the wu-ftpd exploit and would need to be upgraded for production use.
My goal was simple: I needed to play the part of the FBI, and trick my machines into accepting a trojaned version of the new wu-ftpd package.
First, I set up a transparent proxy on my gateway box, which is used to split my cable modem connection amongst my home machines and those of several neighbors. I used a program called "squirm" to rewrite URLs ending in .deb or .rpm so that they would be redirected to my local web server,
from which the trojanned .deb and .rpm files would be served.
Second, I produced trojaned .deb and .rpm files. The .deb file was
trivial to modify, as only a checksum stood between me and a valid hacked
version. The .rpm was a bit more difficult, because RedHat signs their
packages with a PGP key. However, once I rebuilt the package and did not
sign it with PGP, I had a fixed package.
Third, I went to the Debian box and typed 'apt-get update ; apt-get upgrade'. After a few routine prompts, none of which triggered security alerts, the box was rooted by my "custom" package.
Fourth, I went to the Redhat box and did an 'rpm -U' pointed at the updates.redhat.com server. I got my trojanned RPM back, with no warnings or prompts to tell me it hasn't been signed. And I had an ftp server with a new backdoor up in a matter of minutes.
So, to summarize: the FBI can easily set up a transparent proxy between you and the Internet, and trick your OS into installing malware. You're damned if you do and you're damned if you don't, because you need to download the wuftpd-of-the-week sometime.
As a matter of comparison, my Windows 2000 box has no such vulnerability. The first time I went to Windows Update, I checked the box that said "always trust content from Microsoft Corporation." Therefore, only Microsoft's real certificate will be accepted by my machine. Even if the FBI forces Verisign to issue an impostor certificate, it will be detected and thwarted.
Linux distributions need to band together and find a trusted individual who will be responsible for signing all packages and verifying that they do not contain backdoors. That is the only way to solve this issue. Personally, I nominate Eric Raymond, because of his widespread respect from the community and business leaders alike. Additionally, he is a staunch libertarian and would not cave to government pressure to insert backdoors into something that he has signed. I believe that by charging the distribution vendors a small fee per package, ESR can again achieve financial success for himself and his family.
This is a serious issue for Linux users and I believe it should have been addressed years ago. That said, now is not too late and definitely not too early. I look forward to seeing this feature in all future releases of the major Linux distributions.
df
If you ever "go bad" and decide to start screwing people, Paypal is your weapon of choice. If you are a scrupulous merchant, Paypal is probably the best way to go because there will be few complaints on either side of the transaction. As I am also an ebay power seller who uses Paypal, things have been just fine on that side of the table as well.
Just my 2c.
df
Brings new meaning to the term "dictionary attack," eh?
I knew I should have left my threshold at +1.
df
I spoke with Uncle Isaac on several occasions regarding his favorite stock pick, MSFT. He explained that from day one, he knew that Microsoft was one of the most nimble companies that ever existed. Pointing out their rapid turnaround in the browser wars and in internet integration, he said that with billg at the helm, Microsoft would always prosper.
"What about .Net," I asked. "Do you really expect that thing to
succeed?"
".Net will put Microsoft in a position more powerful than any other company in the nation." When I pressed for details, he explained what Microsoft was planning to do:
Passport, in fact, is going to be marketed to web site owners. Sure, personal information is sometimes fun to have, but that isn't the main attraction. Microsoft plans to offer Passport up as a system to facilitate micropayments. They are targeting the owners of the many unprofitable information sites that are being propped up by venture capital (and pathetically meager ad revenues) today. This will force users to use Passport and pay for the information they receive off the web, with Microsoft taking a cut every time. Microsoft will become the largest middleman in the world, and multinational banks will look on in envy.
As a technical matter, this isn't a very difficult thing to do, but it needs a strong, reliable company with a good name, like Microsoft, to hold it up and to fund it during tough times. Microsoft has shown itself to be willing to subsidize many unprofitable ventures (such as IE and Bob) in order to attain a stronger position in the market, so it should come as no surprise that Passport will work the same way.
And, after Passport has taken over, there will be no more need for Linux/Apache on commercial sites. Microsoft can't compete with us directly, so they will destroy our market share by making the economics favor their product. We can give them Free software but Microsoft can sell them a big profit.
We, as the open source community, need to come together to stop this plan dead in its tracks. We can't rely on our government to do it for us, so we need to innovate and find ways to stop Microsoft. Maybe a bunch of open source hackers can get together and start producing macro virii and IIS worms nonstop, so that users are more aware of the poor security afforded by Microsoft products and services. Perhaps frequent DDoS attacks on Passport-compliant web sites are in order. Or maybe something completely different. Either way, we need to do something, so that Microsoft does not use Passport to take the internet away from us.
df
I spoke with Uncle Isaac on several occasions regarding his favorite stock pick, MSFT. He explained that from day one, he knew that Microsoft was one of the most nimble companies that ever existed. Pointing out their rapid turnaround in the browser wars and in internet integration, he said that with billg at the helm, Microsoft would always prosper.
"What about .Net," I asked. "Do you really expect that thing to
succeed?"
".Net will put Microsoft in a position more powerful than any other company in the nation." When I pressed for details, he explained what Microsoft was planning to do:
Passport, in fact, is going to be marketed to web site owners. Sure, personal information is sometimes fun to have, but that isn't the main attraction. Microsoft plans to offer Passport up as a system to facilitate micropayments. They are targeting the owners of the many unprofitable information sites that are being propped up by venture capital (and pathetically meager ad revenues) today. This will force users to use Passport and pay for the information they receive off the web, with Microsoft taking a cut every time. Microsoft will become the largest middleman in the world, and multinational banks will look on in envy.
As a technical matter, this isn't a very difficult thing to do, but it needs a strong, reliable company with a good name, like Microsoft, to hold it up and to fund it during tough times. Microsoft has shown itself to be willing to subsidize many unprofitable ventures (such as IE and Bob) in order to attain a stronger position in the market, so it should come as no surprise that Passport will work the same way.
And, after Passport has taken over, there will be no more need for Linux/Apache on commercial sites. Microsoft can't compete with us directly, so they will destroy our market share by making the economics favor their product. We can give them Free software but Microsoft can sell them a big profit.
We, as the open source community, need to come together to stop this plan dead in its tracks. We can't rely on our government to do it for us, so we need to innovate and find ways to stop Microsoft. Maybe a bunch of open source hackers can get together and start producing macro virii and IIS worms nonstop, so that users are more aware of the poor security afforded by Microsoft products and services. Perhaps frequent DDoS attacks on Passport-compliant web sites are in order. Or maybe something completely different. Either way, we need to do something, so that Microsoft does not use Passport to take the internet away from us.
df
Good luck with the project!
df
My roommate interviewed for a position at WebRing.org while they were in the middle of the Yahoo acquisition, and he revealed a dirty little secret that the interviewer let slip: Yahoo wanted to lay low for a little while to keep building critical mass, then implement interruption based advertising so that in order to get to the next site in the ring, users would be forced to sit through a 10-second Flash animation (probably coupled with a few pop-under X-10 ads).
Naturally, the waning popularity of webrings in general made it an economic reality that the ad revenues generated wouldn't even cover the cost of running the service. So, Yahoo dropped it, predictably enough.
What Yahoo! does makes a lot of business sense. However they are forsaking a large amount of goodwill as they acquire and corrupt various sites that used to be very nice resources. Alas, that is the way of the capitalist. I can't say I'll feel sorry when it comes back and bites them later.
df
P.S. My roommate got the job offer but, fearing imminent layoffs, did not accept.
df
Since so many of my friends show up as "unavailable" on my caller ID, I welcome this measure with open arms as a way to sort the wheat from the chaff.
df
As a long-time Omnisky customer, this is a very good thing for me. In Omnisky's final weeks, my service went from good to nonexistent. Apparently, routers and other equipment went down and nobody was left to reboot them. Getting through to customer service was next to impossible.
Start-ups are cute, but Internet access should be left to the experienced companies who have half a clue what they are doing (both on the service end and on the profitability end). Earthlink has an excellent track record, and as a sort of a charnel house for the corpses of dead ISPs (like Juno and such), it has a proven track record in providing services and making a profit at the same time.
I hope that Earthlink's abundance of clue will last for a long time and assure us Omnisky users quick, uninterrupted service for many years to come.
df
One of the major problems with ADCOs is, predictably enough, running the cables. Overhead and buried cables are usually prohibitively expensive, which is why the only way the telecom/cable companies were able to afford them was with subsidies and legislated monopoly status. Therefore the companies are forced to use sewers and other undesirable underground networks to run cable. And this is where the problems begin.
The sewers in my town are extremely old and small. There are frequently "conflicts" among the carriers when installing and maintaining these cables. Rain has proven to be an issue, as have insects and other much larger creatures. Running these cables in sewers is decidedly jury-rigged and isn't going to work out as a long-term solution.
One of the ADCO companies was considering transmitting signals through water supply lines (!). They claimed that there was a significant amount of potential bandwidth in the water supply network. I am not sure if that ever came to pass.
But one thing is sure: whether it be 802.11b wireless or something else, some other technology is going to be needed to replace the sewer-and-heating-duct kind of cabling that ADCOs rely on.
df
This technology could change everything. Rather than giving law enforcement officers the right to search and harass individuals who fit a "profile" (which, by itself, tends to favor searching Arab and other Middle Eastern types), the government could instead mandate the use of a holographic device such as the one described in this article. The advantages of this approach is that it is not invasive (people will not be embarrassed or inconvenienced by needless searches) and that it would be more effective because it could quickly be used to scan, say, every bag or container in an airport.
This sort of device would also render body cavity searches obsolete. Rather than training LEOs to probe peoples' orifices in a vain attempt to find drugs or weapons, people could be seamlessly screened as they enter "sensitive" buildings. These devices would do for terrorism what store security cameras did for shoplifting: nearly stop it dead in its tracks.
I, for one, would rather see law enforcement widely deploy these devices, rather than subject me to degrading searches. Certainly the majority of Americans feel the same way. We can have our cake and eat it too.
df
Unfortunately, if the many features of Linux and the transition from assembler to C didn't hurt us, the licensing did. Things went very smoothly until we needed to make some big changes to the kernel to accomodate a newer version of our hardware. At that point, there was a schism in the group: some of the developers wanted to change the kernel and release the product without source (the "who would find out?" crowd) and the rest of us knew that Linux was not going to fit our needs anymore unless we wanted to give our work away to competitors.
Well, the "who would find out?" crowd won the first round, and because of release deadlines we "slipped" the kernel changes into the next version of the product. And nobody knew. Except one of us told the legal department about what happened and they became very agitated.
Now our software runs on embedded NetBSD. It wasn't quite as robust as embedded Linux but it works well and we really can't complain. Transitioning to a new OS took a lot of effort but it was a necessary evil. After all, we couldn't risk getting sued out of existence to save a little money.
But the question I draw from this is: why not relax the GPL restrictions a bit for embedded applications? It seems like this area of the market will never be dominated by Linux until companies can stop fretting about licensing problems and start concentrating on coding instead.
df
One of these employees got bored with his coding tasks and, with no previous exposure to a broadband Internet connection, apparently decided to become a script kiddie on company time. From all outward appearances, he got pretty good at it, but one day it caught up with him: U.S. Marshals came into my office and served me with a court order that asked for many, many pieces of information that would tell them who had been cracking systems from our corporate network.
I had no problem turning this information over, as the other choice was to go to jail and let the hacker go free. However, I was appalled with the way the marshals treated me: they knew that I was just the sysadmin, not the perpetrator, but they still treated me like a criminal. When I told them that our NAT setup doesn't keep logs of every single outgoing connection from our network (as had been requested in the court order) they got really pissed off and started threatening me. At that point I told them that I was not going to do anything for them without talking to counsel, and they backed off.
So, the moral of the story here is that law enforcement needs to show more respect for sysadmins, and learn the difference between a network admin and a criminal on the admin's network. Treating everybody as though they are all guilty will only build resentment and get in the way of getting their precious case solved.
df
However, it seems as though most nations' space programs don't feel the same way about that egalitarian vision. They don't think space is the final frontier for everyday citizens; they don't want space travel to become commoditized. NASA, and now the Russian space agency, want to use space as a perk to sell to very wealthy businessmen. They want money, influence with politicians, or both. Regardless, these agencies are using taxpayer money to pamper the rich, and it is high time to stop this abuse.
Mind you, I am not against rich people. My brother has a net worth of over three million dollars. I am simply against letting the government use its considerable power to reward those who have already been rewarded by the capitalist system. Why reward people twice for the same deed? I don't win an award or see the government kissing my behind every time I collect a paycheck. Why should really rich guys be any different?
Astronauts are hired because of their physical strength and courage, their technical abilities, and their personalities. They should not be selected on the basis of their bank account balances. We should work toward letting astronauts do their jobs, without interference from wealthy joy-riders who feel like they have to ride into space before they die, just because they can.
df
For instance, an archive of VHS tapes and a computer would not be eligible for a patent, because it is significantly more complex for the user (and probably could not even be marketed). The Replay units are very easy to use and small, and the technology that makes that possible is considered eligible for patent protection.
I talked with one of our company's patent attorneys and he said that the "scale" issue was not a problem here, but he doubted that such an obvious patent would stand up in court. He expects SonicBlue to get whupped in court, Rambus-style, if Tivo and the other competitors don't capitulate first. (Good.)
df