Security Holes
May. 16th, 2008 | 04:00 am
posted by:
xkcd_rss

Link | Leave a comment {77} | Add to Memories | Tell a Friend
News: Holy F-ing S
May. 15th, 2008 | 05:28 pm
posted by:
pennyarcaderss
Link | Leave a comment {3} | Add to Memories | Tell a Friend
gwap is awesome.
May. 14th, 2008 | 05:36 pm
posted by:
gregdek
Link | Leave a comment {6} | Add to Memories | Tell a Friend
News: Left 4 Dead
May. 14th, 2008 | 06:14 pm
posted by:
pennyarcaderss
Link | Leave a comment | Add to Memories | Tell a Friend
News: Precipice!
May. 14th, 2008 | 05:48 pm
posted by:
pennyarcaderss
Link | Leave a comment | Add to Memories | Tell a Friend
News: The Littlest Vigilante
May. 14th, 2008 | 07:00 am
posted by:
pennyarcaderss
Link | Leave a comment | Add to Memories | Tell a Friend
Rio and Upstart
May. 14th, 2008 | 12:11 am
posted by:
zaitcev
Seen at Rio's place:
Fedora9のupstart、すごいんですけど...。さすがに組み込みみたいな速さでは無いけれど、これならサスペンドしなくても良いんじゃ...。
Which, in my very approximate translation means:
Upstart of Fedora 9 is great, mostly. As expected it includes no visible speed, so not using suspend is not good.
So, I guess that Rio expected improvements which would allow to stop suspending and they did not materialize... Which makes sense, but why the superlatives then? The title of the post was "upstartすげい!" with the exclamation mark. I would understand if he wrote that Upstart allowed him to end suspends, but no, "速さでない" is simple enough even for me to understand. Oh well, perils of international blogging.
Once I figured out that the control file syntax is documented in events(5) of all places, Upstart became rather tolerable, even welcome. I think that our famously poor bootstrap times (which are not that bad in Fedora when compared to other distros — I've seen real hard benchmarks — but are just bad for me as a user) have more to do with trying to execute too much crap. Upstart allows us to do it more efficiently, but it's a palliative.
UPDATE: piyokun comments that the right translation is more like "Of course it's not as fast as embedded (linux), but with (upstart) you can get by without suspending." So, the "shinakute" is like "doing", "mo" is change of state (he suspended before, but not anymore), "n" is explanation tag, and "ja" is uncertainty. Casual, of course. Oh, and "kumikomu" is a verb meaning "to incorporate". I had no idea that they had a native word for "embedded", instead of a katakanized borrowed word.
Link | Leave a comment {6} | Add to Memories | Tell a Friend
Comic: The Littlest Vigilante
May. 14th, 2008 | 07:00 am
posted by:
pennyarcaderss
Link | Leave a comment {1} | Add to Memories | Tell a Friend
ID Not Required!
May. 14th, 2008 | 12:04 am
mood:
hopeful
posted by:
chuckwolber
Hi, everyone. Sorry for the rather impersonal mass mailing.
Some of you, namely KU basketball fans and Kansas Citians, have undoubtedly already seen this, but I'm pretty excited about it and want to bring it to others' attention: On Wednesday, April 9, 2008, the Kansas City Star ran a front-page article [1] about my efforts to stand up for our right to travel freely in this country without being monitored by our government.
[1]: <http://www.kansascity.com/105/story/567590.html>
Inspired by people like John Gilmore [2], Chris Soghoian [3], and my friend Ben [4], I've been flying without identifying myself to TSA agents for a couple years, and after my last flight to Kansas City, I filed a complaint with the TSA about signs posted at the airport [5] that falsely state that travelers must present photo identification before crossing the security checkpoint.
[2]: <http://papersplease.org/gilmore/>
[3]: <http://www.cnet.com/8301-13739_1-9769089-46.html>
[4]: <http://oblivion.net/~ben/journal/?entry=725>
[5]: <http://www.flickr.com/photos/pmocek/2349302702/>
After receiving a response from TSA [6] confirming that there is no requirement that people show ID for domestic flights (and not mentioning anything about fixing the signs), I got in touch with the right people, and the next thing I knew a reporter from the Kansas City Star was interviewing me. At the time I had no idea it would end up on the front page, much less on a somewhat-commemorative "National champion University of Kansas basketball team returns home to big parade" issue that was surely in the eyes of many people who wouldn't otherwise pick up the paper. (That a picture of me, someone who would rather watch paint dry than sit through a basketball game, is likely to end up on the walls of hundreds of KU fans is particularly delicious.)
[6]: <http://papersplease.org/wp/2008/03/31/id-still-not-required-to-fly/>
I feel pretty strongly about this issue and hope that you'll give it at least a little consideration.
If you're so inclined, please read on for my best newspaper-friendly summary of why I've been doing what I do. I submitted this to the Star today and very much hope that it is published by them as an op-ed. Judging by the interest the story seems to have generated in KC, I think there's a good chance that they will do so. If they do, I'm going to do what I can to get one of the Seattle papers to pick it up, and I also have a connection at the AP who might be interested.
------------------------------------------------------------------------
While flying out of Kansas City last year, I saw TSA signs at the airport stating that travelers must present government-issued photo identification. I knew that wasn't true, and I didn't show ID. I neither caused trouble nor slowed things down for other travelers when I asserted my right to travel without checking in with the government by identifying myself; I was taken out of line to be screened along with other "selectees".
After returning home, I filed a complaint with TSA. I received a response from Jeanne Oliver, Associate Director of TSA Office of the Executive Secretariat. She did not indicate that TSA would fix the problem, but did confirm that if a traveler is "unwilling or unable to produce a valid form of ID, the traveler is required to undergo additional screening at the checkpoint to gain access to the secured area of the airport." People who show ID receive a less-thorough screening. Any time saved when people volunteer to show ID comes at the cost of less effectively checking them for dangerous items.
We're being lied to about federal air travel policies by airport security at KCI and other locations, and it's not making us any safer.
Government agents requiring people to show ID before boarding a flight wouldn't make air travel any safer. It's relatively easy to get a fake ID, and regardless of how much technology we put into ID cards, a criminal will be able to purchase a fake one or steal someone else's identity and get a real ID with his picture and the other person's name.
We can and do call upon TSA to ensure safe air travel by preventing people from carrying dangerous items onto flights. TSA's current practice of allowing people who show ID through security with less screening than other people receive contributes to a false sense of security, breeding complacency among passengers, crew, and TSA agents.
I acknowledge that the inconvenience of showing ID is trivial. My concern is that a requirement to show ID would allow the government to monitor and restrict our travel. Our courts have established that people in this country have the right to travel and associate without being monitored or stopped by the government unless they have been convicted of committing a crime or are suspected -- with good reason -- of having committed a crime. They have ruled that we cannot set up roadblocks and checkpoints to stop everyone who passes just to catch the few who have done something wrong, or to find the few who are suspected of intending to do something wrong.
Recent Congressional testimony suggests that over 900,000 names are now on the United States' so-called "terrorist watch list". Many people who have found themselves on the list are U.S. citizens who have no ties to any terrorist organization. There is no appeals process for those who have been blacklisted. We are not allowed to know who is on the list, who put them there, or why they were put on it.
If these people pose a danger to others, why don't we go arrest them instead of waiting for them to present themselves at the airport, then hassling them or preventing them from flying before sending them on their way?
Even if we could prune the list so that it included only people who actually pose a "known" threat, potential terrorists could probe the system by sending people on innocent trips, observing which ones were subjected to additional screening, then later sending the other people on a real terrorist mission. Restricting travel based on an ID check simply cannot improve security.
People can show their ID to whomever they want, whenever they want to do so, if it makes them feel safer. My doing so doesn't make me feel any safer. When a government agent asks me to show my papers or searches me, I feel *un*safe. It reminds me of descriptions of life in the former USSR, where identification was required upon demand, movement was restricted, and people either kept quiet and did as they were told, or risked disappearing into the night, never to be heard from again.
When I see security guards in airports wearing what look like police uniforms and demanding identification, and police on our streets wearing what look like military uniforms, driving DHS-grant-funded armored vehicles, marching in riot gear with machine guns, pepper-spraying and
Tasing peaceful demonstrators, it makes me feel like I live in what is approaching a totalitarian state.
Link | Leave a comment {2} | Add to Memories | Tell a Friend
Finish Line
May. 14th, 2008 | 04:00 am
posted by:
xkcd_rss

Link | Leave a comment {87} | Add to Memories | Tell a Friend
Bike Week, Two Days In
May. 13th, 2008 | 11:05 pm
posted by:
katzj
Yesterday was supposed to be cool and rainy, but the weather forecasters were wrong and the day ended up being just cool and windy. Biked to school per normal, no real oddities. Legs were a little sore from Sunday's ride, but I took it easy and just tried to lightly spin which worked out well.
Today ended up being significantly warmer than I expected, so I ended up peeling off some clothes on my way out to the office. I also happened to be behind a guy on the bike path who had both of the pannier bags that I've been considering (the Arkel Bug and the Arkel Commuter). This was convenient as I was able to get some real opinions and based on that, I think I'm going to go with the Commuter.
My way home ended up being a bit more interesting... I passed a few Quad riders on 225 as I was heading back but only noticed as I was flying past them spinning for all I could (ahhh, the fixie on downhills :). They did eventually catch me with a "don't you hate having to race to catch up to a commuter on a single speed" and I rode with them for a ways. Fell off as they sped down Lowell Rd and I continued on. Happened upon someone on the other side of Concord Center with a mechanical and stopped to try to help them. Finally made it home as it was getting dark and then ended up helping my next door neighbor, who needed to borrow a pump so that he can bike to work tomorrow.
Link | Leave a comment | Add to Memories | Tell a Friend
News: Exciting News!
May. 13th, 2008 | 11:37 pm
posted by:
pennyarcaderss
Link | Leave a comment | Add to Memories | Tell a Friend
Woo!
May. 13th, 2008 | 04:56 pm
mood:
relieved
posted by:
katzj
- My Product Design project was finished up, presented and had a bow tied on it last Friday
- Fedora 9 was released this morning
- My final paper for Technology Strategy was just submitted
Just one class tomorrow and I have a few weeks of "just" work before summer classes start up. It looks like I'm taking Systems Engineering and System Dynamics over the summer. Hopefully with the two classes, the workload won't be too high so that I can manage to get in plenty of riding ;-) Of course, if I bike on the days I come into the office like I did today, that'll help substantially with my overall mileage.
Link | Leave a comment | Add to Memories | Tell a Friend
News: PA TV going live
May. 13th, 2008 | 07:57 pm
posted by:
pennyarcaderss
Link | Leave a comment | Add to Memories | Tell a Friend
The Fedora bureaucracy, and why it matters
May. 13th, 2008 | 03:39 pm
posted by:
gregdek
We feel everyone's pain, and always have. It's a difficult balance: you want to make sure that you open participation to as many packagers as possible -- but you also want to ensure the quality of those packages. Particularly from a security perspective.
The Debian/Ubuntu OpenSSL bug is scary as hell. It's a tough day for those projects right now, but everyone who's been around the Fedora community knows the uncomfortable truth: there, but for the grace of God, go us. Eternal vigilance is the price of liberty, indeed.
It may be fashionable among some to paint this as a stupid mistake on the part of some Debian maintainer -- but this Slashdot poster gives details about the what appears to be an honest and understandable mistake. He also quotes Bruce Schneier to devastating effect: "bad crypto looks much the same as good crypto". Which is why it took over a year for folks to notice this bug, with the result that literally millions of Debian-based systems could be exposed to remote exploits.
Fedora dodged this bullet. Will we dodge the next one?
One defense is to make sure that we diverge as little as possible from upstream developers -- and when we do diverge, make sure that everyone, upstream and downstream, knows about any patches, and why they exist. There's a lot of discussion going on right now about how to do that.
Another possible defense is to put certain packages in a different review category -- especially any packages that deal with fundamental system-level encryption. That discussion is also ongoing.
So there may be changes. There may be a bit more bureaucracy in Fedora, and another step or two (or three, or more) in a process that is already very long indeed. But if it cuts down the chance of a catastrophic mistake like this, it's worth it.
A great day for Fedora today -- but also a tough day for Linux.
Link | Leave a comment {1} | Add to Memories | Tell a Friend
Fedora 9!
May. 13th, 2008 | 11:44 am
mood:
excited
posted by:
deviant_
Link | Leave a comment {1} | Add to Memories | Tell a Friend
Fedora 9 is out.
May. 13th, 2008 | 11:08 am
posted by:
gregdek
In the words of the immortal Cyrus from The Warriors... "can you digg it?"
Link | Leave a comment | Add to Memories | Tell a Friend
John Carmack and Linux VT
May. 12th, 2008 | 06:18 pm
posted by:
zaitcev
Our flight computer now has a display screen to show the current status to a pilot. My first inclination was just to mmap the framebuffer and pretend I was back in the days of DOS, but I decided to try and be a good linux programmer and use ncurses. It took me longer than I expected to get it working properly for displaying on the VGA for an application launched from a telnet session, and the performance was very bad. I wound up writing directly to the terminal device myself, spitting out all the escape sequences manually, but it was still quite appallingly slow. I have it working acceptably by only updating the various display items in a scanning fashion to avoid slowing it down on any individual frame, but I should have just followed my first thought and gone with a direct memory mapping.
I'm a little disturbed by the above, because I consider his application essentially equivalent to what Hercules does, and I never saw any performance issues with it. We all know that ncurses is a pig, and of course he should be using Slang instead of ncurses, but since he says that the result was slow even for the raw sequences, certainly this is not the issue. Weird.
It would be awesome if he posted his code somewhere.
UPDATE: John replies in comments:
The flight computer is only a 486-100, so it doesn't take much to bog it down, even with just text writes. I am doing straightforward fwrites and fprintfs to the console tty for everything.
It is at an acceptable rate now, so I probably won't make any other changes, but if RRL decides that they want anything fancy, like scrolling bar graphs, I will go straight to the framebuffer.
