Home

Security Holes

May. 16th, 2008 | 04:00 am
posted by: [info]xkcd_rss

True story: I had to try several times to upload this comic because my ssh key was blacklisted.

Link | Leave a comment {77} | Add to Memories | Tell a Friend

News: Holy F-ing S

May. 15th, 2008 | 05:28 pm
posted by: [info]pennyarcaderss

Tycho : Don't ask what: just click, and be enriched. (CW)TB

Link | Leave a comment {3} | Add to Memories | Tell a Friend

gwap is awesome.

May. 14th, 2008 | 05:36 pm
posted by: [info]gregdek

Carnegie Mellon? Crazy smart genius people.

Go GWAP now. Do it.

Link | Leave a comment {6} | Add to Memories | Tell a Friend

News: Left 4 Dead

May. 14th, 2008 | 06:14 pm
posted by: [info]pennyarcaderss

Tycho : I have played it, but it was under bizarre circumstances and I don't know if I can write about it. Suffice it to say they'd probably like what I wrote. This video is "must watch," though. (CW)TB

Link | Leave a comment | Add to Memories | Tell a Friend

News: Precipice!

May. 14th, 2008 | 05:48 pm
posted by: [info]pennyarcaderss

Gabe : So our game will be launching very soon and in order to get you in the mood so to speak we made a little four page comic. In the game Gabe and Tycho own and operate the Startling Developments detective agency. The city of New Arcadia is trying to move into the future but it's still plagued by ancient horrors and dark magic. The study of the arcane has fallen out of fashion though as steam powered machines and other new technologies have captured the imaginations of the populace. The Startling Developments detective agency remains committed to investigating the strange ...

Link | Leave a comment | Add to Memories | Tell a Friend

News: The Littlest Vigilante

May. 14th, 2008 | 07:00 am
posted by: [info]pennyarcaderss

Tycho : Comic conventions often have a "free shit" table, and our booth was situated in such a way as to watch this locust swarm coalesce. We even had a chance to see this drama unfold, which we immediately transcribed to the surface of the table for future use. We started the event with our psychic reserves depleted, as we'd been up until two o'clock in the morning the night before. If a grown man is coming home at two in the a.m., it would ordinarily be fair to assume that he was drunk. I would give you that one for free. ...

Link | Leave a comment | Add to Memories | Tell a Friend

zaitcev

Rio and Upstart

May. 14th, 2008 | 12:11 am
posted by: [info]zaitcev

Seen at Rio's place:

Fedora9のupstart、すごいんですけど...。さすがに組み込みみたいな速さでは無いけれど、これならサスペンドしなくても良いんじゃ...。

Which, in my very approximate translation means:

Upstart of Fedora 9 is great, mostly. As expected it includes no visible speed, so not using suspend is not good.

So, I guess that Rio expected improvements which would allow to stop suspending and they did not materialize... Which makes sense, but why the superlatives then? The title of the post was "upstartすげい!" with the exclamation mark. I would understand if he wrote that Upstart allowed him to end suspends, but no, "速さでない" is simple enough even for me to understand. Oh well, perils of international blogging.

Once I figured out that the control file syntax is documented in events(5) of all places, Upstart became rather tolerable, even welcome. I think that our famously poor bootstrap times (which are not that bad in Fedora when compared to other distros — I've seen real hard benchmarks — but are just bad for me as a user) have more to do with trying to execute too much crap. Upstart allows us to do it more efficiently, but it's a palliative.

UPDATE: piyokun comments that the right translation is more like "Of course it's not as fast as embedded (linux), but with (upstart) you can get by without suspending." So, the "shinakute" is like "doing", "mo" is change of state (he suspended before, but not anymore), "n" is explanation tag, and "ja" is uncertainty. Casual, of course. Oh, and "kumikomu" is a verb meaning "to incorporate". I had no idea that they had a native word for "embedded", instead of a katakanized borrowed word.

Tags: ,

Link | Leave a comment {6} | Add to Memories | Tell a Friend

Comic: The Littlest Vigilante

May. 14th, 2008 | 07:00 am
posted by: [info]pennyarcaderss

New Comic : The Littlest Vigilante

Link | Leave a comment {1} | Add to Memories | Tell a Friend

chuckwolber

ID Not Required!

May. 14th, 2008 | 12:04 am
mood: hopeful hopeful
posted by: [info]chuckwolber

This comes from my friend Phil Mocek. I've reprinted it here with permission unedited.

Hi, everyone. Sorry for the rather impersonal mass mailing.

Some of you, namely KU basketball fans and Kansas Citians, have undoubtedly already seen this, but I'm pretty excited about it and want to bring it to others' attention: On Wednesday, April 9, 2008, the  Kansas City Star ran a front-page article [1] about my efforts to stand up for our right to travel freely in this country without being monitored by our government.

[1]: <http://www.kansascity.com/105/story/567590.html>

Inspired by people like John Gilmore [2], Chris Soghoian [3], and my friend Ben [4], I've been flying without identifying myself to TSA agents for a couple years, and after my last flight to Kansas City, I filed a complaint with the TSA about signs posted at the airport [5] that falsely state that travelers must present photo identification before crossing the security checkpoint.

[2]: <http://papersplease.org/gilmore/>
[3]: <http://www.cnet.com/8301-13739_1-9769089-46.html>
[4]: <http://oblivion.net/~ben/journal/?entry=725>
[5]: <http://www.flickr.com/photos/pmocek/2349302702/>

After receiving a response from TSA [6] confirming that there is no requirement that people show ID for domestic flights (and not mentioning anything about fixing the signs), I got in touch with the right people, and the next thing I knew a reporter from the Kansas City Star was interviewing me.  At the time I had no idea it would end up on the front page, much less on a somewhat-commemorative "National champion University of Kansas basketball team returns home to big parade" issue that was surely in the eyes of many people who wouldn't otherwise pick up the paper.  (That a picture of me, someone who would rather watch paint dry than sit through a basketball game, is likely to end up on the walls of hundreds of KU fans is particularly delicious.)

[6]: <http://papersplease.org/wp/2008/03/31/id-still-not-required-to-fly/>

I feel pretty strongly about this issue and hope that you'll give it at least a little consideration.

If you're so inclined, please read on for my best newspaper-friendly summary of why I've been doing what I do.  I submitted this to the Star today and very much hope that it is published by them as an op-ed. Judging by the interest the story seems to have generated in KC, I think  there's a good chance that they will do so.  If they do, I'm going to do what I can to get one of the Seattle papers to pick it up, and I also have a connection at the AP who might be interested.

------------------------------------------------------------------------

While flying out of Kansas City last year, I saw TSA signs at the airport stating that travelers must present government-issued photo identification.  I knew that wasn't true, and I didn't show ID. I neither caused trouble nor slowed things down for other travelers when I asserted my right to travel without checking in with the government by identifying myself; I was taken out of line to be screened along with other "selectees".

After returning home, I filed a complaint with TSA.  I received a response from Jeanne Oliver, Associate Director of TSA Office of the Executive Secretariat.  She did not indicate that TSA would fix the problem, but did confirm that if a traveler is "unwilling or unable to produce a valid form of ID, the traveler is required to undergo additional screening at the checkpoint to gain access to the secured area of the airport."  People who show ID receive a less-thorough screening.  Any time saved when people volunteer to show ID comes at the cost of less effectively checking them for dangerous items.

We're being lied to about federal air travel policies by airport security at KCI and other locations, and it's not making us any safer.

Government agents requiring people to show ID before boarding a flight wouldn't make air travel any safer.  It's relatively easy to get a fake ID, and regardless of how much technology we put into ID cards, a criminal will be able to purchase a fake one or steal someone else's identity and get a real ID with his picture and the other person's name.

We can and do call upon TSA to ensure safe air travel by preventing people from carrying dangerous items onto flights.  TSA's current practice of allowing people who show ID through security with less  screening than other people receive contributes to a false sense of security, breeding complacency among passengers, crew, and TSA agents.

I acknowledge that the inconvenience of showing ID is trivial.  My concern is that a requirement to show ID would allow the government to monitor and restrict our travel.  Our courts have established that   people in this country have the right to travel and associate without being monitored or stopped by the government unless they have been convicted of committing a crime or are suspected -- with good reason -- of having committed a crime.  They have ruled that we cannot set up roadblocks and checkpoints to stop everyone who passes just to catch the few who have done something wrong, or to find the few who are suspected of intending to do something wrong.

Recent Congressional testimony suggests that over 900,000 names are now on the United States' so-called "terrorist watch list".  Many people who have found themselves on the list are U.S. citizens who have no ties to any terrorist organization.  There is no appeals process for those who have been blacklisted.  We are not allowed to know who is on the list, who put them there, or why they were put on it.

If these people pose a danger to others, why don't we go arrest them instead of waiting for them to present themselves at the airport, then hassling them or preventing them from flying before sending them on their way?

Even if we could prune the list so that it included only people who actually pose a "known" threat, potential terrorists could probe the system by sending people on innocent trips, observing which ones were subjected to additional screening, then later sending the other people on a real terrorist mission.  Restricting travel based on an ID check simply cannot improve security.

People can show their ID to whomever they want, whenever they want to do so, if it makes them feel safer.  My doing so doesn't make me feel any safer.  When a government agent asks me to show my papers or searches me, I feel *un*safe.  It reminds me of descriptions of life in the former USSR, where identification was required upon demand, movement was restricted, and people either kept quiet and did as they were told, or risked disappearing into the night, never to be heard from again.

When I see security guards in airports wearing what look like police uniforms and demanding identification, and police on our streets wearing what look like military uniforms, driving DHS-grant-funded armored vehicles, marching in riot gear with machine guns, pepper-spraying and
Tasing peaceful demonstrators, it makes me feel like I live in what is approaching a totalitarian state.

Link | Leave a comment {2} | Add to Memories | Tell a Friend

Finish Line

May. 14th, 2008 | 04:00 am
posted by: [info]xkcd_rss

The question with Lucy and the football was always whether, on some level, she believed the things she said.

Link | Leave a comment {87} | Add to Memories | Tell a Friend

katzj

Bike Week, Two Days In

May. 13th, 2008 | 11:05 pm
posted by: [info]katzj

As previously mentioned, this week is Bike Week and so I'm pushing myself to only travel by bike for the week for going to school/work rather than availing myself of some of the other options. Plus, it's spring and the office isn't that far, so biking in to work gets me some good extra miles.

Yesterday was supposed to be cool and rainy, but the weather forecasters were wrong and the day ended up being just cool and windy. Biked to school per normal, no real oddities. Legs were a little sore from Sunday's ride, but I took it easy and just tried to lightly spin which worked out well.

Today ended up being significantly warmer than I expected, so I ended up peeling off some clothes on my way out to the office. I also happened to be behind a guy on the bike path who had both of the pannier bags that I've been considering (the Arkel Bug and the Arkel Commuter). This was convenient as I was able to get some real opinions and based on that, I think I'm going to go with the Commuter.

My way home ended up being a bit more interesting... I passed a few Quad riders on 225 as I was heading back but only noticed as I was flying past them spinning for all I could (ahhh, the fixie on downhills :). They did eventually catch me with a "don't you hate having to race to catch up to a commuter on a single speed" and I rode with them for a ways. Fell off as they sped down Lowell Rd and I continued on. Happened upon someone on the other side of Concord Center with a mechanical and stopped to try to help them. Finally made it home as it was getting dark and then ended up helping my next door neighbor, who needed to borrow a pump so that he can bike to work tomorrow.
Tags:

Link | Leave a comment | Add to Memories | Tell a Friend

News: Exciting News!

May. 13th, 2008 | 11:37 pm
posted by: [info]pennyarcaderss

Gabe : So we can finally announce that our game will be out on May 21st. IT will be released on Xbox Live as well as our own digital games store Greenhouse. If you do decide to download from Greenhouse you can grab one code that will give you access to the PC, Mac and Linux versions. I'm super excited to hear what you guys think. If you're looking forward to the game you should check out the new trailer over on the Xbox Live site. -Gabe out

Link | Leave a comment | Add to Memories | Tell a Friend

katzj

Woo!

May. 13th, 2008 | 04:56 pm
mood: relieved relieved
posted by: [info]katzj

And with that, a couple of huge weights are lifted off my shoulder. Let's recap or those playing along at home...

Just one class tomorrow and I have a few weeks of "just" work before summer classes start up. It looks like I'm taking Systems Engineering and System Dynamics over the summer. Hopefully with the two classes, the workload won't be too high so that I can manage to get in plenty of riding ;-) Of course, if I bike on the days I come into the office like I did today, that'll help substantially with my overall mileage.
Tags: ,

Link | Leave a comment | Add to Memories | Tell a Friend

News: PA TV going live

May. 13th, 2008 | 07:57 pm
posted by: [info]pennyarcaderss

Gabe : I'll be starting the Live stream in a few minutes. -Gabe out

Link | Leave a comment | Add to Memories | Tell a Friend

The Fedora bureaucracy, and why it matters

May. 13th, 2008 | 03:39 pm
posted by: [info]gregdek

It's been a common complaint since the dawn of the Fedora project: the process for getting new software into Fedora is too complex.

We feel everyone's pain, and always have. It's a difficult balance: you want to make sure that you open participation to as many packagers as possible -- but you also want to ensure the quality of those packages. Particularly from a security perspective.

The Debian/Ubuntu OpenSSL bug is scary as hell. It's a tough day for those projects right now, but everyone who's been around the Fedora community knows the uncomfortable truth: there, but for the grace of God, go us. Eternal vigilance is the price of liberty, indeed.

It may be fashionable among some to paint this as a stupid mistake on the part of some Debian maintainer -- but this Slashdot poster gives details about the what appears to be an honest and understandable mistake. He also quotes Bruce Schneier to devastating effect: "bad crypto looks much the same as good crypto". Which is why it took over a year for folks to notice this bug, with the result that literally millions of Debian-based systems could be exposed to remote exploits.

Fedora dodged this bullet. Will we dodge the next one?

One defense is to make sure that we diverge as little as possible from upstream developers -- and when we do diverge, make sure that everyone, upstream and downstream, knows about any patches, and why they exist. There's a lot of discussion going on right now about how to do that.

Another possible defense is to put certain packages in a different review category -- especially any packages that deal with fundamental system-level encryption. That discussion is also ongoing.

So there may be changes. There may be a bit more bureaucracy in Fedora, and another step or two (or three, or more) in a process that is already very long indeed. But if it cuts down the chance of a catastrophic mistake like this, it's worth it.

A great day for Fedora today -- but also a tough day for Linux.

Link | Leave a comment {1} | Add to Memories | Tell a Friend

deviant_

Fedora 9!

May. 13th, 2008 | 11:44 am
mood: excited excited
posted by: [info]deviant_

After much work, Fedora 9 is finally out. It pretty much rules, so you should really check it out. Digg it here
Tags:

Link | Leave a comment {1} | Add to Memories | Tell a Friend

Fedora 9 is out.

May. 13th, 2008 | 11:08 am
posted by: [info]gregdek

And it's awesome. Obviously.

In the words of the immortal Cyrus from The Warriors... "can you digg it?"

Link | Leave a comment | Add to Memories | Tell a Friend

zaitcev

John Carmack and Linux VT

May. 12th, 2008 | 06:18 pm
posted by: [info]zaitcev

Says John:

Our flight computer now has a display screen to show the current status to a pilot. My first inclination was just to mmap the framebuffer and pretend I was back in the days of DOS, but I decided to try and be a good linux programmer and use ncurses. It took me longer than I expected to get it working properly for displaying on the VGA for an application launched from a telnet session, and the performance was very bad. I wound up writing directly to the terminal device myself, spitting out all the escape sequences manually, but it was still quite appallingly slow. I have it working acceptably by only updating the various display items in a scanning fashion to avoid slowing it down on any individual frame, but I should have just followed my first thought and gone with a direct memory mapping.

I'm a little disturbed by the above, because I consider his application essentially equivalent to what Hercules does, and I never saw any performance issues with it. We all know that ncurses is a pig, and of course he should be using Slang instead of ncurses, but since he says that the result was slow even for the raw sequences, certainly this is not the issue. Weird.

It would be awesome if he posted his code somewhere.

UPDATE: John replies in comments:

The flight computer is only a 486-100, so it doesn't take much to bog it down, even with just text writes. I am doing straightforward fwrites and fprintfs to the console tty for everything.

It is at an acceptable rate now, so I probably won't make any other changes, but if RRL decides that they want anything fancy, like scrolling bar graphs, I will go straight to the framebuffer.

Tags:

Link | Leave a comment {3} | Add to Memories | Tell a Friend

News: Sorry

May. 12th, 2008 | 07:00 am
posted by: [info]pennyarcaderss

Tycho : I was really in a rush to put that post up, and it had a bunch of problems that needed to be resolved. Gabe was putting some points into the Wii to check out some of the new WiiWare stuff, and then an ostrich got in here some how, and shit got all fucked up. (CW)TB

Link | Leave a comment | Add to Memories | Tell a Friend

News: Je Parle Un Peu

May. 12th, 2008 | 07:00 am
posted by: [info]pennyarcaderss

Tycho : Gabe essentially began anti-anxiety medication and planned a trip for Paris in the same week, possibly even in the same moment, and as an observer - it is literally my job to observe - this was an intriguing process. He wasn't yet ensorcelled by the chemical, and yet with full awareness of his own agony he went through the previously unthinkable process of putting all this together. It must have been something like jumping from a plane with a strange backpack and a pamphlet entitled "Your Parachute." The hope was that his mind would be in the correct gear sometime ...

Link | Leave a comment | Add to Memories | Tell a Friend