Older blog entries for etbe (starting at number 268)

Asus EeePC as a Router

It seems to me that the Asus EeePC (a $AU499 ultra-light laptop with only flash storage) would make a decent router.

Often full desktop PCs are used as routers because they run the most common software and have standard interfaces. There have been dedicated router devices with flash for a long time, but without the ability to connect a standard monitor and keyboard they were always more difficult to manage than general purpose PCs. Also dedicated routers have limited RAM and storage which often does not permit running a standard OS.

According to the best review I could find [1] EeePC has a minimum of 256M of RAM, a Celeron-M CPU (32bit Intel), and a minimum of 2G of flash storage. This hardware is more than adequate to run most server software that you might want to run (my current router/firewall/server has 192M of RAM). It could run a web server, a mail server, or any other general server stuff. It comes pre-loaded with a modified version of Debian so you get all the Debian software (which incidentally means more pre-packaged software than is available for any other distribution). Bigger versions are common, I believe that the $AU499 version has 512M of RAM and 4G of flash - I’m not sure that I could even obtain a lesser EeePC in Australia.

The up-side of flash is that it doesn’t take much power as having a low power device in whatever confined space ends up housing your router is a good thing (the EeePC is listed as using less than 20W no matter what the load and idling at as little as 14W) and that it doesn’t tend to break when dropped or have any moving parts to wear out. The down-side of flash is that a sufficient number of writes will destroy it.

Obviously swap is not a suitable use for a flash storage device. But a small mail server (suitable for the needs of a home or a small office) should be fine with it. Squid is commonly run on router devices, to run it on an EeePC I would be inclined to buy 1G USB flash device for the cache, then if Squid’s use destroyed the flash storage it would be easy to spend $20 and buy another.

The EeePC has three USB ports and a built-in Ethernet port. I believe that the minimum number of Ethernet ports for a firewall is three, this means either one for the uplink, one for the DMZ, and one for your LAN, or two for uplinks (with a redundant uplink) and one for the LAN. The three USB ports allow using two USB Ethernet devices to provide the minimum three Ethernet ports and one for USB flash storage.

One notable advantage of using a laptop as a server is the built-in UPS (the laptop battery). Many people have put old laptops into service as servers for this reason, but usually an old battery gives no more than about 30 minutes of power, while a new EeePC should be able to last for more than 3 hours without mains power. Using a second-hand laptop as a server is usually not viable in a corporate environment as laptops are all different. Repairing an old desktop PC is easy, repairing an old laptop is unreasonably difficult and often more expensive than replacing it. The low price of the EeePC makes it easily affordable (cheaper than some of the desktop machines that might be used for such a purpose) and the fact that it is purchased new at such a price means that you get warranty support etc.

It seems to me that a significant disadvantage of using an EeePC (or anything other than a real server) for a server task is that it lacks

Syndicated 2008-01-23 10:26:14 from etbe

Secure Computation on an Insecure Base

Julien Goodwin asks whether an insecure platform can perform secure computation [1]. My immediate reaction was to recall Charles Babbage’s quote On two occasions I have been asked,—”Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?” […] I am not able rightly to comprehend the kind of confusion of ideas that could provoke such a question [2].

However on careful reading of Julien’s post it seems that he is most interested in the integrity of the computations rather than the secrecy. He suggests the possibility of performing the computation twice and comparing the results. Of course the issue to consider is whether both computations could be subverted. It seems most likely that if you are using someone else’s computation cluster for the calculations then performing the same calculation on two nodes of that cluster will give the same result both times (whether it’s right or wrong).

If there was a computation that would get a result that can be verified with little computation then it would be an easy problem to solve. For example if I wanted to brute-force a passphrase for a GPG key then I could try all combinations that were known to be possible, if one was flagged as correct then in a millisecond I could verify it. If none of the possibilities were listed as correct then I could assume that the process was broken in some way. The problem with this is that such a passphrase can have arbitrary length (I know someone who uses more than 50 characters). So if I used a brute-force attack on passwords of up to 9 characters that doesn’t exclude a 10 character password.

Probably the best potential use for insecure systems is for analysing large data sets. There have been several projects to harness unused computation resources to perform various large calculations (protein folding and SETI are two examples). Most such projects use closed-source programs because the people who run the contests are afraid of cheats who modify their programs to merely say “no” repeatedly and quickly. Of course this wouldn’t be a problem if they didn’t have a high-score table, and disassembling the program to hack the protocol can’t be that difficult (consider the work invested in reverse engineering protocols such as SMB which are much more complex).

It would probably be reasonably to randomly send batches of work to two machines in different regions for such large-scale public computation projects.

Finally if you want to perform calculations on secret data on someone else’s hardware then you may have lost before you even start.

• [1] http://laptop006.livejournal.com/39799.html


• [2] http://en.wikipedia.org/wiki/Garbage_In,_Garbage_Out

Share This

Syndicated 2008-01-22 09:57:58 from etbe

Free Software Community and forking

I just read an interesting approach to finding a life partner [1]. A summary is “There is a sad truth to the world today. I am part of a dying breed of people known as “shell users.” … Because there are fewer and fewer of us, I must help keep our lineage alive. I am looking for someone to help me do this. I need a woman (obviously) who is willing to raise a child with me in the method of Unix.“.

While there is a moderate amount of humour in the post (I recommend that you read it in full) it is a genuine attempt to find a partner.

One thing that has occurred to me is that part of the cause of the attitude toward women that is sometimes demonstrated in my community is the fact that there are so many guys who are single and have been single for a long time. If this problem was alleviated then I believe that some of the other social issues would be significantly improved.

The advert in question is a bit more courageous than most guys would be prepared to consider (it’s up there with the guy who paid for a giant sign to be installed beside a highway). But there are many other options.

ESR has some advice to offer [2], but the name of the URL (sextips) seems an accurate representation of the focus of the pages. One problem with ESR’s advice is that it seems to assume an ability to be extroverted (or at least fake it) which is greater than many geeks possess. Another problem is that he assumes that geeks are inherently more intelligent than average people - there is more than adequate evidence to disprove this theory. It seems more reasonable to only assume that geeks are better than average at doing geeky things.

It seems to me that the one thing that geeks really are better at is writing email! Therefore it seems logical that geeks who want good success in meeting women should try and involve the use of email in some way. Singles web sites seem an obvious way to take advantage of this. Unfortunately there is a strange cultural aversion to using such web sites which even afflicts geeks. For some reason it’s thought to be a good idea to try and meet a life partner in a place where there is inadequate light, too much background noise to talk properly, and where everyone has taken mind-altering chemicals (I am referring to drinking alcohol at a bar of night-club). Once strange cultural ideas are discarded it seems obvious that if you want to meet a potential life-partner then you should do so in a place where there is good light, an opportunity to talk, and where everyone is in a normal state of mind. Starting out with email and then talking over the phone and exchanging JPEG pictures seems to be a sensible option in this regard.

Most times that you chat to someone you meet over the net it won’t go any further than email or maybe phone-calls. But that’s still entertaining and useful practice at communicating with women.

One thing that the Craig’s List advertiser really got right is that he knows what he wants. An advantage of the singles sites on the net is that they often force people to make decisions. When a singles site demands that you enter a desired number of children that you want to have (with 0 being an acceptable answer) then you will be forced to consider the issue and make a decision. While being prepared to negotiate about such things may be desirable, I can’t imagine anyone finding it appealing when someone doesn’t know what they want or doesn’t have the confidence to say it.

Finally don’t rule out the possibility of meeting someone through your local LUG. There are a quite a few married couples who met through the Linux community. But don’t go making “pick-up” attempts on women in the community - the result will not be positive.

Via Michael Still.

• [1] http://www.craigslist.org/about/best/nyc/485967082.html


• [2] http://catb.org/~esr/writings/sextips/

Share This

Syndicated 2008-01-21 11:17:56 from etbe

SoftwareFree.org Violates Blog Content Licenses

The portal http://www,softwarefree,org/ aggregates many blog feeds related to free software without regard to license.

The About Page for my blog links to my Blog License page which states that “The contents of my blogs (unless otherwise noted) are licensed under a non-commercial share-alike license. This means (among other things) that you may not put my content on a web page that contains Google AdWords or any other similar advertising“.

Fortunately I had just read a great post on ProBlogger.net about dealing with such problems [2].

This time I decided to report the site to Google Adsense. I’ve been sending out a few DMCA take-down messages recently and it doesn’t seem to do much good (some sites keep doing it). So I’ll try getting their Google account cancelled.

I encourage everone who blogs on Planet Debian and the other planets that they use as sources of such unauthorised copying to do the same.

• [1] http://doc.coker.com.au/legal/blog-license/


• [2] http://www.problogger.net/archives/2008/01/20/fighting-scrapers-with-your-left-jab/

Share This

Syndicated 2008-01-20 20:00:51 from etbe

LCA 2008 Security Blogging Contest

I have decided to run a contest for security related blog posts that appear on Planet Linux Conf Au [1]. That Planet is for people who are attending Linux Conf Au [2], and the prize (or prizes) will be given out at the conference.

The aim will be posts on the topic of computer security from people who are not experts. Anyone who has been employed as a security consultant or developer of security software or who has spoken at a conference such as LCA on a topic related to security can enter but will only be eligible for an honourable mention. Any such expert who enters for an honourable mention MUST note on their entry that they are not eligible for a prize to avoid any possible confusion.

Only blog posts of a positive nature will be well regarded by the judges. Negative reviews are only acceptable if they have positive suggestions for improvement and/or bug reports linked from them.

You may submit a series of posts on a theme, and multiple posts on different security issues will help an entry - we will judge the contributions of the person not a single post.

The prize pool is currently $50, which I hope to expand - but such expansion depends in part on the quality and quantity of early entries, so if some good entries are submitted soon then there will be more and bigger prizes. Currently the prize pool comes from the pockets of me and Casey, commercial sponsorship will be accepted and may increase the prize pool significantly.

The duration of the contest is from this moment until at least lunch-time on Friday the 1st of February. We may extend the contest until Friday night and announce the winner(s) on Saturday - but at this time you should not count on such an extension and plan to have your entry or entries in by mid-day on Friday the 1st of Feb (Australian eastern daylight savings time).

So far of the people I have invited to join the judging panel only Casey Schaufler has accepted. Casey and I will consider offers to assist in judging from people who have a combination of security and blogging experience that is significant, but note that as of this time all prize money comes from the judges…

When you write a post that you wish to submit for the contest please comment on this post with the URL to make sure that the judges don’t miss it. Entries submitted on the last day may need some other form of notification, I will write a future post which clarifies this issue.

Some issues related to selecting the winners have yet to be determined, I will write future posts with more information. But please don’t hesitate to enter now, well written posts that have a positive tone are what you need. Also entering quickly will help increase the prize pool, more prizes means a greater chance that you will win one!

One thing I am considering is how to manage commercial sponsorship if it is offered. One possibility I am considering is allowing a sponsor to declare that half of the money they pay will be used as prizes for entries that relate to their product. That would give an extra incentive for people to blog about topics related to the sponsor but still give extra prize money for other topics. In that situation the relation between the sponsor’s product and the prize winning entry or entries would be liberal, so a post about standard Unix security features would be eligible for prize money from any commercial Linux distribution.

Finally you must have your own individual blog to enter the contest. Guest-posts on other people’s blogs or group efforts are not eligible for anything other than an honourable mention.

• [1] http://planet.linux.org.au/lca2008.html


• [2] http://linux.conf.au/

Share This

Syndicated 2008-01-20 10:56:42 from etbe

Gifts for Strangers

Leon writes about giving a stranger $1 to help him get a train ticket.

Recently I saw something similar, a lady was giving balloons to children in the Bourke St Mall in Melbourne just after 9PM. I asked her about this (I couldn’t see a logo on the balloons and wondered how she was making money). It turned out that unlike almost everyone else who gives out balloons in shopping areas she wasn’t trying to advertise a product to parents, but her hobby was to give out balloons to children.

I regret not asking her more questions, I wonder why she was doing this after 9PM (there aren’t many children out then), whether she always hangs out at Bourke St, and what gave her the idea to start doing this.

Share This

Syndicated 2008-01-19 08:00:18 from etbe

Bruce Schneier Advocates no Encryption

Bruce has written an interesting post about wireless encryption [1]. His main ideas seem to be that it’s nice to provide emergency net access for random people, that attempting to secure a wireless network only causes more problems when (not if) it is broken, and that your machines which are mobile need to be secure against a hostile LAN anyway.

These all make sense. I’d probably be doing the same if it wasn’t for the problems I had getting 802.11b gear working in my house (maybe conflicts with some of the other wireless equipment I run) and for the fact that I run NFS over my home network (which needs decent performance and has no security).

• [1] http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html

Share This

Syndicated 2008-01-18 11:31:09 from etbe

Differences between Distribution Kernels

It is not uncommon to run a Linux system with a kernel that was compiled for another distribution. One reason for doing this is the difficulty in compiling and testing a kernel to make sure it will do what you require. It’s not THAT difficult for someone who knows what they are doing, but if someone else has already done the work then it seems like a waste to re-invent the wheel. Sometimes it’s an issue of a driver that one distribution supports but not another, copying the entire kernel package from another distribution may be easier than compiling a new kernel with the extra driver. Sometimes it’s a kernel bug, if distribution A has fixed the bug and distribution B hasn’t, then it’s often easier to install a kernel package from distribution A when running distribution B.

Another reason for running different distributions with the same kernel is Xen. If you have a Dom0 which hosts instances for different distributions as DomU’s then running the same kernel on all of them can make it easier to manage.

Unfortunately it’s not uncommon for different distributions to have different kernel feature sets. One example I’m currently dealing with is the fact that the Debian/Etch kernel is compiled with CONFIG_AUDITSYSCALL disabled while RHEL and CentOS require it. So if you run a RHEL or CentOS system with a Debian kernel (EG running a Debian Xen server with a RHEL or CentOS DomU) then you see messages such as the following in your logs.

crond[7824]: pam_loginuid(crond:session): set_loginuid failed opening loginuid

The loginuid feature allows login and equivalent programs (which includes xdm and other graphical login programs, cron and every other program that runs a program on behalf of another user) to set the loginuid. This loginuid will be stored by the kernel, inherited across fork() and exec, and not be changed by running setuid or setgid programs. Therefore if you see some strange entries in your audit log indicating an attempted attack you can determine the original login UID of the person responsible.

In terms of security features it’s not a really high priority. But it is really annoying when programs that work on RHEL don’t work properly with a Debian kernel and put many unwanted messages in the log files. For people who have less background knowledge about these things it may be more than annoying, and may even force them to change their deployment plans to make the message go away (not everyone knows which messages can be ignored or where to ask about such things).

The fact that Etch has no user-space support for the auditing features in question (auditing system calls or setting the loginuid) was never a good reason for not enabling this feature (IMHO). Using the auditing system calls was simply a matter of copying the auditctl program from a RHEL, Fedora, or CentOS system (for those who didn’t feel inclined to compile the source). The loginuid required changes to PAM to enable it, but is actually a small part of the auditing layer.

As a general rule minimising the differences between distribution kernels is going to benefit most people. Some people complain about kernel bloat, but there are worse candidates for that accusation and given that it seems impossible to buy a machine with less than 512M of RAM and a 900MHz CPU (the specs of the ASUS EeePC) adding a few extra kernel features seems unlikely to hurt anyone. It is of course always possible to compile your own kernel for the smallest machines.

Finally I am in the process of back-porting SE Linux code and related security features to Etch, and having this already enabled in the kernel would make my work easier. I won’t do a 7 year support cycle for it unless someone pays, but supporting Etch past the release of Lenny with the latest SE Linux features (and the current features working properly) is my aim.

Share This

Syndicated 2008-01-16 10:57:55 from etbe

Victoria Hotel Melbourne

I have just stayed at the Victoria Hotel Melbourne. I booked it through www.WotIf.com and paid ~$110 per night instead of the list price of $186 per night.

The location is great (little Collins St near Swanston St). It’s a short walk from most things that are in the central city area and the nearest tram stop has a tram that goes directly to Melbourne University which will be good for people attending LCA (although it’s close enough that you might want to walk and save a few dollars). The price is pretty good too (you don’t get much cheaper than that in the central city area).

But there are some down-sides. The hotel is old and has an old design. It has small windows and air-conditioners are retro-fitted into the window (as opposed to the modern design of having huge windows and A/C in the ceiling). The air-conditioning is barely adequate and once the hotel walls heat up the room will be warm all night. The window-based air-conditioning also greatly diminishes the possibility of looking out the window, and for people who are tall enough to see over it they will probably find that the bed is too short for them (I stayed in a twin room, maybe a double bed would be longer - of course if I was alone in a double bed then I could probably sleep diagonally).

The room lights are all halogen spotlights, that includes the reading lights over the beds. This is 90’s architectural fashion and not a functional design. If you want to lie on your bed to read a book or watch TV then you will be able to see at least three halogen lights from the corner of your eye. Seeing such a small intense light source in your peripheral vision is really unpleasant.

The pool is about 5M*5M in size and approximately 1.1M deep (it seems deeper than a 1.0M pool I recently swam in but shallower than a 1.2M pool).

In conclusion I think that the Oaks on Market [1] apartments are better value for money, altough Market street is less convenient.

Update: I forgot to mention one last failing. For curtains my room had nothing other than a Venetian blind. As such a blind does not cover the entire window space I was woken by the sun rise. It’s bad enough seeing a sunrise after a hard night coding, I definitely don’t want to see one when I had planned to sleep in. Curtains that properly cover the window is not an expensive feature to add.

• [1] http://etbe.coker.com.au/2008/01/07/oaks-on-market/

Share This

Syndicated 2008-01-12 10:54:24 from etbe

Weather in Melbourne

Some people have been asking about the weather in Melbourne in late-January in terms of what to wear for Linux.Conf.Au.

It is probably impossible to predict weather for a particular day this far ahead. But predicting a range for the week is not difficult.

I think that you should expect at least one day that is really hot with a peak of 37C or more and reasonable humidity with a possibility of another two days the same or similar. A day with a peak of 42C or more is not unlikely over the course of a week.

You should expect a range of temperatures, one or two days that are reasonably cool with a maximum of 25C would not be unexpected. Some heavy rain in short bursts is a possibility (based on the past few weeks - prior to that there was little rain and it’s possible that there may be some time without rain again), there is probably no need for a rain-coat if you have the option of waiting ~30 mins for the rain to pass before going outside. I expect that if there is any rain at a time when conference delegates are about to go out somewhere then things will be delayed.

I suggest that you wear jeans while on the plane but expect to wear shorts for your entire time in Australia. A t-shirt is a reasonable option but if you plan to be outside much then wear a long-sleeved shirt. As I don’t expect to be doing much work in traditional offices in the near future I’m wearing business shirts when I go outside, long sleeves with a collar is good for protecting against sun-burn and as they are light they keep me cool (t-shirts are tighter and thicker and keep you hot). However when at LCA I will be wearing t-shirts that I designed (which should be well suited to being inside and I don’t plan to do much outside during that week).

A Scott e Vest [1] is a good thing to wear. It has heaps of pockets for your electronic gear, is reasonably light, and can be worn on top of a t-shirt. The Scott company also sells a TEC shirt which is a long-sleeved shirt with plenty of pockets. I’ve had a Scott e Vest for a number of years and I might have to get myself a TEC shirt.

• [1] http://www.scottevest.com/

Share This

Syndicated 2008-01-09 05:04:41 from etbe