D-kriptik Blog

So, I recently saw Juno for the first time, and was surprised and happy to hear Kimya Dawson permeate the soundtrack. And, I ate at wd~50, which was, well, an experience - highly recommended if you want to try something truly new.

Anyway, yes, still here. Unfortunately, this rare act of posting will be limited to a quickie - a few miscellaneous items accumulated over a couple of months.

-

A few headaches…

1. Wow, just wow.
   

   The result of this is that for the last two years (from Debian’s “Etch” release until now), anyone doing pretty much any crypto on Debian (and hence Ubuntu) has been using easily guessable keys. This includes SSH keys, SSL keys and OpenVPN keys.

   Update immediately. And be sure to do things such as regenerate all persistent keys that used random data taken from the vulnerable Debian OpenSSL during their generation - some of this type of work is handled automatically when updating your packages (e.g., OpenSSH server keys), but only you know what you have done outside this automated window.

2. I booted up a Windows XP box only to find that some resource of the Logitech QuickCam software had become corrupted, and this resulted in a nasty msi installer loop hitting the box as soon as a user logged in. I found this tool extremely useful in cleaning up the mess.
   

   [..]With the Windows Installer CleanUp Utility, you can remove a program’s Windows Installer configuration information. You may want to remove the Windows Installer configuration information for your program if you experience installation (Setup) problems. For example, you may have to remove a program’s Windows Installer configuration information if you have installation problems when you try to add (or remove) a component of your program that was not included when you first installed your program.

3. Much to my very unpleasant surprise, I upgraded a server over here from Ubuntu Gutsy to Hardy and discovered networking for Xen DomU’s in Ubuntu Hardy 8.04 is somewhat broken. I ended up using the 2.6.24-17-xen kernel from the hardy-proposed repository, but you could also just stick with the Gutsy Xen kernel for DomU’s.
4. When I upgraded to Gnome 2.22 on a particular FreeBSD 7.0 system, certain things, like the clock applet, did not work. This was due to the dbus daemon not being started. Then, the hal daemon and Gnome did not want to play nice together. This page provided the information necessary to get them playing nice - in this particular instance, not mounting procfs was the problem.

Side note, I was helping someone install Ubuntu recently, and it brought to my attention yet again how much I take what I consider to be basic skills for granted when using *nix. Small things, like running an executable from within your environment path versus by directly specifying the path (the most confusing to many example of this seems to be trying to run an executable in the current working directory), are just not common knowledge. Even the whole command line itself is often scary and bizarre to people. This makes it extremely difficult to provide useful guidance for people to blindly follow (posts on this blog should never be assumed to provide step-by-step instructions - they are just some basic notes at best, as extremely helpful comments like this make obvious). And, even Ubuntu is not as trivial to use as it would appear to many that work in the *nix world.

-

Three useful Ubuntu and FreeBSD pages…

USN.

These are the Ubuntu security notices that affect the current supported releases of Ubuntu.[...]

FreeBSD VuXML.

Security issues that affect the FreeBSD operating system or applications in the FreeBSD Ports Collection are documented using the Vulnerabilities and Exposures Markup Language (VuXML).[...]

FreeBSD Security Advisories.

This web page contains a list of released FreeBSD Security Advisories.[...]

-

Story-telling is one of the fundamental tools in a teacher’s toolkit. Having done quite a bit of consulting, I have learned how invaluable a good story is to driving home particular points and building relationships. There is something fundamental about how stories effect us, perhaps stemming from our innate ability to empathesize and our massive pattern recognition horse-power.

Anyway, this site has a useful set of stories. [via exi]

Here are some stories, analogies, research findings and other examples that provide wonderful illustrations for learning, and inspiration for self-development.

In fact, the first story mirrors a recent post.

An old lady had a hearing-aid fitted, discreetly, hidden underneath her hair.

A week later she returned to the doctor for her check-up.

“It’s wonderful - I can hear everything now,” she reported very happily to the doctor.

“And is your family pleased too?” asked the doctor.

“Oh I haven’t told them yet,” said the old lady, “And I’ve changed my will twice already..”

This reminds me of a story I often tell about someone I met a while back, a graduate student in psych. She was studying aspects of the initial meeting/courtship routines of people, and would go out to bars and such and interact with potential suitors. Here these suitors were, following their typical pickup routines and sometimes spilling more than their drinks, and here she was, analyzing their interaction and subsequently writing up notes to be turned into research papers, etc.

-

NIST draft SP 800-108 has been released.

SP 800-108

DRAFT Recommendation for Key Derivation Using Pseudorandom Functions

NIST announces the release of draft Special Publication 800-108, Recommendation for Key Derivation Using Pseudorandom Functions. This Recommendation specifies techniques for key derivation from a secret key using pseudorandom functions (PRF). Please submit comments to draft-SP800-108-comment@nist.gov with “Comments on SP800-108″ in the subject line. The comment period closes on June 28, 2008.

Yet more KDFs.

-

They just don’t quit, do they?

1

This is the first article analyzing the security of SHA-256 against fast collision search which considers the recent attacks by Wang et al. We show the limits of applying techniques known so far to SHA-256. Next we introduce a new type of perturbation vector which circumvents the identified limits. This new technique is then applied to the unmodified SHA-256. Exploiting the combination of Boolean functions and modular addition together with the newly developed technique allows us to derive collision-producing characteristics for step-reduced SHA-256, which was not possible before. Although our results do not threaten the security of SHA-256, we show that the low probability of a single local collision may give rise to a false sense of security.

2

We study the security of step-reduced but otherwise unmodified SHA-256. We show the first collision attacks on SHA-256 reduced to 23 and 24 steps with complexities $2^{18}$ and $2^{50}$, respectively. We give an example colliding message pair for 23-step SHA-256. The best previous, recently obtained result was a collision attack for up to 22 steps. Additionally, we show non-random behaviour of SHA-256 in the form of pseudo-near collisions for up to 31 steps, which is 6 more steps than the recently obtained non-random behaviour in the form of a semi-free start near-collision. Even though this represents a step forwards in terms of cryptanalytic techniques, the results do not threaten the security of applications using SHA-256.

3

[...]First we describe message modification techniques and use them to obtain an algorithm to generate message pairs which collide for the actual SHA-256 reduced to 18 steps. Our second contribution is to present differential paths for 19, 20, 21, 22 and 23 steps of SHA-256. We construct parity check equations in a novel way to find these characteristics. Further, the 19-step differential path presented here is constructed by using only 15 local collisions, as against the previously known 19-step near collision differential path which consists of interleaving of 23 local collisions. Our 19-step differential path can also be seen as a single local collision at the message word level. We use a linearized local collision in this work. These results do not cause any threat to the security of the SHA-256 hash function.

4

[...]We build on the work of Nikoli\’{c} and Biryukov and provide a generalized nonlinear local collision which accepts an arbitrary initial message difference. This local collision succeeds with probability 1. Using this local collision we present attacks against 18-step SHA-256 and 18-step SHA-512 with arbitrary initial difference. Both of these attacks succeed with probability 1. We then present special cases of our local collision and show two different differential paths for attacking 20-step SHA-256 and 20-step SHA-512. One of these paths is the same as presented by Nikoli\’{c} and Biryukov while the other one is a new differential path. Messages following both these differential paths can be found with probability 1. This improves on the previous result where the success probability of 20-step attack was 1/3. Finally, we present two differential paths for 21-step collisions for SHA-256 and SHA-512, one of which is a new path. The success probability of these paths for SHA-256 is roughly $2^{-15}$ and $2^{-17}$ which improves on the 21-step attack having probability $2^{-19}$ reported earlier. We show examples of message pairs following all the presented differential paths for up to 21-step collisions in SHA-256. We also show first real examples of colliding message pairs for up to 20-step reduced SHA-512.

Completely academic, but you know what they say - attacks only get better.

-

Interesting stuff.

NSA/CSS periodically releases declassified documents or indexes to these documents to the public. The documents listed on this page were located in response to numerous requests received by NSA on the various subjects stated and for which there appears to be a general public interest. The date after each entry reflects the most current release date of that material. When additional material for a given subject is updated then a new subject index date is posted. To select a subject index, click on the subject title.

In particular, the Cryptologic Spectrum Articles and Cryptologic Quarterly Articles have some fun reads.

-

An easy to cut ‘n paste into a blog post set of old web server log entries depicting an instance of Tor being used to proxy/anonymize automated probes of this web site.

anonymizer.blutmagie.de - - [13/Mar/2008:00:59:00 -0700] “GET /forum/phpbb/index.php HTTP/1.0″ 404 285 “http://forum.d-kriptik.com/phpbb/index.php” “Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1)”

tor.anonymous.proxy.quex.org - - [13/Mar/2008:00:59:01 -0700] “GET /forum/phpbb2/index.php HTTP/1.0″ 404 286 “http://forum.d-kriptik.com/phpbb2/index.php” “Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1)”

tor.anonymizer.ccc.de - - [13/Mar/2008:00:59:02 -0700] “GET /forum/forums/index.php HTTP/1.0″ 404 286 “http://forum.d-kriptik.com/forums/index.php” “Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1)”

tor.anonymizer.ccc.de - - [13/Mar/2008:00:59:08 -0700] “GET /forum/board/index.php HTTP/1.0″ 404 285 “http://forum.d-kriptik.com/board/index.php” “Mozilla/4.0 (compatible; MSIE 6.0; AOL 9.0; Windows NT 5.1)”

-

Like heat and humidity, free music and Central Park mean summer. The 2008 schedule is up at the Summer Stage web site. And, the opening Saturday looks good to me.

Vampire Weekend
Kid Sister
Ecstatic Sunshine

Saturday, June 14, 2008
From 4:00 PM to 7:30 PM
Central Park SummerStage

So, I have been slammed with work and not keeping up with all of the reading material I normally make the time for when working normal hours, which means I just noticed the first NYSEC meeting that (unfortunately for me) happened a few days ago. Hopefully there will be many more.

What
An informal meetup of information security professionals in New York. Unlike other meetups, you will not be expected to pay dues, “join up”, or present a zero-day exploit to attend.

After I read about the CHISEC meetings, I was going to poke around at the next NYCBUG meeting (that I manage to get to) to see if there existed, or was interest in, a similar thing in NYC, as the NYCBUG people generally seem very in tune with tech happenings around NYC. But, this takes care of that. Cool.

The next NYCBUG meeting is tonight (May 03, 2006) from 6:30-8PM EST. Using OpenBSD to build VPNs for large enterprises sounds really interesting to me, although I would like to hear the discussion on PAE for OpenBSD as well. And, the venue has changed to a bar. Good stuff.

May 03, 2006
Mischa Diehm: VPN & Mickey Shalayeff: PAE
[...]

Suspenders Bar
6:30 PM to 8:00 PM
111 Broadway & Thames
directions are here

Part 1: VPNs with OpenBSD in large corporate networks

[...]This talk will show different practical approaches in building flexible secure VPNs with OpenBSD at different network levels.
[...]

Part 2: Implementing PAE for OpenBSD/i386

Not yet committed to OpenBSD, Mickey has been working on PAE for OpenBSD i386. Essentially, it`s about supporting up to 64 gig of physical memory.

Also, the next Dorkbot-nyc meeting is happening tonight (May 03, 2006) at Location One from 7-9PM EST. Here is the flyer.

Unfortunately, I will not be able to attend the NYCBUG (or dorkbot-nyc) meetings tonight. If anyone does attend and wants to do a brief write-up, please let me know - full credit will be given, and we receive a decent amount of traffic to our meeting write-ups, especially the NYCBUG ones. Thanks.

I made it out to the NYCBUG meeting this month. The following is my raw notes from the meeting.

First off, I must say this meeting was full of optimism for the current boom in technology. And, BSD jobs seem to be quite common these days - OKCupid and Fotolog both announced the need for some strong BSD people during the meeting. (You might want to start shopping that resume.)

So, the point of this meeting and possible future meetings is to try to capture the dynamic of the NYCBUG talk mailing list in a face to face meeting. If you have not hit upon the NYCBUG talk mailing list before, it is basically a place where people can post questions, issues, and everything else BSD related and get informative and friendly feedback from others in the BSD community, including many well known names. (I note that “newbie” questions are not mocked on this list, which is quite rare in technical forums.)

Anyway, on to the content…

—

The meeting started out with a discussion from Bjorn about things he misses from FreeBSD when using GNU/Linux at work. These essentially boiled down to the ease of getting various statistics off the system.

For example,

• “netstat -w 1″ versus “sar -n DEV” - no history

  (someone suggested trying “iptraf”)

• “iostat 1″ versus the GNU/Linux version - no history
• “vmstat” versus Linux version - less info
• “ifconfig” versus Linux version - less info

  (someone suggested “mii-tool”)

Bjorn also discussed some configuration and logging features he misses. (These reminded me of when I first picked up FreeBSD again, which seemed much more GNU/Linux in configuration layout after I had been using OpenBSD for quite a while.)

-

(Interesting note, Theo apparently insulted the dmesgd feature of the NYCBUG web site because it was a webapp and he did not like webapps.)

-

Next up, Alfred Perlstein spoke about the infrastructure at OKCupid, which is a free online dating services. (I thought I had never heard of OKCupid, until he mentioned that they have all sorts of questionaires - then I remembered being sent a link to a political questionaire a while back that ended up telling me I was something along the lines of strongly libertarian. Sure enough, looking in my archives, it was OKCupid.)

Alfred started out by saying OKCupid is looking for some BSD people. If you are interested, send him your resume via email - being at the NYCBUG meeting earns extra credit.

OKCupid runs a 99% FreeBSD shop. They were running a flavor of 4 for a while, tried 5 and found it to be garbage (like every other FreeBSDer it seems - I never used FreeBSD 5 myself), and now are running 6 (6.1 currently).

OKCupid is built from mostly open source technology. Even their custom web server, OKWS created by Max Krohn, has been released to the public under GPL.

(Of note, Max Krohn is of fake CS paper fame.)

Apparently, there is some lore about just how much performance OKCupid squeezes out of their systems, so someone asked Alfred about it. Alfred said one of the keys here was a custom distributed memory cache, DSDc created by Krohn. He then went on to discuss their architecture at a very high, non-proprietary level, and it looked something like this.

(A fuller discussion of web service architectures built from OKWS can be found in papers [1, 2] by Krohn.)

The ability to build services for the OKWS framework is based upon SFS, which uses event-driven callbacks at its core and no threads. The tame framework is used to provide thread-like features such as blocking, but it should be noted that actual threads are not used in SFS.

Alfred also noted that they use “sup” to handle upgrades and installs for their systems.

OkCupid itself is free to use. It is ad and donation supported. (Give it a try - I may.)

-

After that, there was a question about active directory and samba integration. I did not actually catch the outcome of the discussion.

—

Audio of the meeting can be found here.

As for comments on the open format, I thought this meeting went well. Meetings need to have some structure, including an agenda and a leader. That happened. There should always be at least a couple of people that will be presentating some BSD topic of interest or concern to them, and these people should be prepared/able to speak on that topic - maybe not as formally as a normal meeting, but definitely showing they thought about what they is being presented or strong enough that they can wing it effectively. That happened. This could be followed by some general discussion that flows into after meeting bar talk. That also appeared to happen.

My main concern is that the open meetings could easily degenerate into an hour and a half of random questions better suited to the talk mailing list. The good thing about the talk list is that there is effective administration and most people formalize their questions/concerns a bit just to put them into a decent email message to the list - I think that type of effort needs to be translated into the open meeting as well.

Thanks to the NYCBUG team and all the speakers.

(Oh, and apologies to my “date” - I did not expect the meeting to last the full amount of time scheduled.)

——

In other (sorta BSD) news, this sounds like a DoS attack to me.

If I closed the GPS.dix.dk server right now, wrote off all the time I have spent myself, then my expenses would amount to between DKR 45.000,00 and DKR 99.000,00 (USD 7,300 to 16,000) and several hundered administrators throughout Denmark would have to spend time reconfiguring their servers.

If on the other hand we assume I leave the service running and that the unauthorized packets from D-Link products continue for the next five years, the total cost for me will be around DKR 115.000,00 + 54.000,00 per year (approx USD 18,500 + USD 8,800 per year) or DKR 385.000,00 over the next five years (USD 62,000).

The next NYCBUG meeting is this Wednesday. It is going to be an open forum, so there may be some interesting topics.

April 05, 2006
Open Meeting

NEW Time & Location!
And it is necessary to RSVP

Please send an email to rsvp at lists dot nycbug dot org with `RSVP` and your full name in the subject line

6:30 pm, Baruch College, CUNY
Building H, Room 620
E 25th Street between 3rd Ave & Lexington
Map

Past meetings have had a single speaker on a single topic. This time, we have a couple of speakers on a couple of useful topics for about 10 minutes each. Then the floor will be open for *you* to open up a discussion on a topic you are dealing with now.

The next Dorkbot-nyc meeting is also happening Wednesday (April 05, 2006) night at Location One from 7-9PM EST. Here is the flyer. (Unfortunately, I will not make it out to the dorkbot-nyc meeting - if anyone else is planning to attend and wants to do a brief write-up, please let me know. We had no takers last month - maybe this month will be different?)

Next month, the NYCBUG meetings return to the SoHo Apple store, and I return to the dorkbot meetings. Yes! Nevermind.

-

Personal note,

Congratulations to MG!

(Slightly early) Congratulations to PV!

Oh, and I have been dodging my social obligations to those that do not live within a short commute range of NYC. I am trying to work on that.

I noticed this article via Schneier on Security.

The CIA asked the Tribune not to publish her name because she is a covert operative, and the newspaper agreed. But unbeknown to the CIA, her affiliation and those of hundreds of men and women like her have somehow become a matter of public record, thanks to the Internet.

The information age in general and that remarkable trashdump known as the Internet always reinforce what I believe to be a sort of law of nature, information wants to be free. The more digital and connected our world becomes, the stronger that want becomes. All of us as owners and protectors of information try to fight that freedom at times, and one mistake is often all it takes to crush those efforts in the modern world. Once information is freed today, there is little that can be done to lock it back up. In an instant, it is everywhere and nowhere, free.

Information leaks aside though, the following blurb reminded me of a story I once heard.

Some are heavily guarded. Others appear to be unguarded private residences that bear no outward indication of any affiliation with the CIA.

Someone once told me about a meeting they had with a different TLA. They drove to the meeting, and ended up in a mostly residential neighborhood in Maryland, where they encountered what appeared to be a private residence at the address that they had been given. That facade only held until they got within a certain distance of the building though, at which point they encountered a very thorough escort. This was no ordinary private residence.

-

Could it be?

Taipei, Taiwan, 10 March 2005 - VIA Technologies, Inc, a leading innovator and developer of silicon chip technologies and PC platform solutions, today announced the VIA EPIA EN-Series Mini-ITX mainboards, the first of VIA’s ultra compact platforms to feature the VIA C7 processor, making it the most powerful EPIA platform to date.

Designed to inspire a new generation of powerful digital media appliances, the VIA EPIA EN mainboard sets new standards for performance per watt and rich feature set, integrating the advanced VIA CN700 digital media IGP chipset that boasts an impressive range of features, including full hardware HDTV encoding up to 1080i, 720p output, hardware MPEG-2 acceleration, VIA Vinyl Multi-channel Audio, support for up to 1GB of DDR2 400/533MHz memory, full featured SATA II RAID, an LVDS module connector and Gigabit LAN.

And lots of hardware crypto.

Integrated into the VIA C7 and VIA Eden processor supporting is the VIA PadLock Security Engine, the world’s most comprehensive collection native x86 security tools. Featuring the world’s fastest x86 AES encryption engine, a powerful secure hash engine, a hardware Montgomery Multiplier to accelerate public key encryption such as RSA, and dual quantum based random number generators to provide an unshakable foundation for security, the VIA PadLock Security Engine enables developers to seamlessly offload the computational process involved in complex encryption algorithms freeing processor loading to handle more data faster. The security engine also offers NX Execute protection to prevent the propagation of worms.

Oh my goodness, this sounds so so sweet (marketing spin aside). There are a couple of projects I have been thinking about for which this might be perfect.

via a post to cypherpunks

-

The April 2006 NYCBUG meeting looks like it is going to have an open format.

Some of you may have noticed that we don’t have a meeting listed for April.

On admin we are discussing the idea of having an open type meeting, one
in which a few people off talk can propose a topic that they can discuss
in 5 minutes or so that is relevant to the their work with or on the BSDs.

In other words, if you’ve had a repeated problem figuring out how to get
spamd working, or you have a great solution for dealing with those
repeated zombie attacks on sshd, this is the time.

Some of our readers (and friends) are BSD people, especially a few of you down in DC. If you want to chime in, I may know of a place for you to crash for the night.

-

I know a few people that have been hit with this, including myself.

[...]I
>> got a call the other from the number 786-718-9058 and when I answered, it
>> was a message in Spanish which I couldn’t really hear and didn’t
>> understand. That was the end of it. Well then it called again 5 days
>> later and got my voicemail and left the same message it had the other day
>> when I answered the phone.
[...]

-

Hot on the heels of the publicity around the latest release of John the Ripper, l0phtcrack goes away.

The purpose of this letter is to notify you that Symantec Corporation is discontinuing its L0phtCrack (LC) product line and will no longer provide product code updates, enhancements or fixes to this product line.

via this post on the DailyDave mailing list

-

GPG patched.

Signature verification of non-detached signatures may give a positive
result but when extracting the signed data, this data may be prepended
or appended with extra data not covered by the signature. Thus it is
possible for an attacker to take any signed message and inject extra
arbitrary data.

FYI, we recently generated an OpenPGP key for general inquiries to D-kriptik. The public key can be found here.

via this post on the cryptography mailing list

-

Undeadly posted the following request.

Pre-Orders are Up for 3.9! Buy stuff!!!!

Pre-orders are up for 3.9, so you can all whip out your plastic and support the project.

-

The first release candidate for 0.1.1.x branch of TOR was announced.

This is the first release candidate for the 0.1.1.x series.

I noted the following bugfix as well.

- When we’re printing strings from the network, don’t try to print
non-printable characters. This protects us against shell escape
sequence exploits, and also against attacks to fool humans into
misreading their logs.

-

The 2006 SXSW music festival begins on Wednesday (14-03-2006).

The SXSW MUSIC AND MEDIA CONFERENCE showcases hundreds of musical acts from around the globe on over fifty stages in downtown Austin. By day, conference registrants do business in the SXSW Trade Show in the Austin Convention Center and partake of a full agenda of informative, provocative panel discussions featuring hundreds of speakers of international stature.

Sadly, I won’t be there.

So, I had what was supposed to be an informal meeting with a small business to discuss how to go about upgrading their current infrastructure to support their growth from 3 people to a planned 10 people over the course of this year. We were originally going to meet in a bar, but ended up in a conference room, where I briefly presented about what I have experienced during such a transition and then was interrogated for quite a while.

After this meeting, I was on my way to the NYCBUG meeting, when I remembered the meetings had been changed from 6:00PM EST to 6:30PM, so, being in the area of Heathers, I popped in for a drink. Heather soon came in, and she mentioned that she used to do some tech support for Macs. We discussed that I may need more Mac people in the future, and, while she was not directly interested in such a role, she knew people who would be. Good to know.

Unfortunately, the next thing I knew, it was after 6:30PM, so I dashed out of Heathers and ran up to Baruch college on E 25th. By the time I made my way to the proper room (through two security checkpoints), it was the question and answer (QnA) portion of Ray Lai’s presentation on systrace. I was disappointed to only catch the last 15 minutes of his talk, as systrace is a good topic and its use is not as widespread as i’d expect in OpenBSD server environments.

My notes on the QnA follow.

-

There was a question about whether systrace has had any security issues itself, which made me chuckle a bit. Ray answered that it had on NetBSD (not OpenBSD), the last one that he knew of discovered back in 2004 (a quite simple local exploit).

There was some discussion about using systrace to debug applications, which I had never really thought of explicitly in those terms before and so had me mumbling to myself a little in thought. For example, whenever an application crashes because systrace limited its access, well, you then go about debugging what access that application thinks it needs and why. I think the gist was taking the concept of that example and using it to learn about limiting an application’s privileges during development and testing.

Johnny Lam chimed in about using systrace to lockdown builds. When you download the source code for some rogue application and build it, you really don’t know what is going to happen during that build process. Since building generally requires a very limited set of permissions, it is easy to run the build in systrace with a very strict policy and note any weird access attempts. (I have really enjoyed hearing Johnny Lam discuss his NetBSD development environment, from encrypted file-backed domains in Xen with keys stored on a token to builds conducted using systrace.)

Ray noted that the OpenBSD ports have the option to use systrace during builds, although this option is not enabled by default (set the “USE_SYSTRACE” variable to “Yes”).

There was some discussion about systrace being easier to implement in server environments, where the services provided are normally well-defined and quite limited, versus a desktop environment, where there is a wide variety of software that a user may wish to run and covering all of it with systrace can be a huge, complicated task.

Systrace is part of base on both NetBSD and OpenBSD.

-

The presentation slides are available online here, and an audio recording of the presentation can be found here. (I am listening to it right now.)

Thanks to Ray Lai for presenting and NYCBUG for its continued efforts.

Systrace at the next NYCBUG meeting. (The systrace chapter from “Secure Architectures with OpenBSD” is freely available here.)

March 01, 2006
Ray Lai: Systrace for Slackers

NEW Time & Location!
And it is necessary to RSVP

Please send an email to rsvp at lists dot nycbug dot org with `RSVP` and your full name in the subject line

6:30 pm, Baruch College, CUNY
Building H, Room 620
E 25th Street between 3rd Ave & Lexington
Map

Systrace is a facility to confine programs to doing what they are supposed to do. When do they do “bad” things? When they get exploited, of course!

Most people either never heard of Systrace or don`t know how to use it. I hope to change both these problems.

Fortunately, the NYCBUG team found a temporary location for the NYCBUG meetings, which will be used for the March and April meetings. There is this though.

IMPORTANT: It is compulsory to RSVP for this meeting. . . so you MUST do
the following:

EMail to rsvp at lists.nycbug.org with the subject line of:

RSVP FirstName LastName

The cutoff time for the RSVP is 3 pm on Wednesday. You only need to
RSVP once for either or both meetings. Obviously, if you’re not sure
whether you’ll be attending the meetings or not, RSVP anyway.

Also, make sure you have an ID with you.

I have to grab a beer with a prospective client early in the evening, but I will run over to this meeting afterward. Hopefully, I will not be too late.

Also, the next dorkbot-nyc meeting is taking place the same night.

The nine million and twenty ninth dorkbot-nyc meeting will take place on Wednesday, March 1st at 7pm at Location One in SoHo.

Featuring,

• almost certified by k.cain and b.crabtree - “almost certified (grade A noise for non-discerning consumers) is a mechanical sound installation and informative publication. a distributed network of precarious egg-tapping robots.”
• Whorld by Chris Korda - “Whorld is a free, open-source Windows program that offers a unique approach to creating live digital art. Whorld generates real-time animation, but unlike most visualizers, it’s designed for performing, and includes MIDI support and other features more commonly found in clip-based VJ programs.”
• Heddatron by the botmatrix - “For the past year and a half The Botmatrix collaborated with The Les Freres Corbusier theater company on their latest play Heddatron: An adaptation of Henrik Ibsen’s classic play Hedda Gabler complete with 5 robots.”

Unfortunately, I will most likely not make it to this dorkbot-nyc meeting due to the NYCBUG meeting being held in east midtown for the time being. If anyone else is planning to attend and wants to do a brief write-up, please let me know.

Both events are always a good time, and you will meet some cool people. Check them out.

A little late, but better than never… I did make it over to the dorkbot-nyc meeting a bit after 8PM EST. I missed the first speaker, but I was able to catch the other two.

-

The second speaker, Anton Perich, discussed a painting machine he first built in the 1970’s and still uses today.

The painting machine looked like a giant printer (without its case). An image would be projected on a giant canvas, and then a print head would go back and forth across a massive canvas, painting line by line a giant image. Using an optical sensor, the head would know what areas to paint (for example, when in a dark part of the projected image, apply paint). The artist would manually intervene throughout the process to tweak the painting.

The most interesting point made was when Perich said he viewed technology as a tool through which he applied his creativity to build the works of art. He did not view the machine as a work of art in and of itself, just as a means to create art. Perich was asked about what the machine was built from, and he just glazed over the large amount of effort that went into building such a thing, as his focus was on the art created with it, not the technical details that went into to building it. (As we often say, technology is a means, not an end.)

Oh, and he discussed a portrait he did of Andy Warhol, who was a friend of his.

-

After that, the third speaker, Carrie Dashow, presented on a few of her projects. She discussed how her projects were focused on using technology to study human interaction, and she discussed three projects in particular.

The first project (”hello“) was Dashow going around saying hello to random people and recording the interaction. She showed one example where she was passing some person of the street and said hello. The person looked quite puzzled.

Anyway, Dashow made it onto television at one point, and she was made to say hello to random people outside while being filmed. At the same time, she brought with her a hidden camera to take control of the experience and make it her own. The result was amusing.

The second project (”10 Cameras, Caumsett L.I.”) was studying multiple people’s perspectives and the synchronicities between them using video cameras. Dashow gave cameras to 10 people and had them wander around a particular zone in Caumsett State Park. This footage was then shown in an installation, which basically showed all 10 perspectives across 10 monitors, so you could see each person’s viewpoint at any given time.

What I found most interesting were the synchronicities across the group. For example, a plane flying overhead would map across all 10 monitors, being just heard in some views, looked at in other views, etc. Quite interesting.

(Side note: I went to camp in Caumsett State Park during the summer back when I was a little kid. Fun stuff, although my mother didn’t enjoy picking the ticks off me.)

The third project (”Red Light Relay”) Dashow discussed was basically connecting the dots. In a town (Troy) in upstate New York where she went to college, she wanted to pull people together and create sort of network that transmitted a beam of light from one point of town to another. Dashow initiated the first light, and then the next person turned on their light when they saw hers, and so on.

This led her to try the concept with the dorkbot-nyc meeting attendees. Dashow had one person holding a balloon and another person holding a needle, and then had everyone connect to each other by holding hands starting from the balloon person’s free hand and ending with the needle person’s free hand. A signal was sent through this network of people by tapping hands, with each person receiving a tap from one person they were connected and then proceeding to tap the other person they were connected to. The signal was initiated by the balloon person tapping the person they were connected to, and this was meant to trasmit through all of us until it reached the needle person, who would then pop the balloon instead of a regular tap.

Unfortunately, as all of us that have debugged network problems have experienced, the signal went off into the ether and failed to reach its destination. After a bit of debugging, it turned out the attendees were divided into two giant networks, and there was no route between them. Time running out for her presentation, Dashow circumvented these difficulties by creating a tiny network with the people closest to her and sent the signal hopping through them. This worked, and the balloon was popped.

(Yes, it was cheesy, but it was also fun and got everyone talking. You know, sometimes cheesiness is the best way to break the ice.)

-

All in all, I find myself really enjoying these meetings. Thanks to the speakers and to dorkbot.

I made my way over to the NYCBUG meeting a few days ago, which was a talk by Johnny Lam on using Xen with NetBSD.

The meeting started out with administrative announcements. The next NYCBUG meeting will be held somewhere else, as the Apple store is about to undergo some rennovations, but where has yet to be determined. NYCBUG has a TOR node, and Roger Dingledine should be speaking at an upcoming meeting about TOR, which is a talking I am really looking forward to hearing. This was the 2nd anniversary of the NYCBUG public meetings. The NYCBUG web site has been redone, and there are some cool new features, such as submitting port requests. There were also requests for other people to present material at BUG meetings. (I’d love to give a presentation, so hopefully a topic will come to my mind that merges my focuses with subject matter relevant to these meetings. As it stands, the majority of my contribution has been meeting attendance and a couple of glossy posts to the NYCBUG mailing lists. Given TOR is going to be a topic, perhaps the gap is not as wide as I thought.)

After this administrative stuff, Johnny Lam arrived and spoke about Xen. He seemed quite used to public speaking, which is not always the case at NYCBUG meeting (the meetings often serve as a practice forum).

The beginning of the talk was just high level discussion about why to use virtualization at all. The main use is to effectively isolate users and processes, which Unix alone should accomplish by design, but which is often quite hard to accomplish in practice. Johnny discussed the two sides of the spectrum in accomplishing this isolation, and then he discussed virtualization as part of the middle between those extremes. On the one extreme, all servers have their own physical machines. So, the FTP server would be on a separate physical machine from the web server, etc., and so forth and so on. On the other extreme, all servers would be on one machine, and the operating system would be relied upon to keep separation between them all. So, the FTP daemon would be kept separate from the web daemon by process separation, permissioning, etc., and so forth and so on. Virtual machines sort of merge these two extremes, allowing for multiple, logical machines to be running on one physical machine. In theory, each virtual machine is distinct from the other virtual machines and can be viewed as its own machine (although how true that is in practice is a question in my mind).

Johnny went on to talk briefly about Xen and his particular setup. He talked about the privileged domain (domain 0 - think root) and the guest (unprivileged) domains (domain U - think everyone else). Domain 0 essentially serves to manage the guest domains, so Johnny runs only the bare minimum needed to do this in domain 0. The guest domains run everything else.

What really caught my attention though was the usage of file-backed guest domains using encrypted (CGD) virtual disks (VND) (pardon my attempt at NetBSD terminology). Domain 0 would setup the encrypted virtual disks and then configure the guest domains to use them. The setup reminded me of my post about using encrypted memory disks in FreeBSD, as this would be a really cool way to use encrypted memory disks. Take those encrypted memory disks and use them for your virtual machines, which could mean that everything that machine tries to write to disk is encrypted first, but without the fanagling necessary to try to setup FreeBSD with boot/root encrypted. Combine that with encrypted swap for domain 0, and perhaps all the bases are covered. Cool stuff.

That is about it for my notes. Slides can be found here, and audio of the presentation can be found here. Put the two together, and there you go.

Thanks to Johnny for a good talk and to the efforts of NYCBUG.

-

On a related note, I stumbled across the following.

First off, I found this blog, which seems to keep up with lots of virtualization news, and in it was this post. So, it looks like more than a player is going to be out there for free by VMWare. Cool.

An email circulating in these hours reports GSX Server is going to change name in VMware Server, distributed for free from 6th February.

Second, I found this site via that blog, which discusses the efforts to port Xen to FreeBSD. (I am excited about this, as jails seem more like glorified chroots than full blown virtual machines, unless I am missing something.)

This page is intended to document the work on FreeBSD on Xen and the sun4v hypervisor.

No domain 0 yet, but it is coming.

-

Totally unrelated, I have heard Berlin’s The Metro mixed seamlessly in quite a few DJ sets recently. That icy track is as cool today as it was in 1982. Who would have imagined transitions like Bloc Party’s Banquet to Berlin’s The Metro back 20 odd years ago when the latter came out? It reminds me of UFS or the unix epoch.

Oh, and a brief post on the last dorkbot-nyc meeting is forthcoming.