Links May 2009

May 30, 2009 | etbe

An interesting opinion post in the NY Times describes the research on early education and how it can affect IQ [1]. Among other things children from poor families who are adopted into upper middle-class families tend to end up with higher IQ scores. The article notes that half the population in 1917 would be regarded as mentally retarded by today’s standards – finally we have an explanation for WW1!

Two Dominos employees tarnish the brand’s image with a prank video on Youtube [2]. The next obvious step is for activists to seek jobs at such companies for the purpose of influencing companies. The animal rights protesters outside KFC stores haven’t achieved much, but if they worked for KFC and made some nasty videos they would really encourage a change of action. I predict that chain stores will be spending a lot more on security and background checks for their employees in the near future.

Cory Doctorow has written an amusing article titled “Big Entertainment Wants to Party Like It’s 1996” about how the entertainment industry is killing itself by conducting back-room negotiations about new copyright laws [3].

Nate Silver gave a TED talk about racism in elections [4]. The most interesting point was demonstrating statistically that people who don’t meet people of other races tend to be more racist. It seems to me that the use of the X-Face: header in email and the use of HackerGotchi in Planets can help reduce the level of racism on the Internet.

Cory Doctorow writes about his Geeky writing [5]. His idea for an organised system for donating books to libraries will hopefully be fully implemented soon – it should be easy to do and the incremental costs will decrease as the scope increases.

Cory Doctorow writes about the perverse laws that protect criticism of copyright works but stifle praise [6]. In a similar note he has documented a plan for trademark and copyright holders to allow fans to create derivitive works while preserving the original rights AND sharing the profits [7]. So if Cory’s idea became popular someone who wanted to create some art work based on a Coke bottle (which is trademarked) could pay the Coca-Cola company a reasonable rate, include an appropriate disclaimer, and things would work out well for everyone. Also this would allow small artists to develop new products that could be used by the large companies (I’m sure that anyone who legally released an artwork that turned out to be an effective advert for Coke would receive a lucrative job offer).

Bruce Schneier’s blog has an interesting article about the poor quality of software used for breath alcohol detectors [8]. It’s a great concern that innocent people are being punished due to bad software, but it’s only a small part of the problems with the legal system.

Mary Roach gave a TED talk “10 Things You Didn’t Know About Orgasm [9]. Not as insightful as the usual TED talk, but strange and interesting.

Appropriate Talks about Porn

May 17, 2009 | etbe

There is currently some discussion about a talk which used pornographic imagery and jokes to illustrate points about Ruby programming [1]. A similar event happened in 2006 here is the description of the event from the author – which includes an unreserved apology [2].

It seems to me that the current discussion focusing on what is inappropriate for a public lecture is the wrong way to do it as there is a vast range of inappropriate material. I suggest that instead a white-list of appropriate references to porn in lectures will be more effective – if nothing else it makes for a much smaller list. Here is a first draft of such a list:

Pornographic web sites handle a lot of traffic. There are significant technical problems that need to be solved. A lecture from an employee of an Internet porn company which covers the solutions to those technical problems would be of interest to many system administrators. Of course such a lecture should not promote the Internet porn company or show any samples of their products.
Digital processing of images is an interesting topic. Having a digital editor from a magazine such as Vogue describe in detail how they do their job would be really interesting. There is a lot of overlap between the range of pictures displayed in Vogue and those displayed on porn sites. Having an employee of a porn company demonstrate how they touch up the picture of a fully clothed model would be an interesting technical topic, but of course it would be totally inappropriate to make any specific mentions of how the parts of the picture which are not PG-13 rated are edited. Even showing a picture of a porn star might be controversial, but I’m sure that the same work could be reproduced with a photo of someone who has a more respectable career. Touching up a picture of RMS to make him look like a politician would make for a challenge for the presenter and an interesting lecture.
The image known as Lenna is a photograph of a Playboy model named Lena that is widely used to test image compression [3]. While the image remains controversial, it seems to me that it would be impossible to give a complete and factual account of the history of image compression without mentioning it.
The police have great discretionary powers to determine which crimes should be actively investigated. Senior police decide how many resources to assign to each case. I believe that in many jurisdictions the police will assign a much lower priority to a hacking case if the victim is running a porn service. Rumor has it that porn sites put a lot more effort into system security than most Internet services, partly due to not having as much protection from the police as other industries and partly because their customers don’t want to be identified. I would be very interested in attending a presentation about practical computer security by a system administrator from a porn site. As an aside I’m always interested in talking to people who do security work, so I would like to have a chat with someone who does such work for a porn site.
A few years ago I attended a lecture about the security implications of porn surfing. It had some scary statistics on the number of porn sites that try to deploy malware on the computers of the people who view porn, and it made a good business case for banning porn at work without reference to HR issues (which is very relevant for the jurisdictions where viewing porn at work is not considered to be a social problem). I would like to see a new version of that talk with statistics based on more recent research, my theory is that modern porn sites are more toxic than the old ones due to the general increase in criminal activity on the net – but I have no evidence to support it.

Of course in all cases jokes about porn are not acceptable, mentions of porn need to be strictly on the basis of historical analysis or the description of technical and legal issues which are relevant to the audience. Delivering a talk about porn without inappropriate jokes would take a great deal of effort, but it can be done (and I’ve seen it done once). For these five cases (and the few others that will probably be suggested in comments) it would probably be best if the conference organisers viewed the talk first to ensure that there was no misunderstanding about what is appropriate.

I think that comparing a short list of specific cases where porn can reasonably be mentioned in a public lecture with the vast number of potential inappropriate references illustrates the probability of a random porn reference being acceptable. The probability of making a random porn reference that is appropriate is probably slightly less than that of winning the lottery.

The Main Security Problem

May 15, 2009 | etbe

All security problems are to some degree people problems. Code may be buggy, but it was written by people who could have been better trained, had more time to spend on code review, etc. When there are multiple programs, OSs, libraries, etc to choose from then choosing a suitable combination of software is a matter of the skill and background knowledge of the people involved.

There are issues of software choice where there is no provable benefit of making one particular choice, EG choosing between a popular product that is OK and for which it is easy to hire skilled people to use it and a less popular product that has better security features but less public knowledge. But this is minor compared to other security problem.

I believe that the greatest security problem is stupid people. Stupid people in technical positions write buggy code and configure servers to be insecure. In consulting and analysis roles they develop bad procedures. In management they hire bad people to do technical work.

The vast majority of security problems can be fairly directly and immediately traced back to stupidity. In the corporate environment that is stupid programmers, stupid managers who hire people who are obviously stupid, and often stupid executives for mandating that software that everyone knows to be insecure should be used across the entire enterprise. In both the home and corporate environments there are a huge number of people who run machines that they know to be compromised. Apparently using a computer that is known to be under the control of an unknown hostile person is something that they don’t consider to be a problem – in spite of the obvious risks of fraud, data destruction, and risk of being implicated in crimes such as the distribution of child porn.

Dom0 Memory Allocation and X

May 11, 2009 | etbe

I’ve previously written about memory squeeze problems in a Xen Dom0 when large amounts of memory were assigned to DomUs [1]. In summary the Dom0 would have problems if started with default options and the majority of the RAM was later assigned to DomUs, but if the memory of the Dom0 was limited by the dom0_mem parameter to the Xen kernel then things would work well.

Fatal server error:
xf86MapVidMem: Could not mmap framebuffer (0xfae80000,0x80000) (Invalid argument)

I have since found another exciting bug with Xen. I was in the process of upgrading an AMD64 workstation to using Xen so that I could test other versions of some software in the background. The first stage was to install the Xen kernel and the Xen enabled Linux kernel and boot the machine. Unfortunately I then received the above message when trying to start the X server. I discovered the solution to this in the comments section of Different Colours blog post about Virtualisation on Lenny [2]. It seems that there is a problem gaining mmap access to MMIO memory regions in Xen and that restricting the memory of the Dom0 is a work-around.

My AMD64 workstation has 3G of RAM because the motherboard can’t support more than 3.25G and buying 4G of RAM to have 3.25G usable would be an expensive way of doing it. So I used dom0_mem=1500M and now X works again. I have yet to discover if anything strange and exciting happens when I create DomUs on the machine. I don’t have any immediate plans for running Xen on the machine. It’s main uses at the moment is torcs (a slightly realistic 3D car racing game), supertuxkart (a cartoon 3D car racing game), and mplayer so it doesn’t really need a lot of RAM.

I like to keep my options open and have all my machines capable of virtualisation apart from routers.

CPL

May 2, 2009 | etbe

I’ve just bught an NVidia video card from Computers and Parts Land (CPL) [1].

I asked for a PCIe*8 card but was assured that a PCIe*16 card would work. However when I got it home I discovered that it would not fit, the size difference was obvious enough that I didn’t even need to unwrap the new card.

According to the Wikipedia page for PCIe (PCI Express) [2] it is quite legal to have a motherboard implement a slower version of PCIe but have the full slot width, so a motherboard could have PCIe*1 implemented but have a socket that will fit a PCIe*16 card. The motherboard and the card will negotiate the capabilities that they both support. But there is no requirement to have a larger socket than required to use the capabilities of the motherboard.

The CPL salesman assured me that any PCIe*16 card will fit into any PCIe*8 socket. I presume that he is used to white-box gear manufactured by companies that can save a few cents on the sockets if they make them all the same size. The Dell PowerEdge T105 that I own has PCIe*8 sockets that do not fit PCIe*16 cards.

So now I have to return the card, and the CPL web site doesn’t even give the hours that the store is open, so I have to call them. Sigh.

Update: I returned the video card, first I had a debate with the CPL guy who had sold it to me regarding whether such PCIe sockets exist. He suggested that I had mistaken a PCI slot for a PCIe slot and was not convinced until I showed him a picture I had on my phone. He then claimed that Dell made sub-standard machines for not using a PCIe*16 socket for PCIe*8 connectors – so it was Dell’s fault not his fault for delivering me a PCIe*16 board when I asked for a PCIe*8. He told me that no-one had ever made a PCIe*8 video card. Then he told me that I was lucky to not have a re-stocking fee (they sold me a device that was not what I asked for, I returned it in perfect condition on the same day and I was lucky to not pay them for the privilege). They gave me a credit note for the value of it (not a refund).

I recommend never doing business with CPL if you can avoid it. I will make exactly one more purchase from them, that will be to use the credit note.

[1] http://www.cpl.net.au/
[2] http://en.wikipedia.org/wiki/PCIE

Too Stupid to be a Judge

May 2, 2009 | etbe

Bruce Schneier has written about the foolish actions of Justice Antonin Scalia [1]. Antonin made some comments opposing the need for greater privacy protection, most people could get away with doing that, but when a Supreme Court Justice does so it gets some attention. In response to this Fordham University law professor Joel Reidenberg assigned his class a project to discover private information on Antonin using public sources. The class produced a dossier of such information which was then offered to Antonin [2], but which was not published.

Now anyone who knows anything about how the world works would just accept this. Among other things Antonin now knows what is publicly available and can take steps to remove some public data according to his own desires. But being apparently unaware of the Streisand effect [3] Antonin went on to say the following:

It is not a rare phenomenon that what is legal may also be quite irresponsible. That appears in the First Amendment context all the time. What can be said often should not be said. Prof. Reidenberg’s exercise is an example of perfectly legal, abominably poor judgment. Since he was not teaching a course in judgment, I presume he felt no responsibility to display any.

This is of course essentially issuing a challenge to the entire Internet to discover the information that the Fordham students discovered. Of course doing so would not be fun unless it was published. The meme of 2009 has yet to be defined, it might be discovering and widely publishing personal information about Antonin.

Already one of the comments in Bruce Schneier’s blog suggests that activists should do such research on all senior figures in the US government to encourage them to take privacy more seriously. I expect that the first reaction of the legislative branch to such practices would be to enact special laws to protect their own privacy while still allowing large corporations (the organisations that pay for the election campaigns) to do whatever they want to ordinary people.

It’s an interesting situation, I predict that Antonin will regard this as one of the biggest mistakes he’s ever made. I’m sure that there are many more LULZ to come from this.

Redundancy in Network Infrastructure

April 29, 2009 | etbe

It’s generally accepted that certain things need redundancy. RAID is generally regarded as essential for every server except for the corner case of compute clusters where a few nodes can go offline without affecting the results (EG the Google servers). Having redundant network cables with some sort of failover system between big switches is regarded as a good idea, and multiple links to the Internet is regarded as essential for every serious data-center and is gaining increasing acceptance in major corporate offices.

Determining whether you need redundancy for a particular part of the infrastructure is done on the basis of the cost of the redundant device (in terms of hardware and staff costs related to installing it), the cost of not having it available, and the extent to which the expected down-time will be reduced by having some redundancy.

It’s also regarded as a good idea to have more than one person with the knowledge of how to run the servers, jokes are often made about what might happen if a critical person “fell under a bus“, but more mundane things such as the desire to take an occasional holiday or a broken mobile phone can require a backup person.

One thing that doesn’t seem to get any attention is redundancy in the machine used for system administration. I’ve been using an EeePC [1] for supporting my clients, and it’s been working really well for me. Unfortunately I have misplaced the power supply. So I need to replace the machine (if only for the time taken to find the PSU). I have some old Toshiba Satellite laptops, they are quite light by laptop standards (but still heavier than the EeePC) and they only have 64M of RAM. But as a mobile SSH client they will do well. So my next task is to set up a Satellite as a backup machine for my network support work.

It seems that this problem is fairly widespread. I’ve worked in a few companies with reasonably large sysadmin teams. The best managed one had a support laptop that was assigned to the person who was on-call outside business hours. That laptop was not backed up (to the best of my knowledge, it was never connected to the corporate LAN so it seems that no-one had an opportunity to do so) and there was no second machine.

One thing I have been wondering is what happens to laptops with broken screens when the repair price exceeds the replacement cost. I wouldn’t mind buying an EeePC with a broken screen if it comes with a functional PSU, I could use it as a portable server.

[1] http://etbe.coker.com.au/2008/07/21/review-of-the-eeepc-701/

Email Passwords

April 27, 2009 | etbe

I was doing some routine sysadmin work for a client when I had to read mail in the system administration mailbox. This mailbox is used for cron job email, communication with ISPs that run servers for the company, and other important things. I noticed that the account was subscribed to some mailing lists related to system administration, the following is from one of the monthly messages from a list server:

Passwords for sysadmin@example.com:
List Password // URL
---- --------
whatever-users@example.org victoria3

That doesn’t seem terribly exciting, unless you know that the password used for the list server happens to be the same as the one used for POP and IMAP access to the account in question, and that it is available as webmail… Of course I didn’t put the real password in my blog post, I replaced it with something conceptually similar and equally difficult to guess (naturally I’ve changed the password). The fact that the password wasn’t a string of 8 semi-random letters and digits is not a good thing, but not really bad on it’s own. It’s only when the password gets used for 3rd party servers that you have a real problem.

I wonder how many list servers are run by unethical people who use the passwords to gain access to email accounts, and how many hostile parties use such lists of email addresses and passwords when they compromise servers that run mailing lists.

Now there would be an obvious security benefit to not having the list server store the password in clear-text or at least not send it out every month. Of course the down-side to doing that is that it doesn’t give someone like me the opportunity to discover the problem and change the password.

Creating a Double-Ended Bun

April 25, 2009 | etbe

The people who made the above magazine advert gave it two top-halves to the burger bun. But I think that there is actually a demand for such buns, and that it is possible to make them!

Traditional buns have a flat bottom where they rest on a baking tray. One solution to this problem would be to bake in outer space, another possible solution would be to develop a rapid baking process that allows baking in a free-fall aeroplane, but both of these would be unreasonably expensive.

It seems that it would be viable to bake double-ended buns by having a rapidly rising column of hot air to suspend the bun. The terminal velocity of a bun would probably not be that high (maybe 60Km/h) and it should be quite easy to have a pipe full of hot air that bakes the buns. As slight variations in the density and shape of the bun would affect the air-flow it would be necessary to closely monitor the process and adjust the air speed to keep the bun afloat. Manufacturing cheap ovens that use LASERs to monitor the position of the bun should not be difficult.

This might blow the sesame seeds off the bun, but this problem may also be solvable through careful design of the bun shape to make it less aerodynamic and by strongly attaching the seeds. I’m not sure how you would do this.

Links April 2009

April 23, 2009 | etbe

P. W. Singer gave an interesting TED talk about the use of robots in war [1]. He briefly covered some of the ethical and social issues related to robot soldiers as well as showing many pictures of existing robots.

Since November 2007 there has been a request for Google Gears to support “Iceweasel” (the Debian name for Firefox due to trademark issues)[2]. Apparently supporting this different name is not easy for the Google people. If you visit the Google Gears Terms and Conditions page [3] then it will work with Iceweasel on the i386 platform – but not for AMD64 (or at least not my Debian/Lenny AMD64 system).

Charles Moore gave a disturbing TED talk about the “Great Pacific Garbage Patch” [4]. Pollution in the oceans from waste plastic is worse than I realised.

Ressuka documented how to solve the Time went backwards problem on Xen DomUs [5]. Run “echo “jiffies”> /sys/devices/system/clocksource/clocksource0/current_clocksource” or use “clocksource=jiffies” in your DomU kernel boot parameter list.

Nassim Taleb [6] has written Ten principles for a Black Swan-proof world [7], this is in regard to the current US financial crisis. It’s worth noting that he made a significant amount of money due to successfully predicting some aspects of the crisis.

James Duncan Davidson has some good advice for speakers based on his experience in filming presentations [8]. Some of the ones that were not obvious to me were:
Take off your name-tag – it doesn’t look good
Stay in the part of the stage with the best light

etbe – Russell Coker

Linux, politics, and other interesting things