hacking embedded systems

http://lwn.net/Articles/407459/

One of the scariest articles I have seen recently.

The linked PDF is nice too, but the article about it just flows better.

found on a random list of funnies somewhere...

"I think part of a best friend's job should be to immediately clear your computer history if you die"

Awesome!

bikeshedding the twittube!

http://lwn.net/Articles/405810/

Lovely humour from a lady I'm starting to admire as much as JR (that's Joanna Rutkowska, not the zero-EQ JKR of Harry Potter fame).

There's no need to click the link unless you're a file systems maven though... the funny parts are right here:

----- quote -----

This series is the core mount and lookup infrastructure from union mounts, split up into small, easily digestible, bikeshed-friendly pieces.  All of the (non-documentation, non-whitespace) patches in this series are less than 140 lines long.  It's like Twitter for kernel patches.

VFS developers should be able to review each of these patches in 3 minutes or less.  If it takes you longer, email me and I'll post a video on YouTube making fun of you.

Fwd: Consumerization and Corporate IT Security

I can't recall when was the last time Bruce Schneier said something I did not quite agree with.  The last paragraph could have at least hedged a little, instead of making it sound so unequivocal.  Oh well...

-------- Original Message -------- 

 

 

 

Consumerization and Corporate IT Security

via Schneier on Security by schneier on 9/7/10

If you're a typical wired American, you've got a bunch of tech tools you like and a bunch more you covet. You have a cell phone that can easily text. You've got a laptop configured just the way you want it. Maybe you have a Kindle for reading, or an iPad. And when the next new thing comes along, some of you will line up on the first day it's available.

So why can't work keep up? Why are you forced to use an unfamiliar, and sometimes outdated, operating system? Why do you need a second laptop, maybe an older and clunkier one? Why do you need a second cell phone with a new interface, or a BlackBerry, when your phone already does e-mail? Or a second BlackBerry tied to corporate e-mail? Why can't you use the cool stuff you already have?

More and more companies are letting you. They're giving you an allowance and allowing you to buy whatever laptop you want, and to connect into the corporate network with whatever device you choose. They're allowing you to use whatever cell phone you have, whatever portable e-mail device you have, whatever you personally need to get your job done. And the security office is freaking.

You can't blame them, really. Security is hard enough when you have control of the hardware, operating system and software. Lose control of any of those things, and the difficulty goes through the roof. How do you ensure that the employee devices are secure, and have up-to-date security patches? How do you control what goes on them? How do you deal with the tech support issues when they fail? How do you even begin to manage this logistical nightmare? Better to dig your heels in and say "no."

But security is on the losing end of this argument, and the sooner it realizes that, the better.

The meta-trend here is consumerization: cool technologies show up for the consumer market before they're available to the business market. Every corporation is under pressure from its employees to allow them to use these new technologies at work, and that pressure is only getting stronger. Younger employees simply aren't going to stand for using last year's stuff, and they're not going to carry around a second laptop. They're either going to figure out ways around the corporate security rules, or they're going to take another job with a more trendy company. Either way, senior management is going to tell security to get out of the way. It might even be the CEO, who wants to get to the company's databases from his brand new iPad, driving the change. Either way, it's going to be harder and harder to say no.

At the same time, cloud computing makes this easier. More and more, employee computing devices are nothing more than dumb terminals with a browser interface. When corporate e-mail is all webmail, corporate documents are all on GoogleDocs, and when all the specialized applications have a web interface, it's easier to allow employees to use any up-to-date browser. It's what companies are already doing with their partners, suppliers, and customers.

Also on the plus side, technology companies have woken up to this trend and -- from Microsoft and Cisco on down to the startups -- are trying to offer security solutions. Like everything else, it's a mixed bag: some of them will work and some of them won't, most of them will need careful configuration to work well, and few of them will get it right. The result is that we'll muddle through, as usual.

Security is always a tradeoff, and security decisions are often made for non-security reasons. In this case, the right decision is to sacrifice security for convenience and flexibility. Corporations want their employees to be able to work from anywhere, and they're going to have loosened control over the tools they allow in order to get it.

This essay first appeared as the second half of a point/counterpoint with Marcus Ranum in Information Security Magazine. You can read Marcus's half here.

the effect of snake oil security

http://threatpost.com/en_us/blogs/effect-snake-oil-security-090710

it's just a coincidence that the author's nickname is "rsnake" :-)

he makes a valid point, but as the comments show, not everyone agrees.  The most useful comment is the one that says "aah but this will apply equally to non-snake oil remedies" or some such...  worth thinking about

apple bashing...

...is always fun.  Even more so when it happens on otherwise staid and
sedate sites like LWN:

http://lwn.net/Articles/404259/

----

Broadcom releases an open-source driver for its wireless chipsets
Posted Sep 9, 2010 16:09 UTC (Thu) by djcapelis (subscriber, #53964)
Parent article: Broadcom releases an open-source driver for its
wireless chipsets

Oh my!

This is an amazing development. One of the last problems with a
macbook I was having was a broadcom chip.

--

Posted Sep 9, 2010 16:39 UTC (Thu) by lkundrak (subscriber, #43452) [Link]
The last one is being a macbook I presume ;)

Hg easy to use?

http://groups.google.com/group/vim_dev/msg/7e494fa0fe6cc732

If Bram, author of vim, cannot do some simple version cutovers in Hg, is it really that easy to use?

The other thread at http://groups.google.com/group/vim_dev/browse_thread/thread/1ce709f61e5424e5/f70ea0132796c96a?hide_quotes=no#msg_f70ea0132796c96a is even more illustrative (and, as a friend on #git said, too fatiguing to read).

Branching it seems is still a mess in Hg...

fixups on an existing commit using tig and the new autosquash option on rebase

This shows how to use tig and the new option in rebase to do fixups very quickly.

What you need first is this line in your ~/.gitconfig:

# fixup, from http://permalink.gmane.org/gmane.comp.version-control.git/154460
fixup = "!f() { git commit -m\"fixup! $(git log -1 --pretty=%s $1)\"; }; f"

and these lines in your ~/.tigrc:

bind main = !git fixup %(commit)
bind main R !git rebase --autosquash -i %(commit)
bind generic s view-status

We need to make a quick change in conf/example.gitolite.rc. We first make the
change, then start tig

type 's' for status view, then cursor down to the file that you just changed

type 'u' to stage that file

type 'q' to quit status view and go back to main view; cursor down to the
commit you want to "fixup"

hit enter to make sure it is the right one; it is... the filelist confirms it

hit 'q' to get rid of the commit details, then '=' to invoke the "git fixup"

Notice the commit message?

hit enter to get past that commit confirmation message, then arrow down 1 line

hit "R" to rebase with respect to the selected commit

save and exit the editor

hit enter to see the new commits

long time Mandriva user tries Fedora

I have switched my laptop over to Fedora 13 LXDE to check things out properly in normal use; here are my findings so far.  (Remember I have > 10 years of history as a Mandriva user!)

Plus points

• recognises the Tata Photon+ CDMA data stick out of the box.  The GUI is identical, except for color, to the one in Linux Mint; now why can't Mandriva also use that same software, whatever it is?  In Mandriva, you have to use wvdial (which means you have to install it first!).  The normal drakconf-spawned config screen asks you for a "PIN number" (huh?) and regardless of what you type or not, it responds saying "have you inserted your SIM card" or some such message I can't recall.

• the ability to create a custom live CD with everything I want on it.  Thanks to my friend Raj, I now have a nice live CD (actually USB stick) that contains more than 200 packages of my choice.  This means I truly don't have to take my laptop around to many places, while still getting a LOT of work done.

• having a sane set of package repos automatically configured even if you live in India!  Mandriva would always select some mirror in China that, consistently across the last 2-3 releases of Mandriva, has been dead or unresponsive or overloaded any time I try it.  I'd gotten to the point that I'd pretend to be in some US time zone, then change it to India after the install is all done.  Or go to easyurpmi.zarb.org and do a manual mirror selection.
  

Minus points

• missing or outdated packages.  (For example, "recoll" -- if I ever have to switch my work desktop this would be a show stopper!  And "atop" is unmaintained.  And unison is apparently deprecated... in favour of what, I wonder?)
  
  However, the saving grace is that the Fedora ecosystem is just too big for anyone to ignore, so either the upstream themselves will have an RPM available (as in the case of recoll and atop), or someone else (like Dag) might, or -- worst case -- my PFE (personal Fedora expert/evangelist, a person who shall remain nameless in his own interest, lest he be swamped by others' requests for help!) will find me a link from somewhere!

• keychain doesn't work.  I had to add these 3 magic lines into my own .bash_profile because the one in /etc/profile.d didn't seem to work.  I should probably dig deeper and report it if needed

        keychain ~/.ssh/id_rsa
        . ~/.keychain/$HOSTNAME-sh
        . ~/.keychain/$HOSTNAME-sh-gpg

• There is no way to have the screen lock before suspend/hibernate.  This is not secure.  I finally had to put "xscreensaver-command -lock; sleep 2" somewhere inside a file called "pm-action".  There is just no other way as far as I know.  From a non-techie user perspective this is horrible, horrible, horrible.  (I realise this may be only the LXDE spin and perhaps the KDE or GNOME versions do it ok).
  

• The touchpad doesn't let you click.  You have to run gnome-mouse-properties and change the settings, which would be fine, but they don't persist across a logout/login.  Each time you login you have to run that command again.  (Weirdly enough, you don't have to touch the settings; they're all there.  But the GUI has to come up once...)

Still, all in all it was a pleasant experience, especially because my friend Raj showed me how to make my own live image with whatever packages I want in it.  In the end that might be a bigger point than all the rest :-)

making a multi-boot USB (and mandriva troubles)

So today my young colleague Vignesh and I spent some time figuring out how to put more than one live CD onto a USB stick. Without using any external tools (except "unetbootin").

In brief:

• make ext2/3 partitions for each live CD you want to install; make sure you add about 10-20% extra space (moving from iso9660 to ext2 seems to do that!)
• run unetbootin for each live CD in turn, to its respective partition
• on the first partition, edit extlinux.conf to remove any cruft, and then tack on to the end of it just the one or two relevant paragraphs from the same file of the other partitions (i.e., the other live CDs that you unetbootin-ed). Make the identifiers sequential (not sure it works if they repeat; by default they all start with 0)
• make sure all the vmlinuz files and initrd files mentioned in these extract are all copied to the first partition. Watch for name duplication, extra components in the pathnames in the conf file paras that you didn't create (you just dumped 'em all into the first partition's top level directory!) etc., and change the conf lines to fit the filenames
• make one final "extlinux -i /dev/first-partition"
• make sure this is the one marked "bootable" in fdisk

and you're done.

----

Unless one of the live CDs you want is Mandriva :-(

God what a pain. First of all, without initrd tweaking it cannot be "unetbootin"-ed. This is because the extlinux.conf entries don't come with UUID= options, so unless it's the first partition it won't get past that. Worse, the "linuxrc" file inside the initrd.gz hardcodes"-t iso9660". Come on.... why? The mount command should be able to figure out the partition type dammit!

What Vignesh finally did to make it work was

• add a root=UUID= parameter to the "kernel" lines in the config (2 of them; one for live, one for install)
• patch linuxrc to comment out all the stuff to do with labels and add this line in their place:
  sh -c 'root=`grep -o "UUID=[a-zA-Z0-9\-]*" /proc/cmdline`; mount -o ro $root /live/media'

And that seemed to work for me too.

Once.

After that it never worked again (back to sqshfs errors). And after a couple more attempts I just gave up... Mandriva is not really worth it as a quick-check-your-email-on-a-borrowed-laptop live CD anyway so there's no point:

• it's too slow (an *installed* Mandriva boots slower than mint or F13 running off a USB stick)
• it doesn't support my Tata Photon+ USB thingie (what do they use, WiMax? not sure) out of the box -- you have to install wvdial, which it doesn't come with!
• and most important, it's the only one that needs 5 clicks before it gets to the desktop. It's like they didn't intend to make it a real "live CD", but only as an installer
  

----

Looks like my MDV days may be numbered, and not just because I promised a friend of mine (who favours Fedora) that I'd switch to Fedora if they start using gitolite either. Sad... The future looks Fedora-ish blue for my machines and minty-green for the ones I manage for my non-tech f&f.