X-Git-Url: http://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/415ca66faf2bdada94bf138323d58d1b478573b1..82c275270aa04d408cfa46dc7a00dc772a003fdf:/blog/index.html diff --git a/blog/index.html b/blog/index.html index 7b6d01cc98..48cdc3ff9b 100644 --- a/blog/index.html +++ b/blog/index.html @@ -20,124 +20,77 @@
-
Isenkram, Appstream and udev make life as a LEGO builder easier
-
7th October 2016
-

The Isenkram -system provide a practical and easy way to figure out which -packages support the hardware in a given machine. The command line -tool isenkram-lookup and the tasksel options provide a -convenient way to list and install packages relevant for the current -hardware during system installation, both user space packages and -firmware packages. The GUI background daemon on the other hand provide -a pop-up proposing to install packages when a new dongle is inserted -while using the computer. For example, if you plug in a smart card -reader, the system will ask if you want to install pcscd if -that package isn't already installed, and if you plug in a USB video -camera the system will ask if you want to install cheese if -cheese is currently missing. This already work just fine.

- -

But Isenkram depend on a database mapping from hardware IDs to -package names. When I started no such database existed in Debian, so -I made my own data set and included it with the isenkram package and -made isenkram fetch the latest version of this database from git using -http. This way the isenkram users would get updated package proposals -as soon as I learned more about hardware related packages.

- -

The hardware is identified using modalias strings. The modalias -design is from the Linux kernel where most hardware descriptors are -made available as a strings that can be matched using filename style -globbing. It handle USB, PCI, DMI and a lot of other hardware related -identifiers.

- -

The downside to the Isenkram specific database is that there is no -information about relevant distribution / Debian version, making -isenkram propose obsolete packages too. But along came AppStream, a -cross distribution mechanism to store and collect metadata about -software packages. When I heard about the proposal, I contacted the -people involved and suggested to add a hardware matching rule using -modalias strings in the specification, to be able to use AppStream for -mapping hardware to packages. This idea was accepted and AppStream is -now a great way for a package to announce the hardware it support in a -distribution neutral way. I wrote -a -recipe on how to add such meta-information in a blog post last -December. If you have a hardware related package in Debian, please -announce the relevant hardware IDs using AppStream.

- -

In Debian, almost all packages that can talk to a LEGO Mindestorms -RCX or NXT unit, announce this support using AppStream. The effect is -that when you insert such LEGO robot controller into your Debian -machine, Isenkram will propose to install the packages needed to get -it working. The intention is that this should allow the local user to -start programming his robot controller right away without having to -guess what packages to use or which permissions to fix.

- -

But when I sat down with my son the other day to program our NXT -unit using his Debian Stretch computer, I discovered something -annoying. The local console user (ie my son) did not get access to -the USB device for programming the unit. This used to work, but no -longer in Jessie and Stretch. After some investigation and asking -around on #debian-devel, I discovered that this was because udev had -changed the mechanism used to grant access to local devices. The -ConsoleKit mechanism from /lib/udev/rules.d/70-udev-acl.rules -no longer applied, because LDAP users no longer was added to the -plugdev group during login. Michael Biebl told me that this method -was obsolete and the new method used ACLs instead. This was good -news, as the plugdev mechanism is a mess when using a remote user -directory like LDAP. Using ACLs would make sure a user lost device -access when she logged out, even if the user left behind a background -process which would retain the plugdev membership with the ConsoleKit -setup. Armed with this knowledge I moved on to fix the access problem -for the LEGO Mindstorms related packages.

- -

The new system uses a udev tag, 'uaccess'. It can either be -applied directly for a device, or is applied in -/lib/udev/rules.d/70-uaccess.rules for classes of devices. As the -LEGO Mindstorms udev rules did not have a class, I decided to add the -tag directly in the udev rules files included in the packages. Here -is one example. For the nqc C compiler for the RCX, the -/lib/udev/rules.d/60-nqc.rules file now look like this: - -

-SUBSYSTEM=="usb", ACTION=="add", ATTR{idVendor}=="0694", ATTR{idProduct}=="0001", \
-    SYMLINK+="rcx-%k", TAG+="uaccess"
-

- -

I suspect all packages using plugdev in their /lib/udev/rules.d/ -files should be changed to use this tag (either directly or indirectly -via 70-uaccess.rules). Perhaps a lintian check should be -created to detect this?

- -

I've been unable to find good documentation on the uaccess feature. -It is unclear to me if the uaccess tag is an internal implementation -detail like the udev-acl tag used by -/lib/udev/rules.d/70-udev-acl.rules. If it is, I guess the -indirect method is the preferred way. Michael -asked for more -documentation from the systemd project and I hope it will make -this clearer. For now I use the generic classes when they exist and -is already handled by 70-uaccess.rules, and add the tag -directly if no such class exist.

- -

To learn more about the isenkram system, please check out -my -blog posts tagged isenkram.

- -

To help out making life for LEGO constructors in Debian easier, -please join us on our IRC channel -#debian-lego and join -the Debian -LEGO team in the Alioth project we created yesterday. A mailing -list is not yet created, but we are working on it. :)

- -

As usual, if you use Bitcoin and want to show your support of my -activities, please send Bitcoin donations to my address -15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

+
Unlimited randomness with the ChaosKey?
+
1st March 2017
+

A few days ago I ordered a small batch of +the ChaosKey, a small +USB dongle for generating entropy created by Bdale Garbee and Keith +Packard. Yesterday it arrived, and I am very happy to report that it +work great! According to its designers, to get it to work out of the +box, you need the Linux kernel version 4.1 or later. I tested on a +Debian Stretch machine (kernel version 4.9), and there it worked just +fine, increasing the available entropy very quickly. I wrote a small +test oneliner to test. It first print the current entropy level, +drain /dev/random, and then print the entropy level for five seconds. +Here is the situation without the ChaosKey inserted:

+ +
+% cat /proc/sys/kernel/random/entropy_avail; \
+  dd bs=1M if=/dev/random of=/dev/null count=1; \
+  for n in $(seq 1 5); do \
+     cat /proc/sys/kernel/random/entropy_avail; \
+     sleep 1; \
+  done
+300
+0+1 oppføringer inn
+0+1 oppføringer ut
+28 byte kopiert, 0,000264565 s, 106 kB/s
+4
+8
+12
+17
+21
+%
+
+ +

The entropy level increases by 3-4 every second. In such case any +application requiring random bits (like a HTTPS enabled web server) +will halt and wait for more entrpy. And here is the situation with +the ChaosKey inserted:

+ +
+% cat /proc/sys/kernel/random/entropy_avail; \
+  dd bs=1M if=/dev/random of=/dev/null count=1; \
+  for n in $(seq 1 5); do \
+     cat /proc/sys/kernel/random/entropy_avail; \
+     sleep 1; \
+  done
+1079
+0+1 oppføringer inn
+0+1 oppføringer ut
+104 byte kopiert, 0,000487647 s, 213 kB/s
+433
+1028
+1031
+1035
+1038
+%
+
+ +

Quite the difference. :) I bought a few more than I need, in case +someone want to buy one here in Norway. :)

+ +

Update: The dongle was presented at Debconf last year. You might +find the talk +recording illuminating. It explains exactly what the source of +randomness is, if you are unable to spot it from the schema drawing +available from the ChaosKey web site linked at the start of this blog +post.

- Tags: debian, english, isenkram. + Tags: debian, english.
@@ -145,47 +98,34 @@ activities, please send Bitcoin donations to my address
-
Aftenposten-redaktøren med lua i hånda
-
9th September 2016
-

En av dagens nyheter er at Aftenpostens redaktør Espen Egil Hansen -bruker -forsiden -av papiravisen på et åpent brev til Facebooks sjef Mark Zuckerberg om -Facebooks fjerning av bilder, tekster og sider de ikke liker. Det -må være uvant for redaktøren i avisen Aftenposten å stå med lua i -handa og håpe på å bli hørt. Spesielt siden Aftenposten har vært med -på å gi Facebook makten de nå demonstrerer at de har. Ved å melde seg -inn i Facebook-samfunnet har de sagt ja til bruksvilkårene og inngått -en antagelig bindende avtale. Kanskje de skulle lest og vurdert -vilkårene litt nærmere før de sa ja, i stedet for å klage over at -reglende de har valgt å akseptere blir fulgt? Personlig synes jeg -vilkårene er uakseptable og det ville ikke falle meg inn å gå inn på -en avtale med slike vilkår. I tillegg til uakseptable vilkår er det -mange andre grunner til å unngå Facebook. Du kan finne en solid -gjennomgang av flere slike argumenter hos -Richard Stallmans side om -Facebook. - -

Jeg håper flere norske redaktører på samme vis må stå med lua i -hånden inntil de forstår at de selv er med på å føre samfunnet på -ville veier ved å omfavne Facebook slik de gjør når de omtaler og -løfter frem saker fra Facebook, og tar i bruk Facebook som -distribusjonskanal for sine nyheter. De bidrar til -overvåkningssamfunnet og raderer ut lesernes privatsfære når de lenker -til Facebook på sine sider, og låser seg selv inne i en omgivelse der -det er Facebook, og ikke redaktøren, som sitter med makta.

- -

Men det vil nok ta tid, i et Norge der de fleste nettredaktører -deler -sine leseres personopplysinger med utenlands etterretning.

- -

For øvrig burde varsleren Edward Snowden få politisk asyl i -Norge.

+
Detect OOXML files with undefined behaviour?
+
21st February 2017
+

I just noticed +the +new Norwegian proposal for archiving rules in the goverment list +ECMA-376 +/ ISO/IEC 29500 (aka OOXML) as valid formats to put in long term +storage. Luckily such files will only be accepted based on +pre-approval from the National Archive. Allowing OOXML files to be +used for long term storage might seem like a good idea as long as we +forget that there are plenty of ways for a "valid" OOXML document to +have content with no defined interpretation in the standard, which +lead to a question and an idea.

+ +

Is there any tool to detect if a OOXML document depend on such +undefined behaviour? It would be useful for the National Archive (and +anyone else interested in verifying that a document is well defined) +to have such tool available when considering to approve the use of +OOXML. I'm aware of the +officeotron OOXML +validator, but do not know how complete it is nor if it will +report use of undefined behaviour. Are there other similar tools +available? Please send me an email if you know of any such tool.

- Tags: norsk, surveillance. + Tags: english, nuug, standard.
@@ -193,159 +133,33 @@ Norge.

-
E-tjenesten ber om innsyn i eposten til partiene på Stortinget
-
6th September 2016
-

I helga kom det et hårreisende forslag fra Lysne II-utvalget satt -ned av Forsvarsdepartementet. Lysne II-utvalget var bedt om å vurdere -ønskelista til Forsvarets etterretningstjeneste (e-tjenesten), og har -kommet med -forslag -om at e-tjenesten skal få lov til a avlytte all Internett-trafikk -som passerer Norges grenser. Få er klar over at dette innebærer at -e-tjenesten får tilgang til epost sendt til de fleste politiske -partiene på Stortinget. Regjeringspartiet Høyre (@hoyre.no), -støttepartiene Venstre (@venstre.no) og Kristelig Folkeparti (@krf.no) -samt Sosialistisk Ventreparti (@sv.no) og Miljøpartiet de grønne -(@mdg.no) har nemlig alle valgt å ta imot eposten sin via utenlandske -tjenester. Det betyr at hvis noen sender epost til noen med en slik -adresse vil innholdet i eposten, om dette forslaget blir vedtatt, gjøres -tilgjengelig for e-tjenesten. Venstre, Sosialistisk Ventreparti og -Miljøpartiet De Grønne har valgt å motta sin epost hos Google, -Kristelig Folkeparti har valgt å motta sin epost hos Microsoft, og -Høyre har valgt å motta sin epost hos Comendo med mottak i Danmark og -Irland. Kun Arbeiderpartiet og Fremskrittspartiet har valgt å motta -eposten sin i Norge, hos henholdsvis Intility AS og Telecomputing -AS.

- -

Konsekvensen er at epost inn og ut av de politiske organisasjonene, -til og fra partimedlemmer og partiets tillitsvalgte vil gjøres -tilgjengelig for e-tjenesten for analyse og sortering. Jeg mistenker -at kunnskapen som slik blir tilgjengelig vil være nyttig hvis en -ønsker å vite hvilke argumenter som treffer publikum når en ønsker å -påvirke Stortingets representanter.

Ved hjelp av MX-oppslag i DNS for epost-domene, tilhørende -whois-oppslag av IP-adressene og traceroute for å se hvorvidt -trafikken går via utlandet kan enhver få bekreftet at epost sendt til -de omtalte partiene vil gjøres tilgjengelig for forsvarets -etterretningstjeneste hvis forslaget blir vedtatt. En kan også bruke -den kjekke nett-tjenesten ipinfo.io -for å få en ide om hvor i verden en IP-adresse hører til.

- -

På den positive siden vil forslaget gjøre at enda flere blir -motivert til å ta grep for å bruke -Tor og krypterte -kommunikasjonsløsninger for å kommunisere med sine kjære, for å sikre -at privatsfæren vernes. Selv bruker jeg blant annet -FreedomBox og -Signal til slikt. Ingen av -dem er optimale, men de fungerer ganske bra allerede og øker kostnaden -for dem som ønsker å invadere mitt privatliv.

- -

For øvrig burde varsleren Edward Snowden få politisk asyl i -Norge.

- - +
Ruling ignored our objections to the seizure of popcorn-time.no (#domstolkontroll)
+
13th February 2017
+

A few days ago, we received the ruling from +my +day in court. The case in question is a challenge of the seizure +of the DNS domain popcorn-time.no. The ruling simply did not mention +most of our arguments, and seemed to take everything ØKOKRIM said at +face value, ignoring our demonstration and explanations. But it is +hard to tell for sure, as we still have not seen most of the documents +in the case and thus were unprepared and unable to contradict several +of the claims made in court by the opposition. We are considering an +appeal, but it is partly a question of funding, as it is costing us +quite a bit to pay for our lawyer. If you want to help, please +donate to the +NUUG defense fund.

+ +

The details of the case, as far as we know it, is available in +Norwegian from +the NUUG +blog. This also include +the +ruling itself.

- Tags: norsk, surveillance. + Tags: english, nuug, offentlig innsyn, opphavsrett.
@@ -353,33 +167,86 @@ traceroute to mx03.telecomputing.no (95.128.105.102), 30 hops max, 60 byte packe
-
First draft Norwegian Bokmål edition of The Debian Administrator's Handbook now public
-
30th August 2016
-

In April we -started -to work on a Norwegian Bokmål edition of the "open access" book on -how to set up and administrate a Debian system. Today I am happy to -report that the first draft is now publicly available. You can find -it on get the Debian -Administrator's Handbook page (under Other languages). The first -eight chapters have a first draft translation, and we are working on -proofreading the content. If you want to help out, please start -contributing using -the -hosted weblate project page, and get in touch using -the -translators mailing list. Please also check out -the instructions for -contributors. A good way to contribute is to proofread the text -and update weblate if you find errors.

- -

Our goal is still to make the Norwegian book available on paper as well as -electronic form.

+
A day in court challenging seizure of popcorn-time.no for #domstolkontroll
+
3rd February 2017
+

+ +

On Wednesday, I spent the entire day in court in Follo Tingrett +representing the member association +NUUG, alongside the member +association EFN and the DNS registrar +IMC, challenging the seizure of the DNS name popcorn-time.no. It +was interesting to sit in a court of law for the first time in my +life. Our team can be seen in the picture above: attorney Ola +Tellesbø, EFN board member Tom Fredrik Blenning, IMC CEO Morten Emil +Eriksen and NUUG board member Petter Reinholdtsen.

+ +

The +case at hand is that the Norwegian National Authority for +Investigation and Prosecution of Economic and Environmental Crime (aka +Økokrim) decided on their own, to seize a DNS domain early last +year, without following +the +official policy of the Norwegian DNS authority which require a +court decision. The web site in question was a site covering Popcorn +Time. And Popcorn Time is the name of a technology with both legal +and illegal applications. Popcorn Time is a client combining +searching a Bittorrent directory available on the Internet with +downloading/distribute content via Bittorrent and playing the +downloaded content on screen. It can be used illegally if it is used +to distribute content against the will of the right holder, but it can +also be used legally to play a lot of content, for example the +millions of movies +available from the +Internet Archive or the collection +available from Vodo. We created +a +video demonstrating legally use of Popcorn Time and played it in +Court. It can of course be downloaded using Bittorrent.

+ +

I did not quite know what to expect from a day in court. The +government held on to their version of the story and we held on to +ours, and I hope the judge is able to make sense of it all. We will +know in two weeks time. Unfortunately I do not have high hopes, as +the Government have the upper hand here with more knowledge about the +case, better training in handling criminal law and in general higher +standing in the courts than fairly unknown DNS registrar and member +associations. It is expensive to be right also in Norway. So far the +case have cost more than NOK 70 000,-. To help fund the case, NUUG +and EFN have asked for donations, and managed to collect around NOK 25 +000,- so far. Given the presentation from the Government, I expect +the government to appeal if the case go our way. And if the case do +not go our way, I hope we have enough funding to appeal.

+ +

From the other side came two people from Økokrim. On the benches, +appearing to be part of the group from the government were two people +from the Simonsen Vogt Wiik lawyer office, and three others I am not +quite sure who was. Økokrim had proposed to present two witnesses +from The Motion Picture Association, but this was rejected because +they did not speak Norwegian and it was a bit late to bring in a +translator, but perhaps the two from MPA were present anyway. All +seven appeared to know each other. Good to see the case is take +seriously.

+ +

If you, like me, believe the courts should be involved before a DNS +domain is hijacked by the government, or you believe the Popcorn Time +technology have a lot of useful and legal applications, I suggest you +too donate to +the NUUG defense fund. Both Bitcoin and bank transfer are +available. If NUUG get more than we need for the legal action (very +unlikely), the rest will be spend promoting free software, open +standards and unix-like operating systems in Norway, so no matter what +happens the money will be put to good use.

+ +

If you want to lean more about the case, I recommend you check out +the blog +posts from NUUG covering the case. They cover the legal arguments +on both sides.

- Tags: debian, english. + Tags: english, nuug, offentlig innsyn, opphavsrett.
@@ -387,75 +254,41 @@ electronic form.

-
Coz can help you find bottlenecks in multi-threaded software - nice free software
-
11th August 2016
-

This summer, I read a great article -"coz: -This Is the Profiler You're Looking For" in USENIX ;login: about -how to profile multi-threaded programs. It presented a system for -profiling software by running experiences in the running program, -testing how run time performance is affected by "speeding up" parts of -the code to various degrees compared to a normal run. It does this by -slowing down parallel threads while the "faster up" code is running -and measure how this affect processing time. The processing time is -measured using probes inserted into the code, either using progress -counters (COZ_PROGRESS) or as latency meters (COZ_BEGIN/COZ_END). It -can also measure unmodified code by measuring complete the program -runtime and running the program several times instead.

- -

The project and presentation was so inspiring that I would like to -get the system into Debian. I -created -a WNPP request for it and contacted upstream to try to make the -system ready for Debian by sending patches. The build process need to -be changed a bit to avoid running 'git clone' to get dependencies, and -to include the JavaScript web page used to visualize the collected -profiling information included in the source package. -But I expect that should work out fairly soon.

- -

The way the system work is fairly simple. To run an coz experiment -on a binary with debug symbols available, start the program like this: - -

-coz run --- program-to-run
-

- -

This will create a text file profile.coz with the instrumentation -information. To show what part of the code affect the performance -most, use a web browser and either point it to -http://plasma-umass.github.io/coz/ -or use the copy from git (in the gh-pages branch). Check out this web -site to have a look at several example profiling runs and get an idea what the end result from the profile runs look like. To make the -profiling more useful you include <coz.h> and insert the -COZ_PROGRESS or COZ_BEGIN and COZ_END at appropriate places in the -code, rebuild and run the profiler. This allow coz to do more -targeted experiments.

- -

A video published by ACM -presenting the -Coz profiler is available from Youtube. There is also a paper -from the 25th Symposium on Operating Systems Principles available -titled -Coz: -finding code that counts with causal profiling.

- -

The source code -for Coz is available from github. It will only build with clang -because it uses a -C++ -feature missing in GCC, but I've submitted -a patch to solve -it and hope it will be included in the upstream source soon.

- -

Please get in touch if you, like me, would like to see this piece -of software in Debian. I would very much like some help with the -packaging effort, as I lack the in depth knowledge on how to package -C++ libraries.

+
Nasjonalbiblioteket avslutter sin ulovlige bruk av Google Skjemaer
+
12th January 2017
+

I dag fikk jeg en skikkelig gladmelding. Bakgrunnen er at før jul +arrangerte Nasjonalbiblioteket +et +seminar om sitt knakende gode tiltak «verksregister». Eneste +måten å melde seg på dette seminaret var å sende personopplysninger +til Google via Google Skjemaer. Dette syntes jeg var tvilsom praksis, +da det bør være mulig å delta på seminarer arrangert av det offentlige +uten å måtte dele sine interesser, posisjon og andre +personopplysninger med Google. Jeg ba derfor om innsyn via +Mimes brønn i +avtaler +og vurderinger Nasjonalbiblioteket hadde rundt dette. +Personopplysningsloven legger klare rammer for hva som må være på +plass før en kan be tredjeparter, spesielt i utlandet, behandle +personopplysninger på sine vegne, så det burde eksistere grundig +dokumentasjon før noe slikt kan bli lovlig. To jurister hos +Nasjonalbiblioteket mente først dette var helt i orden, og at Googles +standardavtale kunne brukes som databehandlingsavtale. Det syntes jeg +var merkelig, men har ikke hatt kapasitet til å følge opp saken før +for to dager siden.

+ +

Gladnyheten i dag, som kom etter at jeg tipset Nasjonalbiblioteket +om at Datatilsynet underkjente Googles standardavtaler som +databehandleravtaler i 2011, er at Nasjonalbiblioteket har bestemt seg +for å avslutte bruken av Googles Skjemaer/Apps og gå i dialog med DIFI +for å finne bedre måter å håndtere påmeldinger i tråd med +personopplysningsloven. Det er fantastisk å se at av og til hjelper +det å spørre hva i alle dager det offentlige holder på med.

- Tags: debian, english, nice free software. + Tags: norsk, personvern, surveillance, web.
@@ -463,58 +296,86 @@ C++ libraries.

-
Sales number for the Free Culture translation, first half of 2016
-
5th August 2016
-

As my regular readers probably remember, the last year I published -a French and Norwegian translation of the classic -Free Culture book by the -founder of the Creative Commons movement, Lawrence Lessig. A bit less -known is the fact that due to the way I created the translations, -using docbook and po4a, I also recreated the English original. And -because I already had created a new the PDF edition, I published it -too. The revenue from the books are sent to the Creative Commons -Corporation. In other words, I do not earn any money from this -project, I just earn the warm fuzzy feeling that the text is available -for a wider audience and more people can learn why the Creative -Commons is needed.

- -

Today, just for fun, I had a look at the sales number over at -Lulu.com, which take care of payment, printing and shipping. Much to -my surprise, the English edition is selling better than both the -French and Norwegian edition, despite the fact that it has been -available in English since it was first published. In total, 24 paper -books was sold for USD $19.99 between 2016-01-01 and 2016-07-31:

- - - - - - -
Title / languageQuantity
Culture Libre / French3
Fri kultur / Norwegian7
Free Culture / English14
- -

The books are available both from Lulu.com and from large book -stores like Amazon and Barnes&Noble. Most revenue, around $10 per -book, is sent to the Creative Commons project when the book is sold -directly by Lulu.com. The other channels give less revenue. The -summary from Lulu tell me 10 books was sold via the Amazon channel, 10 -via Ingram (what is this?) and 4 directly by Lulu. And Lulu.com tells -me that the revenue sent so far this year is USD $101.42. No idea -what kind of sales numbers to expect, so I do not know if that is a -good amount of sales for a 10 year old book or not. But it make me -happy that the buyers find the book, and I hope they enjoy reading it -as much as I did.

- -

The ebook edition is available for free from -Github.

- -

If you would like to translate and publish the book in your native -language, I would be happy to help make it happen. Please get in -touch.

+
Bryter NAV sin egen personvernerklæring?
+
11th January 2017
+

Jeg leste med interesse en nyhetssak hos +digi.no +og +NRK +om at det ikke bare er meg, men at også NAV bedriver geolokalisering +av IP-adresser, og at det gjøres analyse av IP-adressene til de som +sendes inn meldekort for å se om meldekortet sendes inn fra +utenlandske IP-adresser. Politiadvokat i Drammen, Hans Lyder Haare, +er sitert i NRK på at «De to er jo blant annet avslørt av +IP-adresser. At man ser at meldekortet kommer fra utlandet.»

+ +

Jeg synes det er fint at det blir bedre kjent at IP-adresser +knyttes til enkeltpersoner og at innsamlet informasjon brukes til å +stedsbestemme personer også av aktører her i Norge. Jeg ser det som +nok et argument for å bruke +Tor så mye som mulig for å +gjøre gjøre IP-lokalisering vanskeligere, slik at en kan beskytte sin +privatsfære og unngå å dele sin fysiske plassering med +uvedkommede.

+ +

Men det er en ting som bekymrer meg rundt denne nyheten. Jeg ble +tipset (takk #nuug) om +NAVs +personvernerklæring, som under punktet «Personvern og statistikk» +lyder:

+ +

+ +

«Når du besøker nav.no, etterlater du deg elektroniske spor. Sporene +dannes fordi din nettleser automatisk sender en rekke opplysninger til +NAVs tjener (server-maskin) hver gang du ber om å få vist en side. Det +er eksempelvis opplysninger om hvilken nettleser og -versjon du +bruker, og din internettadresse (ip-adresse). For hver side som vises, +lagres følgende opplysninger:

+ +
    +
  • hvilken side du ser pÃ¥
    • +
  • dato og tid
    • +
  • hvilken nettleser du bruker
    • +
  • din ip-adresse
    • +
+ +

Ingen av opplysningene vil bli brukt til å identifisere +enkeltpersoner. NAV bruker disse opplysningene til å generere en +samlet statistikk som blant annet viser hvilke sider som er mest +populære. Statistikken er et redskap til å forbedre våre +tjenester.»

+ +

+ +

Jeg klarer ikke helt å se hvordan analyse av de besøkendes +IP-adresser for å se hvem som sender inn meldekort via web fra en +IP-adresse i utlandet kan gjøres uten å komme i strid med påstanden om +at «ingen av opplysningene vil bli brukt til å identifisere +enkeltpersoner». Det virker dermed for meg som at NAV bryter sine +egen personvernerklæring, hvilket +Datatilsynet +fortalte meg i starten av desember antagelig er brudd på +personopplysningsloven. + +

I tillegg er personvernerklæringen ganske misvisende i og med at +NAVs nettsider ikke bare forsyner NAV med personopplysninger, men i +tillegg ber brukernes nettleser kontakte fem andre nettjenere +(script.hotjar.com, static.hotjar.com, vars.hotjar.com, +www.google-analytics.com og www.googletagmanager.com), slik at +personopplysninger blir gjort tilgjengelig for selskapene Hotjar og +Google , og alle som kan lytte på trafikken på veien (som FRA, GCHQ og +NSA). Jeg klarer heller ikke se hvordan slikt spredning av +personopplysninger kan være i tråd med kravene i +personopplysningloven, eller i tråd med NAVs personvernerklæring.

+ +

Kanskje NAV bør ta en nøye titt på sin personvernerklæring? Eller +kanskje Datatilsynet bør gjøre det?

- Tags: docbook, english, freeculture. + Tags: norsk, nuug, personvern, surveillance.
@@ -522,40 +383,164 @@ touch.

-
Vitenskapen tar som vanlig feil igjen - relativt feil
-
1st August 2016
-

For mange år siden leste jeg en klassisk tekst som gjorde såpass -inntrykk på meg at jeg husker den fortsatt, flere år senere, og bruker -argumentene fra den stadig vekk. Teksten var «The Relativity of -Wrong» som Isaac Asimov publiserte i Skeptical Inquirer i 1989. Den -gir litt perspektiv rundt formidlingen av vitenskapelige resultater. -Jeg har hatt lyst til å kunne dele den også med folk som ikke -behersker engelsk så godt, som barn og noen av mine eldre slektninger, -og har savnet å ha den tilgjengelig på norsk. For to uker siden tok -jeg meg sammen og kontaktet Asbjørn Dyrendal i foreningen Skepsis om -de var interessert i å publisere en norsk utgave på bloggen sin, og da -han var positiv tok jeg kontakt med Skeptical Inquirer og spurte om -det var greit for dem. I løpet av noen dager fikk vi tilbakemelding -fra Barry Karr hos The Skeptical Inquirer som hadde sjekket og fått OK -fra Robyn Asimov som representerte arvingene i Asmiov-familien og gikk -igang med oversettingen.

- -

Resultatet, «Relativt -feil», ble publisert på skepsis-bloggen for noen minutter siden. -Jeg anbefaler deg på det varmeste å lese denne teksten og dele den med -dine venner.

- -

For å håndtere oversettelsen og sikre at original og oversettelse -var i sync brukte vi git, po4a, GNU make og Transifex. Det hele -fungerte utmerket og gjorde det enkelt å dele tekstene og jobbe sammen -om finpuss på formuleringene. Hadde hosted.weblate.org latt meg -opprette nye prosjekter selv i stedet for å måtte kontakte -administratoren der, så hadde jeg brukt weblate i stedet.

+
Where did that package go? — geolocated IP traceroute
+
9th January 2017
+

Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request.

+ +

There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in Debian.

+ +

This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others).

+ +

Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking PhantomJS to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +their +netsniff example. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page.

+ +

map of combined traces for URLs used by www.stortinget.no using GeoIP

+ +

When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +my +kmltraceroute git repository. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from the +KML file I created using the GeoLite City dataset from MaxMind. + +

scapy traceroute graph for URLs used by www.stortinget.no

+ +

I also had a look at the visual traceroute graph created by +the scrapy project, +showing IP network ownership (aka AS owner) for the IP address in +question. +The +graph display a lot of useful information about the traceroute in SVG +format, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA.

+ +

example geotraceroute view for www.stortinget.no

+ +

In the process, I came across the +web service GeoTraceroute by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +the NUUG assosiation, and get the +trace in KML format for further processing.

+ +

map of combined traces for URLs used by www.stortinget.no using geotraceroute

+ +

Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority.

+ +

Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from GeoTraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +GeoTraceroute). That might be the next step in this project.

+ +

Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet.

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

As usual, if you use Bitcoin and want to show your support of my +activities, please send Bitcoin donations to my address +15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: norsk, skepsis. + Tags: debian, english, kart, nuug, personvern, stortinget, surveillance, web.
@@ -563,51 +548,77 @@ administratoren der, så hadde jeg brukt weblate i stedet.

-
Techno TV broadcasting live across Norway and the Internet (#debconf16, #nuug) on @frikanalen
-
1st August 2016
-

Did you know there is a TV channel broadcasting talks from DebConf -16 across an entire country? Or that there is a TV channel -broadcasting talks by or about -Linus Torvalds, -Tor, -OpenID, -Common Lisp, -Civic Tech, -EFF founder John Barlow, -how to make 3D -printer electronics and many more fascinating topics? It works -using only free software (all of it -available from Github), and -is administrated using a web browser and a web API.

- -

The TV channel is the Norwegian open channel -Frikanalen, and I am involved -via the NUUG member association in -running and developing the software for the channel. The channel is -organised as a member organisation where its members can upload and -broadcast what they want (think of it as Youtube for national -broadcasting television). Individuals can broadcast too. The time -slots are handled on a first come, first serve basis. Because the -channel have almost no viewers and very few active members, we can -experiment with TV technology without too much flack when we make -mistakes. And thanks to the few active members, most of the slots on -the schedule are free. I see this as an opportunity to spread -knowledge about technology and free software, and have a script I run -regularly to fill up all the open slots the next few days with -technology related video. The end result is a channel I like to -describe as Techno TV - filled with interesting talks and -presentations.

- -

It is available on channel 50 on the Norwegian national digital TV -network (RiksTV). It is also available as a multicast stream on -Uninett. And finally, it is available as -a WebM unicast stream from -Frikanalen and NUUG. Check it out. :)

+
Introducing ical-archiver to split out old iCalendar entries
+
4th January 2017
+

Do you have a large iCalendar +file with lots of old entries, and would like to archive them to save +space and resources? At least those of us using KOrganizer know that +turning on and off an event set become slower and slower the more +entries are in the set. While working on migrating our calendars to a +Radicale CalDAV server on our +Freedombox server, my +loved one wondered if I could find a way to split up the calendar file +she had in KOrganizer, and I set out to write a tool. I spent a few +days writing and polishing the system, and it is now ready for general +consumption. The +code for +ical-archiver is publicly available from a git repository on +github. The system is written in Python and depend on +the vobject Python +module.

+ +

To use it, locate the iCalendar file you want to operate on and +give it as an argument to the ical-archiver script. This will +generate a set of new files, one file per component type per year for +all components expiring more than two years in the past. The vevent, +vtodo and vjournal entries are handled by the script. The remaining +entries are stored in a 'remaining' file.

+ +

This is what a test run can look like: + +

+% ical-archiver t/2004-2016.ics 
+Found 3612 vevents
+Found 6 vtodos
+Found 2 vjournals
+Writing t/2004-2016.ics-subset-vevent-2004.ics
+Writing t/2004-2016.ics-subset-vevent-2005.ics
+Writing t/2004-2016.ics-subset-vevent-2006.ics
+Writing t/2004-2016.ics-subset-vevent-2007.ics
+Writing t/2004-2016.ics-subset-vevent-2008.ics
+Writing t/2004-2016.ics-subset-vevent-2009.ics
+Writing t/2004-2016.ics-subset-vevent-2010.ics
+Writing t/2004-2016.ics-subset-vevent-2011.ics
+Writing t/2004-2016.ics-subset-vevent-2012.ics
+Writing t/2004-2016.ics-subset-vevent-2013.ics
+Writing t/2004-2016.ics-subset-vevent-2014.ics
+Writing t/2004-2016.ics-subset-vjournal-2007.ics
+Writing t/2004-2016.ics-subset-vjournal-2011.ics
+Writing t/2004-2016.ics-subset-vtodo-2012.ics
+Writing t/2004-2016.ics-remaining.ics
+%
+

+ +

As you can see, the original file is untouched and new files are +written with names derived from the original file. If you are happy +with their content, the *-remaining.ics file can replace the original +the the others can be archived or imported as historical calendar +collections.

+ +

The script should probably be improved a bit. The error handling +when discovering broken entries is not good, and I am not sure yet if +it make sense to split different entry types into separate files or +not. The program is thus likely to change. If you find it +interesting, please get in touch. :)

+ +

As usual, if you use Bitcoin and want to show your support of my +activities, please send Bitcoin donations to my address +15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: english, frikanalen, nuug, video. + Tags: english, standard.
@@ -615,90 +626,96 @@ Frikanalen and NUUG. Check it out. :)

-
Unlocking HTC Desire HD on Linux using unruu and fastboot
-
7th July 2016
-

Yesterday, I tried to unlock a HTC Desire HD phone, and it proved -to be a slight challenge. Here is the recipe if I ever need to do it -again. It all started by me wanting to try the recipe to set up -an -hardened Android installation from the Tor project blog on a -device I had access to. It is a old mobile phone with a broken -microphone The initial idea had been to just -install -CyanogenMod on it, but did not quite find time to start on it -until a few days ago.

- -

The unlock process is supposed to be simple: (1) Boot into the boot -loader (press volume down and power at the same time), (2) select -'fastboot' before (3) connecting the device via USB to a Linux -machine, (4) request the device identifier token by running 'fastboot -oem get_identifier_token', (5) request the device unlocking key using -the HTC developer web -site and unlock the phone using the key file emailed to you.

- -

Unfortunately, this only work fi you have hboot version 2.00.0029 -or newer, and the device I was working on had 2.00.0027. This -apparently can be easily fixed by downloading a Windows program and -running it on your Windows machine, if you accept the terms Microsoft -require you to accept to use Windows - which I do not. So I had to -come up with a different approach. I got a lot of help from AndyCap -on #nuug, and would not have been able to get this working without -him.

- -

First I needed to extract the hboot firmware from -the -windows binary for HTC Desire HD downloaded as 'the RUU' from HTC. -For this there is is a github -project named unruu using libunshield. The unshield tool did not -recognise the file format, but unruu worked and extracted rom.zip, -containing the new hboot firmware and a text file describing which -devices it would work for.

- -

Next, I needed to get the new firmware into the device. For this I -followed some instructions -available -from HTC1Guru.com, and ran these commands as root on a Linux -machine with Debian testing:

+
Appstream just learned how to map hardware to packages too!
+
23rd December 2016
+

I received a very nice Christmas present today. As my regular +readers probably know, I have been working on the +the Isenkram +system for many years. The goal of the Isenkram system is to make +it easier for users to figure out what to install to get a given piece +of hardware to work in Debian, and a key part of this system is a way +to map hardware to packages. Isenkram have its own mapping database, +and also uses data provided by each package using the AppStream +metadata format. And today, +AppStream in +Debian learned to look up hardware the same way Isenkram is doing it, +ie using fnmatch():

-adb reboot-bootloader
-fastboot oem rebootRUU
-fastboot flash zip rom.zip
-fastboot flash zip rom.zip
-fastboot reboot
+% appstreamcli what-provides modalias \
+  usb:v1130p0202d0100dc00dsc00dp00ic03isc00ip00in00
+Identifier: pymissile [generic]
+Name: pymissile
+Summary: Control original Striker USB Missile Launcher
+Package: pymissile
+% appstreamcli what-provides modalias usb:v0694p0002d0000
+Identifier: libnxt [generic]
+Name: libnxt
+Summary: utility library for talking to the LEGO Mindstorms NXT brick
+Package: libnxt
+---
+Identifier: t2n [generic]
+Name: t2n
+Summary: Simple command-line tool for Lego NXT
+Package: t2n
+---
+Identifier: python-nxt [generic]
+Name: python-nxt
+Summary: Python driver/interface/wrapper for the Lego Mindstorms NXT robot
+Package: python-nxt
+---
+Identifier: nbc [generic]
+Name: nbc
+Summary: C compiler for LEGO Mindstorms NXT bricks
+Package: nbc
+%

-

The flash command apparently need to be done twice to take effect, -as the first is just preparations and the second one do the flashing. -The adb command is just to get to the boot loader menu, so turning the -device on while holding volume down and the power button should work -too.

- -

With the new hboot version in place I could start following the -instructions on the HTC developer web site. I got the device token -like this:

- -

-fastboot oem get_identifier_token 2>&1 | sed 's/(bootloader) //'
-
- -

And once I got the unlock code via email, I could use it like -this:

+

A similar query can be done using the combined AppStream and +Isenkram databases using the isenkram-lookup tool:

-fastboot flash unlocktoken Unlock_code.bin
+% isenkram-lookup usb:v1130p0202d0100dc00dsc00dp00ic03isc00ip00in00
+pymissile
+% isenkram-lookup usb:v0694p0002d0000
+libnxt
+nbc
+python-nxt
+t2n
+%

-

And with that final step in place, the phone was unlocked and I -could start stuffing the software of my own choosing into the device. -So far I only inserted a replacement recovery image to wipe the phone -before I start. We will see what happen next. Perhaps I should -install Debian on it. :)

+

You can find modalias values relevant for your machine using +cat $(find /sys/devices/ -name modalias). + +

If you want to make this system a success and help Debian users +make the most of the hardware they have, please +helpadd +AppStream metadata for your package following the guidelines +documented in the wiki. So far only 11 packages provide such +information, among the several hundred hardware specific packages in +Debian. The Isenkram database on the other hand contain 101 packages, +mostly related to USB dongles. Most of the packages with hardware +mapping in AppStream are LEGO Mindstorms related, because I have, as +part of my involvement in +the Debian LEGO +team given priority to making sure LEGO users get proposed the +complete set of packages in Debian for that particular hardware. The +team also got a nice Christmas present today. The +nxt-firmware +package made it into Debian. With this package in place, it is +now possible to use the LEGO Mindstorms NXT unit with only free +software, as the nxt-firmware package contain the source and firmware +binaries for the NXT brick.

+ +

As usual, if you use Bitcoin and want to show your support of my +activities, please send Bitcoin donations to my address +15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: bootsystem, debian, english, opphavsrett, sikkerhet. + Tags: debian, english, isenkram.
@@ -706,112 +723,106 @@ install Debian on it. :)

-
How to use the Signal app if you only have a land line (ie no mobile phone)
-
3rd July 2016
-

For a while now, I have wanted to test -the Signal app, as it is -said to provide end to end encrypted communication and several of my -friends and family are already using it. As I by choice do not own a -mobile phone, this proved to be harder than expected. And I wanted to -have the source of the client and know that it was the code used on my -machine. But yesterday I managed to get it working. I used the -Github source, compared it to the source in -the -Signal Chrome app available from the Chrome web store, applied -patches to use the production Signal servers, started the app and -asked for the hidden "register without a smart phone" form. Here is -the recipe how I did it.

- -

First, I fetched the Signal desktop source from Github, using - -

-git clone https://github.com/WhisperSystems/Signal-Desktop.git
-
- -

Next, I patched the source to use the production servers, to be -able to talk to other Signal users:

- -
-cat <<EOF | patch -p0
-diff -ur ./js/background.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js
---- ./js/background.js  2016-06-29 13:43:15.630344628 +0200
-+++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js    2016-06-29 14:06:29.530300934 +0200
-@@ -47,8 +47,8 @@
-         });
-     });
- 
--    var SERVER_URL = 'https://textsecure-service-staging.whispersystems.org';
--    var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com';
-+    var SERVER_URL = 'https://textsecure-service-ca.whispersystems.org:4433';
-+    var ATTACHMENT_SERVER_URL = 'https://whispersystems-textsecure-attachments.s3.amazonaws.com';
-     var messageReceiver;
-     window.getSocketStatus = function() {
-         if (messageReceiver) {
-diff -ur ./js/expire.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js
---- ./js/expire.js      2016-06-29 13:43:15.630344628 +0200
-+++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js2016-06-29 14:06:29.530300934 +0200
-@@ -1,6 +1,6 @@
- ;(function() {
-     'use strict';
--    var BUILD_EXPIRATION = 0;
-+    var BUILD_EXPIRATION = 1474492690000;
- 
-     window.extension = window.extension || {};
- 
-EOF
-
- -

The first part is changing the servers, and the second is updating -an expiration timestamp. This timestamp need to be updated regularly. -It is set 90 days in the future by the build process (Gruntfile.js). -The value is seconds since 1970 times 1000, as far as I can tell.

- -

Based on a tip and good help from the #nuug IRC channel, I wrote a -script to launch Signal in Chromium.

- -
-#!/bin/sh
-cd $(dirname $0)
-mkdir -p userdata
-exec chromium \
-  --proxy-server="socks://localhost:9050" \
-  --user-data-dir=`pwd`/userdata --load-and-launch-app=`pwd`
-
- -

The script start the app and configure Chromium to use the Tor -SOCKS5 proxy to make sure those controlling the Signal servers (today -Amazon and Whisper Systems) as well as those listening on the lines -will have a harder time location my laptop based on the Signal -connections if they use source IP address.

- -

When the script starts, one need to follow the instructions under -"Standalone Registration" in the CONTRIBUTING.md file in the git -repository. I right clicked on the Signal window to get up the -Chromium debugging tool, visited the 'Console' tab and wrote -'extension.install("standalone")' on the console prompt to get the -registration form. Then I entered by land line phone number and -pressed 'Call'. 5 seconds later the phone rang and a robot voice -repeated the verification code three times. After entering the number -into the verification code field in the form, I could start using -Signal from my laptop. - -

As far as I can tell, The Signal app will leak who is talking to -whom and thus who know who to those controlling the central server, -but such leakage is hard to avoid with a centrally controlled server -setup. It is something to keep in mind when using Signal - the -content of your chats are harder to intercept, but the meta data -exposing your contact network is available to people you do not know. -So better than many options, but not great. And sadly the usage is -connected to my land line, thus allowing those controlling the server -to associate it to my home and person. I would prefer it if only -those I knew could tell who I was on Signal. There are options -avoiding such information leakage, but most of my friends are not -using them, so I am stuck with Signal for now.

+
Isenkram updated with a lot more hardware-package mappings
+
20th December 2016
+

The Isenkram +system I wrote two years ago to make it easier in Debian to find +and install packages to get your hardware dongles to work, is still +going strong. It is a system to look up the hardware present on or +connected to the current system, and map the hardware to Debian +packages. It can either be done using the tools in isenkram-cli or +using the user space daemon in the isenkram package. The latter will +notify you, when inserting new hardware, about what packages to +install to get the dongle working. It will even provide a button to +click on to ask packagekit to install the packages.

+ +

Here is an command line example from my Thinkpad laptop:

+ +

+% isenkram-lookup  
+bluez
+cheese
+ethtool
+fprintd
+fprintd-demo
+gkrellm-thinkbat
+hdapsd
+libpam-fprintd
+pidgin-blinklight
+thinkfan
+tlp
+tp-smapi-dkms
+tp-smapi-source
+tpb
+%
+

+ +

It can also list the firware package providing firmware requested +by the load kernel modules, which in my case is an empty list because +I have all the firmware my machine need: + +

+% /usr/sbin/isenkram-autoinstall-firmware -l
+info: did not find any firmware files requested by loaded kernel modules.  exiting
+%
+

+ +

The last few days I had a look at several of the around 250 +packages in Debian with udev rules. These seem like good candidates +to install when a given hardware dongle is inserted, and I found +several that should be proposed by isenkram. I have not had time to +check all of them, but am happy to report that now there are 97 +packages packages mapped to hardware by Isenkram. 11 of these +packages provide hardware mapping using AppStream, while the rest are +listed in the modaliases file provided in isenkram.

+ +

These are the packages with hardware mappings at the moment. The +marked packages are also announcing their hardware +support using AppStream, for everyone to use:

+ +

air-quality-sensor, alsa-firmware-loaders, argyll, +array-info, avarice, avrdude, b43-fwcutter, +bit-babbler, bluez, bluez-firmware, brltty, +broadcom-sta-dkms, calibre, cgminer, cheese, colord, +colorhug-client, dahdi-firmware-nonfree, dahdi-linux, +dfu-util, dolphin-emu, ekeyd, ethtool, firmware-ipw2x00, fprintd, +fprintd-demo, galileo, gkrellm-thinkbat, gphoto2, +gpsbabel, gpsbabel-gui, gpsman, gpstrans, gqrx-sdr, gr-fcdproplus, +gr-osmosdr, gtkpod, hackrf, hdapsd, hdmi2usb-udev, hpijs-ppds, hplip, +ipw3945-source, ipw3945d, kde-config-tablet, kinect-audio-setup, +libnxt, libpam-fprintd, lomoco, +madwimax, minidisc-utils, mkgmap, msi-keyboard, mtkbabel, +nbc, nqc, nut-hal-drivers, ola, +open-vm-toolbox, open-vm-tools, openambit, pcgminer, pcmciautils, +pcscd, pidgin-blinklight, printer-driver-splix, +pymissile, python-nxt, qlandkartegt, +qlandkartegt-garmin, rosegarden, rt2x00-source, sispmctl, +soapysdr-module-hackrf, solaar, squeak-plugins-scratch, sunxi-tools, +t2n, thinkfan, thinkfinger-tools, tlp, tp-smapi-dkms, +tp-smapi-source, tpb, tucnak, uhd-host, usbmuxd, viking, +virtualbox-ose-guest-x11, w1retap, xawtv, xserver-xorg-input-vmmouse, +xserver-xorg-input-wacom, xserver-xorg-video-qxl, +xserver-xorg-video-vmware, yubikey-personalization and +zd1211-firmware

+ +

If you know of other packages, please let me know with a wishlist +bug report against the isenkram-cli package, and ask the package +maintainer to +add AppStream +metadata according to the guidelines to provide the information +for everyone. In time, I hope to get rid of the isenkram specific +hardware mapping and depend exclusively on AppStream.

+ +

Note, the AppStream metadata for broadcom-sta-dkms is matching too +much hardware, and suggest that the package with with any ethernet +card. See bug #838735 for +the details. I hope the maintainer find time to address it soon. In +the mean time I provide an override in isenkram.

- Tags: debian, english, sikkerhet, surveillance. + Tags: debian, english, isenkram.
@@ -826,6 +837,17 @@ using them, so I am stuck with Signal for now.

Archive