X-Git-Url: http://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/5555b9e78965484460c4764b91c11fb8d75e0cf1..d3629bcaf36448c154f9049edfa5fda76512d11a:/blog/index.html diff --git a/blog/index.html b/blog/index.html index 1a839e55ab..2627be05ce 100644 --- a/blog/index.html +++ b/blog/index.html @@ -20,114 +20,66 @@
-
Detecting NFS hangs on Linux without hanging yourself...
-
9th March 2017
-

Over the years, administrating thousand of NFS mounting linux -computers at the time, I often needed a way to detect if the machine -was experiencing NFS hang. If you try to use df or look at a -file or directory affected by the hang, the process (and possibly the -shell) will hang too. So you want to be able to detect this without -risking the detection process getting stuck too. It has not been -obvious how to do this. When the hang has lasted a while, it is -possible to find messages like these in dmesg:

+
Add-on to control the projector from within Kodi
+
26th June 2018
+

My movie playing setup involve Kodi, +OpenELEC (probably soon to be +replaced with LibreELEC) and an +Infocus IN76 video projector. My projector can be controlled via both +a infrared remote controller, and a RS-232 serial line. The vendor of +my projector, InFocus, had been +sensible enough to document the serial protocol in its user manual, so +it is easily available, and I used it some years ago to write +a +small script to control the projector. For a while now, I longed +for a setup where the projector was controlled by Kodi, for example in +such a way that when the screen saver went on, the projector was +turned off, and when the screen saver exited, the projector was turned +on again.

+ +

A few days ago, with very good help from parts of my family, I +managed to find a Kodi Add-on for controlling a Epson projector, and +got in touch with its author to see if we could join forces and make a +Add-on with support for several projectors. To my pleasure, he was +positive to the idea, and we set out to add InFocus support to his +add-on, and make the add-on suitable for the official Kodi add-on +repository.

+ +

The Add-on is now working (for me, at least), with a few minor +adjustments. The most important change I do relative to the master +branch in the github repository is embedding the +pyserial module in +the add-on. The long term solution is to make a "script" type +pyserial module for Kodi, that can be pulled in as a dependency in +Kodi. But until that in place, I embed it.

+ +

The add-on can be configured to turn on the projector when Kodi +starts, off when Kodi stops as well as turn the projector off when the +screensaver start and on when the screesaver stops. It can also be +told to set the projector source when turning on the projector. + +

If this sound interesting to you, check out +the +project github repository. Perhaps you can send patches to +support your projector too? As soon as we find time to wrap up the +latest changes, it should be available for easy installation using any +Kodi instance.

+ +

For future improvements, I would like to add projector model +detection and the ability to adjust the brightness level of the +projector from within Kodi. We also need to figure out how to handle +the cooling period of the projector. My projector refuses to turn on +for 60 seconds after it was turned off. This is not handled well by +the add-on at the moment.

-

-nfs: server nfsserver not responding, still trying -
nfs: server nfsserver OK -

- -

It is hard to know if the hang is still going on, and it is hard to -be sure looking in dmesg is going to work. If there are lots of other -messages in dmesg the lines might have rotated out of site before they -are noticed.

- -

While reading through the nfs client implementation in linux kernel -code, I came across some statistics that seem to give a way to detect -it. The om_timeouts sunrpc value in the kernel will increase every -time the above log entry is inserted into dmesg. And after digging a -bit further, I discovered that this value show up in -/proc/self/mountstats on Linux.

- -

The mountstats content seem to be shared between files using the -same file system context, so it is enough to check one of the -mountstats files to get the state of the mount point for the machine. -I assume this will not show lazy umounted NFS points, nor NFS mount -points in a different process context (ie with a different filesystem -view), but that does not worry me.

- -

The content for a NFS mount point look similar to this:

- -

-[...]
-device /dev/mapper/Debian-var mounted on /var with fstype ext3
-device nfsserver:/mnt/nfsserver/home0 mounted on /mnt/nfsserver/home0 with fstype nfs statvers=1.1
-        opts:   rw,vers=3,rsize=65536,wsize=65536,namlen=255,acregmin=3,acregmax=60,acdirmin=30,acdirmax=60,soft,nolock,proto=tcp,timeo=600,retrans=2,sec=sys,mountaddr=129.240.3.145,mountvers=3,mountport=4048,mountproto=udp,local_lock=all
-        age:    7863311
-        caps:   caps=0x3fe7,wtmult=4096,dtsize=8192,bsize=0,namlen=255
-        sec:    flavor=1,pseudoflavor=1
-        events: 61063112 732346265 1028140 35486205 16220064 8162542 761447191 71714012 37189 3891185 45561809 110486139 4850138 420353 15449177 296502 52736725 13523379 0 52182 9016896 1231 0 0 0 0 0 
-        bytes:  166253035039 219519120027 0 0 40783504807 185466229638 11677877 45561809 
-        RPC iostats version: 1.0  p/v: 100003/3 (nfs)
-        xprt:   tcp 925 1 6810 0 0 111505412 111480497 109 2672418560317 0 248 53869103 22481820
-        per-op statistics
-                NULL: 0 0 0 0 0 0 0 0
-             GETATTR: 61063106 61063108 0 9621383060 6839064400 453650 77291321 78926132
-             SETATTR: 463469 463470 0 92005440 66739536 63787 603235 687943
-              LOOKUP: 17021657 17021657 0 3354097764 4013442928 57216 35125459 35566511
-              ACCESS: 14281703 14290009 5 2318400592 1713803640 1709282 4865144 7130140
-            READLINK: 125 125 0 20472 18620 0 1112 1118
-                READ: 4214236 4214237 0 715608524 41328653212 89884 22622768 22806693
-               WRITE: 8479010 8494376 22 187695798568 1356087148 178264904 51506907 231671771
-              CREATE: 171708 171708 0 38084748 46702272 873 1041833 1050398
-               MKDIR: 3680 3680 0 773980 993920 26 23990 24245
-             SYMLINK: 903 903 0 233428 245488 6 5865 5917
-               MKNOD: 80 80 0 20148 21760 0 299 304
-              REMOVE: 429921 429921 0 79796004 61908192 3313 2710416 2741636
-               RMDIR: 3367 3367 0 645112 484848 22 5782 6002
-              RENAME: 466201 466201 0 130026184 121212260 7075 5935207 5961288
-                LINK: 289155 289155 0 72775556 67083960 2199 2565060 2585579
-             READDIR: 2933237 2933237 0 516506204 13973833412 10385 3190199 3297917
-         READDIRPLUS: 1652839 1652839 0 298640972 6895997744 84735 14307895 14448937
-              FSSTAT: 6144 6144 0 1010516 1032192 51 9654 10022
-              FSINFO: 2 2 0 232 328 0 1 1
-            PATHCONF: 1 1 0 116 140 0 0 0
-              COMMIT: 0 0 0 0 0 0 0 0
-
-device binfmt_misc mounted on /proc/sys/fs/binfmt_misc with fstype binfmt_misc
-[...]
-

- -

The key number to look at is the third number in the per-op list. -It is the number of NFS timeouts experiences per file system -operation. Here 22 write timeouts and 5 access timeouts. If these -numbers are increasing, I believe the machine is experiencing NFS -hang. Unfortunately the timeout value do not start to increase right -away. The NFS operations need to time out first, and this can take a -while. The exact timeout value depend on the setup. For example the -defaults for TCP and UDP mount points are quite different, and the -timeout value is affected by the soft, hard, timeo and retrans NFS -mount options.

- -

The only way I have been able to get working on Debian and RedHat -Enterprise Linux for getting the timeout count is to peek in /proc/. -But according to -Solaris -10 System Administration Guide: Network Services, the 'nfsstat -c' -command can be used to get these timeout values. But this do not work -on Linux, as far as I can tell. I -asked Debian about this, -but have not seen any replies yet.

- -

Is there a better way to figure out if a Linux NFS client is -experiencing NFS hangs? Is there a way to detect which processes are -affected? Is there a way to get the NFS mount going quickly once the -network problem causing the NFS hang has been cleared? I would very -much welcome some clues, as we regularly run into NFS hangs.

+

As usual, if you use Bitcoin and want to show your support of my +activities, please send Bitcoin donations to my address +15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: debian, english, sysadmin. + Tags: english, multimedia, video.
@@ -135,44 +87,71 @@ much welcome some clues, as we regularly run into NFS hangs.

-
How does it feel to be wiretapped, when you should be doing the wiretapping...
-
8th March 2017
-

So the new president in the United States of America claim to be -surprised to discover that he was wiretapped during the election -before he was elected president. He even claim this must be illegal. -Well, doh, if it is one thing the confirmations from Snowden -documented, it is that the entire population in USA is wiretapped, one -way or another. Of course the president candidates were wiretapped, -alongside the senators, judges and the rest of the people in USA.

- -

Next, the Federal Bureau of Investigation ask the Department of -Justice to go public rejecting the claims that Donald Trump was -wiretapped illegally. I fail to see the relevance, given that I am -sure the surveillance industry in USA believe they have all the legal -backing they need to conduct mass surveillance on the entire -world.

- -

There is even the director of the FBI stating that he never saw an -order requesting wiretapping of Donald Trump. That is not very -surprising, given how the FISA court work, with all its activity being -secret. Perhaps he only heard about it?

- -

What I find most sad in this story is how Norwegian journalists -present it. In a news reports the other day in the radio from the -Norwegian National broadcasting Company (NRK), I heard the journalist -claim that 'the FBI denies any wiretapping', while the reality is that -'the FBI denies any illegal wiretapping'. There is a fundamental and -important difference, and it make me sad that the journalists are -unable to grasp it.

- -

Update 2017-03-13: Look like -The -Intercept report that US Senator Rand Paul confirm what I state above.

+
youtube-dl for nedlasting fra NRK med undertekster - nice free software
+
28th April 2018
+

I VHS-kassettenes +tid var det rett frem å ta vare på et TV-program en ønsket å kunne se +senere, uten å være avhengig av at programmet ble sendt på nytt. +Kanskje ønsket en å se programmet på hytten der det ikke var +TV-signal, eller av andre grunner ha det tilgjengelig for fremtidig +fornøyelse. Dette er blitt vanskeligere med introduksjon av +digital-TV og webstreaming, der opptak til harddisk er utenfor de +flestes kontroll hvis de bruker ufri programvare og bokser kontrollert +av andre. Men for NRK her i Norge, finnes det heldigvis flere fri +programvare-alternativer, som jeg har +skrevet +om +før. +Så lenge kilden for nedlastingen er lovlig lagt ut på nett (hvilket +jeg antar NRK gjør), så er slik lagring til privat bruk også lovlig i +Norge.

+ +

Sist jeg så på saken, i 2016, nevnte jeg at +youtube-dl ikke kunne +bake undertekster fra NRK inn i videofilene, og at jeg derfor +foretrakk andre alternativer. Nylig oppdaget jeg at dette har endret +seg. Fordelen med youtube-dl er at den er tilgjengelig direkte fra +Linux-distribusjoner som Debian +og Ubuntu, slik at en slipper å +finne ut selv hvordan en skal få dem til å virke.

+ +

For å laste ned et NRK-innslag med undertekster, og få den norske +underteksten pakket inn i videofilen, så kan følgende kommando +brukes:

+ +

+youtube-dl --write-sub --sub-format ttml \
+  --convert-subtitles srt --embed-subs \
+  https://tv.nrk.no/serie/ramm-ferdig-gaa/MUHU11000316/27-04-2018
+

+ +

URL-eksemplet er dagens toppsak på tv.nrk.no. Resultatet er en +MP4-fil med filmen og undertekster som kan spilles av med VLC. Merk +at VLC ikke viser frem undertekster før du aktiverer dem. For å gjøre +det, høyreklikk med musa i fremviservinduet, velg menyvalget for +undertekst og så norsk språk. Jeg testet også '--write-auto-sub', +men det kommandolinjeargumentet ser ikke ut til å fungere, så jeg +endte opp med settet med argumentlisten over, som jeg fant i en +feilrapport i youtube-dl-prosjektets samling over feilrapporter.

+ +

Denne støtten i youtube-dl gjør det svært enkelt å lagre +NRK-innslag, det være seg nyheter, filmer, serier eller dokumentater, +for å ha dem tilgjengelig for fremtidig referanse og bruk, uavhengig +av hvor lenge innslagene ligger tilgjengelig hos NRK. Så får det ikke +hjelpe at NRKs jurister mener at det er +vesensforskjellig +å legge tilgjengelig for nedlasting og for streaming, når det rent +teknisk er samme sak.

+ +

Programmet youtube-dl støtter også en rekke andre nettsteder, se +prosjektoversikten for +en +komplett liste.

- Tags: english, surveillance. + Tags: multimedia, nice free software, norsk, video, web.
@@ -180,33 +159,27 @@ Intercept report that US Senator Rand Paul confirm what I state above.

-
Norwegian Bokmål translation of The Debian Administrator's Handbook complete, proofreading in progress
-
3rd March 2017
-

For almost a year now, we have been working on making a Norwegian -Bokmål edition of The Debian -Administrator's Handbook. Now, thanks to the tireless effort of -Ole-Erik, Ingrid and Andreas, the initial translation is complete, and -we are working on the proof reading to ensure consistent language and -use of correct computer science terms. The plan is to make the book -available on paper, as well as in electronic form. For that to -happen, the proof reading must be completed and all the figures need -to be translated. If you want to help out, get in touch.

- -

A - -fresh PDF edition in A4 format (the final book will have smaller -pages) of the book created every morning is available for -proofreading. If you find any errors, please -visit -Weblate and correct the error. The -state -of the translation including figures is a useful source for those -provide Norwegian bokmål screen shots and figures.

+
Stortingsflertallet går inn for ny IP-basert sensurinfrastruktur i Norge
+
24th April 2018
+

VG, +Dagbladet +og +NRK +melder i dag at flertallet i Familie- og kulturkomiteen på Stortinget +har bestemt seg for å introdusere en ny sensurinfrastruktur i Norge. +Fra før har Norge en «frivillig» sensurinfrastruktur basert på +DNS-navn, der de største ISP-ene basert på en liste med DNS-navn +forgifter DNS-svar og omdirigerer til et annet IP-nummer enn det som +ligger i DNS. Nå kommer altså IP-basert omdirigering i tillegg. Når +infrastrukturen er på plass, er sensur av IP-adresser redusert et +spørsmål om hvilke IP-nummer som skal blokkeres. Listen over +IP-adresser vil naturligvis endre seg etter hvert som myndighetene +endrer seg. Det er ingen betryggende tanke.

- Tags: debian, debian-handbook, english. + Tags: norsk, sikkerhet.
@@ -214,77 +187,40 @@ provide Norwegian bokmål screen shots and figures.

-
Unlimited randomness with the ChaosKey?
-
1st March 2017
-

A few days ago I ordered a small batch of -the ChaosKey, a small -USB dongle for generating entropy created by Bdale Garbee and Keith -Packard. Yesterday it arrived, and I am very happy to report that it -work great! According to its designers, to get it to work out of the -box, you need the Linux kernel version 4.1 or later. I tested on a -Debian Stretch machine (kernel version 4.9), and there it worked just -fine, increasing the available entropy very quickly. I wrote a small -test oneliner to test. It first print the current entropy level, -drain /dev/random, and then print the entropy level for five seconds. -Here is the situation without the ChaosKey inserted:

- -
-% cat /proc/sys/kernel/random/entropy_avail; \
-  dd bs=1M if=/dev/random of=/dev/null count=1; \
-  for n in $(seq 1 5); do \
-     cat /proc/sys/kernel/random/entropy_avail; \
-     sleep 1; \
-  done
-300
-0+1 oppføringer inn
-0+1 oppføringer ut
-28 byte kopiert, 0,000264565 s, 106 kB/s
-4
-8
-12
-17
-21
-%
-
- -

The entropy level increases by 3-4 every second. In such case any -application requiring random bits (like a HTTPS enabled web server) -will halt and wait for more entrpy. And here is the situation with -the ChaosKey inserted:

- -
-% cat /proc/sys/kernel/random/entropy_avail; \
-  dd bs=1M if=/dev/random of=/dev/null count=1; \
-  for n in $(seq 1 5); do \
-     cat /proc/sys/kernel/random/entropy_avail; \
-     sleep 1; \
-  done
-1079
-0+1 oppføringer inn
-0+1 oppføringer ut
-104 byte kopiert, 0,000487647 s, 213 kB/s
-433
-1028
-1031
-1035
-1038
-%
-
- -

Quite the difference. :) I bought a few more than I need, in case -someone want to buy one here in Norway. :)

- -

Update: The dongle was presented at Debconf last year. You might -find the talk -recording illuminating. It explains exactly what the source of -randomness is, if you are unable to spot it from the schema drawing -available from the ChaosKey web site linked at the start of this blog -post.

+
En grunn til å takke nei til usikker digital post
+
2nd April 2018
+

Brevpost er beskyttet av straffelovens bestemmelse som gjør det +kriminelt å åpne andres brev. Dette følger av (ny) straffelovs +§ 205 +(Krenkelse av retten til privat kommunikasjon), som sier at «Med +bot eller fengsel inntil 2 år straffes den som uberettiget ... c) +åpner brev eller annen lukket skriftlig meddelelse som er adressert +til en annen, eller på annen måte skaffer seg uberettiget tilgang til +innholdet.» Dette gjelder såvel postbud som alle andre som har +befatning med brevet etter at avsender har befatning med et lukket +brev. Tilsvarende står også tidligere utgaver av den norske +straffeloven.

+ +

Når en registrerer seg på usikre digitale postkasseløsningene, som +f.eks. Digipost og e-Boks, og slik tar disse i bruk, så gir en de som +står bak løsningene tillatelse til å åpne sine brev. Dette er +nødvendig for at innholdet i digital post skal kunne vises frem til +mottaker via tjenestens websider. Dermed gjelder ikke straffelovens +paragraf om forbud mot å åpne brev, da tilgangen ikke lenger er +uberettiget. En gir altså fremmede tilgang til å lese sin +korrespondanse. I tillegg vil bruk av slike usikre digitale +postbokser føre til at det blir registrert når du leser brevene, hvor +du befinner deg (vha. tilkoblingens IP-adresse), hvilket utstyr du +bruker og en rekke annen personlig informasjon som ikke er +tilgjengelig når papirpost brukes. Jeg foretrekker at det er +lovmessig beskyttelse av min korrespondanse, som jo inneholder privat +og personlig informasjon. Det bidrar til litt bedre vern av personlig +integritet i dagens norske samfunn.

- Tags: debian, english. + Tags: norsk, personvern, surveillance.
@@ -292,34 +228,34 @@ post.

-
Detect OOXML files with undefined behaviour?
-
21st February 2017
-

I just noticed -the -new Norwegian proposal for archiving rules in the goverment list -ECMA-376 -/ ISO/IEC 29500 (aka OOXML) as valid formats to put in long term -storage. Luckily such files will only be accepted based on -pre-approval from the National Archive. Allowing OOXML files to be -used for long term storage might seem like a good idea as long as we -forget that there are plenty of ways for a "valid" OOXML document to -have content with no defined interpretation in the standard, which -lead to a question and an idea.

- -

Is there any tool to detect if a OOXML document depend on such -undefined behaviour? It would be useful for the National Archive (and -anyone else interested in verifying that a document is well defined) -to have such tool available when considering to approve the use of -OOXML. I'm aware of the -officeotron OOXML -validator, but do not know how complete it is nor if it will -report use of undefined behaviour. Are there other similar tools -available? Please send me an email if you know of any such tool.

+
Self-appointed leaders of the Free World
+
22nd March 2018
+

The leaders of the worlds have started to congratulate the +re-elected Russian head of state, and this causes some criticism. I +am though a little fascinated by a comment from USA senator John McCain, +sited +by The Hill and others: + +

+

"An American president does not lead the Free World by +congratulating dictators on winning sham elections."

+

+ +

While I totally agree with the senator here, the way the quote is +phrased make me suspect that he is unaware of the simple fact that USA +have not lead the Free World since at least before its government +kidnapped a +completely innocent Canadian citizen in transit on his way home to +Canada via John F. Kennedy International Airport in September 2002 and +sent him to be tortured in Syria for a year.

+ +

USA might be running ahead, but the path they are taking is not the +one taken by any Free World.

- Tags: english, nuug, standard. + Tags: english.
@@ -327,33 +263,63 @@ available? Please send me an email if you know of any such tool.

-
Ruling ignored our objections to the seizure of popcorn-time.no (#domstolkontroll)
-
13th February 2017
-

A few days ago, we received the ruling from -my -day in court. The case in question is a challenge of the seizure -of the DNS domain popcorn-time.no. The ruling simply did not mention -most of our arguments, and seemed to take everything ØKOKRIM said at -face value, ignoring our demonstration and explanations. But it is -hard to tell for sure, as we still have not seen most of the documents -in the case and thus were unprepared and unable to contradict several -of the claims made in court by the opposition. We are considering an -appeal, but it is partly a question of funding, as it is costing us -quite a bit to pay for our lawyer. If you want to help, please -donate to the -NUUG defense fund.

- -

The details of the case, as far as we know it, is available in -Norwegian from -the NUUG -blog. This also include -the -ruling itself.

+
Facebooks ability to sell your personal information is the real Cambridge Analytica scandal
+
21st March 2018
+

So, Cambridge Analytica is getting some well deserved criticism for +(mis)using information it got from Facebook about 50 million people, +mostly in the USA. What I find a bit surprising, is how little +criticism Facebook is getting for handing the information over to +Cambridge Analytica and others in the first place. And what about the +people handing their private and personal information to Facebook? +And last, but not least, what about the government offices who are +handing information about the visitors of their web pages to Facebook? +No-one who looked at the terms of use of Facebook should be surprised +that information about peoples interests, political views, personal +lifes and whereabouts would be sold by Facebook.

+ +

What I find to be the real scandal is the fact that Facebook is +selling your personal information, not that one of the buyers used it +in a way Facebook did not approve when exposed. It is well known that +Facebook is selling out their users privacy, but a scandal +nevertheless. Of course the information provided to them by Facebook +would be misused by one of the parties given access to personal +information about the millions of Facebook users. Collected +information will be misused sooner or later. The only way to avoid +such misuse, is to not collect the information in the first place. If +you do not want Facebook to hand out information about yourself for +the use and misuse of its customers, do not give Facebook the +information.

+ +

Personally, I would recommend to completely remove your Facebook +account, and take back some control of your personal information. +According +to The Guardian, it is a bit hard to find out how to request +account removal (and not just 'disabling'). You need to +visit +a specific Facebook page and click on 'let us know' on that page +to get to the +real account deletion screen. Perhaps something to consider? I +would not trust the information to really be deleted (who knows, +perhaps NSA, GCHQ and FRA already got a copy), but it might reduce the +exposure a bit.

+ +

If you want to learn more about the capabilities of Cambridge +Analytica, I recommend to see the video recording of the one hour talk +Paul-Olivier Dehaye gave to NUUG last april about + +Data collection, psychometric profiling and their impact on +politics.

+ +

And if you want to communicate with your friends and loved ones, +use some end-to-end encrypted method like +Signal or +Ring, and stop sharing your private +messages with strangers like Facebook and Google.

- Tags: english, nuug, offentlig innsyn, opphavsrett. + Tags: english, personvern.
@@ -361,86 +327,67 @@ ruling itself.

-
A day in court challenging seizure of popcorn-time.no for #domstolkontroll
-
3rd February 2017
-

- -

On Wednesday, I spent the entire day in court in Follo Tingrett -representing the member association -NUUG, alongside the member -association EFN and the DNS registrar -IMC, challenging the seizure of the DNS name popcorn-time.no. It -was interesting to sit in a court of law for the first time in my -life. Our team can be seen in the picture above: attorney Ola -Tellesbø, EFN board member Tom Fredrik Blenning, IMC CEO Morten Emil -Eriksen and NUUG board member Petter Reinholdtsen.

- -

The -case at hand is that the Norwegian National Authority for -Investigation and Prosecution of Economic and Environmental Crime (aka -Økokrim) decided on their own, to seize a DNS domain early last -year, without following -the -official policy of the Norwegian DNS authority which require a -court decision. The web site in question was a site covering Popcorn -Time. And Popcorn Time is the name of a technology with both legal -and illegal applications. Popcorn Time is a client combining -searching a Bittorrent directory available on the Internet with -downloading/distribute content via Bittorrent and playing the -downloaded content on screen. It can be used illegally if it is used -to distribute content against the will of the right holder, but it can -also be used legally to play a lot of content, for example the -millions of movies -available from the -Internet Archive or the collection -available from Vodo. We created -a -video demonstrating legally use of Popcorn Time and played it in -Court. It can of course be downloaded using Bittorrent.

- -

I did not quite know what to expect from a day in court. The -government held on to their version of the story and we held on to -ours, and I hope the judge is able to make sense of it all. We will -know in two weeks time. Unfortunately I do not have high hopes, as -the Government have the upper hand here with more knowledge about the -case, better training in handling criminal law and in general higher -standing in the courts than fairly unknown DNS registrar and member -associations. It is expensive to be right also in Norway. So far the -case have cost more than NOK 70 000,-. To help fund the case, NUUG -and EFN have asked for donations, and managed to collect around NOK 25 -000,- so far. Given the presentation from the Government, I expect -the government to appeal if the case go our way. And if the case do -not go our way, I hope we have enough funding to appeal.

- -

From the other side came two people from Økokrim. On the benches, -appearing to be part of the group from the government were two people -from the Simonsen Vogt Wiik lawyer office, and three others I am not -quite sure who was. Økokrim had proposed to present two witnesses -from The Motion Picture Association, but this was rejected because -they did not speak Norwegian and it was a bit late to bring in a -translator, but perhaps the two from MPA were present anyway. All -seven appeared to know each other. Good to see the case is take -seriously.

- -

If you, like me, believe the courts should be involved before a DNS -domain is hijacked by the government, or you believe the Popcorn Time -technology have a lot of useful and legal applications, I suggest you -too donate to -the NUUG defense fund. Both Bitcoin and bank transfer are -available. If NUUG get more than we need for the legal action (very -unlikely), the rest will be spend promoting free software, open -standards and unix-like operating systems in Norway, so no matter what -happens the money will be put to good use.

- -

If you want to lean more about the case, I recommend you check out -the blog -posts from NUUG covering the case. They cover the legal arguments -on both sides.

+
H, Ap, Frp og Venstre går for DNA-innsamling av hele befolkningen
+
14th March 2018
+

I går kom det nok et argument for å holde seg unna det norske +helsevesenet. Da annonserte et stortingsflertall, bestående av Høyre, +Arbeiderpartiet, Fremskrittspartiet og Venstre, at de går inn for å +samle inn og lagre DNA-prøver fra hele befolkningen i Norge til evig +tid. Endringen gjelder innsamlede blodprøver fra nyfødte i Norge. +Det vil dermed ta litt tid før en har hele befolkningen, men det er +dit vi havner gitt nok tid. I dag er det nesten hundre prosent +oppslutning om undersøkelsen som gjøres like etter fødselen, på +bakgrunn av blodprøven det er snakk om å lagre, for å oppdage endel +medfødte sykdommer. Blodprøven lagres i dag i inntil seks år. +Stortingets +flertallsinnstilling er at tidsbegrensingen skal fjernes, og mener +at tidsubegrenset lagring ikke vil påvirke oppslutningen om +undersøkelsen.

+ +

Datatilsynet har ikke akkurat applaudert forslaget:

+ +

+ +

«Datatilsynet mener forslaget ikke i tilstrekkelig grad + synliggjør hvilke etiske og personvernmessige utfordringer som må + diskuteres før en etablerer en nasjonal biobank med blodprøver fra + hele befolkningen.»

+ +

+ +

Det er flere historier om hvordan innsamlet biologisk materiale har +blitt brukt til andre formål enn de ble innsamlet til, og historien om +folkehelseinstituttets +lagring på vegne av politiet (Kripos) av innsamlet biologisk materiale +og DNA-informasjon i strid med loven viser at en ikke kan være +trygg på at lover og intensjoner beskytter de som blir berørt mot +misbruk av slik privat og personlig informasjon.

+ +

Det er verdt å merke seg at det kan forskes på de innsamlede +blodprøvene uten samtykke fra den det gjelder (eller foreldre når det +gjelder barn), etter en lovendring for en stund tilbake, med mindre +det er sendt inn skjema der en reserverer seg mot forskning uten +samtykke. Skjemaet er tilgjengelig fra +folkehelseinstituttets +websider, og jeg anbefaler, uavhengig av denne saken, varmt alle å +sende inn skjemaet for å dokumentere hvor mange som ikke synes det er +greit å fjerne krav om samtykke.

+ +

I tillegg bør en kreve destruering av alt biologisk materiale som +er samlet inn om en selv, for å redusere eventuelle negative +konsekvenser i fremtiden når materialet kommer på avveie eller blir +brukt uten samtykke, men det er så vidt jeg vet ikke noe system for +dette i dag.

+ +

Som vanlig, hvis du bruker Bitcoin og ønsker å vise din støtte til +det jeg driver med, setter jeg pris på om du sender Bitcoin-donasjoner +til min adresse +15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: english, nuug, offentlig innsyn, opphavsrett. + Tags: norsk, personvern, surveillance.
@@ -448,41 +395,62 @@ on both sides.

-
Nasjonalbiblioteket avslutter sin ulovlige bruk av Google Skjemaer
-
12th January 2017
-

I dag fikk jeg en skikkelig gladmelding. Bakgrunnen er at før jul -arrangerte Nasjonalbiblioteket -et -seminar om sitt knakende gode tiltak «verksregister». Eneste -måten å melde seg på dette seminaret var å sende personopplysninger -til Google via Google Skjemaer. Dette syntes jeg var tvilsom praksis, -da det bør være mulig å delta på seminarer arrangert av det offentlige -uten å måtte dele sine interesser, posisjon og andre -personopplysninger med Google. Jeg ba derfor om innsyn via -Mimes brønn i -avtaler -og vurderinger Nasjonalbiblioteket hadde rundt dette. -Personopplysningsloven legger klare rammer for hva som må være på -plass før en kan be tredjeparter, spesielt i utlandet, behandle -personopplysninger på sine vegne, så det burde eksistere grundig -dokumentasjon før noe slikt kan bli lovlig. To jurister hos -Nasjonalbiblioteket mente først dette var helt i orden, og at Googles -standardavtale kunne brukes som databehandlingsavtale. Det syntes jeg -var merkelig, men har ikke hatt kapasitet til å følge opp saken før -for to dager siden.

- -

Gladnyheten i dag, som kom etter at jeg tipset Nasjonalbiblioteket -om at Datatilsynet underkjente Googles standardavtaler som -databehandleravtaler i 2011, er at Nasjonalbiblioteket har bestemt seg -for å avslutte bruken av Googles Skjemaer/Apps og gå i dialog med DIFI -for å finne bedre måter å håndtere påmeldinger i tråd med -personopplysningsloven. Det er fantastisk å se at av og til hjelper -det å spørre hva i alle dager det offentlige holder på med.

+
First rough draft Norwegian and Spanish edition of the book Made with Creative Commons
+
13th March 2018
+

I am working on publishing yet another book related to Creative +Commons. This time it is a book filled with interviews and histories +from those around the globe making a living using Creative +Commons.

+ +

Yesterday, after many months of hard work by several volunteer +translators, the first draft of a Norwegian Bokmål edition of the book +Made with Creative Commons from 2017 +was complete. The Spanish translation is also complete, while the +Dutch, Polish, German and Ukraine edition need a lot of work. Get in +touch if you want to help make those happen, or would like to +translate into your mother tongue.

+ +

The whole book project started when +Gunnar Wolf announced that he +was going to make a Spanish edition of the book. I noticed, and +offered some input on how to make a book, based on my experience with +translating the +Free +Culture and +The Debian +Administrator's Handbook books to Norwegian Bokmål. To make a +long story short, we ended up working on a Bokmål edition, and now the +first rough translation is complete, thanks to the hard work of +Ole-Erik Yrvin, Ingrid Yrvin, Allan Nordhøy and myself. The first +proof reading is almost done, and only the second and third proof +reading remains. We will also need to translate the 14 figures and +create a book cover. Once it is done we will publish the book on +paper, as well as in PDF, ePub and possibly Mobi formats.

+ +

The book itself originates as a manuscript on Google Docs, is +downloaded as ODT from there and converted to Markdown using pandoc. +The Markdown is modified by a script before is converted to DocBook +using pandoc. The DocBook is modified again using a script before it +is used to create a Gettext POT file for translators. The translated +PO file is then combined with the earlier mentioned DocBook file to +create a translated DocBook file, which finally is given to dblatex to +create the final PDF. The end result is a set of editions of the +manuscript, one English and one for each of the translations.

+ +

The translation is conducted using +the +Weblate web based translation system. Please have a look there +and get in touch if you would like to help out with proof +reading. :)

+ +

As usual, if you use Bitcoin and want to show your support of my +activities, please send Bitcoin donations to my address +15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: norsk, personvern, surveillance, web. + Tags: docbook, english.
@@ -490,86 +458,54 @@ det å spørre hva i alle dager det offentlige holder på med.

-
Bryter NAV sin egen personvernerklæring?
-
11th January 2017
-

Jeg leste med interesse en nyhetssak hos -digi.no -og -NRK -om at det ikke bare er meg, men at også NAV bedriver geolokalisering -av IP-adresser, og at det gjøres analyse av IP-adressene til de som -sendes inn meldekort for å se om meldekortet sendes inn fra -utenlandske IP-adresser. Politiadvokat i Drammen, Hans Lyder Haare, -er sitert i NRK på at «De to er jo blant annet avslørt av -IP-adresser. At man ser at meldekortet kommer fra utlandet.»

- -

Jeg synes det er fint at det blir bedre kjent at IP-adresser -knyttes til enkeltpersoner og at innsamlet informasjon brukes til å -stedsbestemme personer også av aktører her i Norge. Jeg ser det som -nok et argument for å bruke -Tor så mye som mulig for å -gjøre gjøre IP-lokalisering vanskeligere, slik at en kan beskytte sin -privatsfære og unngå å dele sin fysiske plassering med -uvedkommede.

- -

Men det er en ting som bekymrer meg rundt denne nyheten. Jeg ble -tipset (takk #nuug) om -NAVs -personvernerklæring, som under punktet «Personvern og statistikk» -lyder:

- -

- -

«Når du besøker nav.no, etterlater du deg elektroniske spor. Sporene -dannes fordi din nettleser automatisk sender en rekke opplysninger til -NAVs tjener (server-maskin) hver gang du ber om å få vist en side. Det -er eksempelvis opplysninger om hvilken nettleser og -versjon du -bruker, og din internettadresse (ip-adresse). For hver side som vises, -lagres følgende opplysninger:

- -
    -
  • hvilken side du ser pÃ¥
    • -
  • dato og tid
    • -
  • hvilken nettleser du bruker
    • -
  • din ip-adresse
    • -
+
Debian used in the subway info screens in Oslo, Norway
+
2nd March 2018
+

Today I was pleasantly surprised to discover my operating system of +choice, Debian, was used in the info screens on the subway stations. +While passing Nydalen subway station in Oslo, Norway, I discovered the +info screen booting with some text scrolling. I was not quick enough +with my camera to be able to record a video of the scrolling boot +screen, but I did get a photo from when the boot got stuck with a +corrupt file system: + +

[photo of subway info screen]

+ +

While I am happy to see Debian used more places, some details of the +content on the screen worries me.

+ +

The image show the version booting is 'Debian GNU/Linux lenny/sid', +indicating that this is based on code taken from Debian Unstable/Sid +after Debian Etch (version 4) was released 2007-04-08 and before +Debian Lenny (version 5) was released 2009-02-14. Since Lenny Debian +has released version 6 (Squeeze) 2011-02-06, 7 (Wheezy) 2013-05-04, 8 +(Jessie) 2015-04-25 and 9 (Stretch) 2017-06-15, according to +a Debian +version history on Wikpedia. This mean the system is running +around 10 year old code, with no security fixes from the vendor for +many years.

+ +

This is not the first time I discover the Oslo subway company, +Ruter, running outdated software. In 2012, +I +discovered the ticket vending machines were running Windows 2000, +and this was +still +the case in 2016. Given the response from the responsible people +in 2016, I would assume the machines are still running unpatched +Windows 2000. Thus, an unpatched Debian setup come as no surprise.

+ +

The photo is made available under the license terms +Creative Commons +4.0 Attribution International (CC BY 4.0).

-

Ingen av opplysningene vil bli brukt til å identifisere -enkeltpersoner. NAV bruker disse opplysningene til å generere en -samlet statistikk som blant annet viser hvilke sider som er mest -populære. Statistikken er et redskap til å forbedre våre -tjenester.»

- -

- -

Jeg klarer ikke helt å se hvordan analyse av de besøkendes -IP-adresser for å se hvem som sender inn meldekort via web fra en -IP-adresse i utlandet kan gjøres uten å komme i strid med påstanden om -at «ingen av opplysningene vil bli brukt til å identifisere -enkeltpersoner». Det virker dermed for meg som at NAV bryter sine -egen personvernerklæring, hvilket -Datatilsynet -fortalte meg i starten av desember antagelig er brudd på -personopplysningsloven. - -

I tillegg er personvernerklæringen ganske misvisende i og med at -NAVs nettsider ikke bare forsyner NAV med personopplysninger, men i -tillegg ber brukernes nettleser kontakte fem andre nettjenere -(script.hotjar.com, static.hotjar.com, vars.hotjar.com, -www.google-analytics.com og www.googletagmanager.com), slik at -personopplysninger blir gjort tilgjengelig for selskapene Hotjar og -Google , og alle som kan lytte på trafikken på veien (som FRA, GCHQ og -NSA). Jeg klarer heller ikke se hvordan slikt spredning av -personopplysninger kan være i tråd med kravene i -personopplysningloven, eller i tråd med NAVs personvernerklæring.

- -

Kanskje NAV bør ta en nøye titt på sin personvernerklæring? Eller -kanskje Datatilsynet bør gjøre det?

+

As usual, if you use Bitcoin and want to show your support of my +activities, please send Bitcoin donations to my address +15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: norsk, nuug, personvern, surveillance. + Tags: english, ruter.
@@ -577,164 +513,39 @@ kanskje Datatilsynet bør gjøre det?

-
Where did that package go? — geolocated IP traceroute
-
9th January 2017
-

Did you ever wonder where the web trafic really flow to reach the -web servers, and who own the network equipment it is flowing through? -It is possible to get a glimpse of this from using traceroute, but it -is hard to find all the details. Many years ago, I wrote a system to -map the Norwegian Internet (trying to figure out if our plans for a -network game service would get low enough latency, and who we needed -to talk to about setting up game servers close to the users. Back -then I used traceroute output from many locations (I asked my friends -to run a script and send me their traceroute output) to create the -graph and the map. The output from traceroute typically look like -this: +

The SysVinit upstream project just migrated to git
+
18th February 2018
+

Surprising as it might sound, there are still computers using the +traditional Sys V init system, and there probably will be until +systemd start working on Hurd and FreeBSD. +The upstream +project still exist, though, and up until today, the upstream +source was available from Savannah via subversion. I am happy to +report that this just changed.

+ +

The upstream source is now in Git, and consist of three +repositories:

-

-traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
- 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
- 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
- 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
- 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
- 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
- 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
- 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
- 8  * * *
- 9  * * *
-[...]
-

+
    -

    This show the DNS names and IP addresses of (at least some of the) -network equipment involved in getting the data traffic from me to the -www.stortinget.no server, and how long it took in milliseconds for a -package to reach the equipment and return to me. Three packages are -sent, and some times the packages do not follow the same path. This -is shown for hop 5, where three different IP addresses replied to the -traceroute request.

    - -

    There are many ways to measure trace routes. Other good traceroute -implementations I use are traceroute (using ICMP packages) mtr (can do -both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP -traceroute and a lot of other capabilities). All of them are easily -available in Debian.

    - -

    This time around, I wanted to know the geographic location of -different route points, to visualize how visiting a web page spread -information about the visit to a lot of servers around the globe. The -background is that a web site today often will ask the browser to get -from many servers the parts (for example HTML, JSON, fonts, -JavaScript, CSS, video) required to display the content. This will -leak information about the visit to those controlling these servers -and anyone able to peek at the data traffic passing by (like your ISP, -the ISPs backbone provider, FRA, GCHQ, NSA and others).

    - -

    Lets pick an example, the Norwegian parliament web site -www.stortinget.no. It is read daily by all members of parliament and -their staff, as well as political journalists, activits and many other -citizens of Norway. A visit to the www.stortinget.no web site will -ask your browser to contact 8 other servers: ajax.googleapis.com, -insights.hotjar.com, script.hotjar.com, static.hotjar.com, -stats.g.doubleclick.net, www.google-analytics.com, -www.googletagmanager.com and www.netigate.se. I extracted this by -asking PhantomJS to visit the -Stortinget web page and tell me all the URLs PhantomJS downloaded to -render the page (in HAR format using -their -netsniff example. I am very grateful to Gorm for showing me how -to do this). My goal is to visualize network traces to all IP -addresses behind these DNS names, do show where visitors personal -information is spread when visiting the page.

    - -

    map of combined traces for URLs used by www.stortinget.no using GeoIP

    - -

    When I had a look around for options, I could not find any good -free software tools to do this, and decided I needed my own traceroute -wrapper outputting KML based on locations looked up using GeoIP. KML -is easy to work with and easy to generate, and understood by several -of the GIS tools I have available. I got good help from by NUUG -colleague Anders Einar with this, and the result can be seen in -my -kmltraceroute git repository. Unfortunately, the quality of the -free GeoIP databases I could find (and the for-pay databases my -friends had access to) is not up to the task. The IP addresses of -central Internet infrastructure would typically be placed near the -controlling companies main office, and not where the router is really -located, as you can see from the -KML file I created using the GeoLite City dataset from MaxMind. - -

    scapy traceroute graph for URLs used by www.stortinget.no

    - -

    I also had a look at the visual traceroute graph created by -the scrapy project, -showing IP network ownership (aka AS owner) for the IP address in -question. -The -graph display a lot of useful information about the traceroute in SVG -format, and give a good indication on who control the network -equipment involved, but it do not include geolocation. This graph -make it possible to see the information is made available at least for -UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level -3 Communications and NetDNA.

    - -

    example geotraceroute view for www.stortinget.no

    - -

    In the process, I came across the -web service GeoTraceroute by -Salim Gasmi. Its methology of combining guesses based on DNS names, -various location databases and finally use latecy times to rule out -candidate locations seemed to do a very good job of guessing correct -geolocation. But it could only do one trace at the time, did not have -a sensor in Norway and did not make the geolocations easily available -for postprocessing. So I contacted the developer and asked if he -would be willing to share the code (he refused until he had time to -clean it up), but he was interested in providing the geolocations in a -machine readable format, and willing to set up a sensor in Norway. So -since yesterday, it is possible to run traces from Norway in this -service thanks to a sensor node set up by -the NUUG assosiation, and get the -trace in KML format for further processing.

    - -

    map of combined traces for URLs used by www.stortinget.no using geotraceroute

    - -

    Here we can see a lot of trafic passes Sweden on its way to -Denmark, Germany, Holland and Ireland. Plenty of places where the -Snowden confirmations verified the traffic is read by various actors -without your best interest as their top priority.

    - -

    Combining KML files is trivial using a text editor, so I could loop -over all the hosts behind the urls imported by www.stortinget.no and -ask for the KML file from GeoTraceroute, and create a combined KML -file with all the traces (unfortunately only one of the IP addresses -behind the DNS name is traced this time. To get them all, one would -have to request traces using IP number instead of DNS names from -GeoTraceroute). That might be the next step in this project.

    - -

    Armed with these tools, I find it a lot easier to figure out where -the IP traffic moves and who control the boxes involved in moving it. -And every time the link crosses for example the Swedish border, we can -be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in -Britain and NSA in USA and cables around the globe. (Hm, what should -we tell them? :) Keep that in mind if you ever send anything -unencrypted over the Internet.

    - -

    PS: KML files are drawn using -the KML viewer from Ivan -Rublev, as it was less cluttered than the local Linux application -Marble. There are heaps of other options too.

    +
  • sysvinit
    • +
  • insserv
    • +
  • startpar
    • + +
+ +

I do not really spend much time on the project these days, and I +has mostly retired, but found it best to migrate the source to a good +version control system to help those willing to move it forward.

As usual, if you use Bitcoin and want to show your support of my activities, please send Bitcoin donations to my address -15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

+15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b.

- Tags: debian, english, kart, nuug, personvern, stortinget, surveillance, web. + Tags: bootsystem, english.
@@ -749,6 +560,21 @@ activities, please send Bitcoin donations to my address

Archive