X-Git-Url: http://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/b207c3757ccbc1f7535b01d332fb98766135eec7..2d047348b0dfe1d3bab7955e9bf9b52223e84373:/blog/index.html diff --git a/blog/index.html b/blog/index.html index 34913cbbc0..7ee76c94b8 100644 --- a/blog/index.html +++ b/blog/index.html @@ -20,33 +20,96 @@
-
Dugnadsnett for alle, a wireless community network in Oslo, take shape
-
30th November 2013
-

If you want the ability to electronically communicate directly with -your neighbors and friends using a network controlled by your peers in -stead of centrally controlled by a few corporations, or would like to -experiment with interesting network technology, the -Dugnasnett for alle i Oslo -might be project for you. 39 mesh nodes are currently being planned, -in the freshly started initiative from NUUG and Hackeriet to create a -wireless community network. The work is inspired by -Freifunk, -Athens Wireless Metropolitan -Network, Roofnet -and other successful mesh networks around the globe. Two days ago we -held a workshop to try to get people started on setting up their own -mesh node, and there we decided to create a new mailing list -dugnadsnett -(at) nuug.no and IRC channel -#dugnadsnett.no to -coordinate the work. See also the NUUG blog post -announcing -the mailing list and IRC channel.

+ +
9th August 2017
+

On friday, I came across an interesting article in the Norwegian +web based ICT news magazine digi.no on +how +to collect the IMSI numbers of nearby cell phones using the cheap +DVB-T software defined radios. The article refered to instructions +and a recipe by +Keld Norman on Youtube on how to make a simple $7 IMSI Catcher, and I decided to test them out.

+ +

The instructions said to use Ubuntu, install pip using apt (to +bypass apt), use pip to install pybombs (to bypass both apt and pip), +and the ask pybombs to fetch and build everything you need from +scratch. I wanted to see if I could do the same on the most recent +Debian packages, but this did not work because pybombs tried to build +stuff that no longer build with the most recent openssl library or +some other version skew problem. While trying to get this recipe +working, I learned that the apt->pip->pybombs route was a long detour, +and the only piece of software dependency missing in Debian was the +gr-gsm package. I also found out that the lead upstream developer of +gr-gsm (the name stand for GNU Radio GSM) project already had a set of +Debian packages provided in an Ubuntu PPA repository. All I needed to +do was to dget the Debian source package and built it.

+ +

The IMSI collector is a python script listening for packages on the +loopback network device and printing to the terminal some specific GSM +packages with IMSI numbers in them. The code is fairly short and easy +to understand. The reason this work is because gr-gsm include a tool +to read GSM data from a software defined radio like a DVB-T USB stick +and other software defined radios, decode them and inject them into a +network device on your Linux machine (using the loopback device by +default). This proved to work just fine, and I've been testing the +collector for a few days now.

+ +

The updated and simpler recipe is thus to

+ +
    + +
  1. start with a Debian machine running Stretch or newer,
  2. + +
  3. build and install the gr-gsm package available from +http://ppa.launchpad.net/ptrkrysik/gr-gsm/ubuntu/pool/main/g/gr-gsm/,
  4. + +
  5. clone the git repostory from https://github.com/Oros42/IMSI-catcher,
  6. + +
  7. run grgsm_livemon and adjust the frequency until the terminal +where it was started is filled with a stream of text (meaning you +found a GSM station).
  8. + +
  9. go into the IMSI-catcher directory and run 'sudo python simple_IMSI-catcher.py' to extract the IMSI numbers.
  10. + +
+ +

To make it even easier in the future to get this sniffer up and +running, I decided to package +the gr-gsm project +for Debian (WNPP +#871055), and the package was uploaded into the NEW queue today. +Luckily the gnuradio maintainer has promised to help me, as I do not +know much about gnuradio stuff yet.

+ +

I doubt this "IMSI cacher" is anywhere near as powerfull as +commercial tools like +The +Spy Phone Portable IMSI / IMEI Catcher or the +Harris +Stingray, but I hope the existance of cheap alternatives can make +more people realise how their whereabouts when carrying a cell phone +is easily tracked. Seeing the data flow on the screen, realizing that +I live close to a police station and knowing that the police is also +wearing cell phones, I wonder how hard it would be for criminals to +track the position of the police officers to discover when there are +police near by, or for foreign military forces to track the location +of the Norwegian military forces, or for anyone to track the location +of government officials...

+ +

It is worth noting that the data reported by the IMSI-catcher +script mentioned above is only a fraction of the data broadcasted on +the GSM network. It will only collect one frequency at the time, +while a typical phone will be using several frequencies, and not all +phones will be using the frequencies tracked by the grgsm_livemod +program. Also, there is a lot of radio chatter being ignored by the +simple_IMSI-catcher script, which would be collected by extending the +parser code. I wonder if gr-gsm can be set up to listen to more than +one frequency?

@@ -54,84 +117,37 @@ the mailing list and IRC channel.

- -
26th November 2013
-

Jeg -skrev -i juni om protestene på planene til min arbeidsplass, -Universitetet i Oslo, om å gå bort fra -fri programvare- og åpne standardløsninger for å håndtere epost, -vekk fra IETF-standarden SIEVE for filtrering av epost og over til -godseide spesifikasjoner og epostsystemet Microsoft Exchange. -Protestene har fått litt ny omtale i media de siste dagene, i tillegg -til de oppslagene som kom i mai.

- - - -

Prosjektledelsen har fortalt at dette skal fungere like godt for -Linux-brukere som for brukere av Microsoft Windows og Apple MacOSX, -men jeg lurer på hva slags erfaringer Linux-brukere i eksisterende -miljøer som bruker MS Exchange har gjort. Hvis du har slik erfaring -hadet det vært veldig fint om du kan send et leserbrev til -Uniforum og fortelle om hvor -greit det er å bruke Exchange i kryss-platform-miljøer? De jeg har -snakket med sier en greit får lest e-posten sin hvis Exchange har -slått på IMAP-funksjonalitet, men at kalender og møtebooking ikke -fungerer godt for Linux-klienter. Jeg har ingen personlig erfaring å -komme med, så jeg er nysgjerrig på hva andre kan dele av erfaringer -med universitetet.

- -

Mitt ankerpunkt mot å bytte ut fri programvare som fungerer godt -med godseid programvare er at en mister kontroll over egen -infrastruktur, låser seg inn i en løsning det vil bli dyrt å komme ut -av, uten at en får funksjonalitet en ikke kunne skaffet seg med fri -programvare, eventuelt videreutviklet med de pengene som brukes på -overgangen til MS Exchange. Personlig planlegger jeg å fortsette å -laste ned all eposten min til lokal maskin for indeksering og lesing -med notmuch, så jeg håper jeg -ikke blir veldig skadelidende av overgangen.

- -

Underskriftslista -for oss som er mot endringen, som omtales i artiklene, er fortsatt -åpen for de som vil signere på oppropet. Akkurat nå er det 298 -personer som har signert.

+ +
25th July 2017
+

+ +

I finally received a copy of the Norwegian Bokmål edition of +"The Debian Administrator's +Handbook". This test copy arrived in the mail a few days ago, and +I am very happy to hold the result in my hand. We spent around one and a half year translating it. This paperbook edition +is available +from lulu.com. If you buy it quickly, you save 25% on the list +price. The book is also available for download in electronic form as +PDF, EPUB and Mobipocket, as can be +read online +as a web page.

+ +

This is the second book I publish (the first was the book +"Free Culture" by Lawrence Lessig +in +English, +French +and +Norwegian +Bokmål), and I am very excited to finally wrap up this +project. I hope +"Håndbok +for Debian-administratoren" will be well received.

@@ -139,56 +155,50 @@ personer som har signert.

- -
24th November 2013
-

After many years break from the package and a vain hope that -development would be continued by someone else, I finally pulled my -acts together this morning and wrapped up a new release of chrpath, -the command line tool to modify the rpath and runpath of already -compiled ELF programs. The update was triggered by the persistence of -Isha Vishnoi at IBM, which needed a new config.guess file to get -support for the ppc64le architecture (powerpc 64-bit Little Endian) he -is working on. I checked the -Debian, -Ubuntu and -Fedora -packages for interesting patches (failed to find the source from -OpenSUSE and Mandriva packages), and found quite a few nice fixes. -These are the release notes:

- -

New in 0.15 released 2013-11-24:

- -
    - -
  • Updated config.sub and config.guess from the GNU project to work - with newer architectures. Thanks to isha vishnoi for the heads - up.
  • - -
  • Updated README with current URLs.
  • - -
  • Added byteswap fix found in Ubuntu, credited Jeremy Kerr and - Matthias Klose.
  • - -
  • Added missing help for -k|--keepgoing option, using patch by - Petr Machata found in Fedora.
  • - -
  • Rewrite removal of RPATH/RUNPATH to make sure the entry in - .dynamic is a NULL terminated string. Based on patch found in - Fedora credited Axel Thimm and Christian Krause.
  • - -
- -

You can -download the -new version 0.15 from alioth. Please let us know via the Alioth -project if something is wrong with the new release. The test suite -did not discover any old errors, so if you find a new one, please also -include a testsuite check.

+ +
27th June 2017
+

Jeg kom over teksten +«Killing +car privacy by federal mandate» av Leonid Reyzin på Freedom to +Tinker i dag, og det gleder meg å se en god gjennomgang om hvorfor det +er et urimelig inngrep i privatsfæren å la alle biler kringkaste sin +posisjon og bevegelse via radio. Det omtalte forslaget basert på +Dedicated Short Range Communication (DSRC) kalles Basic Safety Message +(BSM) i USA og Cooperative Awareness Message (CAM) i Europa, og det +norske Vegvesenet er en av de som ser ut til å kunne tenke seg å +pålegge alle biler å fjerne nok en bit av innbyggernes privatsfære. +Anbefaler alle å lese det som står der. + +

Mens jeg tittet litt på DSRC på biler i Norge kom jeg over et sitat +jeg synes er illustrativt for hvordan det offentlige Norge håndterer +problemstillinger rundt innbyggernes privatsfære i SINTEF-rapporten +«Informasjonssikkerhet +i AutoPASS-brikker» av Trond Foss:

+ +

+«Rapporten ser ikke på informasjonssikkerhet knyttet til personlig + integritet.» +

+ +

Så enkelt kan det tydeligvis gjøres når en vurderer +informasjonssikkerheten. Det holder vel at folkene på toppen kan si +at «Personvernet er ivaretatt», som jo er den populære intetsigende +frasen som gjør at mange tror enkeltindividers integritet tas vare på. +Sitatet fikk meg til å undres på hvor ofte samme tilnærming, å bare se +bort fra behovet for personlig itegritet, blir valgt når en velger å +legge til rette for nok et inngrep i privatsfæren til personer i +Norge. Det er jo sjelden det får reaksjoner. Historien om +reaksjonene på Helse Sør-Østs tjenesteutsetting er jo sørgelig nok et +unntak og toppen av isfjellet, desverre. Tror jeg fortsatt takker nei +til både AutoPASS og holder meg så langt unna det norske helsevesenet +som jeg kan, inntil de har demonstrert og dokumentert at de verdsetter +individets privatsfære og personlige integritet høyere enn kortsiktig +gevist og samfunnsnytte.

- Tags: debian, english. + Tags: norsk, personvern, sikkerhet.
@@ -196,64 +206,66 @@ include a testsuite check.

- -
22nd November 2013
-

I fjor sommer lagde jeg en -offentlig -tilgjengelig SQL-database over offentlig anbud basert på skraping -av HTML-data fra Doffin. Den har stått og gått siden da, og har nå -ca. 28000 oppføringer. Jeg oppdaget da jeg tittet innom at noen -oppføringer var ikke blitt med, antagelig på grunn av at de fikk -tildelt sekvensnummer i Doffin en godt stund før de ble publisert, -slik at min nettsideskraper som fortsatte skrapingen der den slapp -sist ikke fikk dem med seg. Jeg har fikset litt slik at skraperen nå -ser litt tilbake i tid for å se om den har gått glipp av noen -oppføringer, og har skrapet på nytt fra midten av september 2013 og -fremover. Det bør dermed bli en mer komplett database for kommende -måneder. Hvis jeg får tid skal jeg forsøke å skrape "glemte" data fra -før midten av september 2013, men tør ikke garantere at det blir -prioritert med det første.

- -

Men målet med denne bloggposten er å vise hvordan denne -Doffin-databasen kan brukes og integreres med en RSS-leser, slik at en -kan la datamaskinen holde et øye med Doffin-annonseringer etter -nøkkelord. En kan lage sitt eget søk ved å besøke -API-et -hos Scraperwiki, velge format rss2 og så legge inn noe ala dette i -"query in SQL":

- -

-select title, scrapedurl as link, abstract as description,
-       publishdate as pubDate from 'swdata'
-   where abstract like '%linux%' or title like '%linux%'
-   order by seq desc limit 20
-

- -

Dette vil søke opp alle anbud med ordet linux i oppsummering eller -tittel. En kan lage mer avanserte søk hvis en ønsker det. URL-en som -dukker opp nederst på siden kan en så gi til sin RSS-leser (jeg bruker -akregator selv), og så automatisk få beskjed hvis det dukker opp anbud -med det aktuelle nøkkelordet i teksten. Merk at kapasiteten og -ytelsen hos Scraperwiki er begrenset, så ikke be RSS-leseren hente ned -oftere enn en gang hver dag.

- -

Du lurer kanskje på hva slags informasjon en kan få ut fra denne -databasen. Her er to RSS-kilder, med søkeordet -"linux", -søkeordet -"fri -programvare" -og søkeordet -"odf". -Det er bare å søke på det en er interessert i. Kopier gjerne -datasettet og sett opp din egen tjeneste hvis du vil gjøre mer -avanserte søk. SQLite-filen med Doffin-oppføringer kan lastes med fra -Scraperwiki for de som vil grave dypere.

+ +
12th June 2017
+

It is pleasing to see that the work we put down in publishing new +editions of the classic Free +Culture book by the founder of the Creative Commons movement, +Lawrence Lessig, is still being appreciated. I had a look at the +latest sales numbers for the paper edition today. Not too impressive, +but happy to see some buyers still exist. All the revenue from the +books is sent to the Creative +Commons Corporation, and they receive the largest cut if you buy +directly from Lulu. Most books are sold via Amazon, with Ingram +second and only a small fraction directly from Lulu. The ebook +edition is available for free from +Github.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Title / languageQuantity
2016 jan-jun2016 jul-dec2017 jan-may
Culture Libre / French3615
Fri kultur / Norwegian710
Free Culture / English142716
Total243431
+ +

A bit sad to see the low sales number on the Norwegian edition, and +a bit surprising the English edition still selling so well.

+ +

If you would like to translate and publish the book in your native +language, I would be happy to help make it happen. Please get in +touch.

@@ -261,56 +273,59 @@ Scraperwiki for de som vil grave dypere.

- -
21st November 2013
-

Drones, flying robots, are getting more and more popular. The most -know ones are the killer drones used by some government to murder -people they do not like without giving them the chance of a fair -trial, but the technology have many good uses too, from mapping and -forest maintenance to photography and search and rescue. I am sure it -is just a question of time before "bad drones" are in the hands of -private enterprises and not only state criminals but petty criminals -too. The drone technology is very useful and very dangerous. To have -some control over the use of drones, I agree with Daniel Suarez in his -TED talk -"The kill -decision shouldn't belong to a robot", where he suggested this -little gem to keep the good while limiting the bad use of drones:

- -
+ +
10th June 2017
+

I am very happy to report that the +Nikita Noark 5 +core project tagged its second release today. The free software +solution is an implementation of the Norwegian archive standard Noark +5 used by government offices in Norway. These were the changes in +version 0.1.1 since version 0.1.0 (from NEWS.md): -

Each robot and drone should have a cryptographically signed -I.D. burned in at the factory that can be used to track its movement -through public spaces. We have license plates on cars, tail numbers on -aircraft. This is no different. And every citizen should be able to -download an app that shows the population of drones and autonomous -vehicles moving through public spaces around them, both right now and -historically. And civic leaders should deploy sensors and civic drones -to detect rogue drones, and instead of sending killer drones of their -own up to shoot them down, they should notify humans to their -presence. And in certain very high-security areas, perhaps civic -drones would snare them and drag them off to a bomb disposal facility.

- -

But notice, this is more an immune system than a weapons system. It -would allow us to avail ourselves of the use of autonomous vehicles -and drones while still preserving our open, civil society.

+
    -
+
  • Continued work on the angularjs GUI, including document upload.
  • +
  • Implemented correspondencepartPerson, correspondencepartUnit and + correspondencepartInternal
  • +
  • Applied for coverity coverage and started submitting code on + regualr basis.
  • +
  • Started fixing bugs reported by coverity
  • +
  • Corrected and completed HATEOAS links to make sure entire API is + available via URLs in _links.
  • +
  • Corrected all relation URLs to use trailing slash.
  • +
  • Add initial support for storing data in ElasticSearch.
  • +
  • Now able to receive and store uploaded files in the archive.
  • +
  • Changed JSON output for object lists to have relations in _links.
  • +
  • Improve JSON output for empty object lists.
  • +
  • Now uses correct MIME type application/vnd.noark5-v4+json.
  • +
  • Added support for docker container images.
  • +
  • Added simple API browser implemented in JavaScript/Angular.
  • +
  • Started on archive client implemented in JavaScript/Angular.
  • +
  • Started on prototype to show the public mail journal.
  • +
  • Improved performance by disabling Sprint FileWatcher.
  • +
  • Added support for 'arkivskaper', 'saksmappe' and 'journalpost'.
  • +
  • Added support for some metadata codelists.
  • +
  • Added support for Cross-origin resource sharing (CORS).
  • +
  • Changed login method from Basic Auth to JSON Web Token (RFC 7519) + style.
  • +
  • Added support for GET-ing ny-* URLs.
  • +
  • Added support for modifying entities using PUT and eTag.
  • +
  • Added support for returning XML output on request.
  • +
  • Removed support for English field and class names, limiting ourself + to the official names.
  • +
  • ...
  • + + -

    The key is that every citizen should be able to read the -radio beacons sent from the drones in the area, to be able to check -both the government and others use of drones. For such control to be -effective, everyone must be able to do it. What should such beacon -contain? At least formal owner, purpose, contact information and GPS -location. Probably also the origin and target position of the current -flight. And perhaps some registration number to be able to look up -the drone in a central database tracking their movement. Robots -should not have privacy. It is people who need privacy.

    +

    If this sound interesting to you, please contact us on IRC (#nikita +on irc.freenode.net) or email +(nikita-noark +mailing list).

    @@ -318,26 +333,99 @@ should not have privacy. It is people who need privacy.

    - -
    13th November 2013
    -

    Today NUUG and Hackeriet announced -our -plans to join forces and create a wireless community network in -Oslo. The workshop to help people get started will take place -Thursday 2013-11-28, but we already are collecting the geolocation of -people joining forces to make this happen. We have -9 -locations plotted on the map, but we will need more before we have -a connected mesh spread across Oslo. If this sound interesting to -you, please join us at the workshop. If you are too impatient to wait -15 days, please join us on the IRC channel -#nuug on irc.freenode.net -right away. :)

    + +
    7th June 2017
    +

    This is a copy of +an +email I posted to the nikita-noark mailing list. Please follow up +there if you would like to discuss this topic. The background is that +we are making a free software archive system based on the Norwegian +Noark +5 standard for government archives.

    + +

    I've been wondering a bit lately how trusted timestamps could be +stored in Noark 5. +Trusted +timestamps can be used to verify that some information +(document/file/checksum/metadata) have not been changed since a +specific time in the past. This is useful to verify the integrity of +the documents in the archive.

    + +

    Then it occured to me, perhaps the trusted timestamps could be +stored as dokument variants (ie dokumentobjekt referered to from +dokumentbeskrivelse) with the filename set to the hash it is +stamping?

    + +

    Given a "dokumentbeskrivelse" with an associated "dokumentobjekt", +a new dokumentobjekt is associated with "dokumentbeskrivelse" with the +same attributes as the stamped dokumentobjekt except these +attributes:

    + +
      + +
    • format -> "RFC3161" +
    • mimeType -> "application/timestamp-reply" +
    • formatDetaljer -> "<source URL for timestamp service>" +
    • filenavn -> "<sjekksum>.tsr" + +
    + +

    This assume a service following +IETF RFC 3161 is +used, which specifiy the given MIME type for replies and the .tsr file +ending for the content of such trusted timestamp. As far as I can +tell from the Noark 5 specifications, it is OK to have several +variants/renderings of a dokument attached to a given +dokumentbeskrivelse objekt. It might be stretching it a bit to make +some of these variants represent crypto-signatures useful for +verifying the document integrity instead of representing the dokument +itself.

    + +

    Using the source of the service in formatDetaljer allow several +timestamping services to be used. This is useful to spread the risk +of key compromise over several organisations. It would only be a +problem to trust the timestamps if all of the organisations are +compromised.

    + +

    The following oneliner on Linux can be used to generate the tsr +file. $input is the path to the file to checksum, and $sha256 is the +SHA-256 checksum of the file (ie the ".tsr" value mentioned +above).

    + +

    +openssl ts -query -data "$inputfile" -cert -sha256 -no_nonce \
    +  | curl -s -H "Content-Type: application/timestamp-query" \
    +      --data-binary "@-" http://zeitstempel.dfn.de > $sha256.tsr
    +

    + +

    To verify the timestamp, you first need to download the public key +of the trusted timestamp service, for example using this command:

    + +

    +wget -O ca-cert.txt \
    +  https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt
    +

    + +

    Note, the public key should be stored alongside the timestamps in +the archive to make sure it is also available 100 years from now. It +is probably a good idea to standardise how and were to store such +public keys, to make it easier to find for those trying to verify +documents 100 or 1000 years from now. :)

    + +

    The verification itself is a simple openssl command:

    + +

    +openssl ts -verify -data $inputfile -in $sha256.tsr \
    +  -CAfile ca-cert.txt -text
    +

    + +

    Is there any reason this approach would not work? Is it somehow against +the Noark 5 specification?

    @@ -345,131 +433,61 @@ right away. :)

    - -
    10th November 2013
    -

    Continuing my research into mesh networking, I was recommended to -use TP-Link 3040 and 3600 access points as mesh nodes, and the pair I -bought arrived on Friday. Here are my notes on how to set up the -MR3040 as a mesh node using -OpenWrt.

    - -

    I started by following the instructions on the OpenWRT wiki for -TL-MR3040, -and downloaded -the -recommended firmware image -(openwrt-ar71xx-generic-tl-mr3040-v2-squashfs-factory.bin) and -uploaded it into the original web interface. The flashing went fine, -and the machine was available via telnet on the ethernet port. After -logging in and setting the root password, ssh was available and I -could start to set it up as a batman-adv mesh node.

    - -

    I started off by reading the instructions from -Wireless -Africa, which had quite a lot of useful information, but -eventually I followed the recipe from the Open Mesh wiki for -using -batman-adv on OpenWrt. A small snag was the fact that the -opkg install kmod-batman-adv command did not work as it -should. The batman-adv kernel module would fail to load because its -dependency crc16 was not already loaded. I -reported the bug to -the openwrt project and hope it will be fixed soon. But the problem -only seem to affect initial testing of batman-adv, as configuration -seem to work when booting from scratch.

    - -

    The setup is done using files in /etc/config/. I did not bridge -the Ethernet and mesh interfaces this time, to be able to hook up the -box on my local network and log into it for configuration updates. -The following files were changed and look like this after modifying -them:

    - -

    /etc/config/network

    - -
    -
    -config interface 'loopback'
    -        option ifname 'lo'
    -        option proto 'static'
    -        option ipaddr '127.0.0.1'
    -        option netmask '255.0.0.0'
    -
    -config globals 'globals'
    -        option ula_prefix 'fdbf:4c12:3fed::/48'
    -
    -config interface 'lan'
    -        option ifname 'eth0'
    -        option type 'bridge'
    -        option proto 'dhcp'
    -        option ipaddr '192.168.1.1'
    -        option netmask '255.255.255.0'
    -        option hostname 'tl-mr3040'
    -        option ip6assign '60'
    -
    -config interface 'mesh'
    -        option ifname 'adhoc0'
    -        option mtu '1528'
    -        option proto 'batadv'
    -        option mesh 'bat0'
    -
    - -

    /etc/config/wireless

    -
    -
    -config wifi-device 'radio0'
    -        option type 'mac80211'
    -        option channel '11'
    -        option hwmode '11ng'
    -        option path 'platform/ar933x_wmac'
    -        option htmode 'HT20'
    -        list ht_capab 'SHORT-GI-20'
    -        list ht_capab 'SHORT-GI-40'
    -        list ht_capab 'RX-STBC1'
    -        list ht_capab 'DSSS_CCK-40'
    -        option disabled '0'
    -
    -config wifi-iface 'wmesh'
    -        option device 'radio0'
    -        option ifname 'adhoc0'
    -        option network 'mesh'
    -        option encryption 'none'
    -        option mode 'adhoc'
    -        option bssid '02:BA:00:00:00:01'
    -        option ssid 'meshfx@hackeriet'
    -
    -

    /etc/config/batman-adv

    -
    -
    -config 'mesh' 'bat0'
    -        option interfaces 'adhoc0'
    -        option 'aggregated_ogms'
    -        option 'ap_isolation'
    -        option 'bonding'
    -        option 'fragmentation'
    -        option 'gw_bandwidth'
    -        option 'gw_mode'
    -        option 'gw_sel_class'
    -        option 'log_level'
    -        option 'orig_interval'
    -        option 'vis_mode'
    -        option 'bridge_loop_avoidance'
    -        option 'distributed_arp_table'
    -        option 'network_coding'
    -        option 'hop_penalty'
    -
    -# yet another batX instance
    -# config 'mesh' 'bat5'
    -#       option 'interfaces' 'second_mesh'
    -
    - -

    The mesh node is now operational. I have yet to test its range, -but I hope it is good. I have not yet tested the TP-Link 3600 box -still wrapped up in plastic.

    + +
    3rd June 2017
    +

    Aftenposten +melder i dag om feil i eksamensoppgavene for eksamen i politikk og +menneskerettigheter, der teksten i bokmåls og nynorskutgaven ikke var +like. Oppgaveteksten er gjengitt i artikkelen, og jeg ble nysgjerring +på om den fri oversetterløsningen +Apertium ville gjort en bedre +jobb enn Utdanningsdirektoratet. Det kan se slik ut.

    + +

    Her er bokmålsoppgaven fra eksamenen:

    + +
    +

    Drøft utfordringene knyttet til nasjonalstatenes og andre aktørers +rolle og muligheter til å håndtere internasjonale utfordringer, som +for eksempel flykningekrisen.

    + +

    Vedlegge er eksempler på tekster som kan gi relevante perspektiver +på temaet:

    +
      +
    1. Flykningeregnskapet 2016, UNHCR og IDMC +
    2. «Grenseløst Europa for fall» A-Magasinet, 26. november 2015 +
    + +
    + +

    Dette oversetter Apertium slik:

    + +
    +

    Drøft utfordringane knytte til nasjonalstatane sine og rolla til +andre aktørar og høve til å handtera internasjonale utfordringar, som +til dømes *flykningekrisen.

    + +

    Vedleggja er døme på tekster som kan gje relevante perspektiv på +temaet:

    + +
      +
    1. *Flykningeregnskapet 2016, *UNHCR og *IDMC
    2. +
    3. «*Grenseløst Europa for fall» A-Magasinet, 26. november 2015
    4. +
    + +
    + +

    Ord som ikke ble forstått er markert med stjerne (*), og trenger +ekstra språksjekk. Men ingen ord er forsvunnet, slik det var i +oppgaven elevene fikk presentert på eksamen. Jeg mistenker dog at +"andre aktørers rolle og muligheter til ..." burde vært oversatt til +"rolla til andre aktørar og deira høve til ..." eller noe slikt, men +det er kanskje flisespikking. Det understreker vel bare at det alltid +trengs korrekturlesning etter automatisk oversettelse.

    @@ -477,204 +495,67 @@ still wrapped up in plastic.

    - -
    2nd November 2013
    -

    If one of the points of switching to a new init system in Debian is -to get rid of huge -init.d scripts, I doubt we need to switch away from sysvinit and -init.d scripts at all. Here is an example init.d script, ie a rewrite -of /etc/init.d/rsyslog:

    - -

    -#!/lib/init/init-d-script
    -### BEGIN INIT INFO
    -# Provides:          rsyslog
    -# Required-Start:    $remote_fs $time
    -# Required-Stop:     umountnfs $time
    -# X-Stop-After:      sendsigs
    -# Default-Start:     2 3 4 5
    -# Default-Stop:      0 1 6
    -# Short-Description: enhanced syslogd
    -# Description:       Rsyslog is an enhanced multi-threaded syslogd.
    -#                    It is quite compatible to stock sysklogd and can be 
    -#                    used as a drop-in replacement.
    -### END INIT INFO
    -DESC="enhanced syslogd"
    -DAEMON=/usr/sbin/rsyslogd
    -

    - -

    Pretty minimalistic to me... For the record, the original sysv-rc -script was 137 lines, and the above is just 15 lines, most of it meta -info/comments.

    - -

    How to do this, you ask? Well, one create a new script -/lib/init/init-d-script looking something like this: - -

    -#!/bin/sh
    -
    -# Define LSB log_* functions.
    -# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
    -# and status_of_proc is working.
    -. /lib/lsb/init-functions
    -
    -#
    -# Function that starts the daemon/service
    -
    -#
    -do_start()
    -{
    -	# Return
    -	#   0 if daemon has been started
    -	#   1 if daemon was already running
    -	#   2 if daemon could not be started
    -	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
    -		|| return 1
    -	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
    -		$DAEMON_ARGS \
    -		|| return 2
    -	# Add code here, if necessary, that waits for the process to be ready
    -	# to handle requests from services started subsequently which depend
    -	# on this one.  As a last resort, sleep for some time.
    -}
    -
    -#
    -# Function that stops the daemon/service
    -#
    -do_stop()
    -{
    -	# Return
    -	#   0 if daemon has been stopped
    -	#   1 if daemon was already stopped
    -	#   2 if daemon could not be stopped
    -	#   other if a failure occurred
    -	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
    -	RETVAL="$?"
    -	[ "$RETVAL" = 2 ] && return 2
    -	# Wait for children to finish too if this is a daemon that forks
    -	# and if the daemon is only ever run from this initscript.
    -	# If the above conditions are not satisfied then add some other code
    -	# that waits for the process to drop all resources that could be
    -	# needed by services started subsequently.  A last resort is to
    -	# sleep for some time.
    -	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
    -	[ "$?" = 2 ] && return 2
    -	# Many daemons don't delete their pidfiles when they exit.
    -	rm -f $PIDFILE
    -	return "$RETVAL"
    -}
    -
    -#
    -# Function that sends a SIGHUP to the daemon/service
    -#
    -do_reload() {
    -	#
    -	# If the daemon can reload its configuration without
    -	# restarting (for example, when it is sent a SIGHUP),
    -	# then implement that here.
    -	#
    -	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
    -	return 0
    -}
    -
    -SCRIPTNAME=$1
    -scriptbasename="$(basename $1)"
    -echo "SN: $scriptbasename"
    -if [ "$scriptbasename" != "init-d-library" ] ; then
    -    script="$1"
    -    shift
    -    . $script
    -else
    -    exit 0
    -fi
    -
    -NAME=$(basename $DAEMON)
    -PIDFILE=/var/run/$NAME.pid
    -
    -# Exit if the package is not installed
    -#[ -x "$DAEMON" ] || exit 0
    -
    -# Read configuration variable file if it is present
    -[ -r /etc/default/$NAME ] && . /etc/default/$NAME
    -
    -# Load the VERBOSE setting and other rcS variables
    -. /lib/init/vars.sh
    -
    -case "$1" in
    -  start)
    -	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
    -	do_start
    -	case "$?" in
    -		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
    -		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
    -	esac
    -	;;
    -  stop)
    -	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
    -	do_stop
    -	case "$?" in
    -		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
    -		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
    -	esac
    -	;;
    -  status)
    -	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
    -	;;
    -  #reload|force-reload)
    -	#
    -	# If do_reload() is not implemented then leave this commented out
    -	# and leave 'force-reload' as an alias for 'restart'.
    -	#
    -	#log_daemon_msg "Reloading $DESC" "$NAME"
    -	#do_reload
    -	#log_end_msg $?
    -	#;;
    -  restart|force-reload)
    -	#
    -	# If the "reload" option is implemented then remove the
    -	# 'force-reload' alias
    -	#
    -	log_daemon_msg "Restarting $DESC" "$NAME"
    -	do_stop
    -	case "$?" in
    -	  0|1)
    -		do_start
    -		case "$?" in
    -			0) log_end_msg 0 ;;
    -			1) log_end_msg 1 ;; # Old process is still running
    -			*) log_end_msg 1 ;; # Failed to start
    -		esac
    -		;;
    -	  *)
    -		# Failed to stop
    -		log_end_msg 1
    -		;;
    -	esac
    -	;;
    -  *)
    -	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
    -	exit 3
    -	;;
    -esac
    -
    -:
    -

    - -

    It is based on /etc/init.d/skeleton, and could be improved quite a -lot. I did not really polish the approach, so it might not always -work out of the box, but you get the idea. I did not try very hard to -optimize it nor make it more robust either.

    - -

    A better argument for switching init system in Debian than reducing -the size of init scripts (which is a good thing to do anyway), is to -get boot system that is able to handle the kernel events sensibly and -robustly, and do not depend on the boot to run sequentially. The boot -and the kernel have not behaved sequentially in years.

    + +
    27th April 2017
    +

    I disse dager, med frist 1. mai, har Riksarkivaren ute en høring på +sin forskrift. Som en kan se er det ikke mye tid igjen før fristen +som går ut på søndag. Denne forskriften er det som lister opp hvilke +formater det er greit å arkivere i +Noark +5-løsninger i Norge.

    + +

    Jeg fant høringsdokumentene hos +Norsk +Arkivråd etter å ha blitt tipset på epostlisten til +fri +programvareprosjektet Nikita Noark5-Core, som lager et Noark 5 +Tjenestegresesnitt. Jeg er involvert i Nikita-prosjektet og takket +være min interesse for tjenestegrensesnittsprosjektet har jeg lest en +god del Noark 5-relaterte dokumenter, og til min overraskelse oppdaget +at standard epost ikke er på listen over godkjente formater som kan +arkiveres. Høringen med frist søndag er en glimrende mulighet til å +forsøke å gjøre noe med det. Jeg holder på med +egen +høringsuttalelse, og lurer på om andre er interessert i å støtte +forslaget om å tillate arkivering av epost som epost i arkivet.

    + +

    Er du igang med å skrive egen høringsuttalelse allerede? I så fall +kan du jo vurdere å ta med en formulering om epost-lagring. Jeg tror +ikke det trengs så mye. Her et kort forslag til tekst:

    + +

    + +

    Viser til høring sendt ut 2017-02-17 (Riksarkivarens referanse + 2016/9840 HELHJO), og tillater oss å sende inn noen innspill om + revisjon av Forskrift om utfyllende tekniske og arkivfaglige + bestemmelser om behandling av offentlige arkiver (Riksarkivarens + forskrift).

    + +

    Svært mye av vår kommuikasjon foregår i dag på e-post.  Vi + foreslår derfor at Internett-e-post, slik det er beskrevet i IETF + RFC 5322, + https://tools.ietf.org/html/rfc5322. bør + inn som godkjent dokumentformat.  Vi foreslår at forskriftens + oversikt over godkjente dokumentformater ved innlevering i § 5-16 + endres til å ta med Internett-e-post.

    + +

    + +

    Som del av arbeidet med tjenestegrensesnitt har vi testet hvordan +epost kan lagres i en Noark 5-struktur, og holder på å skrive et +forslag om hvordan dette kan gjøres som vil bli sendt over til +arkivverket så snart det er ferdig. De som er interesserte kan +følge +fremdriften på web.

    + +

    Oppdatering 2017-04-28: I dag ble høringuttalelsen jeg skrev + sendt + inn av foreningen NUUG.

    @@ -682,28 +563,52 @@ and the kernel have not behaved sequentially in years.

    - -
    1st November 2013
    -

    The SPICE protocol for -remote display access is the preferred solution with oVirt and RedHat -Enterprise Virtualization, and I was sad to discover the other day -that the browser plugin needed to use these systems seamlessly was -missing in Debian. The request -for a package was from 2012-04-10 with no progress since -2013-04-01, so I decided to wrap up a package based on the great work -from Cajus Pollmeier and put it in a collab-maint maintained git -repository to get a package I could use. I would very much like -others to help me maintain the package (or just take over, I do not -mind), but as no-one had volunteered so far, I just uploaded it to -NEW. I hope it will be available in Debian in a few days.

    - -

    The source is now available from -http://anonscm.debian.org/gitweb/?p=collab-maint/spice-xpi.git;a=summary.

    + +
    20th April 2017
    +

    Jeg oppdaget i dag at nettstedet som +publiserer offentlige postjournaler fra statlige etater, OEP, har +begynt å blokkerer enkelte typer webklienter fra å få tilgang. Vet +ikke hvor mange det gjelder, men det gjelder i hvert fall libwww-perl +og curl. For å teste selv, kjør følgende:

    + +
    +% curl -v -s https://www.oep.no/pub/report.xhtml?reportId=3 2>&1 |grep '< HTTP'
    +< HTTP/1.1 404 Not Found
    +% curl -v -s --header 'User-Agent:Opera/12.0' https://www.oep.no/pub/report.xhtml?reportId=3 2>&1 |grep '< HTTP'
    +< HTTP/1.1 200 OK
    +%
    +
    + +

    Her kan en se at tjenesten gir «404 Not Found» for curl i +standardoppsettet, mens den gir «200 OK» hvis curl hevder å være Opera +versjon 12.0. Offentlig elektronisk postjournal startet blokkeringen +2017-03-02.

    + +

    Blokkeringen vil gjøre det litt vanskeligere å maskinelt hente +informasjon fra oep.no. Kan blokkeringen være gjort for å hindre +automatisert innsamling av informasjon fra OEP, slik Pressens +Offentlighetsutvalg gjorde for å dokumentere hvordan departementene +hindrer innsyn i +rapporten +«Slik hindrer departementer innsyn» som ble publiserte i januar +2017. Det virker usannsynlig, da det jo er trivielt å bytte +User-Agent til noe nytt.

    + +

    Finnes det juridisk grunnlag for det offentlige å diskriminere +webklienter slik det gjøres her? Der tilgang gis eller ikke alt etter +hva klienten sier at den heter? Da OEP eies av DIFI og driftes av +Basefarm, finnes det kanskje noen dokumenter sendt mellom disse to +aktørene man kan be om innsyn i for å forstå hva som har skjedd. Men +postjournalen +til DIFI viser kun to dokumenter det siste året mellom DIFI og +Basefarm. +Mimes brønn neste, +tenker jeg.

    - Tags: debian, english. + Tags: norsk, offentlig innsyn.
    @@ -711,120 +616,101 @@ NEW. I hope it will be available in Debian in a few days.

    - -
    27th October 2013
    -

    The -vmdebootstrap -program is a a very nice system to create virtual machine images. It -create a image file, add a partition table, mount it and run -debootstrap in the mounted directory to create a Debian system on a -stick. Yesterday, I decided to try to teach it how to make images for -Raspberry Pi, as part -of a plan to simplify the build system for -the FreedomBox -project. The FreedomBox project already uses vmdebootstrap for -the virtualbox images, but its current build system made multistrap -based system for Dreamplug images, and it is lacking support for -Raspberry Pi.

    - -

    Armed with the knowledge on how to build "foreign" (aka non-native -architecture) chroots for Raspberry Pi, I dived into the vmdebootstrap -code and adjusted it to be able to build armel images on my amd64 -Debian laptop. I ended up giving vmdebootstrap five new options, -allowing me to replicate the image creation process I use to make -Debian -Jessie based mesh node images for the Raspberry Pi. First, the ---foreign /path/to/binfm_handler option tell vmdebootstrap to -call debootstrap with --foreign and to copy the handler into the -generated chroot before running the second stage. This allow -vmdebootstrap to create armel images on an amd64 host. Next I added -two new options --bootsize size and --boottype -fstype to teach it to create a separate /boot/ partition with the -given file system type, allowing me to create an image with a vfat -partition for the /boot/ stuff. I also added a --variant -variant option to allow me to create smaller images without the -Debian base system packages installed. Finally, I added an option ---no-extlinux to tell vmdebootstrap to not install extlinux -as a boot loader. It is not needed on the Raspberry Pi and probably -most other non-x86 architectures. The changes were accepted by the -upstream author of vmdebootstrap yesterday and today, and is now -available from -the -upstream project page.

    - -

    To use it to build a Raspberry Pi image using Debian Jessie, first -create a small script (the customize script) to add the non-free -binary blob needed to boot the Raspberry Pi and the APT source -list:

    - -

    -#!/bin/sh
    -set -e # Exit on first error
    -rootdir="$1"
    -cd "$rootdir"
    -cat <<EOF > etc/apt/sources.list
    -deb http://http.debian.net/debian/ jessie main contrib non-free
    -EOF
    -# Install non-free binary blob needed to boot Raspberry Pi.  This
    -# install a kernel somewhere too.
    -wget https://raw.github.com/Hexxeh/rpi-update/master/rpi-update \
    -    -O $rootdir/usr/bin/rpi-update
    -chmod a+x $rootdir/usr/bin/rpi-update
    -mkdir -p $rootdir/lib/modules
    -touch $rootdir/boot/start.elf
    -chroot $rootdir rpi-update
    -

    - -

    Next, fetch the latest vmdebootstrap script and call it like this -to build the image:

    - -
    -sudo ./vmdebootstrap \
    -    --variant minbase \
    -    --arch armel \
    -    --distribution jessie \
    -    --mirror http://http.debian.net/debian \
    -    --image test.img \
    -    --size 600M \
    -    --bootsize 64M \
    -    --boottype vfat \
    -    --log-level debug \
    -    --verbose \
    -    --no-kernel \
    -    --no-extlinux \
    -    --root-password raspberry \
    -    --hostname raspberrypi \
    -    --foreign /usr/bin/qemu-arm-static \
    -    --customize `pwd`/customize \
    -    --package netbase \
    -    --package git-core \
    -    --package binutils \
    -    --package ca-certificates \
    -    --package wget \
    -    --package kmod
    -

    - -

    The list of packages being installed are the ones needed by -rpi-update to make the image bootable on the Raspberry Pi, with the -exception of netbase, which is needed by debootstrap to find -/etc/hosts with the minbase variant. I really wish there was a way to -set up an Raspberry Pi using only packages in the Debian archive, but -that is not possible as far as I know, because it boots from the GPU -using a non-free binary blob.

    - -

    The build host need debootstrap, kpartx and qemu-user-static and -probably a few others installed. I have not checked the complete -build dependency list.

    - -

    The resulting image will not use the hardware floating point unit -on the Raspberry PI, because the armel architecture in Debian is not -optimized for that use. So the images created will be a bit slower -than Raspbian based images.

    + +
    19th March 2017
    +

    The Nikita +Noark 5 core project is implementing the Norwegian standard for +keeping an electronic archive of government documents. +The +Noark 5 standard document the requirement for data systems used by +the archives in the Norwegian government, and the Noark 5 web interface +specification document a REST web service for storing, searching and +retrieving documents and metadata in such archive. I've been involved +in the project since a few weeks before Christmas, when the Norwegian +Unix User Group +announced +it supported the project. I believe this is an important project, +and hope it can make it possible for the government archives in the +future to use free software to keep the archives we citizens depend +on. But as I do not hold such archive myself, personally my first use +case is to store and analyse public mail journal metadata published +from the government. I find it useful to have a clear use case in +mind when developing, to make sure the system scratches one of my +itches.

    + +

    If you would like to help make sure there is a free software +alternatives for the archives, please join our IRC channel +(#nikita on +irc.freenode.net) and +the +project mailing list.

    + +

    When I got involved, the web service could store metadata about +documents. But a few weeks ago, a new milestone was reached when it +became possible to store full text documents too. Yesterday, I +completed an implementation of a command line tool +archive-pdf to upload a PDF file to the archive using this +API. The tool is very simple at the moment, and find existing +fonds, series and +files while asking the user to select which one to use if more than +one exist. Once a file is identified, the PDF is associated with the +file and uploaded, using the title extracted from the PDF itself. The +process is fairly similar to visiting the archive, opening a cabinet, +locating a file and storing a piece of paper in the archive. Here is +a test run directly after populating the database with test data using +our API tester:

    + +

    +~/src//noark5-tester$ ./archive-pdf mangelmelding/mangler.pdf
    +using arkiv: Title of the test fonds created 2017-03-18T23:49:32.103446
    +using arkivdel: Title of the test series created 2017-03-18T23:49:32.103446
    +
    + 0 - Title of the test case file created 2017-03-18T23:49:32.103446
    + 1 - Title of the test file created 2017-03-18T23:49:32.103446
    +Select which mappe you want (or search term): 0
    +Uploading mangelmelding/mangler.pdf
    +  PDF title: Mangler i spesifikasjonsdokumentet for NOARK 5 Tjenestegrensesnitt
    +  File 2017/1: Title of the test case file created 2017-03-18T23:49:32.103446
    +~/src//noark5-tester$
    +

    + +

    You can see here how the fonds (arkiv) and serie (arkivdel) only had +one option, while the user need to choose which file (mappe) to use +among the two created by the API tester. The archive-pdf +tool can be found in the git repository for the API tester.

    + +

    In the project, I have been mostly working on +the API +tester so far, while getting to know the code base. The API +tester currently use +the HATEOAS links +to traverse the entire exposed service API and verify that the exposed +operations and objects match the specification, as well as trying to +create objects holding metadata and uploading a simple XML file to +store. The tester has proved very useful for finding flaws in our +implementation, as well as flaws in the reference site and the +specification.

    + +

    The test document I uploaded is a summary of all the specification +defects we have collected so far while implementing the web service. +There are several unclear and conflicting parts of the specification, +and we have +started +writing down the questions we get from implementing it. We use a +format inspired by how The +Austin Group collect defect reports for the POSIX standard with +their +instructions for the MANTIS defect tracker system, in lack of an official way to structure defect reports for Noark 5 (our first submitted defect report was a request for a procedure for submitting defect reports :). + +

    The Nikita project is implemented using Java and Spring, and is +fairly easy to get up and running using Docker containers for those +that want to test the current code base. The API tester is +implemented in Python.

    @@ -839,6 +725,112 @@ than Raspbian based images.

    Archive