X-Git-Url: http://pere.pagekite.me/gitweb/homepage.git/blobdiff_plain/e8aade9fc124dbd020313b34cb60f34b9059e48f..2d047348b0dfe1d3bab7955e9bf9b52223e84373:/blog/index.html?ds=sidebyside diff --git a/blog/index.html b/blog/index.html index 2f64d45d58..7ee76c94b8 100644 --- a/blog/index.html +++ b/blog/index.html @@ -20,44 +20,96 @@
-
Dugnadsnett for alle stiller på Oslo Maker Faire i januar 2014
-
10th December 2013
-

Helga 18. og 19. januar 2014 arrangeres -Oslo Maker -Faire, og Dugnadsnett for -alle har fått plass! Planen er å ha et bord med en plakat der vi -forteller om hva Dugnadsnett for alle er for noe, og et lite verksted -der vi hjelper folk som er interessert i å få opp sin egen mesh-node. -Jeg gleder meg til å se hvordan prosjektet blir mottatt der.

- -

Målet med dugnadsnett for alle i Oslo er å få på plass et datanett -for kommunikasjon ved hjelp av radio-repeaterstasjoner (kalt -mesh-noder) som gjør at en kan direkte kommunisere med slekt, venner -og bekjente i Oslo via andre som deltar i dugnadsnettet, samt gjøre -det mulig komme ut på internett via dugnadsnettet. Første delmål er å -kunne sende SMS-meldinger vha. IP-telefoni løsningen -Serval project mellom -deltagerne i Dugnadsnett for alle i Oslo. Formålet er å ta tilbake -kontrollen over egen nett-infrastruktur og gjøre det dyrere å bedrive -massiv innsamling av informasjon om borgernes bruk av datanett.

- -

Høres dette interessant ut? Bli med på prosjektet, fortell oss -hvor du kunne tenke deg å sette opp en radio-repeater (slik at folk i -nærheten kan finne hverandre ved hjelp av -kartet over planlagte og -eksisterende radio-repeatere), bli med på epostlisten -dugnadsnett -(at) nuug.no og stikk innom -IRC-kanalen -#dugnadsnett.no. Så langt er det planlagt over 40 -radio-repeatere, med VPN-forbindelser via Internet for å la de delene -av nettet som ikke når hverandre via radio kunne snakke med hverandre -likevel.

+ +
9th August 2017
+

On friday, I came across an interesting article in the Norwegian +web based ICT news magazine digi.no on +how +to collect the IMSI numbers of nearby cell phones using the cheap +DVB-T software defined radios. The article refered to instructions +and a recipe by +Keld Norman on Youtube on how to make a simple $7 IMSI Catcher, and I decided to test them out.

+ +

The instructions said to use Ubuntu, install pip using apt (to +bypass apt), use pip to install pybombs (to bypass both apt and pip), +and the ask pybombs to fetch and build everything you need from +scratch. I wanted to see if I could do the same on the most recent +Debian packages, but this did not work because pybombs tried to build +stuff that no longer build with the most recent openssl library or +some other version skew problem. While trying to get this recipe +working, I learned that the apt->pip->pybombs route was a long detour, +and the only piece of software dependency missing in Debian was the +gr-gsm package. I also found out that the lead upstream developer of +gr-gsm (the name stand for GNU Radio GSM) project already had a set of +Debian packages provided in an Ubuntu PPA repository. All I needed to +do was to dget the Debian source package and built it.

+ +

The IMSI collector is a python script listening for packages on the +loopback network device and printing to the terminal some specific GSM +packages with IMSI numbers in them. The code is fairly short and easy +to understand. The reason this work is because gr-gsm include a tool +to read GSM data from a software defined radio like a DVB-T USB stick +and other software defined radios, decode them and inject them into a +network device on your Linux machine (using the loopback device by +default). This proved to work just fine, and I've been testing the +collector for a few days now.

+ +

The updated and simpler recipe is thus to

+ +
    + +
  1. start with a Debian machine running Stretch or newer,
  2. + +
  3. build and install the gr-gsm package available from +http://ppa.launchpad.net/ptrkrysik/gr-gsm/ubuntu/pool/main/g/gr-gsm/,
  4. + +
  5. clone the git repostory from https://github.com/Oros42/IMSI-catcher,
  6. + +
  7. run grgsm_livemon and adjust the frequency until the terminal +where it was started is filled with a stream of text (meaning you +found a GSM station).
  8. + +
  9. go into the IMSI-catcher directory and run 'sudo python simple_IMSI-catcher.py' to extract the IMSI numbers.
  10. + +
+ +

To make it even easier in the future to get this sniffer up and +running, I decided to package +the gr-gsm project +for Debian (WNPP +#871055), and the package was uploaded into the NEW queue today. +Luckily the gnuradio maintainer has promised to help me, as I do not +know much about gnuradio stuff yet.

+ +

I doubt this "IMSI cacher" is anywhere near as powerfull as +commercial tools like +The +Spy Phone Portable IMSI / IMEI Catcher or the +Harris +Stingray, but I hope the existance of cheap alternatives can make +more people realise how their whereabouts when carrying a cell phone +is easily tracked. Seeing the data flow on the screen, realizing that +I live close to a police station and knowing that the police is also +wearing cell phones, I wonder how hard it would be for criminals to +track the position of the police officers to discover when there are +police near by, or for foreign military forces to track the location +of the Norwegian military forces, or for anyone to track the location +of government officials...

+ +

It is worth noting that the data reported by the IMSI-catcher +script mentioned above is only a fraction of the data broadcasted on +the GSM network. It will only collect one frequency at the time, +while a typical phone will be using several frequencies, and not all +phones will be using the frequencies tracked by the grgsm_livemod +program. Also, there is a lot of radio chatter being ignored by the +simple_IMSI-catcher script, which would be collected by extending the +parser code. I wonder if gr-gsm can be set up to listen to more than +one frequency?

@@ -65,129 +117,37 @@ likevel.

- -
6th December 2013
-

It has been a while since I managed to publish the last interview, -but the Debian Edu / -Skolelinux community is still going strong, and yesterday we even -had a new school administrator show up on -#debian-edu to share -his success story with installing Debian Edu at their school. This -time I have been able to get some helpful comments from the creator of -Knoppix, Klaus Knopper, who was involved in a Skolelinux project in -Germany a few years ago.

- -

Who are you, and how do you spend your days?

- -

I am Klaus Knopper. I have a master degree in electrical -engineering, and is currently professor in information management at -the university of applied sciences Kaiserslautern / Germany and -freelance Open Source software developer and consultant.

- -

All of this is pretty much of the work I spend my days with. Apart -from teaching, I'm also conducting some more or less experimental -projects like the Knoppix GNU/Linux live -system (Debian-based like Skolelinux), -ADRIANE -(a blind-friendly talking desktop system) and -LINBO -(Linux-based network boot console, a fast remote install and repair -system supporting various operating systems).

- -

How did you get in contact with the Skolelinux / Debian Edu -project?

- -

The credit for this have to go to Kurt Gramlich, who is the German -coordinator for Skolelinux. We were looking for an all-in-one open -source community-supported distribution for schools, and Kurt -introduced us to Skolelinux for this purpose.

- -

What do you see as the advantages of Skolelinux / Debian -Edu?

- -
    -
  • Quick installation,
  • -
  • works (almost) out of the box,
  • -
  • contains many useful software packages for teaching and learning,
  • -
  • is a purely community-based distro and not controlled by a - single company,
  • -
  • has a large number of supporters and teachers who share their - experience and problem solutions.
  • -
- -

What do you see as the disadvantages of Skolelinux / Debian -Edu?

- -
    -
  • Skolelinux is - as we had to learn - not easily upgradable to - the next version. Opposed to its genuine Debian base, upgrading to - a new version means a full new installation from scratch to get it - working again reliably. - -
  • Skolelinux is based on Debian/stable, and therefore always a - little outdated in terms of program versions compared to Edubuntu or - similar educational Linux distros, which rather use Debian/testing - as their base. - -
  • Skolelinux has some very self-opinionated and stubborn default - configuration which in my opinion adds unnecessary complexity and is - not always suitable for a schools needs, the preset network - configuration is actually a core definition feature of Skolelinux - and not easy to change, so schools sometimes have to change their - network configuration to make it "Skolelinux-compatible". - -
  • Some proposed extensions, which were made available as - contribution, like secure examination mode and lecture material - distribution and collection, were not accepted into the mainline - Skolelinux development and are now not easy to maintain in the - future because of Skolelinux somewhat undeterministic update - schemes.
  • - -
  • Skolelinux has only a very tiny number of base developers - compared to Debian.
  • - -
- -

For these reasons and experience from our project, I would now -rather consider using plain Debian for schools next time, until -Skolelinux is more closely integrated into Debian and becomes -upgradeable without reinstallation.

- -

Which free software do you use daily?

- -

GNU/Linux with LXDE desktop, bash for interactive dialog and -programming, texlive for documentation and correspondence, -occasionally LibreOffice for document format conversion. Various -programming languages for teaching.

- -

Which strategy do you believe is the right one to use to -get schools to use free software?

- -

Strong arguments are

- -
    - -
  • Knowledge is free, and so should be methods and tools for - teaching and learning.
  • - -
  • Students can learn with and use the same software at school, at - home, and at their working place without running into license or - conversion problems.
  • - -
  • Closed source or proprietary software hides knowledge rather - than exposing it, and proprietary software vendors try to bind - customers to certain products. But teachers need to teach - science, not products.
  • - -
  • If you have everything you for daily work as open source, what - would you need proprietary software for?
  • - -
+ +
25th July 2017
+

+ +

I finally received a copy of the Norwegian Bokmål edition of +"The Debian Administrator's +Handbook". This test copy arrived in the mail a few days ago, and +I am very happy to hold the result in my hand. We spent around one and a half year translating it. This paperbook edition +is available +from lulu.com. If you buy it quickly, you save 25% on the list +price. The book is also available for download in electronic form as +PDF, EPUB and Mobipocket, as can be +read online +as a web page.

+ +

This is the second book I publish (the first was the book +"Free Culture" by Lawrence Lessig +in +English, +French +and +Norwegian +Bokmål), and I am very excited to finally wrap up this +project. I hope +"Håndbok +for Debian-administratoren" will be well received.

@@ -195,33 +155,50 @@ get schools to use free software?

- -
30th November 2013
-

If you want the ability to electronically communicate directly with -your neighbors and friends using a network controlled by your peers in -stead of centrally controlled by a few corporations, or would like to -experiment with interesting network technology, the -Dugnasnett for alle i Oslo -might be project for you. 39 mesh nodes are currently being planned, -in the freshly started initiative from NUUG and Hackeriet to create a -wireless community network. The work is inspired by -Freifunk, -Athens Wireless Metropolitan -Network, Roofnet -and other successful mesh networks around the globe. Two days ago we -held a workshop to try to get people started on setting up their own -mesh node, and there we decided to create a new mailing list -dugnadsnett -(at) nuug.no and IRC channel -#dugnadsnett.no to -coordinate the work. See also the NUUG blog post -announcing -the mailing list and IRC channel.

+ +
27th June 2017
+

Jeg kom over teksten +«Killing +car privacy by federal mandate» av Leonid Reyzin på Freedom to +Tinker i dag, og det gleder meg å se en god gjennomgang om hvorfor det +er et urimelig inngrep i privatsfæren å la alle biler kringkaste sin +posisjon og bevegelse via radio. Det omtalte forslaget basert på +Dedicated Short Range Communication (DSRC) kalles Basic Safety Message +(BSM) i USA og Cooperative Awareness Message (CAM) i Europa, og det +norske Vegvesenet er en av de som ser ut til å kunne tenke seg å +pålegge alle biler å fjerne nok en bit av innbyggernes privatsfære. +Anbefaler alle å lese det som står der. + +

Mens jeg tittet litt på DSRC på biler i Norge kom jeg over et sitat +jeg synes er illustrativt for hvordan det offentlige Norge håndterer +problemstillinger rundt innbyggernes privatsfære i SINTEF-rapporten +«Informasjonssikkerhet +i AutoPASS-brikker» av Trond Foss:

+ +

+«Rapporten ser ikke på informasjonssikkerhet knyttet til personlig + integritet.» +

+ +

Så enkelt kan det tydeligvis gjøres når en vurderer +informasjonssikkerheten. Det holder vel at folkene på toppen kan si +at «Personvernet er ivaretatt», som jo er den populære intetsigende +frasen som gjør at mange tror enkeltindividers integritet tas vare på. +Sitatet fikk meg til å undres på hvor ofte samme tilnærming, å bare se +bort fra behovet for personlig itegritet, blir valgt når en velger å +legge til rette for nok et inngrep i privatsfæren til personer i +Norge. Det er jo sjelden det får reaksjoner. Historien om +reaksjonene på Helse Sør-Østs tjenesteutsetting er jo sørgelig nok et +unntak og toppen av isfjellet, desverre. Tror jeg fortsatt takker nei +til både AutoPASS og holder meg så langt unna det norske helsevesenet +som jeg kan, inntil de har demonstrert og dokumentert at de verdsetter +individets privatsfære og personlige integritet høyere enn kortsiktig +gevist og samfunnsnytte.

@@ -229,84 +206,66 @@ the mailing list and IRC channel.

- -
26th November 2013
-

Jeg -skrev -i juni om protestene på planene til min arbeidsplass, -Universitetet i Oslo, om å gå bort fra -fri programvare- og åpne standardløsninger for å håndtere epost, -vekk fra IETF-standarden SIEVE for filtrering av epost og over til -godseide spesifikasjoner og epostsystemet Microsoft Exchange. -Protestene har fått litt ny omtale i media de siste dagene, i tillegg -til de oppslagene som kom i mai.

- - - -

Prosjektledelsen har fortalt at dette skal fungere like godt for -Linux-brukere som for brukere av Microsoft Windows og Apple MacOSX, -men jeg lurer på hva slags erfaringer Linux-brukere i eksisterende -miljøer som bruker MS Exchange har gjort. Hvis du har slik erfaring -hadet det vært veldig fint om du kan send et leserbrev til -Uniforum og fortelle om hvor -greit det er å bruke Exchange i kryss-platform-miljøer? De jeg har -snakket med sier en greit får lest e-posten sin hvis Exchange har -slått på IMAP-funksjonalitet, men at kalender og møtebooking ikke -fungerer godt for Linux-klienter. Jeg har ingen personlig erfaring å -komme med, så jeg er nysgjerrig på hva andre kan dele av erfaringer -med universitetet.

- -

Mitt ankerpunkt mot å bytte ut fri programvare som fungerer godt -med godseid programvare er at en mister kontroll over egen -infrastruktur, låser seg inn i en løsning det vil bli dyrt å komme ut -av, uten at en får funksjonalitet en ikke kunne skaffet seg med fri -programvare, eventuelt videreutviklet med de pengene som brukes på -overgangen til MS Exchange. Personlig planlegger jeg å fortsette å -laste ned all eposten min til lokal maskin for indeksering og lesing -med notmuch, så jeg håper jeg -ikke blir veldig skadelidende av overgangen.

- -

Underskriftslista -for oss som er mot endringen, som omtales i artiklene, er fortsatt -åpen for de som vil signere på oppropet. Akkurat nå er det 298 -personer som har signert.

+ +
12th June 2017
+

It is pleasing to see that the work we put down in publishing new +editions of the classic Free +Culture book by the founder of the Creative Commons movement, +Lawrence Lessig, is still being appreciated. I had a look at the +latest sales numbers for the paper edition today. Not too impressive, +but happy to see some buyers still exist. All the revenue from the +books is sent to the Creative +Commons Corporation, and they receive the largest cut if you buy +directly from Lulu. Most books are sold via Amazon, with Ingram +second and only a small fraction directly from Lulu. The ebook +edition is available for free from +Github.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Title / languageQuantity
2016 jan-jun2016 jul-dec2017 jan-may
Culture Libre / French3615
Fri kultur / Norwegian710
Free Culture / English142716
Total243431
+ +

A bit sad to see the low sales number on the Norwegian edition, and +a bit surprising the English edition still selling so well.

+ +

If you would like to translate and publish the book in your native +language, I would be happy to help make it happen. Please get in +touch.

- Tags: norsk, standard. + Tags: docbook, english, freeculture.
@@ -314,56 +273,59 @@ personer som har signert.

- -
24th November 2013
-

After many years break from the package and a vain hope that -development would be continued by someone else, I finally pulled my -acts together this morning and wrapped up a new release of chrpath, -the command line tool to modify the rpath and runpath of already -compiled ELF programs. The update was triggered by the persistence of -Isha Vishnoi at IBM, which needed a new config.guess file to get -support for the ppc64le architecture (powerpc 64-bit Little Endian) he -is working on. I checked the -Debian, -Ubuntu and -Fedora -packages for interesting patches (failed to find the source from -OpenSUSE and Mandriva packages), and found quite a few nice fixes. -These are the release notes:

- -

New in 0.15 released 2013-11-24:

+ +
10th June 2017
+

I am very happy to report that the +Nikita Noark 5 +core project tagged its second release today. The free software +solution is an implementation of the Norwegian archive standard Noark +5 used by government offices in Norway. These were the changes in +version 0.1.1 since version 0.1.0 (from NEWS.md):

    -
  • Updated config.sub and config.guess from the GNU project to work - with newer architectures. Thanks to isha vishnoi for the heads - up.
  • - -
  • Updated README with current URLs.
  • - -
  • Added byteswap fix found in Ubuntu, credited Jeremy Kerr and - Matthias Klose.
  • - -
  • Added missing help for -k|--keepgoing option, using patch by - Petr Machata found in Fedora.
  • - -
  • Rewrite removal of RPATH/RUNPATH to make sure the entry in - .dynamic is a NULL terminated string. Based on patch found in - Fedora credited Axel Thimm and Christian Krause.
  • - +
  • Continued work on the angularjs GUI, including document upload.
  • +
  • Implemented correspondencepartPerson, correspondencepartUnit and + correspondencepartInternal
  • +
  • Applied for coverity coverage and started submitting code on + regualr basis.
  • +
  • Started fixing bugs reported by coverity
  • +
  • Corrected and completed HATEOAS links to make sure entire API is + available via URLs in _links.
  • +
  • Corrected all relation URLs to use trailing slash.
  • +
  • Add initial support for storing data in ElasticSearch.
  • +
  • Now able to receive and store uploaded files in the archive.
  • +
  • Changed JSON output for object lists to have relations in _links.
  • +
  • Improve JSON output for empty object lists.
  • +
  • Now uses correct MIME type application/vnd.noark5-v4+json.
  • +
  • Added support for docker container images.
  • +
  • Added simple API browser implemented in JavaScript/Angular.
  • +
  • Started on archive client implemented in JavaScript/Angular.
  • +
  • Started on prototype to show the public mail journal.
  • +
  • Improved performance by disabling Sprint FileWatcher.
  • +
  • Added support for 'arkivskaper', 'saksmappe' and 'journalpost'.
  • +
  • Added support for some metadata codelists.
  • +
  • Added support for Cross-origin resource sharing (CORS).
  • +
  • Changed login method from Basic Auth to JSON Web Token (RFC 7519) + style.
  • +
  • Added support for GET-ing ny-* URLs.
  • +
  • Added support for modifying entities using PUT and eTag.
  • +
  • Added support for returning XML output on request.
  • +
  • Removed support for English field and class names, limiting ourself + to the official names.
  • +
  • ...
  • +
-

You can -download the -new version 0.15 from alioth. Please let us know via the Alioth -project if something is wrong with the new release. The test suite -did not discover any old errors, so if you find a new one, please also -include a testsuite check.

+

If this sound interesting to you, please contact us on IRC (#nikita +on irc.freenode.net) or email +(nikita-noark +mailing list).

@@ -371,64 +333,99 @@ include a testsuite check.

- -
22nd November 2013
-

I fjor sommer lagde jeg en -offentlig -tilgjengelig SQL-database over offentlig anbud basert på skraping -av HTML-data fra Doffin. Den har stått og gått siden da, og har nå -ca. 28000 oppføringer. Jeg oppdaget da jeg tittet innom at noen -oppføringer var ikke blitt med, antagelig på grunn av at de fikk -tildelt sekvensnummer i Doffin en godt stund før de ble publisert, -slik at min nettsideskraper som fortsatte skrapingen der den slapp -sist ikke fikk dem med seg. Jeg har fikset litt slik at skraperen nå -ser litt tilbake i tid for å se om den har gått glipp av noen -oppføringer, og har skrapet på nytt fra midten av september 2013 og -fremover. Det bør dermed bli en mer komplett database for kommende -måneder. Hvis jeg får tid skal jeg forsøke å skrape "glemte" data fra -før midten av september 2013, men tør ikke garantere at det blir -prioritert med det første.

- -

Men målet med denne bloggposten er å vise hvordan denne -Doffin-databasen kan brukes og integreres med en RSS-leser, slik at en -kan la datamaskinen holde et øye med Doffin-annonseringer etter -nøkkelord. En kan lage sitt eget søk ved å besøke -API-et -hos Scraperwiki, velge format rss2 og så legge inn noe ala dette i -"query in SQL":

- -

-select title, scrapedurl as link, abstract as description,
-       publishdate as pubDate from 'swdata'
-   where abstract like '%linux%' or title like '%linux%'
-   order by seq desc limit 20
-

- -

Dette vil søke opp alle anbud med ordet linux i oppsummering eller -tittel. En kan lage mer avanserte søk hvis en ønsker det. URL-en som -dukker opp nederst på siden kan en så gi til sin RSS-leser (jeg bruker -akregator selv), og så automatisk få beskjed hvis det dukker opp anbud -med det aktuelle nøkkelordet i teksten. Merk at kapasiteten og -ytelsen hos Scraperwiki er begrenset, så ikke be RSS-leseren hente ned -oftere enn en gang hver dag.

- -

Du lurer kanskje på hva slags informasjon en kan få ut fra denne -databasen. Her er to RSS-kilder, med søkeordet -"linux", -søkeordet -"fri -programvare" -og søkeordet -"odf". -Det er bare å søke på det en er interessert i. Kopier gjerne -datasettet og sett opp din egen tjeneste hvis du vil gjøre mer -avanserte søk. SQLite-filen med Doffin-oppføringer kan lastes med fra -Scraperwiki for de som vil grave dypere.

+ +
7th June 2017
+

This is a copy of +an +email I posted to the nikita-noark mailing list. Please follow up +there if you would like to discuss this topic. The background is that +we are making a free software archive system based on the Norwegian +Noark +5 standard for government archives.

+ +

I've been wondering a bit lately how trusted timestamps could be +stored in Noark 5. +Trusted +timestamps can be used to verify that some information +(document/file/checksum/metadata) have not been changed since a +specific time in the past. This is useful to verify the integrity of +the documents in the archive.

+ +

Then it occured to me, perhaps the trusted timestamps could be +stored as dokument variants (ie dokumentobjekt referered to from +dokumentbeskrivelse) with the filename set to the hash it is +stamping?

+ +

Given a "dokumentbeskrivelse" with an associated "dokumentobjekt", +a new dokumentobjekt is associated with "dokumentbeskrivelse" with the +same attributes as the stamped dokumentobjekt except these +attributes:

+ +
    + +
  • format -> "RFC3161" +
  • mimeType -> "application/timestamp-reply" +
  • formatDetaljer -> "<source URL for timestamp service>" +
  • filenavn -> "<sjekksum>.tsr" + +
+ +

This assume a service following +IETF RFC 3161 is +used, which specifiy the given MIME type for replies and the .tsr file +ending for the content of such trusted timestamp. As far as I can +tell from the Noark 5 specifications, it is OK to have several +variants/renderings of a dokument attached to a given +dokumentbeskrivelse objekt. It might be stretching it a bit to make +some of these variants represent crypto-signatures useful for +verifying the document integrity instead of representing the dokument +itself.

+ +

Using the source of the service in formatDetaljer allow several +timestamping services to be used. This is useful to spread the risk +of key compromise over several organisations. It would only be a +problem to trust the timestamps if all of the organisations are +compromised.

+ +

The following oneliner on Linux can be used to generate the tsr +file. $input is the path to the file to checksum, and $sha256 is the +SHA-256 checksum of the file (ie the ".tsr" value mentioned +above).

+ +

+openssl ts -query -data "$inputfile" -cert -sha256 -no_nonce \
+  | curl -s -H "Content-Type: application/timestamp-query" \
+      --data-binary "@-" http://zeitstempel.dfn.de > $sha256.tsr
+

+ +

To verify the timestamp, you first need to download the public key +of the trusted timestamp service, for example using this command:

+ +

+wget -O ca-cert.txt \
+  https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt
+

+ +

Note, the public key should be stored alongside the timestamps in +the archive to make sure it is also available 100 years from now. It +is probably a good idea to standardise how and were to store such +public keys, to make it easier to find for those trying to verify +documents 100 or 1000 years from now. :)

+ +

The verification itself is a simple openssl command:

+ +

+openssl ts -verify -data $inputfile -in $sha256.tsr \
+  -CAfile ca-cert.txt -text
+

+ +

Is there any reason this approach would not work? Is it somehow against +the Noark 5 specification?

@@ -436,56 +433,61 @@ Scraperwiki for de som vil grave dypere.

- -
21st November 2013
-

Drones, flying robots, are getting more and more popular. The most -know ones are the killer drones used by some government to murder -people they do not like without giving them the chance of a fair -trial, but the technology have many good uses too, from mapping and -forest maintenance to photography and search and rescue. I am sure it -is just a question of time before "bad drones" are in the hands of -private enterprises and not only state criminals but petty criminals -too. The drone technology is very useful and very dangerous. To have -some control over the use of drones, I agree with Daniel Suarez in his -TED talk -"The kill -decision shouldn't belong to a robot", where he suggested this -little gem to keep the good while limiting the bad use of drones:

- + +
3rd June 2017
+

Aftenposten +melder i dag om feil i eksamensoppgavene for eksamen i politikk og +menneskerettigheter, der teksten i bokmåls og nynorskutgaven ikke var +like. Oppgaveteksten er gjengitt i artikkelen, og jeg ble nysgjerring +på om den fri oversetterløsningen +Apertium ville gjort en bedre +jobb enn Utdanningsdirektoratet. Det kan se slik ut.

+ +

Her er bokmålsoppgaven fra eksamenen:

+
+

Drøft utfordringene knyttet til nasjonalstatenes og andre aktørers +rolle og muligheter til å håndtere internasjonale utfordringer, som +for eksempel flykningekrisen.

-

Each robot and drone should have a cryptographically signed -I.D. burned in at the factory that can be used to track its movement -through public spaces. We have license plates on cars, tail numbers on -aircraft. This is no different. And every citizen should be able to -download an app that shows the population of drones and autonomous -vehicles moving through public spaces around them, both right now and -historically. And civic leaders should deploy sensors and civic drones -to detect rogue drones, and instead of sending killer drones of their -own up to shoot them down, they should notify humans to their -presence. And in certain very high-security areas, perhaps civic -drones would snare them and drag them off to a bomb disposal facility.

- -

But notice, this is more an immune system than a weapons system. It -would allow us to avail ourselves of the use of autonomous vehicles -and drones while still preserving our open, civil society.

+

Vedlegge er eksempler på tekster som kan gi relevante perspektiver +på temaet:

+
    +
  1. Flykningeregnskapet 2016, UNHCR og IDMC +
  2. «Grenseløst Europa for fall» A-Magasinet, 26. november 2015 +
-

The key is that every citizen should be able to read the -radio beacons sent from the drones in the area, to be able to check -both the government and others use of drones. For such control to be -effective, everyone must be able to do it. What should such beacon -contain? At least formal owner, purpose, contact information and GPS -location. Probably also the origin and target position of the current -flight. And perhaps some registration number to be able to look up -the drone in a central database tracking their movement. Robots -should not have privacy. It is people who need privacy.

+

Dette oversetter Apertium slik:

+ +
+

Drøft utfordringane knytte til nasjonalstatane sine og rolla til +andre aktørar og høve til å handtera internasjonale utfordringar, som +til dømes *flykningekrisen.

+ +

Vedleggja er døme på tekster som kan gje relevante perspektiv på +temaet:

+ +
    +
  1. *Flykningeregnskapet 2016, *UNHCR og *IDMC
  2. +
  3. «*Grenseløst Europa for fall» A-Magasinet, 26. november 2015
  4. +
+ +
+ +

Ord som ikke ble forstått er markert med stjerne (*), og trenger +ekstra språksjekk. Men ingen ord er forsvunnet, slik det var i +oppgaven elevene fikk presentert på eksamen. Jeg mistenker dog at +"andre aktørers rolle og muligheter til ..." burde vært oversatt til +"rolla til andre aktørar og deira høve til ..." eller noe slikt, men +det er kanskje flisespikking. Det understreker vel bare at det alltid +trengs korrekturlesning etter automatisk oversettelse.

@@ -493,26 +495,67 @@ should not have privacy. It is people who need privacy.

- -
13th November 2013
-

Today NUUG and Hackeriet announced -our -plans to join forces and create a wireless community network in -Oslo. The workshop to help people get started will take place -Thursday 2013-11-28, but we already are collecting the geolocation of -people joining forces to make this happen. We have -9 -locations plotted on the map, but we will need more before we have -a connected mesh spread across Oslo. If this sound interesting to -you, please join us at the workshop. If you are too impatient to wait -15 days, please join us on the IRC channel -#nuug on irc.freenode.net -right away. :)

+ +
27th April 2017
+

I disse dager, med frist 1. mai, har Riksarkivaren ute en høring på +sin forskrift. Som en kan se er det ikke mye tid igjen før fristen +som går ut på søndag. Denne forskriften er det som lister opp hvilke +formater det er greit å arkivere i +Noark +5-løsninger i Norge.

+ +

Jeg fant høringsdokumentene hos +Norsk +Arkivråd etter å ha blitt tipset på epostlisten til +fri +programvareprosjektet Nikita Noark5-Core, som lager et Noark 5 +Tjenestegresesnitt. Jeg er involvert i Nikita-prosjektet og takket +være min interesse for tjenestegrensesnittsprosjektet har jeg lest en +god del Noark 5-relaterte dokumenter, og til min overraskelse oppdaget +at standard epost ikke er på listen over godkjente formater som kan +arkiveres. Høringen med frist søndag er en glimrende mulighet til å +forsøke å gjøre noe med det. Jeg holder på med +egen +høringsuttalelse, og lurer på om andre er interessert i å støtte +forslaget om å tillate arkivering av epost som epost i arkivet.

+ +

Er du igang med å skrive egen høringsuttalelse allerede? I så fall +kan du jo vurdere å ta med en formulering om epost-lagring. Jeg tror +ikke det trengs så mye. Her et kort forslag til tekst:

+ +

+ +

Viser til høring sendt ut 2017-02-17 (Riksarkivarens referanse + 2016/9840 HELHJO), og tillater oss å sende inn noen innspill om + revisjon av Forskrift om utfyllende tekniske og arkivfaglige + bestemmelser om behandling av offentlige arkiver (Riksarkivarens + forskrift).

+ +

Svært mye av vår kommuikasjon foregår i dag på e-post.  Vi + foreslår derfor at Internett-e-post, slik det er beskrevet i IETF + RFC 5322, + https://tools.ietf.org/html/rfc5322. bør + inn som godkjent dokumentformat.  Vi foreslår at forskriftens + oversikt over godkjente dokumentformater ved innlevering i § 5-16 + endres til å ta med Internett-e-post.

+ +

+ +

Som del av arbeidet med tjenestegrensesnitt har vi testet hvordan +epost kan lagres i en Noark 5-struktur, og holder på å skrive et +forslag om hvordan dette kan gjøres som vil bli sendt over til +arkivverket så snart det er ferdig. De som er interesserte kan +følge +fremdriften på web.

+ +

Oppdatering 2017-04-28: I dag ble høringuttalelsen jeg skrev + sendt + inn av foreningen NUUG.

@@ -520,131 +563,52 @@ right away. :)

- -
10th November 2013
-

Continuing my research into mesh networking, I was recommended to -use TP-Link 3040 and 3600 access points as mesh nodes, and the pair I -bought arrived on Friday. Here are my notes on how to set up the -MR3040 as a mesh node using -OpenWrt.

- -

I started by following the instructions on the OpenWRT wiki for -TL-MR3040, -and downloaded -the -recommended firmware image -(openwrt-ar71xx-generic-tl-mr3040-v2-squashfs-factory.bin) and -uploaded it into the original web interface. The flashing went fine, -and the machine was available via telnet on the ethernet port. After -logging in and setting the root password, ssh was available and I -could start to set it up as a batman-adv mesh node.

- -

I started off by reading the instructions from -Wireless -Africa, which had quite a lot of useful information, but -eventually I followed the recipe from the Open Mesh wiki for -using -batman-adv on OpenWrt. A small snag was the fact that the -opkg install kmod-batman-adv command did not work as it -should. The batman-adv kernel module would fail to load because its -dependency crc16 was not already loaded. I -reported the bug to -the openwrt project and hope it will be fixed soon. But the problem -only seem to affect initial testing of batman-adv, as configuration -seem to work when booting from scratch.

- -

The setup is done using files in /etc/config/. I did not bridge -the Ethernet and mesh interfaces this time, to be able to hook up the -box on my local network and log into it for configuration updates. -The following files were changed and look like this after modifying -them:

- -

/etc/config/network

- -
-
-config interface 'loopback'
-        option ifname 'lo'
-        option proto 'static'
-        option ipaddr '127.0.0.1'
-        option netmask '255.0.0.0'
-
-config globals 'globals'
-        option ula_prefix 'fdbf:4c12:3fed::/48'
-
-config interface 'lan'
-        option ifname 'eth0'
-        option type 'bridge'
-        option proto 'dhcp'
-        option ipaddr '192.168.1.1'
-        option netmask '255.255.255.0'
-        option hostname 'tl-mr3040'
-        option ip6assign '60'
-
-config interface 'mesh'
-        option ifname 'adhoc0'
-        option mtu '1528'
-        option proto 'batadv'
-        option mesh 'bat0'
-
- -

/etc/config/wireless

-
-
-config wifi-device 'radio0'
-        option type 'mac80211'
-        option channel '11'
-        option hwmode '11ng'
-        option path 'platform/ar933x_wmac'
-        option htmode 'HT20'
-        list ht_capab 'SHORT-GI-20'
-        list ht_capab 'SHORT-GI-40'
-        list ht_capab 'RX-STBC1'
-        list ht_capab 'DSSS_CCK-40'
-        option disabled '0'
-
-config wifi-iface 'wmesh'
-        option device 'radio0'
-        option ifname 'adhoc0'
-        option network 'mesh'
-        option encryption 'none'
-        option mode 'adhoc'
-        option bssid '02:BA:00:00:00:01'
-        option ssid 'meshfx@hackeriet'
-
-

/etc/config/batman-adv

-
-
-config 'mesh' 'bat0'
-        option interfaces 'adhoc0'
-        option 'aggregated_ogms'
-        option 'ap_isolation'
-        option 'bonding'
-        option 'fragmentation'
-        option 'gw_bandwidth'
-        option 'gw_mode'
-        option 'gw_sel_class'
-        option 'log_level'
-        option 'orig_interval'
-        option 'vis_mode'
-        option 'bridge_loop_avoidance'
-        option 'distributed_arp_table'
-        option 'network_coding'
-        option 'hop_penalty'
-
-# yet another batX instance
-# config 'mesh' 'bat5'
-#       option 'interfaces' 'second_mesh'
-
- -

The mesh node is now operational. I have yet to test its range, -but I hope it is good. I have not yet tested the TP-Link 3600 box -still wrapped up in plastic.

+ +
20th April 2017
+

Jeg oppdaget i dag at nettstedet som +publiserer offentlige postjournaler fra statlige etater, OEP, har +begynt å blokkerer enkelte typer webklienter fra å få tilgang. Vet +ikke hvor mange det gjelder, men det gjelder i hvert fall libwww-perl +og curl. For å teste selv, kjør følgende:

+ +
+% curl -v -s https://www.oep.no/pub/report.xhtml?reportId=3 2>&1 |grep '< HTTP'
+< HTTP/1.1 404 Not Found
+% curl -v -s --header 'User-Agent:Opera/12.0' https://www.oep.no/pub/report.xhtml?reportId=3 2>&1 |grep '< HTTP'
+< HTTP/1.1 200 OK
+%
+
+ +

Her kan en se at tjenesten gir «404 Not Found» for curl i +standardoppsettet, mens den gir «200 OK» hvis curl hevder å være Opera +versjon 12.0. Offentlig elektronisk postjournal startet blokkeringen +2017-03-02.

+ +

Blokkeringen vil gjøre det litt vanskeligere å maskinelt hente +informasjon fra oep.no. Kan blokkeringen være gjort for å hindre +automatisert innsamling av informasjon fra OEP, slik Pressens +Offentlighetsutvalg gjorde for å dokumentere hvordan departementene +hindrer innsyn i +rapporten +«Slik hindrer departementer innsyn» som ble publiserte i januar +2017. Det virker usannsynlig, da det jo er trivielt å bytte +User-Agent til noe nytt.

+ +

Finnes det juridisk grunnlag for det offentlige å diskriminere +webklienter slik det gjøres her? Der tilgang gis eller ikke alt etter +hva klienten sier at den heter? Da OEP eies av DIFI og driftes av +Basefarm, finnes det kanskje noen dokumenter sendt mellom disse to +aktørene man kan be om innsyn i for å forstå hva som har skjedd. Men +postjournalen +til DIFI viser kun to dokumenter det siste året mellom DIFI og +Basefarm. +Mimes brønn neste, +tenker jeg.

@@ -652,204 +616,101 @@ still wrapped up in plastic.

- -
2nd November 2013
-

If one of the points of switching to a new init system in Debian is -to get rid of huge -init.d scripts, I doubt we need to switch away from sysvinit and -init.d scripts at all. Here is an example init.d script, ie a rewrite -of /etc/init.d/rsyslog:

- -

-#!/lib/init/init-d-script
-### BEGIN INIT INFO
-# Provides:          rsyslog
-# Required-Start:    $remote_fs $time
-# Required-Stop:     umountnfs $time
-# X-Stop-After:      sendsigs
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: enhanced syslogd
-# Description:       Rsyslog is an enhanced multi-threaded syslogd.
-#                    It is quite compatible to stock sysklogd and can be 
-#                    used as a drop-in replacement.
-### END INIT INFO
-DESC="enhanced syslogd"
-DAEMON=/usr/sbin/rsyslogd
-

- -

Pretty minimalistic to me... For the record, the original sysv-rc -script was 137 lines, and the above is just 15 lines, most of it meta -info/comments.

- -

How to do this, you ask? Well, one create a new script -/lib/init/init-d-script looking something like this: - -

-#!/bin/sh
-
-# Define LSB log_* functions.
-# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
-# and status_of_proc is working.
-. /lib/lsb/init-functions
-
-#
-# Function that starts the daemon/service
-
-#
-do_start()
-{
-	# Return
-	#   0 if daemon has been started
-	#   1 if daemon was already running
-	#   2 if daemon could not be started
-	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
-		|| return 1
-	start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON -- \
-		$DAEMON_ARGS \
-		|| return 2
-	# Add code here, if necessary, that waits for the process to be ready
-	# to handle requests from services started subsequently which depend
-	# on this one.  As a last resort, sleep for some time.
-}
-
-#
-# Function that stops the daemon/service
-#
-do_stop()
-{
-	# Return
-	#   0 if daemon has been stopped
-	#   1 if daemon was already stopped
-	#   2 if daemon could not be stopped
-	#   other if a failure occurred
-	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
-	RETVAL="$?"
-	[ "$RETVAL" = 2 ] && return 2
-	# Wait for children to finish too if this is a daemon that forks
-	# and if the daemon is only ever run from this initscript.
-	# If the above conditions are not satisfied then add some other code
-	# that waits for the process to drop all resources that could be
-	# needed by services started subsequently.  A last resort is to
-	# sleep for some time.
-	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec $DAEMON
-	[ "$?" = 2 ] && return 2
-	# Many daemons don't delete their pidfiles when they exit.
-	rm -f $PIDFILE
-	return "$RETVAL"
-}
-
-#
-# Function that sends a SIGHUP to the daemon/service
-#
-do_reload() {
-	#
-	# If the daemon can reload its configuration without
-	# restarting (for example, when it is sent a SIGHUP),
-	# then implement that here.
-	#
-	start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
-	return 0
-}
-
-SCRIPTNAME=$1
-scriptbasename="$(basename $1)"
-echo "SN: $scriptbasename"
-if [ "$scriptbasename" != "init-d-library" ] ; then
-    script="$1"
-    shift
-    . $script
-else
-    exit 0
-fi
-
-NAME=$(basename $DAEMON)
-PIDFILE=/var/run/$NAME.pid
-
-# Exit if the package is not installed
-#[ -x "$DAEMON" ] || exit 0
-
-# Read configuration variable file if it is present
-[ -r /etc/default/$NAME ] && . /etc/default/$NAME
-
-# Load the VERBOSE setting and other rcS variables
-. /lib/init/vars.sh
-
-case "$1" in
-  start)
-	[ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
-	do_start
-	case "$?" in
-		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
-		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
-	esac
-	;;
-  stop)
-	[ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
-	do_stop
-	case "$?" in
-		0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
-		2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
-	esac
-	;;
-  status)
-	status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
-	;;
-  #reload|force-reload)
-	#
-	# If do_reload() is not implemented then leave this commented out
-	# and leave 'force-reload' as an alias for 'restart'.
-	#
-	#log_daemon_msg "Reloading $DESC" "$NAME"
-	#do_reload
-	#log_end_msg $?
-	#;;
-  restart|force-reload)
-	#
-	# If the "reload" option is implemented then remove the
-	# 'force-reload' alias
-	#
-	log_daemon_msg "Restarting $DESC" "$NAME"
-	do_stop
-	case "$?" in
-	  0|1)
-		do_start
-		case "$?" in
-			0) log_end_msg 0 ;;
-			1) log_end_msg 1 ;; # Old process is still running
-			*) log_end_msg 1 ;; # Failed to start
-		esac
-		;;
-	  *)
-		# Failed to stop
-		log_end_msg 1
-		;;
-	esac
-	;;
-  *)
-	echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
-	exit 3
-	;;
-esac
-
-:
-

- -

It is based on /etc/init.d/skeleton, and could be improved quite a -lot. I did not really polish the approach, so it might not always -work out of the box, but you get the idea. I did not try very hard to -optimize it nor make it more robust either.

- -

A better argument for switching init system in Debian than reducing -the size of init scripts (which is a good thing to do anyway), is to -get boot system that is able to handle the kernel events sensibly and -robustly, and do not depend on the boot to run sequentially. The boot -and the kernel have not behaved sequentially in years.

+ +
19th March 2017
+

The Nikita +Noark 5 core project is implementing the Norwegian standard for +keeping an electronic archive of government documents. +The +Noark 5 standard document the requirement for data systems used by +the archives in the Norwegian government, and the Noark 5 web interface +specification document a REST web service for storing, searching and +retrieving documents and metadata in such archive. I've been involved +in the project since a few weeks before Christmas, when the Norwegian +Unix User Group +announced +it supported the project. I believe this is an important project, +and hope it can make it possible for the government archives in the +future to use free software to keep the archives we citizens depend +on. But as I do not hold such archive myself, personally my first use +case is to store and analyse public mail journal metadata published +from the government. I find it useful to have a clear use case in +mind when developing, to make sure the system scratches one of my +itches.

+ +

If you would like to help make sure there is a free software +alternatives for the archives, please join our IRC channel +(#nikita on +irc.freenode.net) and +the +project mailing list.

+ +

When I got involved, the web service could store metadata about +documents. But a few weeks ago, a new milestone was reached when it +became possible to store full text documents too. Yesterday, I +completed an implementation of a command line tool +archive-pdf to upload a PDF file to the archive using this +API. The tool is very simple at the moment, and find existing +fonds, series and +files while asking the user to select which one to use if more than +one exist. Once a file is identified, the PDF is associated with the +file and uploaded, using the title extracted from the PDF itself. The +process is fairly similar to visiting the archive, opening a cabinet, +locating a file and storing a piece of paper in the archive. Here is +a test run directly after populating the database with test data using +our API tester:

+ +

+~/src//noark5-tester$ ./archive-pdf mangelmelding/mangler.pdf
+using arkiv: Title of the test fonds created 2017-03-18T23:49:32.103446
+using arkivdel: Title of the test series created 2017-03-18T23:49:32.103446
+
+ 0 - Title of the test case file created 2017-03-18T23:49:32.103446
+ 1 - Title of the test file created 2017-03-18T23:49:32.103446
+Select which mappe you want (or search term): 0
+Uploading mangelmelding/mangler.pdf
+  PDF title: Mangler i spesifikasjonsdokumentet for NOARK 5 Tjenestegrensesnitt
+  File 2017/1: Title of the test case file created 2017-03-18T23:49:32.103446
+~/src//noark5-tester$
+

+ +

You can see here how the fonds (arkiv) and serie (arkivdel) only had +one option, while the user need to choose which file (mappe) to use +among the two created by the API tester. The archive-pdf +tool can be found in the git repository for the API tester.

+ +

In the project, I have been mostly working on +the API +tester so far, while getting to know the code base. The API +tester currently use +the HATEOAS links +to traverse the entire exposed service API and verify that the exposed +operations and objects match the specification, as well as trying to +create objects holding metadata and uploading a simple XML file to +store. The tester has proved very useful for finding flaws in our +implementation, as well as flaws in the reference site and the +specification.

+ +

The test document I uploaded is a summary of all the specification +defects we have collected so far while implementing the web service. +There are several unclear and conflicting parts of the specification, +and we have +started +writing down the questions we get from implementing it. We use a +format inspired by how The +Austin Group collect defect reports for the POSIX standard with +their +instructions for the MANTIS defect tracker system, in lack of an official way to structure defect reports for Noark 5 (our first submitted defect report was a request for a procedure for submitting defect reports :). + +

The Nikita project is implemented using Java and Spring, and is +fairly easy to get up and running using Docker containers for those +that want to test the current code base. The API tester is +implemented in Python.

@@ -864,6 +725,112 @@ and the kernel have not behaved sequentially in years.

Archive