[homepage.git] / blog / tags / sikkerhet / sikkerhet.rss

<?xml version="1.0" encoding="utf-8"?>
<rss version='2.0' xmlns:lj='http://www.livejournal.org/rss/lj/1.0/'>
        <channel>
                <title>Petter Reinholdtsen - Entries tagged sikkerhet</title>
                <description>Entries tagged sikkerhet</description>
                <link>https://people.skolelinux.org/pere/blog/</link>

        
        <item>
                <title>Latest Jami back in Debian Testing, and scriptable using dbus</title>
                <link>https://people.skolelinux.org/pere/blog/Latest_Jami_back_in_Debian_Testing__and_scriptable_using_dbus.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Latest_Jami_back_in_Debian_Testing__and_scriptable_using_dbus.html</guid>
                <pubDate>Tue, 12 Jan 2021 17:00:00 +0100</pubDate>
                <description>&lt;p&gt;After a lot of hard work by its maintainer Alexandre Viau and
others, the decentralized communication platform
&lt;a href=&quot;https://en.wikipedia.org/wiki/Jami_(software)&quot;&gt;Jami&lt;/a&gt;
(earlier known as Ring), managed to get
&lt;a href=&quot;https://tracker.debian.org/pkg/ring&quot;&gt;its latest version&lt;/a&gt;
into Debian Testing.  Several of its dependencies has caused build and
propagation problems, which all seem to be solved now.&lt;/p&gt;

&lt;p&gt;In addition to the fact that Jami is decentralized, similar to how
bittorrent is decentralized, I first of all like how it is not
connected to external IDs like phone numbers.  This allow me to set up
computers to send me notifications using Jami without having to find
get a phone number for each computer.  Automatic notification via Jami
is also made trivial thanks to the provided client side API (as a DBus
service).  Here is my bourne shell script demonstrating how to let any
system send a message to any Jami address.  It will create a new
identity before sending the message, if no Jami identity exist
already:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
#!/bin/sh
#
# Usage: $0 &lt;jami-address&gt; &lt;message&gt;
#
# Send &lt;message&gt; to &lt;jami-address&gt;, create local jami account if
# missing.
#
# License: GPL v2 or later at your choice
# Author: Petter Reinholdtsen


if [ -z &quot;$HOME&quot; ] ; then
    echo &quot;error: missing \$HOME, required for dbus to work&quot;
    exit 1
fi

# First, get dbus running if not already running
DBUSLAUNCH=/usr/bin/dbus-launch
PIDFILE=/run/asterisk/dbus-session.pid
if [ -e $PIDFILE ] ; then
    . $PIDFILE
    if ! kill -0 $DBUS_SESSION_BUS_PID 2&gt;/dev/null ; then
        unset DBUS_SESSION_BUS_ADDRESS
    fi
fi
if [ -z &quot;$DBUS_SESSION_BUS_ADDRESS&quot; ] &amp;&amp; [ -x &quot;$DBUSLAUNCH&quot; ]; then
    DBUS_SESSION_BUS_ADDRESS=&quot;unix:path=$HOME/.dbus&quot;
    dbus-daemon --session --address=&quot;$DBUS_SESSION_BUS_ADDRESS&quot; --nofork --nopidfile --syslog-only &lt; /dev/null &gt; /dev/null 2&gt;&amp;1 3&gt;&amp;1 &amp;
    DBUS_SESSION_BUS_PID=$!
    (
        echo DBUS_SESSION_BUS_PID=$DBUS_SESSION_BUS_PID
        echo DBUS_SESSION_BUS_ADDRESS=\&quot;&quot;$DBUS_SESSION_BUS_ADDRESS&quot;\&quot;
        echo export DBUS_SESSION_BUS_ADDRESS
    ) &gt; $PIDFILE
    . $PIDFILE
fi &amp;

dringop() {
    part=&quot;$1&quot;; shift
    op=&quot;$1&quot;; shift
    dbus-send --session \
        --dest=&quot;cx.ring.Ring&quot; /cx/ring/Ring/$part cx.ring.Ring.$part.$op $*
}

dringopreply() {
    part=&quot;$1&quot;; shift
    op=&quot;$1&quot;; shift
    dbus-send --session --print-reply \
        --dest=&quot;cx.ring.Ring&quot; /cx/ring/Ring/$part cx.ring.Ring.$part.$op $*
}

firstaccount() {
    dringopreply ConfigurationManager getAccountList | \
      grep string | awk -F&#39;&quot;&#39; &#39;{print $2}&#39; | head -n 1
}

account=$(firstaccount)

if [ -z &quot;$account&quot; ] ; then
    echo &quot;Missing local account, trying to create it&quot;
    dringop ConfigurationManager addAccount \
      dict:string:string:&quot;Account.type&quot;,&quot;RING&quot;,&quot;Account.videoEnabled&quot;,&quot;false&quot;
    account=$(firstaccount)
    if [ -z &quot;$account&quot; ] ; then
        echo &quot;unable to create local account&quot;
        exit 1
    fi
fi

# Not using dringopreply to ensure $2 can contain spaces
dbus-send --print-reply --session \
  --dest=cx.ring.Ring \
  /cx/ring/Ring/ConfigurationManager \
  cx.ring.Ring.ConfigurationManager.sendTextMessage \
  string:&quot;$account&quot; string:&quot;$1&quot; \
  dict:string:string:&quot;text/plain&quot;,&quot;$2&quot; 
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;If you want to check it out yourself, visit the 
&lt;a href=&quot;https://jami.net/&quot;&gt;the Jami system project page&lt;/a&gt; to learn
more, and install the latest Jami client from Debian Unstable or
Testing.&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Secure Socket API - a simple and powerful approach for TLS support in software</title>
                <link>https://people.skolelinux.org/pere/blog/Secure_Socket_API___a_simple_and_powerful_approach_for_TLS_support_in_software.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Secure_Socket_API___a_simple_and_powerful_approach_for_TLS_support_in_software.html</guid>
                <pubDate>Sat, 6 Jun 2020 12:40:00 +0200</pubDate>
                <description>&lt;p&gt;As a member of the &lt;a href=&quot;https://www.nuug.no/&quot;&gt;Norwegian Unix
User Group&lt;/a&gt;, I have the pleasure of receiving the
&lt;a href=&quot;https://www.usenix.org/&quot;&gt;USENIX&lt;/a&gt; magazine
&lt;a href=&quot;https://www.usenix.org/publications/login/&quot;&gt;;login:&lt;/a&gt;
several times a year.  I rarely have time to read all the articles,
but try to at least skim through them all as there is a lot of nice
knowledge passed on there.  I even carry the latest issue with me most
of the time to try to get through all the articles when I have a few
spare minutes.&lt;/p&gt;

&lt;p&gt;The other day I came across a nice article titled
&quot;&lt;a href=&quot;https://www.usenix.org/publications/login/winter2018/oneill&quot;&gt;The
Secure Socket API: TLS as an Operating System Service&lt;/a&gt;&quot; with a
marvellous idea I hope can make it all the way into the POSIX standard.
The idea is as simple as it is powerful.  By introducing a new
socket() option IPPROTO_TLS to use TLS, and a system wide service to
handle setting up TLS connections, one both make it trivial to add TLS
support to any program currently using the POSIX socket API, and gain
system wide control over certificates, TLS versions and encryption
systems used.  Instead of doing this:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
int socket = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;the program code would be doing this:&lt;p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
int socket = socket(PF_INET, SOCK_STREAM, IPPROTO_TLS);
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;According to the ;login: article, converting a C program to use TLS
would normally modify only 5-10 lines in the code, which is amazing
when compared to using for example the OpenSSL API.&lt;/p&gt;

&lt;p&gt;The project has set up the
&lt;a href=&quot;https://securesocketapi.org/&quot;&gt;https://securesocketapi.org/&lt;/a&gt;
web site to spread the idea, and the code for a kernel module and the
associated system daemon is available from two github repositories:
&lt;a href=&quot;https://github.com/markoneill/ssa&quot;&gt;ssa&lt;/a&gt; and
&lt;a href=&quot;https://github.com/markoneill/ssa-daemon&quot;&gt;ssa-daemon&lt;/a&gt;.
Unfortunately there is no explicit license information with the code,
so its copyright status is unclear.  A
&lt;a href=&quot;https://github.com/markoneill/ssa/issues/2&quot;&gt;request to solve
this&lt;/a&gt; about it has been unsolved since 2018-08-17.&lt;/p&gt;

&lt;p&gt;I love the idea of extending socket() to gain TLS support, and
understand why it is an advantage to implement this as a kernel module
and system wide service daemon, but can not help to think that it
would be a lot easier to get projects to move to this way of setting
up TLS if it was done with a user space approach where programs
wanting to use this API approach could just link with a wrapper
library.&lt;/p&gt;

&lt;p&gt;I recommend you check out this simple and powerful approach to more
secure network connections. :)&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Jami as a Zoom client, a trick for password protected rooms...</title>
                <link>https://people.skolelinux.org/pere/blog/Jami_as_a_Zoom_client__a_trick_for_password_protected_rooms___.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Jami_as_a_Zoom_client__a_trick_for_password_protected_rooms___.html</guid>
                <pubDate>Fri, 8 May 2020 13:30:00 +0200</pubDate>
                <description>&lt;p&gt;Half a year ago,
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Jami_Ring__finally_functioning_peer_to_peer_communication_client.html&quot;&gt;I
wrote&lt;/a&gt; about &lt;a href=&quot;https://jami.net/&quot;&gt;the Jami communication
client&lt;/a&gt;, capable of peer-to-peer encrypted communication.  It
handle both messages, audio and video.  It uses distributed hash
tables instead of central infrastructure to connect its users to each
other, which in my book is a plus.  I mentioned briefly that it could
also work as a SIP client, which came in handy when the higher
educational sector in Norway started to promote Zoom as its video
conferencing solution.  I am reluctant to use the official Zoom client
software, due to their &lt;a href=&quot;https://zoom.us/terms&quot;&gt;copyright
license clauses&lt;/a&gt; prohibiting users to reverse engineer (for example
to check the security) and benchmark it, and thus prefer to connect to
Zoom meetings with free software clients.&lt;/p&gt;

&lt;p&gt;Jami worked OK as a SIP client to Zoom as long as there was no
password set on the room.  The Jami daemon leak memory like crazy
(approximately 1 GiB a minute) when I am connected to the video
conference, so I had to restart the client every 7-10 minutes, which
is not great.  I tried to get other SIP Linux clients to work
without success, so I decided I would have to live with this wart
until someone managed to fix the leak in the dring code base.  But
another problem showed up once the rooms were password protected.  I
could not get my dial tone signaling through from Jami to Zoom, and
dial tone signaling is used to enter the password when connecting to
Zoom.  I tried a lot of different permutations with my Jami and
Asterisk setup to try to figure out why the signaling did not get
through, only to finally discover that the fundamental problem seem to
be that Zoom is simply not able to receive dial tone signaling when
connecting via SIP.  There seem to be nothing wrong with the Jami and
Asterisk end, it is simply broken in the Zoom end.  I got help from a
very skilled VoIP engineer figuring out this last part.  And being a
very skilled engineer, he was also able to locate a solution for me.
Or to be exact, a workaround that solve my initial problem of
connecting to password protected Zoom rooms using Jami.&lt;/p&gt;

&lt;p&gt;So, how do you do this, I am sure you are wondering by now.  The
trick is already
&lt;a href=&quot;https://support.zoom.us/hc/en-us/articles/202405539-H-323-SIP-Room-Connector-Dial-Strings#sip&quot;&gt;documented
from Zoom&lt;/a&gt;, and it is to modify the SIP address to include the room
password.  What is most surprising about this is that the
automatically generated email from Zoom with instructions on how to
connect via SIP do not mention this.  The SIP address to use normally
consist of the room ID (a number), an @ character and the IP address
of the Zoom SIP gateway.  But Zoom understand a lot more than just the
room ID in front of the at sign.  The format is &quot;&lt;tt&gt;[Meeting
ID].[Password].[Layout].[Host Key]&lt;/tt&gt;&quot;, and you can here see how you
can both enter password, control the layout (full screen, active
presence and gallery) and specify the host key to start the meeting.
The full SIP address entered into Jami to provide the password will
then look like this (all using made up numbers):&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
&lt;tt&gt;sip:657837644.522827@192.168.169.170&lt;/tt&gt;
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Now if only jami would reduce its memory usage, I could even
recommend this setup to others. :)&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Jami/Ring, finally functioning peer to peer communication client</title>
                <link>https://people.skolelinux.org/pere/blog/Jami_Ring__finally_functioning_peer_to_peer_communication_client.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Jami_Ring__finally_functioning_peer_to_peer_communication_client.html</guid>
                <pubDate>Wed, 19 Jun 2019 08:50:00 +0200</pubDate>
                <description>&lt;p&gt;Some years ago, in 2016, I
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Experience_and_updated_recipe_for_using_the_Signal_app_without_a_mobile_phone.html&quot;&gt;wrote
for the first time about&lt;/a&gt; the Ring peer to peer messaging system.
It would provide messaging without any central server coordinating the
system and without requiring all users to register a phone number or
own a mobile phone.  Back then, I could not get it to work, and put it
aside until it had seen more development.  A few days ago I decided to
give it another try, and am happy to report that this time I am able
to not only send and receive messages, but also place audio and video
calls.  But only if UDP is not blocked into your network.&lt;/p&gt;

&lt;p&gt;The Ring system changed name earlier this year to
&lt;a href=&quot;https://en.wikipedia.org/wiki/Jami_(software)&quot;&gt;Jami&lt;/a&gt;.  I
tried doing web search for &#39;ring&#39; when I discovered it for the first
time, and can only applaud this change as it is impossible to find
something called Ring among the noise of other uses of that word.  Now
you can search for &#39;jami&#39; and this client and
&lt;a href=&quot;https://jami.net/&quot;&gt;the Jami system&lt;/a&gt; is the first hit at
least on duckduckgo.&lt;/p&gt;

&lt;p&gt;Jami will by default encrypt messages as well as audio and video
calls, and try to send them directly between the communicating parties
if possible.  If this proves impossible (for example if both ends are
behind NAT), it will use a central SIP TURN server maintained by the
Jami project.  Jami can also be a normal SIP client.  If the SIP
server is unencrypted, the audio and video calls will also be
unencrypted.  This is as far as I know the only case where Jami will
do anything without encryption.&lt;/p&gt;

&lt;p&gt;Jami is available for several platforms: Linux, Windows, MacOSX,
Android, iOS, and Android TV.  It is included in Debian already.  Jami
also work for those using F-Droid without any Google connections,
while Signal do not.
&lt;a href=&quot;https://git.jami.net/savoirfairelinux/ring-project/wikis/technical/Protocol&quot;&gt;The
protocol&lt;/a&gt; is described in the Ring project wiki.  The system uses a
distributed hash table (DHT) system (similar to BitTorrent) running
over UDP.  On one of the networks I use, I discovered Jami failed to
work.  I tracked this down to the fact that incoming UDP packages
going to ports 1-49999 were blocked, and the DHT would pick a random
port and end up in the low range most of the time.  After talking to
the developers, I solved this by enabling the dhtproxy in the
settings, thus using TCP to talk to a central DHT proxy instead of

peering directly with others.  I&#39;ve been told the developers are
working on allowing DHT to use TCP to avoid this problem.  I also ran
into a problem when trying to talk to the version of Ring included in
Debian Stable (Stretch).  Apparently the protocol changed between
beta2 and the current version, making these clients incompatible.
Hopefully the protocol will not be made incompatible in the
future.&lt;/p&gt;

&lt;p&gt;It is worth noting that while looking at Jami and its features, I
came across another communication platform I have not tested yet.  The
&lt;a href=&quot;https://en.wikipedia.org/wiki/Tox_(protocol)&quot;&gt;Tox protocol&lt;/a&gt;
and &lt;a href=&quot;https://tox.chat/&quot;&gt;family of Tox clients&lt;/a&gt;.  It might
become the topic of a future blog post.&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Fetching trusted timestamps using the rfc3161ng python module</title>
                <link>https://people.skolelinux.org/pere/blog/Fetching_trusted_timestamps_using_the_rfc3161ng_python_module.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Fetching_trusted_timestamps_using_the_rfc3161ng_python_module.html</guid>
                <pubDate>Mon, 8 Oct 2018 12:30:00 +0200</pubDate>
                <description>&lt;p&gt;I have  earlier covered the basics of trusted timestamping using the
&#39;openssl ts&#39; client.  See blog post for
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html&quot;&gt;2014&lt;/a&gt;,
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html&quot;&gt;2016&lt;/a&gt;
and
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Idea_for_storing_trusted_timestamps_in_a_Noark_5_archive.html&quot;&gt;2017&lt;/a&gt;
for those stories.  But some times I want to integrate the timestamping
in other code, and recently I needed to integrate it into Python.
After searching a bit, I found
&lt;a href=&quot;https://dev.entrouvert.org/projects/python-rfc3161&quot;&gt;the
rfc3161 library&lt;/a&gt; which seemed like a good fit, but I soon
discovered it only worked for python version 2, and I needed something
that work with python version 3.  Luckily I next came across
&lt;a href=&quot;https://github.com/trbs/rfc3161ng/&quot;&gt;the rfc3161ng library&lt;/a&gt;,
a fork of the original rfc3161 library.  Not only is it working with
python 3, it have fixed a few of the bugs in the original library, and
it has an active maintainer.  I decided to wrap it up and make it
&lt;a href=&quot;https://tracker.debian.org/pkg/python-rfc3161ng&quot;&gt;available in
Debian&lt;/a&gt;, and a few days ago it entered Debian unstable and testing.&lt;/p&gt;

&lt;p&gt;Using the library is fairly straight forward.  The only slightly
problematic step is to fetch the required certificates to verify the
timestamp.  For some services it is straight forward, while for others
I have not yet figured out how to do it.  Here is a small standalone
code example based on of the integration tests in the library code:&lt;/p&gt;

&lt;pre&gt;
#!/usr/bin/python3

&quot;&quot;&quot;

Python 3 script demonstrating how to use the rfc3161ng module to
get trusted timestamps.

The license of this code is the same as the license of the rfc3161ng
library, ie MIT/BSD.

&quot;&quot;&quot;

import os
import pyasn1.codec.der
import rfc3161ng
import subprocess
import tempfile
import urllib.request

def store(f, data):
    f.write(data)
    f.flush()
    f.seek(0)

def fetch(url, f=None):
    response = urllib.request.urlopen(url)
    data = response.read()
    if f:
        store(f, data)
    return data

def main():
    with tempfile.NamedTemporaryFile() as cert_f,\
         tempfile.NamedTemporaryFile() as ca_f,\
         tempfile.NamedTemporaryFile() as msg_f,\
         tempfile.NamedTemporaryFile() as tsr_f:

        # First fetch certificates used by service
        certificate_data = fetch(&#39;https://freetsa.org/files/tsa.crt&#39;, cert_f)
        ca_data_data = fetch(&#39;https://freetsa.org/files/cacert.pem&#39;, ca_f)

        # Then timestamp the message
        timestamper = \
            rfc3161ng.RemoteTimestamper(&#39;http://freetsa.org/tsr&#39;,
                                        certificate=certificate_data)
        data = b&quot;Python forever!\n&quot;
        tsr = timestamper(data=data, return_tsr=True)

        # Finally, convert message and response to something &#39;openssl ts&#39; can verify
        store(msg_f, data)
        store(tsr_f, pyasn1.codec.der.encoder.encode(tsr))
        args = [&quot;openssl&quot;, &quot;ts&quot;, &quot;-verify&quot;,
                &quot;-data&quot;, msg_f.name,
                &quot;-in&quot;, tsr_f.name,
                &quot;-CAfile&quot;, ca_f.name,
                &quot;-untrusted&quot;, cert_f.name]
        subprocess.check_call(args)

if &#39;__main__&#39; == __name__:
   main()
&lt;/pre&gt;

&lt;p&gt;The code fetches the required certificates, store them as temporary
files, timestamp a simple message, store the message and timestamp to
disk and ask &#39;openssl ts&#39; to verify the timestamp.  A timestamp is
around 1.5 kiB in size, and should be fairly easy to store for future
use.&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Stortingsflertallet går inn for ny IP-basert sensurinfrastruktur i Norge</title>
                <link>https://people.skolelinux.org/pere/blog/Stortingsflertallet_g_r_inn_for_ny_IP_basert_sensurinfrastruktur_i_Norge.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Stortingsflertallet_g_r_inn_for_ny_IP_basert_sensurinfrastruktur_i_Norge.html</guid>
                <pubDate>Tue, 24 Apr 2018 15:00:00 +0200</pubDate>
                <description>&lt;p&gt;&lt;a href=&quot;https://www.vg.no/sport/i/J1g8zj/stortingsvedtak-snart-ip-blokkerer-utenlandske-spillselskaper&quot;&gt;VG&lt;/a&gt;,
&lt;a href=&quot;https://www.dagbladet.no/nyheter/stortinget-blokkerer-utenlandske-spillselskaper/69740219&quot;&gt;Dagbladet&lt;/a&gt;
og
&lt;a href=&quot;https://www.nrk.no/ostfold/tar-opp-kampen-mot-utenlandske-spillselskap-1.14021381&quot;&gt;NRK&lt;/a&gt;
melder i dag at flertallet i Familie- og kulturkomiteen på Stortinget
har bestemt seg for å introdusere en ny sensurinfrastruktur i Norge.
Fra før har Norge en «frivillig» sensurinfrastruktur basert på
DNS-navn, der de største ISP-ene basert på en liste med DNS-navn
forgifter DNS-svar og omdirigerer til et annet IP-nummer enn det som
ligger i DNS.  Nå kommer altså IP-basert omdirigering i tillegg.  Når
infrastrukturen er på plass, er sensur av IP-adresser redusert et
spørsmål om hvilke IP-nummer som skal blokkeres.  Listen over
IP-adresser vil naturligvis endre seg etter hvert som myndighetene
endrer seg.  Det er ingen betryggende tanke.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>«Rapporten ser ikke på informasjonssikkerhet knyttet til personlig integritet»</title>
                <link>https://people.skolelinux.org/pere/blog/_Rapporten_ser_ikke_p__informasjonssikkerhet_knyttet_til_personlig_integritet_.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/_Rapporten_ser_ikke_p__informasjonssikkerhet_knyttet_til_personlig_integritet_.html</guid>
                <pubDate>Tue, 27 Jun 2017 17:50:00 +0200</pubDate>
                <description>&lt;p&gt;Jeg kom over teksten
«&lt;a href=&quot;https://freedom-to-tinker.com/2017/06/21/killing-car-privacy-by-federal-mandate/&quot;&gt;Killing
car privacy by federal mandate&lt;/a&gt;» av Leonid Reyzin på Freedom to
Tinker i dag, og det gleder meg å se en god gjennomgang om hvorfor det
er et urimelig inngrep i privatsfæren å la alle biler kringkaste sin
posisjon og bevegelse via radio.  Det omtalte forslaget basert på
Dedicated Short Range Communication (DSRC) kalles Basic Safety Message
(BSM) i USA og Cooperative Awareness Message (CAM) i Europa, og det
norske Vegvesenet er en av de som ser ut til å kunne tenke seg å
pålegge alle biler å fjerne nok en bit av innbyggernes privatsfære.
Anbefaler alle å lese det som står der.

&lt;p&gt;Mens jeg tittet litt på DSRC på biler i Norge kom jeg over et sitat
jeg synes er illustrativt for hvordan det offentlige Norge håndterer
problemstillinger rundt innbyggernes privatsfære i SINTEF-rapporten
«&lt;a href=&quot;https://www.sintef.no/publikasjoner/publikasjon/Download/?pubid=SINTEF+A23933&quot;&gt;Informasjonssikkerhet
i AutoPASS-brikker&lt;/a&gt;» av Trond Foss:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
«Rapporten ser ikke på informasjonssikkerhet knyttet til personlig
  integritet.»
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Så enkelt kan det tydeligvis gjøres når en vurderer
informasjonssikkerheten.  Det holder vel at folkene på toppen kan si
at «Personvernet er ivaretatt», som jo er den populære intetsigende
frasen som gjør at mange tror enkeltindividers integritet tas vare på.
Sitatet fikk meg til å undres på hvor ofte samme tilnærming, å bare se
bort fra behovet for personlig itegritet, blir valgt når en velger å
legge til rette for nok et inngrep i privatsfæren til personer i
Norge.  Det er jo sjelden det får reaksjoner.  Historien om
reaksjonene på Helse Sør-Østs tjenesteutsetting er jo sørgelig nok et
unntak og toppen av isfjellet, desverre.  Tror jeg fortsatt takker nei
til både AutoPASS og holder meg så langt unna det norske helsevesenet
som jeg kan, inntil de har demonstrert og dokumentert at de verdsetter
individets privatsfære og personlige integritet høyere enn kortsiktig
gevist og samfunnsnytte.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>How to talk with your loved ones in private</title>
                <link>https://people.skolelinux.org/pere/blog/How_to_talk_with_your_loved_ones_in_private.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/How_to_talk_with_your_loved_ones_in_private.html</guid>
                <pubDate>Mon, 7 Nov 2016 10:25:00 +0100</pubDate>
                <description>&lt;p&gt;A few days ago I ran a very biased and informal survey to get an
idea about what options are being used to communicate with end to end
encryption with friends and family.  I explicitly asked people not to
list options only used in a work setting.  The background is the
uneasy feeling I get when using Signal, a feeling shared by others as
a blog post from Sander Venima about
&lt;a href=&quot;https://sandervenema.ch/2016/11/why-i-wont-recommend-signal-anymore/&quot;&gt;why
he do not recommend Signal anymore&lt;/a&gt; (with
&lt;a href=&quot;https://news.ycombinator.com/item?id=12883410&quot;&gt;feedback from
the Signal author available from ycombinator&lt;/a&gt;).  I wanted an
overview of the options being used, and hope to include those options
in a less biased survey later on.  So far I have not taken the time to
look into the individual proposed systems.  They range from text
sharing web pages, via file sharing and email to instant messaging,
VOIP and video conferencing.  For those considering which system to
use, it is also useful to have a look at
&lt;a href=&quot;https://www.eff.org/secure-messaging-scorecard&quot;&gt;the EFF Secure
messaging scorecard&lt;/a&gt; which is slightly out of date but still
provide valuable information.&lt;/p&gt;

&lt;p&gt;So, on to the list.  There were some used by many, some used by a
few, some rarely used ones and a few mentioned but without anyone
claiming to use them.  Notice the grouping is in reality quite random
given the biased self selected set of participants.  First the ones
used by many:&lt;/p&gt;

&lt;ul&gt;

&lt;li&gt;&lt;a href=&quot;https://whispersystems.org/&quot;&gt;Signal&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Email w/&lt;a href=&quot;http://openpgp.org/&quot;&gt;OpenPGP&lt;/a&gt; (Enigmail, GPGSuite,etc)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://www.whatsapp.com/&quot;&gt;Whatsapp&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;IRC w/&lt;a href=&quot;https://otr.cypherpunks.ca/&quot;&gt;OTR&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;XMPP w/&lt;a href=&quot;https://otr.cypherpunks.ca/&quot;&gt;OTR&lt;/a&gt;&lt;/li&gt;

&lt;/ul&gt;

&lt;p&gt;Then the ones used by a few.&lt;/p&gt;

&lt;ul&gt;

&lt;li&gt;&lt;a href=&quot;https://wiki.mumble.info/wiki/Main_Page&quot;&gt;Mumble&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;iMessage (included in iOS from Apple)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://telegram.org/&quot;&gt;Telegram&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://jitsi.org/&quot;&gt;Jitsi&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://keybase.io/download&quot;&gt;Keybase file&lt;/a&gt;&lt;/li&gt;

&lt;/ul&gt;

&lt;p&gt;Then the ones used by even fewer people&lt;/p&gt;

&lt;ul&gt;

&lt;li&gt;&lt;a href=&quot;https://ring.cx/&quot;&gt;Ring&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://bitmessage.org/&quot;&gt;Bitmessage&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://wire.com/&quot;&gt;Wire&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;VoIP w/&lt;a href=&quot;https://en.wikipedia.org/wiki/ZRTP&quot;&gt;ZRTP&lt;/a&gt; or controlled &lt;a href=&quot;https://en.wikipedia.org/wiki/Secure_Real-time_Transport_Protocol&quot;&gt;SRTP&lt;/a&gt; (e.g using &lt;a href=&quot;https://en.wikipedia.org/wiki/CSipSimple&quot;&gt;CSipSimple&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/Linphone&quot;&gt;Linphone&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://matrix.org/&quot;&gt;Matrix&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://kontalk.org/&quot;&gt;Kontalk&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://0bin.net/&quot;&gt;0bin&lt;/a&gt; (encrypted pastebin)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://appear.in&quot;&gt;Appear.in&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://riot.im/&quot;&gt;riot&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://www.wickr.com/&quot;&gt;Wickr Me&lt;/a&gt;&lt;/li&gt;

&lt;/ul&gt;

&lt;p&gt;And finally the ones mentioned by not marked as used by
anyone. This might be a mistake, perhaps the person adding the entry
forgot to flag it as used?&lt;/p&gt;

&lt;ul&gt;

&lt;li&gt;Email w/Certificates &lt;a href=&quot;https://en.wikipedia.org/wiki/S/MIME&quot;&gt;S/MIME&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://www.crypho.com/&quot;&gt;Crypho&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://cryptpad.fr/&quot;&gt;CryptPad&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/ricochet-im/ricochet&quot;&gt;ricochet&lt;/a&gt;&lt;/li&gt;

&lt;/ul&gt;

&lt;p&gt;Given the network effect it seem obvious to me that we as a society
have been divided and conquered by those interested in keeping
encrypted and secure communication away from the masses.  The
finishing remarks &lt;a href=&quot;https://vimeo.com/97505679&quot;&gt;from Aral Balkan
in his talk &quot;Free is a lie&quot;&lt;/a&gt; about the usability of free software
really come into effect when you want to communicate in private with
your friends and family.  We can not expect them to allow the
usability of communication tool to block their ability to talk to
their loved ones.&lt;/p&gt;

&lt;p&gt;Note for example the option IRC w/OTR.  Most IRC clients do not
have OTR support, so in most cases OTR would not be an option, even if
you wanted to.  In my personal experience, about 1 in 20 I talk to
have a IRC client with OTR.  For private communication to really be
available, most people to talk to must have the option in their
currently used client.  I can not simply ask my family to install an
IRC client.  I need to guide them through a technical multi-step
process of adding extensions to the client to get them going.  This is
a non-starter for most.&lt;/p&gt;

&lt;p&gt;I would like to be able to do video phone calls, audio phone calls,
exchange instant messages and share files with my loved ones, without
being forced to share with people I do not know.  I do not want to
share the content of the conversations, and I do not want to share who
I communicate with or the fact that I communicate with someone.
Without all these factors in place, my private life is being more or
less invaded.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Update 2019-10-08&lt;/strong&gt;: Børge Dvergsdal, who told me he
  is Customer Relationship Manager @ Whereby (formerly appear.in),
  asked if I could mention that appear.in is now renamed and found at
  &lt;a href=&quot;https://whereby.com/&quot;&gt;https://whereby.com/&lt;/a&gt;.  And sure,
  why not.  Apparently they changed the name because they were unable
  to trademark appear.in somewhere...  While I am at it, I can mention
  that Ring changed name to Jami, now available from &lt;a
  href=&quot;https://jami.net/&quot;&gt;https://jami.net/&lt;/a&gt;.  Luckily they were
  able to have a direct redirect from ring.cx to jami.net, so the user
  experience is almost the same.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Aktivitetsbånd som beskytter privatsfæren</title>
                <link>https://people.skolelinux.org/pere/blog/Aktivitetsb_nd_som_beskytter_privatsf_ren.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Aktivitetsb_nd_som_beskytter_privatsf_ren.html</guid>
                <pubDate>Thu, 3 Nov 2016 09:55:00 +0100</pubDate>
                <description>&lt;p&gt;Jeg ble så imponert over
&lt;a href=&quot;https://www.nrk.no/norge/forbrukerradet-mener-aktivitetsarmband-strider-mot-norsk-lov-1.13209079&quot;&gt;dagens
gladnyhet på NRK&lt;/a&gt;, om at Forbrukerrådet klager inn vilkårene for
bruk av aktivitetsbånd fra Fitbit, Garmin, Jawbone og Mio til
Datatilsynet og forbrukerombudet, at jeg sendte følgende brev til
forbrukerrådet for å uttrykke min støtte:

&lt;blockquote&gt;

&lt;p&gt;Jeg ble veldig glad over å lese at Forbrukerrådet
&lt;a href=&quot;http://www.forbrukerradet.no/siste-nytt/klager-inn-aktivitetsarmband-for-brudd-pa-norsk-lov/&quot;&gt;klager
inn flere aktivitetsbånd til Datatilsynet for dårlige vilkår&lt;/a&gt;.  Jeg
har ønsket meg et aktivitetsbånd som kan måle puls, bevegelse og
gjerne også andre helserelaterte indikatorer en stund nå.  De eneste
jeg har funnet i salg gjør, som dere også har oppdaget, graverende
inngrep i privatsfæren og sender informasjonen ut av huset til folk og
organisasjoner jeg ikke ønsker å dele aktivitets- og helseinformasjon
med.  Jeg ønsker et alternativ som &lt;em&gt;ikke&lt;/em&gt; sender informasjon til
skyen, men derimot bruker
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Fri_og__pen_standard__slik_Digistan_ser_det.html&quot;&gt;en
fritt og åpent standardisert&lt;/a&gt; protokoll (eller i det minste en
dokumentert protokoll uten patent- og opphavsrettslige
bruksbegrensinger) til å kommunisere med datautstyr jeg kontrollerer.
Er jo ikke interessert i å betale noen for å tilrøve seg
personopplysninger fra meg.  Desverre har jeg ikke funnet noe
alternativ så langt.&lt;/p&gt;

&lt;p&gt;Det holder ikke å endre på bruksvilkårene for enhetene, slik
Datatilsynet ofte legger opp til i sin behandling, når de gjør slik
f.eks. Fitbit (den jeg har sett mest på).  Fitbit krypterer
informasjonen på enheten og sender den kryptert til leverandøren.  Det
gjør det i praksis umulig både å sjekke hva slags informasjon som
sendes over, og umulig å ta imot informasjonen selv i stedet for
Fitbit.  Uansett hva slags historie som forteller i bruksvilkårene er
en jo både prisgitt leverandørens godvilje og at de ikke tvinges av
sitt lands myndigheter til å lyve til sine kunder om hvorvidt
personopplysninger spres ut over det bruksvilkårene sier.  Det er
veldokumentert hvordan f.eks. USA tvinger selskaper vha. såkalte
National security letters til å utlevere personopplysninger samtidig
som de ikke får lov til å fortelle dette til kundene sine.&lt;/p&gt;

&lt;p&gt;Stå på, jeg er veldig glade for at dere har sett på saken.  Vet
dere om aktivitetsbånd i salg i dag som ikke tvinger en til å utlevere
aktivitets- og helseopplysninger med leverandøren?&lt;/p&gt;

&lt;/blockquote&gt;

&lt;p&gt;Jeg håper en konkurrent som respekterer kundenes privatliv klarer å
nå opp i markedet, slik at det finnes et reelt alternativ for oss som
har full tillit til at skyleverandører vil prioritere egen inntjening
og myndighetspålegg langt foran kundenes rett til privatliv.  Jeg har
ingen tiltro til at Datatilsynet vil kreve noe mer enn at vilkårene
endres slik at de forklarer eksplisitt i hvor stor grad bruk av
produktene utraderer privatsfæren til kundene.  Det vil nok gjøre de
innklagede armbåndene «lovlige», men fortsatt tvinge kundene til å
dele sine personopplysninger med leverandøren.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Experience and updated recipe for using the Signal app without a mobile phone</title>
                <link>https://people.skolelinux.org/pere/blog/Experience_and_updated_recipe_for_using_the_Signal_app_without_a_mobile_phone.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Experience_and_updated_recipe_for_using_the_Signal_app_without_a_mobile_phone.html</guid>
                <pubDate>Mon, 10 Oct 2016 11:30:00 +0200</pubDate>
                <description>&lt;p&gt;In July
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/How_to_use_the_Signal_app_if_you_only_have_a_land_line__ie_no_mobile_phone_.html&quot;&gt;I
wrote how to get the Signal Chrome/Chromium app working&lt;/a&gt; without
the ability to receive SMS messages (aka without a cell phone).  It is
time to share some experiences and provide an updated setup.&lt;/p&gt;

&lt;p&gt;The Signal app have worked fine for several months now, and I use
it regularly to chat with my loved ones.  I had a major snag at the
end of my summer vacation, when the the app completely forgot my
setup, identity and keys.  The reason behind this major mess was
running out of disk space.  To avoid that ever happening again I have
started storing everything in &lt;tt&gt;userdata/&lt;/tt&gt; in git, to be able to
roll back to an earlier version if the files are wiped by mistake.  I
had to use it once after introducing the git backup.  When rolling
back to an earlier version, one need to use the &#39;reset session&#39; option
in Signal to get going, and notify the people you talk with about the
problem.  I assume there is some sequence number tracking in the
protocol to detect rollback attacks.  The git repository is rather big
(674 MiB so far), but I have not tried to figure out if some of the
content can be added to a .gitignore file due to lack of spare
time.&lt;/p&gt;

&lt;p&gt;I&#39;ve also hit the 90 days timeout blocking, and noticed that this
make it impossible to send messages using Signal.  I could still
receive them, but had to patch the code with a new timestamp to send.
I believe the timeout is added by the developers to force people to
upgrade to the latest version of the app, even when there is no
protocol changes, to reduce the version skew among the user base and
thus try to keep the number of support requests down.&lt;/p&gt;

&lt;p&gt;Since my original recipe, the Signal source code changed slightly,
making the old patch fail to apply cleanly.  Below is an updated
patch, including the shell wrapper I use to start Signal.  The
original version required a new user to locate the JavaScript console
and call a function from there.  I got help from a friend with more
JavaScript knowledge than me to modify the code to provide a GUI
button instead.  This mean that to get started you just need to run
the wrapper and click the &#39;Register without mobile phone&#39; to get going
now.  I&#39;ve also modified the timeout code to always set it to 90 days
in the future, to avoid having to patch the code regularly.&lt;/p&gt;

&lt;p&gt;So, the updated recipe for Debian Jessie:&lt;/p&gt;

&lt;ol&gt;

&lt;li&gt;First, install required packages to get the source code and the
browser you need.  Signal only work with Chrome/Chromium, as far as I
know, so you need to install it.

&lt;pre&gt;
apt install git tor chromium
git clone https://github.com/WhisperSystems/Signal-Desktop.git
&lt;/pre&gt;&lt;/li&gt;

&lt;li&gt;Modify the source code using command listed in the the patch
block below.&lt;/li&gt;

&lt;li&gt;Start Signal using the run-signal-app wrapper (for example using
&lt;tt&gt;`pwd`/run-signal-app&lt;/tt&gt;).

&lt;li&gt;Click on the &#39;Register without mobile phone&#39;, will in a phone
number you can receive calls to the next minute, receive the
verification code and enter it into the form field and press
&#39;Register&#39;.  Note, the phone number you use will be user Signal
username, ie the way others can find you on Signal.&lt;/li&gt;

&lt;li&gt;You can now use Signal to contact others.  Note, new contacts do
not show up in the contact list until you restart Signal, and there is
no way to assign names to Contacts.  There is also no way to create or
update chat groups.  I suspect this is because the web app do not have
a associated contact database.&lt;/li&gt;

&lt;/ol&gt;

&lt;p&gt;I am still a bit uneasy about using Signal, because of the way its
main author moxie0 reject federation and accept dependencies to major
corporations like Google (part of the code is fetched from Google) and
Amazon (the central coordination point is owned by Amazon).  See for
example
&lt;a href=&quot;https://github.com/LibreSignal/LibreSignal/issues/37&quot;&gt;the
LibreSignal issue tracker&lt;/a&gt; for a thread documenting the authors
view on these issues.  But the network effect is strong in this case,
and several of the people I want to communicate with already use
Signal.  Perhaps we can all move to &lt;a href=&quot;https://ring.cx/&quot;&gt;Ring&lt;/a&gt;
once it &lt;a href=&quot;https://bugs.debian.org/830265&quot;&gt;work on my
laptop&lt;/a&gt;?  It already work on Windows and Android, and is included
in &lt;a href=&quot;https://tracker.debian.org/pkg/ring&quot;&gt;Debian&lt;/a&gt; and
&lt;a href=&quot;https://launchpad.net/ubuntu/+source/ring&quot;&gt;Ubuntu&lt;/a&gt;, but not
working on Debian Stable.&lt;/p&gt;

&lt;p&gt;Anyway, this is the patch I apply to the Signal code to get it
working.  It switch to the production servers, disable to timeout,
make registration easier and add the shell wrapper:&lt;/p&gt;

&lt;pre&gt;
cd Signal-Desktop; cat &amp;lt;&amp;lt;EOF | patch -p1
diff --git a/js/background.js b/js/background.js
index 24b4c1d..579345f 100644
--- a/js/background.js
+++ b/js/background.js
@@ -33,9 +33,9 @@
         });
     });
 
-    var SERVER_URL = &#39;https://textsecure-service-staging.whispersystems.org&#39;;
+    var SERVER_URL = &#39;https://textsecure-service-ca.whispersystems.org&#39;;
     var SERVER_PORTS = [80, 4433, 8443];
-    var ATTACHMENT_SERVER_URL = &#39;https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com&#39;;
+    var ATTACHMENT_SERVER_URL = &#39;https://whispersystems-textsecure-attachments.s3.amazonaws.com&#39;;
     var messageReceiver;
     window.getSocketStatus = function() {
         if (messageReceiver) {
diff --git a/js/expire.js b/js/expire.js
index 639aeae..beb91c3 100644
--- a/js/expire.js
+++ b/js/expire.js
@@ -1,6 +1,6 @@
 ;(function() {
     &#39;use strict&#39;;
-    var BUILD_EXPIRATION = 0;
+    var BUILD_EXPIRATION = Date.now() + (90 * 24 * 60 * 60 * 1000);
 
     window.extension = window.extension || {};
 
diff --git a/js/views/install_view.js b/js/views/install_view.js
index 7816f4f..1d6233b 100644
--- a/js/views/install_view.js
+++ b/js/views/install_view.js
@@ -38,7 +38,8 @@
             return {
                 &#39;click .step1&#39;: this.selectStep.bind(this, 1),
                 &#39;click .step2&#39;: this.selectStep.bind(this, 2),
-                &#39;click .step3&#39;: this.selectStep.bind(this, 3)
+                &#39;click .step3&#39;: this.selectStep.bind(this, 3),
+                &#39;click .callreg&#39;: function() { extension.install(&#39;standalone&#39;) },
             };
         },
         clearQR: function() {
diff --git a/options.html b/options.html
index dc0f28e..8d709f6 100644
--- a/options.html
+++ b/options.html
@@ -14,7 +14,10 @@
         &amp;lt;div class=&#39;nav&#39;&gt;
           &amp;lt;h1&gt;{{ installWelcome }}&amp;lt;/h1&gt;
           &amp;lt;p&gt;{{ installTagline }}&amp;lt;/p&gt;
-          &amp;lt;div&gt; &amp;lt;a class=&#39;button step2&#39;&gt;{{ installGetStartedButton }}&amp;lt;/a&gt; &amp;lt;/div&gt;
+          &amp;lt;div&gt; &amp;lt;a class=&#39;button step2&#39;&gt;{{ installGetStartedButton }}&amp;lt;/a&gt;
+           &amp;lt;br&gt; &amp;lt;a class=&quot;button callreg&quot;&gt;Register without mobile phone&amp;lt;/a&gt;
+
+         &amp;lt;/div&gt;
           &amp;lt;span class=&#39;dot step1 selected&#39;&gt;&amp;lt;/span&gt;
           &amp;lt;span class=&#39;dot step2&#39;&gt;&amp;lt;/span&gt;
           &amp;lt;span class=&#39;dot step3&#39;&gt;&amp;lt;/span&gt;
--- /dev/null   2016-10-07 09:55:13.730181472 +0200
+++ b/run-signal-app   2016-10-10 08:54:09.434172391 +0200
@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+cd $(dirname $0)
+mkdir -p userdata
+userdata=&quot;`pwd`/userdata&quot;
+if [ -d &quot;$userdata&quot; ] &amp;&amp; [ ! -d &quot;$userdata/.git&quot; ] ; then
+    (cd $userdata &amp;&amp; git init)
+fi
+(cd $userdata &amp;&amp; git add . &amp;&amp; git commit -m &quot;Current status.&quot; || true)
+exec chromium \
+  --proxy-server=&quot;socks://localhost:9050&quot; \
+  --user-data-dir=$userdata --load-and-launch-app=`pwd`
EOF
chmod a+rx run-signal-app
&lt;/pre&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>NRKs kildevern når NRK-epost deles med utenlands etterretning?</title>
                <link>https://people.skolelinux.org/pere/blog/NRKs_kildevern_n_r_NRK_epost_deles_med_utenlands_etterretning_.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/NRKs_kildevern_n_r_NRK_epost_deles_med_utenlands_etterretning_.html</guid>
                <pubDate>Sat, 8 Oct 2016 08:15:00 +0200</pubDate>
                <description>&lt;p&gt;NRK
&lt;a href=&quot;https://nrkbeta.no/2016/09/02/securing-whistleblowers/&quot;&gt;lanserte
for noen uker siden&lt;/a&gt; en ny
&lt;a href=&quot;https://www.nrk.no/varsle/&quot;&gt;varslerportal som bruker
SecureDrop til å ta imot tips&lt;/a&gt; der det er vesentlig at ingen
utenforstående får vite at NRK er tipset.  Det er et langt steg
fremover for NRK, og når en leser bloggposten om hva de har tenkt på
og hvordan løsningen er satt opp virker det som om de har gjort en
grundig jobb der.  Men det er ganske mye ekstra jobb å motta tips via
SecureDrop, så varslersiden skriver &quot;Nyhetstips som ikke krever denne
typen ekstra vern vil vi gjerne ha på nrk.no/03030&quot;, og 03030-siden
foreslår i tillegg til et webskjema å bruke epost, SMS, telefon,
personlig oppmøte og brevpost.  Denne artikkelen handler disse andre
metodene.&lt;/p&gt;

&lt;p&gt;Når en sender epost til en @nrk.no-adresse så vil eposten sendes ut
av landet til datamaskiner kontrollert av Microsoft.  En kan sjekke
dette selv ved å slå opp epostleveringsadresse (MX) i DNS.  For NRK er
dette i dag &quot;nrk-no.mail.protection.outlook.com&quot;.  NRK har som en ser
valgt å sette bort epostmottaket sitt til de som står bak outlook.com,
dvs. Microsoft.  En kan sjekke hvor nettverkstrafikken tar veien
gjennom Internett til epostmottaket vha. programmet
&lt;tt&gt;traceroute&lt;/tt&gt;, og finne ut hvem som eier en Internett-adresse
vha. whois-systemet.  Når en gjør dette for epost-trafikk til @nrk.no
ser en at trafikken fra Norge mot nrk-no.mail.protection.outlook.com
går via Sverige mot enten Irland eller Tyskland (det varierer fra gang
til gang og kan endre seg over tid).&lt;/p&gt;

&lt;p&gt;Vi vet fra
&lt;a href=&quot;https://no.wikipedia.org/wiki/FRA-loven&quot;&gt;introduksjonen av
FRA-loven&lt;/a&gt; at IP-trafikk som passerer grensen til Sverige avlyttes
av Försvarets radioanstalt (FRA).  Vi vet videre takket være
Snowden-bekreftelsene at trafikk som passerer grensen til
Storbritannia avlyttes av Government Communications Headquarters
(GCHQ).  I tillegg er er det nettopp lansert et forslag i Norge om at
forsvarets E-tjeneste skal få avlytte trafikk som krysser grensen til
Norge. Jeg er ikke kjent med dokumentasjon på at Irland og Tyskland
gjør det samme.  Poenget er uansett at utenlandsk etterretning har
mulighet til å snappe opp trafikken når en sender epost til @nrk.no.
I tillegg er det selvsagt tilgjengelig for Microsoft som er underlagt USAs
jurisdiksjon og
&lt;a href=&quot;https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-collaboration-user-data&quot;&gt;samarbeider
med USAs etterretning på flere områder&lt;/a&gt;.  De som tipser NRK om
nyheter via epost kan dermed gå ut fra at det blir kjent for mange
andre enn NRK at det er gjort.&lt;/p&gt;

&lt;p&gt;Bruk av SMS og telefon registreres av blant annet telefonselskapene
og er tilgjengelig i følge lov og forskrift for blant annet Politi,
NAV og Finanstilsynet, i tillegg til IT-folkene hos telefonselskapene
og deres overordnede.  Hvis innringer eller mottaker bruker
smarttelefon vil slik kontakt også gjøres tilgjengelig for ulike
app-leverandører og de som lytter på trafikken mellom telefon og
app-leverandør, alt etter hva som er installert på telefonene som
brukes.&lt;/p&gt;

&lt;p&gt;Brevpost kan virke trygt, og jeg vet ikke hvor mye som registreres
og lagres av postens datastyrte postsorteringssentraler.  Det vil ikke
overraske meg om det lagres hvor i landet hver konvolutt kommer fra og
hvor den er adressert, i hvert fall for en kortere periode.  Jeg vet
heller ikke hvem slik informasjon gjøres tilgjengelig for.  Det kan
være nok til å ringe inn potensielle kilder når det krysses med hvem
som kjente til aktuell informasjon og hvor de befant seg (tilgjengelig
f.eks.  hvis de bærer mobiltelefon eller bor i nærheten).&lt;/p&gt;

&lt;p&gt;Personlig oppmøte hos en NRK-journalist er antagelig det tryggeste,
men en bør passe seg for å bruke NRK-kantina.  Der bryter de nemlig
&lt;a href=&quot;http://www.lovdata.no/all/hl-19850524-028.html#14&quot;&gt;Sentralbanklovens
paragraf 14&lt;/a&gt; og nekter folk å betale med kontanter.  I stedet
krever de at en varsle sin bankkortutsteder om hvor en befinner seg
ved å bruke bankkort.  Banktransaksjoner er tilgjengelig for
bankkortutsteder (det være seg VISA, Mastercard, Nets og/eller en
bank) i tillegg til politiet og i hvert fall tidligere med Se &amp; Hør
(via utro tjenere, slik det ble avslørt etter utgivelsen av boken
«Livet, det forbannede» av Ken B. Rasmussen).  Men hvor mange kjenner
en NRK-journalist personlig?  Besøk på NRK på Marienlyst krever at en
registrerer sin ankost elektronisk i besøkssystemet.  Jeg vet ikke hva
som skjer med det datasettet, men har grunn til å tro at det sendes ut
SMS til den en skal besøke med navnet som er oppgitt.  Kanskje greit å
oppgi falskt navn.&lt;/p&gt;

&lt;p&gt;Når så tipset er kommet frem til NRK skal det behandles
redaksjonelt i NRK.  Der vet jeg via ulike kilder at de fleste
journalistene bruker lokalt installert programvare, men noen bruker
Google Docs og andre skytjenester i strid med interne retningslinjer
når de skriver.  Hvordan vet en hvem det gjelder?  Ikke vet jeg, men
det kan være greit å spørre for å sjekke at journalisten har tenkt på
problemstillingen, før en gir et tips.  Og hvis tipset omtales internt
på epost, er det jo grunn til å tro at også intern eposten vil deles
med Microsoft og utenlands etterretning, slik tidligere nevnt, men det
kan hende at det holdes internt i NRKs interne MS Exchange-løsning.
Men Microsoft ønsker å få alle Exchange-kunder over &quot;i skyen&quot; (eller
andre folks datamaskiner, som det jo innebærer), så jeg vet ikke hvor
lenge det i så fall vil vare.&lt;/p&gt;

&lt;p&gt;I tillegg vet en jo at
&lt;a href=&quot;https://www.nrk.no/ytring/elektronisk-kildevern-i-nrk-1.11941196&quot;&gt;NRK
har valgt å gi nasjonal sikkerhetsmyndighet (NSM) tilgang til å se på
intern og ekstern Internett-trafikk&lt;/a&gt; hos NRK ved oppsett av såkalte
VDI-noder, på tross av
&lt;a href=&quot;https://www.nrk.no/ytring/bekymring-for-nrks-kildevern-1.11941584&quot;&gt;protester
fra NRKs journalistlag&lt;/a&gt;.  Jeg vet ikke om den vil kunne snappe opp
dokumenter som lagres på interne filtjenere eller dokumenter som lages
i de interne webbaserte publiseringssystemene, men vet at hva noden
ser etter på nettet kontrolleres av NSM og oppdateres automatisk, slik
at det ikke gir så mye mening å sjekke hva noden ser etter i dag når
det kan endres automatisk i morgen.&lt;/p&gt;

&lt;p&gt;Personlig vet jeg ikke om jeg hadde turt tipse NRK hvis jeg satt på
noe som kunne være en trussel mot den bestående makten i Norge eller
verden.  Til det virker det å være for mange åpninger for
utenforstående med andre prioriteter enn NRKs journalistiske fokus.
Og den største truslen for en varsler er jo om metainformasjon kommer
på avveie, dvs. informasjon om at en har vært i kontakt med en
journalist.  Det kan være nok til at en kommer i myndighetenes
søkelys, og de færreste har nok operasjonell sikkerhet til at vil tåle
slik flombelysning på sitt privatliv.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Unlocking HTC Desire HD on Linux using unruu and fastboot</title>
                <link>https://people.skolelinux.org/pere/blog/Unlocking_HTC_Desire_HD_on_Linux_using_unruu_and_fastboot.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Unlocking_HTC_Desire_HD_on_Linux_using_unruu_and_fastboot.html</guid>
                <pubDate>Thu, 7 Jul 2016 11:30:00 +0200</pubDate>
                <description>&lt;p&gt;Yesterday, I tried to unlock a HTC Desire HD phone, and it proved
to be a slight challenge.  Here is the recipe if I ever need to do it
again.  It all started by me wanting to try the recipe to set up
&lt;a href=&quot;https://blog.torproject.org/blog/mission-impossible-hardening-android-security-and-privacy&quot;&gt;an
hardened Android installation&lt;/a&gt; from the Tor project blog on a
device I had access to.  It is a old mobile phone with a broken
microphone The initial idea had been to just
&lt;a href=&quot;http://wiki.cyanogenmod.org/w/Install_CM_for_ace&quot;&gt;install
CyanogenMod on it&lt;/a&gt;, but did not quite find time to start on it
until a few days ago.&lt;/p&gt;

&lt;p&gt;The unlock process is supposed to be simple: (1) Boot into the boot
loader (press volume down and power at the same time), (2) select
&#39;fastboot&#39; before (3) connecting the device via USB to a Linux
machine, (4) request the device identifier token by running &#39;fastboot
oem get_identifier_token&#39;, (5) request the device unlocking key using
the &lt;a href=&quot;http://www.htcdev.com/bootloader/&quot;&gt;HTC developer web
site&lt;/a&gt; and unlock the phone using the key file emailed to you.&lt;/p&gt;

&lt;p&gt;Unfortunately, this only work fi you have hboot version 2.00.0029
or newer, and the device I was working on had 2.00.0027.  This
apparently can be easily fixed by downloading a Windows program and
running it on your Windows machine, if you accept the terms Microsoft
require you to accept to use Windows - which I do not.  So I had to
come up with a different approach.  I got a lot of help from AndyCap
on #nuug, and would not have been able to get this working without
him.&lt;/p&gt;

&lt;p&gt;First I needed to extract the hboot firmware from
&lt;a href=&quot;http://www.htcdev.com/ruu/PD9810000_Ace_Sense30_S_hboot_2.00.0029.exe&quot;&gt;the
windows binary for HTC Desire HD&lt;/a&gt; downloaded as &#39;the RUU&#39; from HTC.
For this there is is &lt;a href=&quot;https://github.com/kmdm/unruu/&quot;&gt;a github
project named unruu&lt;/a&gt; using libunshield.  The unshield tool did not
recognise the file format, but unruu worked and extracted rom.zip,
containing the new hboot firmware and a text file describing which
devices it would work for.&lt;/p&gt;

&lt;p&gt;Next, I needed to get the new firmware into the device.  For this I
followed some instructions
&lt;a href=&quot;http://www.htc1guru.com/2013/09/new-ruu-zips-posted/&quot;&gt;available
from HTC1Guru.com&lt;/a&gt;, and ran these commands as root on a Linux
machine with Debian testing:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
adb reboot-bootloader
fastboot oem rebootRUU
fastboot flash zip rom.zip
fastboot flash zip rom.zip
fastboot reboot
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;The flash command apparently need to be done twice to take effect,
as the first is just preparations and the second one do the flashing.
The adb command is just to get to the boot loader menu, so turning the
device on while holding volume down and the power button should work
too.&lt;/p&gt;

&lt;p&gt;With the new hboot version in place I could start following the
instructions on the HTC developer web site.  I got the device token
like this:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
fastboot oem get_identifier_token 2&gt;&amp;1 | sed &#39;s/(bootloader) //&#39;
&lt;/pre&gt;

&lt;p&gt;And once I got the unlock code via email, I could use it like
this:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
fastboot flash unlocktoken Unlock_code.bin
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;And with that final step in place, the phone was unlocked and I
could start stuffing the software of my own choosing into the device.
So far I only inserted a replacement recovery image to wipe the phone
before I start.  We will see what happen next.  Perhaps I should
install &lt;a href=&quot;https://www.debian.org/&quot;&gt;Debian&lt;/a&gt; on it. :)&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>How to use the Signal app if you only have a land line (ie no mobile phone)</title>
                <link>https://people.skolelinux.org/pere/blog/How_to_use_the_Signal_app_if_you_only_have_a_land_line__ie_no_mobile_phone_.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/How_to_use_the_Signal_app_if_you_only_have_a_land_line__ie_no_mobile_phone_.html</guid>
                <pubDate>Sun, 3 Jul 2016 14:20:00 +0200</pubDate>
                <description>&lt;p&gt;For a while now, I have wanted to test
&lt;a href=&quot;https://whispersystems.org/&quot;&gt;the Signal app&lt;/a&gt;, as it is
said to provide end to end encrypted communication and several of my
friends and family are already using it.  As I by choice do not own a
mobile phone, this proved to be harder than expected.  And I wanted to
have the source of the client and know that it was the code used on my
machine.  But yesterday I managed to get it working.  I used the
Github source, compared it to the source in
&lt;a href=&quot;https://chrome.google.com/webstore/detail/signal-private-messenger/bikioccmkafdpakkkcpdbppfkghcmihk?hl=en-US&quot;&gt;the
Signal Chrome app&lt;/a&gt; available from the Chrome web store, applied
patches to use the production Signal servers, started the app and
asked for the hidden &quot;register without a smart phone&quot; form.  Here is
the recipe how I did it.&lt;/p&gt;

&lt;p&gt;First, I fetched the Signal desktop source from Github, using

&lt;pre&gt;
git clone https://github.com/WhisperSystems/Signal-Desktop.git
&lt;/pre&gt;

&lt;p&gt;Next, I patched the source to use the production servers, to be
able to talk to other Signal users:&lt;/p&gt;

&lt;pre&gt;
cat &amp;lt;&amp;lt;EOF | patch -p0
diff -ur ./js/background.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js
--- ./js/background.js  2016-06-29 13:43:15.630344628 +0200
+++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/background.js    2016-06-29 14:06:29.530300934 +0200
@@ -47,8 +47,8 @@
         });
     });
 
-    var SERVER_URL = &#39;https://textsecure-service-staging.whispersystems.org&#39;;
-    var ATTACHMENT_SERVER_URL = &#39;https://whispersystems-textsecure-attachments-staging.s3.amazonaws.com&#39;;
+    var SERVER_URL = &#39;https://textsecure-service-ca.whispersystems.org:4433&#39;;
+    var ATTACHMENT_SERVER_URL = &#39;https://whispersystems-textsecure-attachments.s3.amazonaws.com&#39;;
     var messageReceiver;
     window.getSocketStatus = function() {
         if (messageReceiver) {
diff -ur ./js/expire.js userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js
--- ./js/expire.js      2016-06-29 13:43:15.630344628 +0200
+++ userdata/Default/Extensions/bikioccmkafdpakkkcpdbppfkghcmihk/0.15.0_0/js/expire.js2016-06-29 14:06:29.530300934 +0200
@@ -1,6 +1,6 @@
 ;(function() {
     &#39;use strict&#39;;
-    var BUILD_EXPIRATION = 0;
+    var BUILD_EXPIRATION = 1474492690000;
 
     window.extension = window.extension || {};
 
EOF
&lt;/pre&gt;

&lt;p&gt;The first part is changing the servers, and the second is updating
an expiration timestamp.  This timestamp need to be updated regularly.
It is set 90 days in the future by the build process (Gruntfile.js).
The value is seconds since 1970 times 1000, as far as I can tell.&lt;/p&gt;

&lt;p&gt;Based on a tip and good help from the #nuug IRC channel, I wrote a
script to launch Signal in Chromium.&lt;/p&gt;

&lt;pre&gt;
#!/bin/sh
cd $(dirname $0)
mkdir -p userdata
exec chromium \
  --proxy-server=&quot;socks://localhost:9050&quot; \
  --user-data-dir=`pwd`/userdata --load-and-launch-app=`pwd`
&lt;/pre&gt;

&lt;p&gt; The script start the app and configure Chromium to use the Tor
SOCKS5 proxy to make sure those controlling the Signal servers (today
Amazon and Whisper Systems) as well as those listening on the lines
will have a harder time location my laptop based on the Signal
connections if they use source IP address.&lt;/p&gt;

&lt;p&gt;When the script starts, one need to follow the instructions under
&quot;Standalone Registration&quot; in the CONTRIBUTING.md file in the git
repository.  I right clicked on the Signal window to get up the
Chromium debugging tool, visited the &#39;Console&#39; tab and wrote
&#39;extension.install(&quot;standalone&quot;)&#39; on the console prompt to get the
registration form.  Then I entered by land line phone number and
pressed &#39;Call&#39;.  5 seconds later the phone rang and a robot voice
repeated the verification code three times.  After entering the number
into the verification code field in the form, I could start using
Signal from my laptop.

&lt;p&gt;As far as I can tell, The Signal app will leak who is talking to
whom and thus who know who to those controlling the central server,
but such leakage is hard to avoid with a centrally controlled server
setup.  It is something to keep in mind when using Signal - the
content of your chats are harder to intercept, but the meta data
exposing your contact network is available to people you do not know.
So better than many options, but not great.  And sadly the usage is
connected to my land line, thus allowing those controlling the server
to associate it to my home and person.  I would prefer it if only
those I knew could tell who I was on Signal.  There are options
avoiding such information leakage, but most of my friends are not
using them, so I am stuck with Signal for now.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Update 2017-01-10&lt;/strong&gt;: There is an updated blog post
on this topic in
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Experience_and_updated_recipe_for_using_the_Signal_app_without_a_mobile_phone.html&quot;&gt;Experience
and updated recipe for using the Signal app without a mobile
phone&lt;/a&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>syslog-trusted-timestamp - chain of trusted timestamps for your syslog</title>
                <link>https://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html</guid>
                <pubDate>Sat, 2 Apr 2016 09:50:00 +0200</pubDate>
                <description>&lt;p&gt;Two years ago, I had
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html&quot;&gt;a
look at trusted timestamping options available&lt;/a&gt;, and among
other things noted a still open
&lt;a href=&quot;https://bugs.debian.org/742553&quot;&gt;bug in the tsget script&lt;/a&gt;
included in openssl that made it harder than necessary to use openssl
as a trusted timestamping client.  A few days ago I was told
&lt;a href=&quot;https:/www.difi.no/&quot;&gt;the Norwegian government office DIFI&lt;/a&gt; is
close to releasing their own trusted timestamp service, and in the
process I was happy to learn about a replacement for the tsget script
using only curl:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
openssl ts -query -data &quot;/etc/shells&quot; -cert -sha256 -no_nonce \
  | curl -s -H &quot;Content-Type: application/timestamp-query&quot; \
         --data-binary &quot;@-&quot; http://zeitstempel.dfn.de &gt; etc-shells.tsr
openssl ts -reply -text -in etc-shells.tsr
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;This produces a binary timestamp file (etc-shells.tsr) which can be
used to verify that the content of the file /etc/shell with the
calculated sha256 hash existed at the point in time when the request
was made.  The last command extract the content of the etc-shells.tsr
in human readable form.  The idea behind such timestamp is to be able
to prove using cryptography that the content of a file have not
changed since the file was stamped.&lt;/p&gt;

&lt;p&gt;To verify that the file on disk match the public key signature in
the timestamp file, run the following commands.  It make sure you have
the required certificate for the trusted timestamp service available
and use it to compare the file content with the timestamp.  In
production, one should of course use a better method to verify the
service certificate.&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
wget -O ca-cert.txt https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt
openssl ts -verify -data /etc/shells -in etc-shells.tsr -CAfile ca-cert.txt -text
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;Wikipedia have a lot more information about
&lt;a href=&quot;https://en.wikipedia.org/wiki/Trusted_timestamping&quot;&gt;trusted
Timestamping&lt;/a&gt; and
&lt;a href=&quot;https://en.wikipedia.org/wiki/Linked_timestamping&quot;&gt;linked
timestamping&lt;/a&gt;, and there are several trusted timestamping services
around, both as commercial services and as free and public services.
Among the latter is
&lt;a href=&quot;https://www.pki.dfn.de/zeitstempeldienst/&quot;&gt;the
zeitstempel.dfn.de service&lt;/a&gt; mentioned above and
&lt;a href=&quot;https://freetsa.org/&quot;&gt;freetsa.org service&lt;/a&gt; linked to from the
wikipedia web site.  I believe the DIFI service should show up on
https://tsa.difi.no, but it is not available to the public at the
moment.  I hope this will change when it is into production.  The
&lt;a href=&quot;https://tools.ietf.org/html/rfc3161&quot;&gt;RFC 3161&lt;/a&gt; trusted
timestamping protocol standard is even implemented in LibreOffice,
Microsoft Office and Adobe Acrobat, making it possible to verify when
a document was created.&lt;/p&gt;

&lt;p&gt;I would find it useful to be able to use such trusted timestamp
service to make it possible to verify that my stored syslog files have
not been tampered with.  This is not a new idea.  I found one example
implemented on the Endian network appliances where
&lt;a href=&quot;http://help.endian.com/entries/21518508-Enabling-Timestamping-on-log-files-&quot;&gt;the
configuration of such feature was described in 2012&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;But I could not find any free implementation of such feature when I
searched, so I decided to try to
&lt;a href=&quot;https://github.com/petterreinholdtsen/syslog-trusted-timestamp&quot;&gt;build
a prototype named syslog-trusted-timestamp&lt;/a&gt;.  My idea is to
generate a timestamp of the old log files after they are rotated, and
store the timestamp in the new log file just after rotation.  This
will form a chain that would make it possible to see if any old log
files are tampered with.  But syslog is bad at handling kilobytes of
binary data, so I decided to base64 encode the timestamp and add an ID
and line sequence numbers to the base64 data to make it possible to
reassemble the timestamp file again.  To use it, simply run it like
this:

&lt;p&gt;&lt;pre&gt;
syslog-trusted-timestamp /path/to/list-of-log-files
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;This will send a timestamp from one or more timestamp services (not
yet decided nor implemented) for each listed file to the syslog using
logger(1).  To verify the timestamp, the same program is used with the
--verify option:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
syslog-trusted-timestamp --verify /path/to/log-file /path/to/log-with-timestamp
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;The verification step is not yet well designed.  The current
implementation depend on the file path being unique and unchanging,
and this is not a solid assumption.  It also uses process number as
timestamp ID, and this is bound to create ID collisions.  I hope to
have time to come up with a better way to handle timestamp IDs and
verification later.&lt;/p&gt;

&lt;p&gt;Please check out
&lt;a href=&quot;https://github.com/petterreinholdtsen/syslog-trusted-timestamp&quot;&gt;the
prototype for syslog-trusted-timestamp on github&lt;/a&gt; and send
suggestions and improvement, or let me know if there already exist a
similar system for timestamping logs already to allow me to join
forces with others with the same interest.&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Always download Debian packages using Tor - the simple recipe</title>
                <link>https://people.skolelinux.org/pere/blog/Always_download_Debian_packages_using_Tor___the_simple_recipe.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Always_download_Debian_packages_using_Tor___the_simple_recipe.html</guid>
                <pubDate>Fri, 15 Jan 2016 00:30:00 +0100</pubDate>
                <description>&lt;p&gt;During his DebConf15 keynote, Jacob Appelbaum
&lt;a href=&quot;https://summit.debconf.org/debconf15/meeting/331/what-is-to-be-done/&quot;&gt;observed
that those listening on the Internet lines would have good reason to
believe a computer have a given security hole&lt;/a&gt; if it download a
security fix from a Debian mirror.  This is a good reason to always
use encrypted connections to the Debian mirror, to make sure those
listening do not know which IP address to attack.  In August, Richard
Hartmann observed that encryption was not enough, when it was possible
to interfere download size to security patches or the fact that
download took place shortly after a security fix was released, and
&lt;a href=&quot;http://richardhartmann.de/blog/posts/2015/08/24-Tor-enabled_Debian_mirror/&quot;&gt;proposed
to always use Tor to download packages from the Debian mirror&lt;/a&gt;.  He
was not the first to propose this, as the
&lt;tt&gt;&lt;a href=&quot;https://tracker.debian.org/pkg/apt-transport-tor&quot;&gt;apt-transport-tor&lt;/a&gt;&lt;/tt&gt;
package by Tim Retout already existed to make it easy to convince apt
to use &lt;a href=&quot;https://www.torproject.org/&quot;&gt;Tor&lt;/a&gt;, but I was not
aware of that package when I read the blog post from Richard.&lt;/p&gt;

&lt;p&gt;Richard discussed the idea with Peter Palfrader, one of the Debian
sysadmins, and he set up a Tor hidden service on one of the central
Debian mirrors using the address vwakviie2ienjx6t.onion, thus making
it possible to download packages directly between two tor nodes,
making sure the network traffic always were encrypted.&lt;/p&gt;

&lt;p&gt;Here is a short recipe for enabling this on your machine, by
installing &lt;tt&gt;apt-transport-tor&lt;/tt&gt; and replacing http and https
urls with tor+http and tor+https, and using the hidden service instead
of the official Debian mirror site.  I recommend installing
&lt;tt&gt;etckeeper&lt;/tt&gt; before you start to have a history of the changes
done in /etc/.&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
apt install apt-transport-tor
sed -i &#39;s% http://ftp.debian.org/% tor+http://vwakviie2ienjx6t.onion/%&#39; /etc/apt/sources.list
sed -i &#39;s% http% tor+http%&#39; /etc/apt/sources.list
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;If you have more sources listed in /etc/apt/sources.list.d/, run
the sed commands for these too.  The sed command is assuming your are
using the ftp.debian.org Debian mirror.  Adjust the command (or just
edit the file manually) to match your mirror.&lt;/p&gt;

&lt;p&gt;This work in Debian Jessie and later.  Note that tools like
&lt;tt&gt;apt-file&lt;/tt&gt; only recently started using the apt transport
system, and do not work with these tor+http URLs.  For
&lt;tt&gt;apt-file&lt;/tt&gt; you need the version currently in experimental,
which need a recent apt version currently only in unstable.  So if you
need a working &lt;tt&gt;apt-file&lt;/tt&gt;, this is not for you.&lt;/p&gt;

&lt;p&gt;Another advantage from this change is that your machine will start
using Tor regularly and at fairly random intervals (every time you
update the package lists or upgrade or install a new package), thus
masking other Tor traffic done from the same machine.  Using Tor will
become normal for the machine in question.&lt;/p&gt;

&lt;p&gt;On &lt;a href=&quot;https://wiki.debian.org/FreedomBox&quot;&gt;Freedombox&lt;/a&gt;, APT
is set up by default to use &lt;tt&gt;apt-transport-tor&lt;/tt&gt; when Tor is
enabled.  It would be great if it was the default on any Debian
system.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>PGP key transition statement for key EE4E02F9</title>
                <link>https://people.skolelinux.org/pere/blog/PGP_key_transition_statement_for_key_EE4E02F9.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/PGP_key_transition_statement_for_key_EE4E02F9.html</guid>
                <pubDate>Tue, 17 Nov 2015 10:50:00 +0100</pubDate>
                <description>&lt;p&gt;I&#39;ve needed a new OpenPGP key for a while, but have not had time to
set it up properly.  I wanted to generate it offline and have it
available on &lt;a href=&quot;http://shop.kernelconcepts.de/#openpgp&quot;&gt;a OpenPGP
smart card&lt;/a&gt; for daily use, and learning how to do it and finding
time to sit down with an offline machine almost took forever.  But
finally I&#39;ve been able to complete the process, and have now moved
from my old GPG key to a new GPG key.  See
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/images/2015-11-17-new-gpg-key-transition.txt&quot;&gt;the
full transition statement, signed with both my old and new key&lt;/a&gt; for
the details.  This is my new key:&lt;/p&gt;

&lt;pre&gt;
pub   3936R/&lt;a href=&quot;http://pgp.cs.uu.nl/stats/111D6B29EE4E02F9.html&quot;&gt;111D6B29EE4E02F9&lt;/a&gt; 2015-11-03 [expires: 2019-11-14]
      Key fingerprint = 3AC7 B2E3 ACA5 DF87 78F1  D827 111D 6B29 EE4E 02F9
uid                  Petter Reinholdtsen &amp;lt;pere@hungry.com&amp;gt;
uid                  Petter Reinholdtsen &amp;lt;pere@debian.org&amp;gt;
sub   4096R/87BAFB0E 2015-11-03 [expires: 2019-11-02]
sub   4096R/F91E6DE9 2015-11-03 [expires: 2019-11-02]
sub   4096R/A0439BAB 2015-11-03 [expires: 2019-11-02]
&lt;/pre&gt;

&lt;p&gt;The key can be downloaded from the OpenPGP key servers, signed by
my old key.&lt;/p&gt;

&lt;p&gt;If you signed my old key
(&lt;a href=&quot;http://pgp.cs.uu.nl/stats/DB4CCC4B2A30D729.html&quot;&gt;DB4CCC4B2A30D729&lt;/a&gt;),
I&#39;d very much appreciate a signature on my new key, details and
instructions in the transition statement. I m happy to reciprocate if
you have a similarly signed transition statement to present.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Lawrence Lessig interviewed Edward Snowden a year ago</title>
                <link>https://people.skolelinux.org/pere/blog/Lawrence_Lessig_interviewed_Edward_Snowden_a_year_ago.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Lawrence_Lessig_interviewed_Edward_Snowden_a_year_ago.html</guid>
                <pubDate>Mon, 19 Oct 2015 11:50:00 +0200</pubDate>
                <description>&lt;p&gt;Last year, &lt;a href=&quot;https://lessig2016.us/&quot;&gt;US president candidate
in the Democratic Party&lt;/a&gt; Lawrence interviewed Edward Snowden.  The
one hour interview was
&lt;a href=&quot;https://www.youtube.com/watch?v=o_Sr96TFQQE&quot;&gt;published by
Harvard Law School 2014-10-23 on Youtube&lt;/a&gt;, and the meeting took
place 2014-10-20.&lt;/p&gt;

&lt;p&gt;The questions are very good, and there is lots of useful
information to be learned and very interesting issues to think about
being raised.  Please check it out.&lt;/p&gt;

&lt;iframe width=&quot;560&quot; height=&quot;315&quot; src=&quot;https://www.youtube.com/embed/o_Sr96TFQQE&quot; frameborder=&quot;0&quot; allowfullscreen&gt;&lt;/iframe&gt;

&lt;p&gt;I find it especially interesting to hear again that Snowden did try
to bring up his reservations through the official channels without any
luck.  It is in sharp contrast to the answers made 2013-11-06 by the
Norwegian prime minister Erna Solberg to the Norwegian Parliament,
&lt;a href=&quot;https://tale.holderdeord.no/speeches/s131106/68&quot;&gt;claiming
Snowden is no Whistle-Blower&lt;/a&gt; because he should have taken up his
concerns internally and using official channels.  It make me sad
that this is the political leadership we have here in Norway.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Alle Stortingets mobiltelefoner kontrolleres fra USA...</title>
                <link>https://people.skolelinux.org/pere/blog/Alle_Stortingets_mobiltelefoner_kontrolleres_fra_USA___.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Alle_Stortingets_mobiltelefoner_kontrolleres_fra_USA___.html</guid>
                <pubDate>Wed, 7 Oct 2015 09:55:00 +0200</pubDate>
                <description>&lt;p&gt;Jeg lot meg fascinere av
&lt;a href=&quot;http://www.aftenposten.no/nyheter/iriks/politikk/Stortinget-har-tilgang-til-a-fjernstyre-600-mobiler-8192692.html&quot;&gt;en
artikkel i Aftenposten&lt;/a&gt; der det fortelles at «over 600 telefoner som
benyttes av stortingsrepresentanter, rådgivere og ansatte på
Stortinget, kan «fjernstyres» ved hjelp av
&lt;a href=&quot;https://play.google.com/store/apps/details?id=com.airwatch.androidagent&quot;&gt;programvaren
Airwatch&lt;/a&gt;, et såkalte MDM-program (Mobile Device Managment)».  Det
hele bagatelliseres av Stortingets IT-stab, men det er i hovedsak på
grunn av at journalisten ikke stiller de relevante spørsmålene.  For
meg er det relevante spørsmålet hvem som har lovlig tilgang (i henhold
til lokal lovgiving, dvs. i hvert fall i Norge, Sverige, UK og USA)
til informasjon om og på telefonene, og hvor enkelt det er å skaffe
seg tilgang til hvor mobilene befinner seg og informasjon som befinner
seg på telefonene ved hjelp av utro tjenere, trusler, innbrudd og
andre ulovlige metoder.&lt;/p&gt;

&lt;p&gt;Bruken av AirWatch betyr i realiteten at USAs etteretning og
politimyndigheter har full tilgang til stortingets mobiltelefoner,
inkludert posisjon og innhold, takket være
&lt;a href=&quot;https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_Amendments_Act_of_2008&quot;&gt;FISAAA-loven&lt;/a&gt;
og
&quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/National_security_letter&quot;&gt;National
Security Letters&lt;/a&gt;&quot; og det enkle faktum at selskapet
&lt;a href=&quot;http://www.airwatch.com/&quot;&gt;AirWatch&lt;/a&gt; er kontrollert av et
selskap i USA.  I tillegg er det kjent at flere lands
etterretningstjenester kan lytte på trafikken når den passerer
landegrensene.&lt;/p&gt;

&lt;p&gt;Jeg har bedt om mer informasjon
&lt;a href=&quot;https://www.mimesbronn.no/request/saksnummer_for_saker_anganede_br&quot;&gt;fra
Stortinget om bruken av AirWatch&lt;/a&gt; via Mimes brønn så får vi se hva
de har å fortelle om saken.  Fant ingenting om &#39;airwatch&#39; i
postjournalen til Stortinget, så jeg trenger hjelp før jeg kan be om
innsyn i konkrete dokumenter.&lt;/p&gt;

&lt;p&gt;Oppdatering 2015-10-07: Jeg er blitt spurt hvorfor jeg antar at
AirWatch-agenten rapporterer til USA og ikke direkte til Stortingets
egen infrastruktur.  Det stemmer at det er teknisk mulig å sette
opp mobiltelefonene til å rapportere til datamaskiner som eies av
Stortinget.  Jeg antar det rapporteres til AirWatch sine sentrale
tjenester basert på det jeg leste fra beskrivelsen av
&lt;a href=&quot;http://www.airwatch.com/solutions/mobile-device-management/&quot;&gt;Mobile
Device Management&lt;/A&gt; på AirWatch sine egne nettsider, koblet med at
det brukes en standard app som kan hentes fra &quot;app-butikkene&quot; for å få
tilgang.  Enten må app-en settes opp individuelt hos Stortinget, eller
så får den beskjed fra AirWatch i USA om hvor den skal koble seg opp.
I det første tilfellet vil den ikke rapportere direkte til USA, men
til programvare utviklet av AirWatch som kjører på en maskin under
Stortingets kontroll.  Det er litt bedre, men fortsatt vil det være
umulig for Stortinget å være sikker på hva programvaren som tar imot
forbindelser gjør.  Jeg ser fra beskrivelsen av
&lt;a href=&quot;http://www.airwatch.com/differentiators/enterprise-integration/&quot;&gt;Enterprice
Integration&lt;/a&gt; hos AirWatch at det er mulig å ha lokal installasjon,
og håper innsynsforespørsler mot Stortinget kan fortelle mer om
hvordan ting konkret fungerer der.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Good bye subkeys.pgp.net, welcome pool.sks-keyservers.net</title>
                <link>https://people.skolelinux.org/pere/blog/Good_bye_subkeys_pgp_net__welcome_pool_sks_keyservers_net.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Good_bye_subkeys_pgp_net__welcome_pool_sks_keyservers_net.html</guid>
                <pubDate>Wed, 10 Sep 2014 13:10:00 +0200</pubDate>
                <description>&lt;p&gt;Yesterday, I had the pleasure of attending a talk with the
&lt;a href=&quot;http://www.nuug.no/&quot;&gt;Norwegian Unix User Group&lt;/a&gt; about
&lt;a href=&quot;http://www.nuug.no/aktiviteter/20140909-sks-keyservers/&quot;&gt;the
OpenPGP keyserver pool sks-keyservers.net&lt;/a&gt;, and was very happy to
learn that there is a large set of publicly available key servers to
use when looking for peoples public key.  So far I have used
subkeys.pgp.net, and some times wwwkeys.nl.pgp.net when the former
were misbehaving, but those days are ended.  The servers I have used
up until yesterday have been slow and some times unavailable.  I hope
those problems are gone now.&lt;/p&gt;

&lt;p&gt;Behind the round robin DNS entry of the
&lt;a href=&quot;https://sks-keyservers.net/&quot;&gt;sks-keyservers.net&lt;/a&gt; service
there is a pool of more than 100 keyservers which are checked every
day to ensure they are well connected and up to date.  It must be
better than what I have used so far. :)&lt;/p&gt;

&lt;p&gt;Yesterdays speaker told me that the service is the default
keyserver provided by the default configuration in GnuPG, but this do
not seem to be used in Debian.  Perhaps it should?&lt;/p&gt;

&lt;p&gt;Anyway, I&#39;ve updated my ~/.gnupg/options file to now include this
line:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
keyserver pool.sks-keyservers.net
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;With GnuPG version 2 one can also locate the keyserver using SRV
entries in DNS.  Just for fun, I did just that at work, so now every
user of GnuPG at the University of Oslo should find a OpenGPG
keyserver automatically should their need it:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
% host -t srv _pgpkey-http._tcp.uio.no
_pgpkey-http._tcp.uio.no has SRV record 0 100 11371 pool.sks-keyservers.net.
%
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Now if only
&lt;a href=&quot;http://ietfreport.isoc.org/idref/draft-shaw-openpgp-hkp/&quot;&gt;the
HKP lookup protocol&lt;/a&gt; supported finding signature paths, I would be
very happy.  It can look up a given key or search for a user ID, but I
normally do not want that, but to find a trust path from my key to
another key.  Given a user ID or key ID, I would like to find (and
download) the keys representing a signature path from my key to the
key in question, to be able to get a trust path between the two keys.
This is as far as I can tell not possible today.  Perhaps something
for a future version of the protocol?&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>FreedomBox milestone - all packages now in Debian Sid</title>
                <link>https://people.skolelinux.org/pere/blog/FreedomBox_milestone___all_packages_now_in_Debian_Sid.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/FreedomBox_milestone___all_packages_now_in_Debian_Sid.html</guid>
                <pubDate>Tue, 15 Apr 2014 22:10:00 +0200</pubDate>
                <description>&lt;p&gt;The &lt;a href=&quot;https://wiki.debian.org/FreedomBox&quot;&gt;Freedombox
project&lt;/a&gt; is working on providing the software and hardware to make
it easy for non-technical people to host their data and communication
at home, and being able to communicate with their friends and family
encrypted and away from prying eyes.  It is still going strong, and
today a major mile stone was reached.&lt;/p&gt;

&lt;p&gt;Today, the last of the packages currently used by the project to
created the system images were accepted into Debian Unstable.  It was
the freedombox-setup package, which is used to configure the images
during build and on the first boot.  Now all one need to get going is
the build code from the freedom-maker git repository and packages from
Debian.  And once the freedombox-setup package enter testing, we can
build everything directly from Debian. :)&lt;/p&gt;

&lt;p&gt;Some key packages used by Freedombox are
&lt;a href=&quot;http://packages.qa.debian.org/freedombox-setup&quot;&gt;freedombox-setup&lt;/a&gt;,
&lt;a href=&quot;http://packages.qa.debian.org/plinth&quot;&gt;plinth&lt;/a&gt;,
&lt;a href=&quot;http://packages.qa.debian.org/pagekite&quot;&gt;pagekite&lt;/a&gt;,
&lt;a href=&quot;http://packages.qa.debian.org/tor&quot;&gt;tor&lt;/a&gt;,
&lt;a href=&quot;http://packages.qa.debian.org/privoxy&quot;&gt;privoxy&lt;/a&gt;,
&lt;a href=&quot;http://packages.qa.debian.org/owncloud&quot;&gt;owncloud&lt;/a&gt; and
&lt;a href=&quot;http://packages.qa.debian.org/dnsmasq&quot;&gt;dnsmasq&lt;/a&gt;.  There
are plans to integrate more packages into the setup.  User
documentation is maintained on the Debian wiki.  Please
&lt;a href=&quot;https://wiki.debian.org/FreedomBox/Manual/Jessie&quot;&gt;check out
the manual&lt;/a&gt; and help us improve it.&lt;/p&gt;

&lt;p&gt;To test for yourself and create boot images with the FreedomBox
setup, run this on a Debian machine using a user with sudo rights to
become root:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
sudo apt-get install git vmdebootstrap mercurial python-docutils \
  mktorrent extlinux virtualbox qemu-user-static binfmt-support \
  u-boot-tools
git clone http://anonscm.debian.org/git/freedombox/freedom-maker.git \
  freedom-maker
make -C freedom-maker dreamplug-image raspberry-image virtualbox-image
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;Root access is needed to run debootstrap and mount loopback
devices.  See the README in the freedom-maker git repo for more
details on the build.  If you do not want all three images, trim the
make line.  Note that the virtualbox-image target is not really
virtualbox specific.  It create a x86 image usable in kvm, qemu,
vmware and any other x86 virtual machine environment.  You might need
the version of vmdebootstrap in Jessie to get the build working, as it
include fixes for a race condition with kpartx.&lt;/p&gt;

&lt;p&gt;If you instead want to install using a Debian CD and the preseed
method, boot a Debian Wheezy ISO and use this boot argument to load
the preseed values:&lt;/p&gt;

&lt;p&gt;&lt;pre&gt;
url=&lt;a href=&quot;http://www.reinholdtsen.name/freedombox/preseed-jessie.dat&quot;&gt;http://www.reinholdtsen.name/freedombox/preseed-jessie.dat&lt;/a&gt;
&lt;/pre&gt;&lt;/p&gt;

&lt;p&gt;I have not tested it myself the last few weeks, so I do not know if
it still work.&lt;/p&gt;

&lt;p&gt;If you wonder how to help, one task you could look at is using
systemd as the boot system.  It will become the default for Linux in
Jessie, so we need to make sure it is usable on the Freedombox.  I did
a simple test a few weeks ago, and noticed dnsmasq failed to start
during boot when using systemd.  I suspect there are other problems
too. :) To detect problems, there is a test suite included, which can
be run from the plinth web interface.&lt;/p&gt;

&lt;p&gt;Give it a go and let us know how it goes on the mailing list, and help
us get the new release published. :) Please join us on
&lt;a href=&quot;irc://irc.debian.org:6667/%23freedombox&quot;&gt;IRC (#freedombox on
irc.debian.org)&lt;/a&gt; and
&lt;a href=&quot;http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss&quot;&gt;the
mailing list&lt;/a&gt; if you want to help make this vision come true.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>S3QL, a locally mounted cloud file system - nice free software</title>
                <link>https://people.skolelinux.org/pere/blog/S3QL__a_locally_mounted_cloud_file_system___nice_free_software.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/S3QL__a_locally_mounted_cloud_file_system___nice_free_software.html</guid>
                <pubDate>Wed, 9 Apr 2014 11:30:00 +0200</pubDate>
                <description>&lt;p&gt;For a while now, I have been looking for a sensible offsite backup
solution for use at home.  My requirements are simple, it must be
cheap and locally encrypted (in other words, I keep the encryption
keys, the storage provider do not have access to my private files).
One idea me and my friends had many years ago, before the cloud
storage providers showed up, was to use Google mail as storage,
writing a Linux block device storing blocks as emails in the mail
service provided by Google, and thus get heaps of free space.  On top
of this one can add encryption, RAID and volume management to have
lots of (fairly slow, I admit that) cheap and encrypted storage.  But
I never found time to implement such system.  But the last few weeks I
have looked at a system called
&lt;a href=&quot;https://bitbucket.org/nikratio/s3ql/&quot;&gt;S3QL&lt;/a&gt;, a locally
mounted network backed file system with the features I need.&lt;/p&gt;

&lt;p&gt;S3QL is a fuse file system with a local cache and cloud storage,
handling several different storage providers, any with Amazon S3,
Google Drive or OpenStack API.  There are heaps of such storage
providers.  S3QL can also use a local directory as storage, which
combined with sshfs allow for file storage on any ssh server.  S3QL
include support for encryption, compression, de-duplication, snapshots
and immutable file systems, allowing me to mount the remote storage as
a local mount point, look at and use the files as if they were local,
while the content is stored in the cloud as well.  This allow me to
have a backup that should survive fire.  The file system can not be
shared between several machines at the same time, as only one can
mount it at the time, but any machine with the encryption key and
access to the storage service can mount it if it is unmounted.&lt;/p&gt;

&lt;p&gt;It is simple to use.  I&#39;m using it on Debian Wheezy, where the
package is included already.  So to get started, run &lt;tt&gt;apt-get
install s3ql&lt;/tt&gt;.  Next, pick a storage provider.  I ended up picking
Greenqloud, after reading their nice recipe on
&lt;a href=&quot;https://greenqloud.zendesk.com/entries/44611757-How-To-Use-S3QL-to-mount-a-StorageQloud-bucket-on-Debian-Wheezy&quot;&gt;how
to use S3QL with their Amazon S3 service&lt;/a&gt;, because I trust the laws
in Iceland more than those in USA when it come to keeping my personal
data safe and private, and thus would rather spend money on a company
in Iceland.  Another nice recipe is available from the article
&lt;a href=&quot;http://www.admin-magazine.com/HPC/Articles/HPC-Cloud-Storage&quot;&gt;S3QL
Filesystem for HPC Storage&lt;/a&gt; by Jeff Layton in the HPC section of
Admin magazine.  When the provider is picked, figure out how to get
the API key needed to connect to the storage API.  With Greencloud,
the key did not show up until I had added payment details to my
account.&lt;/p&gt;

&lt;p&gt;Armed with the API access details, it is time to create the file
system.  First, create a new bucket in the cloud.  This bucket is the
file system storage area.  I picked a bucket name reflecting the
machine that was going to store data there, but any name will do.
I&#39;ll refer to it as &lt;tt&gt;bucket-name&lt;/tt&gt; below.  In addition, one need
the API login and password, and a locally created password.  Store it
all in ~root/.s3ql/authinfo2 like this:

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
[s3c]
storage-url: s3c://s.greenqloud.com:443/bucket-name
backend-login: API-login
backend-password: API-password
fs-passphrase: local-password
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;I create my local passphrase using &lt;tt&gt;pwget 50&lt;/tt&gt; or similar,
but any sensible way to create a fairly random password should do it.
Armed with these details, it is now time to run mkfs, entering the API
details and password to create it:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
# mkdir -m 700 /var/lib/s3ql-cache
# mkfs.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
  --ssl s3c://s.greenqloud.com:443/bucket-name
Enter backend login: 
Enter backend password: 
Before using S3QL, make sure to read the user&#39;s guide, especially
the &#39;Important Rules to Avoid Loosing Data&#39; section.
Enter encryption password: 
Confirm encryption password: 
Generating random encryption key...
Creating metadata tables...
Dumping metadata...
..objects..
..blocks..
..inodes..
..inode_blocks..
..symlink_targets..
..names..
..contents..
..ext_attributes..
Compressing and uploading metadata...
Wrote 0.00 MB of compressed metadata.
# &lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;The next step is mounting the file system to make the storage available.

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
# mount.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
  --ssl --allow-root s3c://s.greenqloud.com:443/bucket-name /s3ql
Using 4 upload threads.
Downloading and decompressing metadata...
Reading metadata...
..objects..
..blocks..
..inodes..
..inode_blocks..
..symlink_targets..
..names..
..contents..
..ext_attributes..
Mounting filesystem...
# df -h /s3ql
Filesystem                              Size  Used Avail Use% Mounted on
s3c://s.greenqloud.com:443/bucket-name  1.0T     0  1.0T   0% /s3ql
#
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;The file system is now ready for use.  I use rsync to store my
backups in it, and as the metadata used by rsync is downloaded at
mount time, no network traffic (and storage cost) is triggered by
running rsync.  To unmount, one should not use the normal umount
command, as this will not flush the cache to the cloud storage, but
instead running the umount.s3ql command like this:

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
# umount.s3ql /s3ql
# 
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;There is a fsck command available to check the file system and
correct any problems detected.  This can be used if the local server
crashes while the file system is mounted, to reset the &quot;already
mounted&quot; flag.  This is what it look like when processing a working
file system:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
# fsck.s3ql --force --ssl s3c://s.greenqloud.com:443/bucket-name
Using cached metadata.
File system seems clean, checking anyway.
Checking DB integrity...
Creating temporary extra indices...
Checking lost+found...
Checking cached objects...
Checking names (refcounts)...
Checking contents (names)...
Checking contents (inodes)...
Checking contents (parent inodes)...
Checking objects (reference counts)...
Checking objects (backend)...
..processed 5000 objects so far..
..processed 10000 objects so far..
..processed 15000 objects so far..
Checking objects (sizes)...
Checking blocks (referenced objects)...
Checking blocks (refcounts)...
Checking inode-block mapping (blocks)...
Checking inode-block mapping (inodes)...
Checking inodes (refcounts)...
Checking inodes (sizes)...
Checking extended attributes (names)...
Checking extended attributes (inodes)...
Checking symlinks (inodes)...
Checking directory reachability...
Checking unix conventions...
Checking referential integrity...
Dropping temporary indices...
Backing up old metadata...
Dumping metadata...
..objects..
..blocks..
..inodes..
..inode_blocks..
..symlink_targets..
..names..
..contents..
..ext_attributes..
Compressing and uploading metadata...
Wrote 0.89 MB of compressed metadata.
# 
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Thanks to the cache, working on files that fit in the cache is very
quick, about the same speed as local file access.  Uploading large
amount of data is to me limited by the bandwidth out of and into my
house.  Uploading 685 MiB with a 100 MiB cache gave me 305 kiB/s,
which is very close to my upload speed, and downloading the same
Debian installation ISO gave me 610 kiB/s, close to my download speed.
Both were measured using &lt;tt&gt;dd&lt;/tt&gt;.  So for me, the bottleneck is my
network, not the file system code.  I do not know what a good cache
size would be, but suspect that the cache should e larger than your
working set.&lt;/p&gt;

&lt;p&gt;I mentioned that only one machine can mount the file system at the
time.  If another machine try, it is told that the file system is
busy:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
# mount.s3ql --cachedir /var/lib/s3ql-cache --authfile /root/.s3ql/authinfo2 \
  --ssl --allow-root s3c://s.greenqloud.com:443/bucket-name /s3ql
Using 8 upload threads.
Backend reports that fs is still mounted elsewhere, aborting.
#
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;The file content is uploaded when the cache is full, while the
metadata is uploaded once every 24 hour by default.  To ensure the
file system content is flushed to the cloud, one can either umount the
file system, or ask S3QL to flush the cache and metadata using
s3qlctrl:

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
# s3qlctrl upload-meta /s3ql
# s3qlctrl flushcache /s3ql
# 
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;If you are curious about how much space your data uses in the
cloud, and how much compression and deduplication cut down on the
storage usage, you can use s3qlstat on the mounted file system to get
a report:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
# s3qlstat /s3ql
Directory entries:    9141
Inodes:               9143
Data blocks:          8851
Total data size:      22049.38 MB
After de-duplication: 21955.46 MB (99.57% of total)
After compression:    21877.28 MB (99.22% of total, 99.64% of de-duplicated)
Database size:        2.39 MB (uncompressed)
(some values do not take into account not-yet-uploaded dirty blocks in cache)
#
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;I mentioned earlier that there are several possible suppliers of
storage.  I did not try to locate them all, but am aware of at least
&lt;a href=&quot;https://www.greenqloud.com/&quot;&gt;Greenqloud&lt;/a&gt;,
&lt;a href=&quot;http://drive.google.com/&quot;&gt;Google Drive&lt;/a&gt;,
&lt;a href=&quot;http://aws.amazon.com/s3/&quot;&gt;Amazon S3 web serivces&lt;/a&gt;,
&lt;a href=&quot;http://www.rackspace.com/&quot;&gt;Rackspace&lt;/a&gt; and
&lt;a href=&quot;http://crowncloud.net/&quot;&gt;Crowncloud&lt;/A&gt;.  The latter even
accept payment in Bitcoin.  Pick one that suit your need.  Some of
them provide several GiB of free storage, but the prize models are
quite different and you will have to figure out what suits you
best.&lt;/p&gt;

&lt;p&gt;While researching this blog post, I had a look at research papers
and posters discussing the S3QL file system.  There are several, which
told me that the file system is getting a critical check by the
science community and increased my confidence in using it.  One nice
poster is titled
&quot;&lt;a href=&quot;http://www.lanl.gov/orgs/adtsc/publications/science_highlights_2013/docs/pg68_69.pdf&quot;&gt;An
Innovative Parallel Cloud Storage System using OpenStack’s SwiftObject
Store and Transformative Parallel I/O Approach&lt;/a&gt;&quot; by Hsing-Bung
Chen, Benjamin McClelland, David Sherrill, Alfred Torrez, Parks Fields
and Pamela Smith.  Please  have a look.&lt;/p&gt;

&lt;p&gt;Given my problems with different file systems earlier, I decided to
check out the mounted S3QL file system to see if it would be usable as
a home directory (in other word, that it provided POSIX semantics when
it come to locking and umask handling etc).  Running
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Testing_if_a_file_system_can_be_used_for_home_directories___.html&quot;&gt;my
test code to check file system semantics&lt;/a&gt;, I was happy to discover that
no error was found.  So the file system can be used for home
directories, if one chooses to do so.&lt;/p&gt;

&lt;p&gt;If you do not want a locally file system, and want something that
work without the Linux fuse file system, I would like to mention the
&lt;a href=&quot;http://www.tarsnap.com/&quot;&gt;Tarsnap service&lt;/a&gt;, which also
provide locally encrypted backup using a command line client.  It have
a nicer access control system, where one can split out read and write
access, allowing some systems to write to the backup and others to
only read from it.&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>EU-domstolen bekreftet i dag at datalagringsdirektivet er ulovlig</title>
                <link>https://people.skolelinux.org/pere/blog/EU_domstolen_bekreftet_i_dag_at_datalagringsdirektivet_er_ulovlig.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/EU_domstolen_bekreftet_i_dag_at_datalagringsdirektivet_er_ulovlig.html</guid>
                <pubDate>Tue, 8 Apr 2014 11:30:00 +0200</pubDate>
                <description>&lt;p&gt;I dag kom endelig avgjørelsen fra EU-domstolen om
datalagringsdirektivet, som ikke overraskende ble dømt ulovlig og i
strid med borgernes grunnleggende rettigheter.  Hvis du lurer på hva
datalagringsdirektivet er for noe, så er det
&lt;a href=&quot;http://tv.nrk.no/program/koid75005313/tema-dine-digitale-spor-datalagringsdirektivet&quot;&gt;en
flott dokumentar tilgjengelig hos NRK&lt;/a&gt; som jeg tidligere
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Dokumentaren_om_Datalagringsdirektivet_sendes_endelig_p__NRK.html&quot;&gt;har
anbefalt&lt;/a&gt; alle å se.&lt;/p&gt;

&lt;p&gt;Her er et liten knippe nyhetsoppslag om saken, og jeg regner med at
det kommer flere ut over dagen.  Flere kan finnes
&lt;a href=&quot;http://www.mylder.no/?drill=datalagringsdirektivet&amp;intern=1&quot;&gt;via
mylder&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;&lt;ul&gt;

&lt;li&gt;&lt;a href=&quot;http://e24.no/digital/eu-domstolen-datalagringsdirektivet-er-ugyldig/22879592&quot;&gt;EU-domstolen:
Datalagringsdirektivet er ugyldig&lt;/a&gt; - e24.no 2014-04-08

&lt;li&gt;&lt;a href=&quot;http://www.aftenposten.no/nyheter/iriks/EU-domstolen-Datalagringsdirektivet-er-ulovlig-7529032.html&quot;&gt;EU-domstolen:
Datalagringsdirektivet er ulovlig&lt;/a&gt; - aftenposten.no 2014-04-08

&lt;li&gt;&lt;a href=&quot;http://www.aftenposten.no/nyheter/iriks/politikk/Krever-DLD-stopp-i-Norge-7530086.html&quot;&gt;Krever
DLD-stopp i Norge&lt;/a&gt; - aftenposten.no 2014-04-08

&lt;li&gt;&lt;a href=&quot;http://www.p4.no/story.aspx?id=566431&quot;&gt;Apenes: - En
gledens dag&lt;/a&gt; - p4.no 2014-04-08

&lt;li&gt;&lt;a href=&quot;http://www.nrk.no/norge/_-datalagringsdirektivet-er-ugyldig-1.11655929&quot;&gt;EU-domstolen:
– Datalagringsdirektivet er ugyldig&lt;/a&gt; - nrk.no 2014-04-08&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.vg.no/nyheter/utenriks/data-og-nett/eu-domstolen-datalagringsdirektivet-er-ugyldig/a/10130280/&quot;&gt;EU-domstolen:
Datalagringsdirektivet er ugyldig&lt;/a&gt; - vg.no 2014-04-08&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.dagbladet.no/2014/04/08/nyheter/innenriks/datalagringsdirektivet/personvern/32711646/&quot;&gt;-
Vi bør skrote hele datalagringsdirektivet&lt;/a&gt; - dagbladet.no
2014-04-08&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.digi.no/928137/eu-domstolen-dld-er-ugyldig&quot;&gt;EU-domstolen:
DLD er ugyldig&lt;/a&gt; - digi.no 2014-04-08&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.irishtimes.com/business/sectors/technology/european-court-declares-data-retention-directive-invalid-1.1754150&quot;&gt;European
court declares data retention directive invalid&lt;/a&gt; - irishtimes.com
2014-04-08&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.reuters.com/article/2014/04/08/us-eu-data-ruling-idUSBREA370F020140408?feedType=RSS&quot;&gt;EU
court rules against requirement to keep data of telecom users&lt;/a&gt; -
reuters.com 2014-04-08&lt;/li&gt;

&lt;/ul&gt;
&lt;/p&gt;

&lt;p&gt;Jeg synes det er veldig fint at nok en stemme slår fast at
totalitær overvåkning av befolkningen er uakseptabelt, men det er
fortsatt like viktig å beskytte privatsfæren som før, da de
teknologiske mulighetene fortsatt finnes og utnyttes, og jeg tror
innsats i prosjekter som
&lt;a href=&quot;https://wiki.debian.org/FreedomBox&quot;&gt;Freedombox&lt;/a&gt; og
&lt;a href=&quot;http://www.dugnadsnett.no/&quot;&gt;Dugnadsnett&lt;/a&gt; er viktigere enn
noen gang.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Update 2014-04-08 12:10&lt;/strong&gt;: Kronerullingen for å
stoppe datalagringsdirektivet i Norge gjøres hos foreningen
&lt;a href=&quot;http://www.digitaltpersonvern.no/&quot;&gt;Digitalt Personvern&lt;/a&gt;,
som har samlet inn 843 215,- så langt men trenger nok mye mer hvis

ikke Høyre og Arbeiderpartiet bytter mening i saken.  Det var
&lt;a href=&quot;http://www.holderdeord.no/parliament-issues/48650&quot;&gt;kun
partinene Høyre og Arbeiderpartiet&lt;/a&gt; som stemte for
Datalagringsdirektivet, og en av dem må bytte mening for at det skal
bli flertall mot i Stortinget.  Se mer om saken
&lt;a href=&quot;http://www.holderdeord.no/issues/69-innfore-datalagringsdirektivet&quot;&gt;Holder
de ord&lt;/a&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Dokumentaren om Datalagringsdirektivet sendes endelig på NRK</title>
                <link>https://people.skolelinux.org/pere/blog/Dokumentaren_om_Datalagringsdirektivet_sendes_endelig_p__NRK.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Dokumentaren_om_Datalagringsdirektivet_sendes_endelig_p__NRK.html</guid>
                <pubDate>Wed, 26 Mar 2014 09:50:00 +0100</pubDate>
                <description>&lt;p&gt;&lt;a href=&quot;http://www.nuug.no/&quot;&gt;Foreningen NUUG&lt;/a&gt; melder i natt at
NRK nå har bestemt seg for
&lt;a href=&quot;http://www.nuug.no/news/NRK_viser_filmen_om_Datalagringsdirektivet_f_rste_gang_2014_03_31.shtml&quot;&gt;når
den norske dokumentarfilmen om datalagringsdirektivet skal
sendes&lt;/a&gt; (se &lt;a href=&quot;http://www.imdb.com/title/tt2832844/&quot;&gt;IMDB&lt;/a&gt;
for detaljer om filmen) . Første visning blir på NRK2 mandag
2014-03-31 kl. 19:50, og deretter visninger onsdag 2014-04-02
kl. 12:30, fredag 2014-04-04 kl. 19:40 og søndag 2014-04-06 kl. 15:10.
Jeg har sett dokumentaren, og jeg anbefaler enhver å se den selv.  Som
oppvarming mens vi venter anbefaler jeg Bjørn Stærks kronikk i
Aftenposten fra i går,
&lt;a href=&quot;http://www.aftenposten.no/meninger/kronikker/Autoritar-gjokunge-7514915.html&quot;&gt;Autoritær
gjøkunge&lt;/a&gt;, der han gir en grei skisse av hvor ille det står til med
retten til privatliv og beskyttelsen av demokrati i Norge og resten
verden, og helt riktig slår fast at det er vi i databransjen som
sitter med nøkkelen til å gjøre noe med dette.  Jeg har involvert meg
i prosjektene &lt;a href=&quot;http://www.dugnadsnett.no/&quot;&gt;dugnadsnett.no&lt;/a&gt;
og &lt;a href=&quot;https://wiki.debian.org/FreedomBox&quot;&gt;FreedomBox&lt;/a&gt; for å
forsøke å gjøre litt selv for å bedre situasjonen, men det er mye
hardt arbeid fra mange flere enn meg som gjenstår før vi kan sies å ha
gjenopprettet balansen.&lt;/p&gt;

&lt;p&gt;Jeg regner med at nettutgaven dukker opp på
&lt;a href=&quot;http://tv.nrk.no/program/koid75005313/tema-dine-digitale-spor-datalagringsdirektivet&quot;&gt;NRKs
side om filmen om datalagringsdirektivet&lt;/a&gt; om fem dager.  Hold et
øye med siden, og tips venner og slekt om at de også bør se den.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Public Trusted Timestamping services for everyone</title>
                <link>https://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Public_Trusted_Timestamping_services_for_everyone.html</guid>
                <pubDate>Tue, 25 Mar 2014 12:50:00 +0100</pubDate>
                <description>&lt;p&gt;Did you ever need to store logs or other files in a way that would
allow it to be used as evidence in court, and needed a way to
demonstrate without reasonable doubt that the file had not been
changed since it was created?  Or, did you ever need to document that
a given document was received at some point in time, like some
archived document or the answer to an exam, and not changed after it
was received?  The problem in these settings is to remove the need to
trust yourself and your computers, while still being able to prove
that a file is the same as it was at some given time in the past.&lt;/p&gt;

&lt;p&gt;A solution to these problems is to have a trusted third party
&quot;stamp&quot; the document and verify that at some given time the document
looked a given way.  Such
&lt;a href=&quot;https://en.wikipedia.org/wiki/Notarius&quot;&gt;notarius&lt;/a&gt; service
have been around for thousands of years, and its digital equivalent is
called a
&lt;a href=&quot;http://en.wikipedia.org/wiki/Trusted_timestamping&quot;&gt;trusted
timestamping service&lt;/a&gt;.  &lt;a href=&quot;http://www.ietf.org/&quot;&gt;The Internet
Engineering Task Force&lt;/a&gt; standardised how such service could work a
few years ago as &lt;a href=&quot;http://tools.ietf.org/html/rfc3161&quot;&gt;RFC
3161&lt;/a&gt;.  The mechanism is simple.  Create a hash of the file in
question, send it to a trusted third party which add a time stamp to
the hash and sign the result with its private key, and send back the
signed hash + timestamp.  Both email, FTP and HTTP can be used to
request such signature, depending on what is provided by the service
used. Anyone with the document and the signature can then verify that
the document matches the signature by creating their own hash and
checking the signature using the trusted third party public key.
There are several commercial services around providing such
timestamping.  A quick search for
&quot;&lt;a href=&quot;https://duckduckgo.com/?q=rfc+3161+service&quot;&gt;rfc 3161
service&lt;/a&gt;&quot; pointed me to at least
&lt;a href=&quot;https://www.digistamp.com/technical/how-a-digital-time-stamp-works/&quot;&gt;DigiStamp&lt;/a&gt;,
&lt;a href=&quot;http://www.quovadisglobal.co.uk/CertificateServices/SigningServices/TimeStamp.aspx&quot;&gt;Quo
Vadis&lt;/a&gt;,
&lt;a href=&quot;https://www.globalsign.com/timestamp-service/&quot;&gt;Global Sign&lt;/a&gt;
and &lt;a href=&quot;http://www.globaltrustfinder.com/TSADefault.aspx&quot;&gt;Global
Trust Finder&lt;/a&gt;.  The system work as long as the private key of the
trusted third party is not compromised.&lt;/p&gt;

&lt;p&gt;But as far as I can tell, there are very few public trusted
timestamp services available for everyone.  I&#39;ve been looking for one
for a while now. But yesterday I found one over at
&lt;a href=&quot;https://www.pki.dfn.de/zeitstempeldienst/&quot;&gt;Deutches
Forschungsnetz&lt;/a&gt; mentioned in
&lt;a href=&quot;http://www.d-mueller.de/blog/dealing-with-trusted-timestamps-in-php-rfc-3161/&quot;&gt;a
blog by David Müller&lt;/a&gt;.  I then found
&lt;a href=&quot;http://www.rz.uni-greifswald.de/support/dfn-pki-zertifikate/zeitstempeldienst.html&quot;&gt;a
good recipe on how to use the service&lt;/a&gt; over at the University of
Greifswald.&lt;/p&gt;

&lt;p&gt;&lt;a href=&quot;http://www.openssl.org/&quot;&gt;The OpenSSL library&lt;/a&gt; contain
both server and tools to use and set up your own signing service.  See
the ts(1SSL), tsget(1SSL) manual pages for more details.  The
following shell script demonstrate how to extract a signed timestamp
for any file on the disk in a Debian environment:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;&lt;pre&gt;
#!/bin/sh
set -e
url=&quot;http://zeitstempel.dfn.de&quot;
caurl=&quot;https://pki.pca.dfn.de/global-services-ca/pub/cacert/chain.txt&quot;
reqfile=$(mktemp -t tmp.XXXXXXXXXX.tsq)
resfile=$(mktemp -t tmp.XXXXXXXXXX.tsr)
cafile=chain.txt
if [ ! -f $cafile ] ; then
    wget -O $cafile &quot;$caurl&quot;
fi
openssl ts -query -data &quot;$1&quot; -cert | tee &quot;$reqfile&quot; \
    | /usr/lib/ssl/misc/tsget -h &quot;$url&quot; -o &quot;$resfile&quot;
openssl ts -reply -in &quot;$resfile&quot; -text 1&gt;&amp;2
openssl ts -verify -data &quot;$1&quot; -in &quot;$resfile&quot; -CAfile &quot;$cafile&quot; 1&gt;&amp;2
base64 &lt; &quot;$resfile&quot;
rm &quot;$reqfile&quot; &quot;$resfile&quot;
&lt;/pre&gt;&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;The argument to the script is the file to timestamp, and the output
is a base64 encoded version of the signature to STDOUT and details
about the signature to STDERR.  Note that due to
&lt;a href=&quot;http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742553&quot;&gt;a bug
in the tsget script&lt;/a&gt;, you might need to modify the included script
and remove the last line.  Or just write your own HTTP uploader using
curl. :) Now you too can prove and verify that files have not been
changed.&lt;/p&gt;

&lt;p&gt;But the Internet need more public trusted timestamp services.
Perhaps something for &lt;a href=&quot;http://www.uninett.no/&quot;&gt;Uninett&lt;/a&gt; or
my work place the &lt;a href=&quot;http://www.uio.no/&quot;&gt;University of Oslo&lt;/a&gt;
to set up?&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Freedombox on Dreamplug, Raspberry Pi and virtual x86 machine</title>
                <link>https://people.skolelinux.org/pere/blog/Freedombox_on_Dreamplug__Raspberry_Pi_and_virtual_x86_machine.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Freedombox_on_Dreamplug__Raspberry_Pi_and_virtual_x86_machine.html</guid>
                <pubDate>Fri, 14 Mar 2014 11:00:00 +0100</pubDate>
                <description>&lt;p&gt;The &lt;a href=&quot;https://wiki.debian.org/FreedomBox&quot;&gt;Freedombox
project&lt;/a&gt; is working on providing the software and hardware for
making it easy for non-technical people to host their data and
communication at home, and being able to communicate with their
friends and family encrypted and away from prying eyes.  It has been
going on for a while, and is slowly progressing towards a new test
release (0.2).&lt;/p&gt;

&lt;p&gt;And what day could be better than the Pi day to announce that the
new version will provide &quot;hard drive&quot; / SD card / USB stick images for
Dreamplug, Raspberry Pi and VirtualBox (or any other virtualization
system), and can also be installed using a Debian installer preseed
file.  The Debian based Freedombox is now based on Debian Jessie,
where most of the needed packages used are already present.  Only one,
the freedombox-setup package, is missing.  To try to build your own
boot image to test the current status, fetch the freedom-maker scripts
and build using
&lt;a href=&quot;http://packages.qa.debian.org/vmdebootstrap&quot;&gt;vmdebootstrap&lt;/a&gt;
with a user with sudo access to become root:

&lt;pre&gt;
git clone http://anonscm.debian.org/git/freedombox/freedom-maker.git \
  freedom-maker
sudo apt-get install git vmdebootstrap mercurial python-docutils \
  mktorrent extlinux virtualbox qemu-user-static binfmt-support \
  u-boot-tools
make -C freedom-maker dreamplug-image raspberry-image virtualbox-image
&lt;/pre&gt;

&lt;p&gt;Root access is needed to run debootstrap and mount loopback
devices.  See the README for more details on the build. If you do not
want all three images, trim the make line.  But note that thanks to &lt;a
href=&quot;https://bugs.debian.org/741407&quot;&gt;a race condition in
vmdebootstrap&lt;/a&gt;, the build might fail without the patch to the
kpartx call.&lt;/p&gt;

&lt;p&gt;If you instead want to install using a Debian CD and the preseed
method, boot a Debian Wheezy ISO and use this boot argument to load
the preseed values:&lt;/p&gt;

&lt;pre&gt;
url=&lt;a href=&quot;http://www.reinholdtsen.name/freedombox/preseed-jessie.dat&quot;&gt;http://www.reinholdtsen.name/freedombox/preseed-jessie.dat&lt;/a&gt;
&lt;/pre&gt;

&lt;p&gt;But note that due to &lt;a href=&quot;https://bugs.debian.org/740673&quot;&gt;a
recently introduced bug in apt in Jessie&lt;/a&gt;, the installer will
currently hang while setting up APT sources.  Killing the
&#39;&lt;tt&gt;apt-cdrom ident&lt;/tt&gt;&#39; process when it hang a few times during the
installation will get the installation going.  This affect all
installations in Jessie, and I expect it will be fixed soon.&lt;/p&gt;

&lt;p&gt;Give it a go and let us know how it goes on the mailing list, and help
us get the new release published. :) Please join us on
&lt;a href=&quot;irc://irc.debian.org:6667/%23freedombox&quot;&gt;IRC (#freedombox on
irc.debian.org)&lt;/a&gt; and
&lt;a href=&quot;http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss&quot;&gt;the
mailing list&lt;/a&gt; if you want to help make this vision come true.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>A fist full of non-anonymous Bitcoins</title>
                <link>https://people.skolelinux.org/pere/blog/A_fist_full_of_non_anonymous_Bitcoins.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/A_fist_full_of_non_anonymous_Bitcoins.html</guid>
                <pubDate>Wed, 29 Jan 2014 14:10:00 +0100</pubDate>
                <description>&lt;p&gt;Bitcoin is a incredible use of peer to peer communication and
encryption, allowing direct and immediate money transfer without any
central control.  It is sometimes claimed to be ideal for illegal
activity, which I believe is quite a long way from the truth.  At least
I would not conduct illegal money transfers using a system where the
details of every transaction are kept forever.  This point is
investigated in
&lt;a href=&quot;https://www.usenix.org/publications/login&quot;&gt;USENIX ;login:&lt;/a&gt;
from December 2013, in the article
&quot;&lt;a href=&quot;https://www.usenix.org/system/files/login/articles/03_meiklejohn-online.pdf&quot;&gt;A
Fistful of Bitcoins - Characterizing Payments Among Men with No
Names&lt;/a&gt;&quot; by Sarah Meiklejohn, Marjori Pomarole,Grant Jordan, Kirill
Levchenko, Damon McCoy, Geoffrey M. Voelker, and Stefan Savage.  They
analyse the transaction log in the Bitcoin system, using it to find
addresses belong to individuals and organisations and follow the flow
of money from both Bitcoin theft and trades on Silk Road to where the
money end up.  This is how they wrap up their article:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
&lt;p&gt;&quot;To demonstrate the usefulness of this type of analysis, we turned
our attention to criminal activity. In the Bitcoin economy, criminal
activity can appear in a number of forms, such as dealing drugs on
Silk Road or simply stealing someone else’s bitcoins. We followed the
flow of bitcoins out of Silk Road (in particular, from one notorious
address) and from a number of highly publicized thefts to see whether
we could track the bitcoins to known services. Although some of the
thieves attempted to use sophisticated mixing techniques (or possibly
mix services) to obscure the flow of bitcoins, for the most part
tracking the bitcoins was quite straightforward, and we ultimately saw
large quantities of bitcoins flow to a variety of exchanges directly
from the point of theft (or the withdrawal from Silk Road).&lt;/p&gt;

&lt;p&gt;As acknowledged above, following stolen bitcoins to the point at
which they are deposited into an exchange does not in itself identify
the thief; however, it does enable further de-anonymization in the
case in which certain agencies can determine (through, for example,
subpoena power) the real-world owner of the account into which the
stolen bitcoins were deposited.  Because such exchanges seem to serve
as chokepoints into and out of the Bitcoin economy (i.e., there are
few alternative ways to cash out), we conclude that using Bitcoin for
money laundering or other illicit purposes does not (at least at
present) seem to be particularly attractive.&quot;&lt;/p&gt;
&lt;/blockquote&gt;&lt;p&gt;

&lt;p&gt;These researches are not the first to analyse the Bitcoin
transaction log.  The 2011 paper
&quot;&lt;a href=&quot;http://arxiv.org/abs/1107.4524&quot;&gt;An Analysis of Anonymity in
the Bitcoin System&lt;/A&gt;&quot; by Fergal Reid and Martin Harrigan is
summarized like this:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
&quot;Anonymity in Bitcoin, a peer-to-peer electronic currency system, is a
complicated issue. Within the system, users are identified by
public-keys only. An attacker wishing to de-anonymize its users will
attempt to construct the one-to-many mapping between users and
public-keys and associate information external to the system with the
users. Bitcoin tries to prevent this attack by storing the mapping of
a user to his or her public-keys on that user&#39;s node only and by
allowing each user to generate as many public-keys as required. In
this chapter we consider the topological structure of two networks
derived from Bitcoin&#39;s public transaction history. We show that the
two networks have a non-trivial topological structure, provide
complementary views of the Bitcoin system and have implications for
anonymity. We combine these structures with external information and
techniques such as context discovery and flow analysis to investigate
an alleged theft of Bitcoins, which, at the time of the theft, had a
market value of approximately half a million U.S. dollars.&quot;
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;I hope these references can help kill the urban myth that Bitcoin
is anonymous.  It isn&#39;t really a good fit for illegal activites.  Use
cash if you need to stay anonymous, at least until regular DNA
sampling of notes and coins become the norm. :)&lt;/p&gt;

&lt;p&gt;As usual, if you use Bitcoin and want to show your support of my
activities, please send Bitcoin donations to my address
&lt;b&gt;&lt;a href=&quot;bitcoin:15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;&lt;/b&gt;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>All drones should be radio marked with what they do and who they belong to</title>
                <link>https://people.skolelinux.org/pere/blog/All_drones_should_be_radio_marked_with_what_they_do_and_who_they_belong_to.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/All_drones_should_be_radio_marked_with_what_they_do_and_who_they_belong_to.html</guid>
                <pubDate>Thu, 21 Nov 2013 15:40:00 +0100</pubDate>
                <description>&lt;p&gt;Drones, flying robots, are getting more and more popular.  The most
know ones are the killer drones used by some government to murder
people they do not like without giving them the chance of a fair
trial, but the technology have many good uses too, from mapping and
forest maintenance to photography and search and rescue.  I am sure it
is just a question of time before &quot;bad drones&quot; are in the hands of
private enterprises and not only state criminals but petty criminals
too.  The drone technology is very useful and very dangerous.  To have
some control over the use of drones, I agree with Daniel Suarez in his
TED talk
&quot;&lt;a href=&quot;https://archive.org/details/DanielSuarez_2013G&quot;&gt;The kill
decision shouldn&#39;t belong to a robot&lt;/a&gt;&quot;, where he suggested this
little gem to keep the good while limiting the bad use of drones:&lt;/p&gt;
 
&lt;blockquote&gt;

&lt;p&gt;Each robot and drone should have a cryptographically signed
I.D. burned in at the factory that can be used to track its movement
through public spaces. We have license plates on cars, tail numbers on
aircraft. This is no different. And every citizen should be able to
download an app that shows the population of drones and autonomous
vehicles moving through public spaces around them, both right now and
historically. And civic leaders should deploy sensors and civic drones
to detect rogue drones, and instead of sending killer drones of their
own up to shoot them down, they should notify humans to their
presence. And in certain very high-security areas, perhaps civic
drones would snare them and drag them off to a bomb disposal facility.&lt;/p&gt;

&lt;p&gt;But notice, this is more an immune system than a weapons system. It
would allow us to avail ourselves of the use of autonomous vehicles
and drones while still preserving our open, civil society.&lt;/p&gt;

&lt;/blockquote&gt;

&lt;p&gt;The key is that &lt;em&gt;every citizen&lt;/em&gt; should be able to read the
radio beacons sent from the drones in the area, to be able to check
both the government and others use of drones.  For such control to be
effective, everyone must be able to do it.  What should such beacon
contain?  At least formal owner, purpose, contact information and GPS
location.  Probably also the origin and target position of the current
flight.  And perhaps some registration number to be able to look up
the drone in a central database tracking their movement.  Robots
should not have privacy.  It is people who need privacy.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Det er jo makta som er mest sårbar ved massiv overvåkning av Internett</title>
                <link>https://people.skolelinux.org/pere/blog/Det_er_jo_makta_som_er_mest_s_rbar_ved_massiv_overv_kning_av_Internett.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Det_er_jo_makta_som_er_mest_s_rbar_ved_massiv_overv_kning_av_Internett.html</guid>
                <pubDate>Sat, 26 Oct 2013 20:30:00 +0200</pubDate>
                <description>&lt;p&gt;De siste måneders eksponering av
&lt;a href=&quot;http://www.aftenposten.no/nyheter/uriks/Her-er-Edvard-Snowdens-mest-omtalte-avsloringer-7351734.html&quot;&gt;den
totale overvåkningen som foregår i den vestlige verden dokumenterer
hvor sårbare vi er&lt;/a&gt;.  Men det slår meg at de som er mest sårbare
for dette, myndighetspersoner på alle nivåer, neppe har innsett at de
selv er de mest interessante personene å lage profiler på, for å kunne
påvirke dem.&lt;/p&gt;

&lt;p&gt;For å ta et lite eksempel: Stortingets nettsted,
&lt;a href=&quot;http://www.stortinget.no/&quot;&gt;www.stortinget.no&lt;/a&gt; (og
forsåvidt også
&lt;a href=&quot;http://data.stortinget.no/&quot;&gt;data.stortinget.no&lt;/a&gt;),
inneholder informasjon om det som foregår på Stortinget, og jeg antar
de største brukerne av informasjonen der er representanter og
rådgivere på Stortinget.  Intet overraskende med det.  Det som derimot
er mer skjult er at Stortingets nettsted bruker
&lt;a href=&quot;http://en.wikipedia.org/wiki/Google_Analytics&quot;&gt;Google
Analytics&lt;/a&gt;, hvilket gjør at enhver som besøker nettsidene der også
rapporterer om besøket via Internett-linjer som passerer Sverige,
England og videre til USA.  Det betyr at informasjon om ethvert besøk
på stortingets nettsider kan snappes opp av svensk, britisk og USAs
etterretningsvesen.  De kan dermed holde et øye med hvilke
Stortingssaker stortingsrepresentantene synes er interessante å sjekke
ut, og hvilke sider rådgivere og andre på stortinget synes er
interessant å besøke, når de gjør det og hvilke andre representanter
som sjekker de samme sidene omtrent samtidig.  Stortingets bruk av
Google Analytics gjør det dermed enkelt for utenlands etteretning å
spore representantenes aktivitet og interesse.  Hvis noen av
representantene bruker Google Mail eller noen andre tjenestene som
krever innlogging, så vil det være enda enklere å finne ut nøyaktig
hvilke personer som bruker hvilke nettlesere og dermed knytte
informasjonen opp til enkeltpersoner på Stortinget.&lt;/p&gt;

&lt;p&gt;Og jo flere nettsteder som bruker Google Analytics, jo bedre
oversikt over stortingsrepresentantenes lesevaner og interesse blir
tilgjengelig for svensk, britisk og USAs etterretning.  Hva de kan
bruke den informasjonen til overlater jeg til leseren å undres
over.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Videos about the Freedombox project - for inspiration and learning</title>
                <link>https://people.skolelinux.org/pere/blog/Videos_about_the_Freedombox_project___for_inspiration_and_learning.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Videos_about_the_Freedombox_project___for_inspiration_and_learning.html</guid>
                <pubDate>Fri, 27 Sep 2013 14:10:00 +0200</pubDate>
                <description>&lt;p&gt;The &lt;a href=&quot;http://www.freedomboxfoundation.org/&quot;&gt;Freedombox
project&lt;/a&gt; have been going on for a while, and have presented the
vision, ideas and solution several places.  Here is a little
collection of videos of talks and presentation of the project.&lt;/p&gt;

&lt;ul&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=ukvUz5taxvA&quot;&gt;FreedomBox -
2,5 minute marketing film&lt;/a&gt; (Youtube)&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=SzW25QTVWsE&quot;&gt;Eben Moglen
discusses the Freedombox on CBS news 2011&lt;/a&gt; (Youtube)&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=Ae8SZbxfE0g&quot;&gt;Eben Moglen -
Freedom in the Cloud - Software Freedom, Privacy and and Security for
Web 2.0 and Cloud computing at ISOC-NY Public Meeting 2010&lt;/a&gt;
(Youtube)&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=vNaIji_3xBE&quot;&gt;Fosdem 2011
Keynote by Eben Moglen presenting the Freedombox&lt;/a&gt; (Youtube)&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=9bDDUyJSQ9s&quot;&gt;Presentation of
the Freedombox by James Vasile at Elevate in Gratz 2011&lt;/a&gt; (Youtube)&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=zQTmnk27g9s&quot;&gt; Freedombox -
Discovery, Identity, and Trust by Nick Daly at Freedombox Hackfest New
York City in 2012&lt;/a&gt; (Youtube)&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=tkbSB4Ba7Ck&quot;&gt;Introduction
to the Freedombox at Freedombox Hackfest New York City in 2012&lt;/a&gt;
(Youtube)&lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=z-P2Jaeg0aQ&quot;&gt;Freedom, Out
of the Box! by Bdale Garbee at linux.conf.au Ballarat, 2012&lt;/a&gt; (Youtube) &lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;https://archive.fosdem.org/2013/schedule/event/freedombox/&quot;&gt;Freedombox
1.0 by Eben Moglen and Bdale Garbee at Fosdem 2013&lt;/a&gt; (FOSDEM) &lt;/li&gt;

&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=e1LpYX2zVYg&quot;&gt;What is the
FreedomBox today by Bdale Garbee at Debconf13 in Vaumarcus
2013&lt;/a&gt; (Youtube)&lt;/li&gt;

&lt;/ul&gt;

&lt;p&gt;A larger list is available from
&lt;a href=&quot;https://wiki.debian.org/FreedomBox/TalksAndPresentations&quot;&gt;the
Freedombox Wiki&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;On other news, I am happy to report that Freedombox based on Debian
Jessie is coming along quite well, and soon both Owncloud and using
Tor should be available for testers of the Freedombox solution. :) In
a few weeks I hope everything needed to test it is included in Debian.
The withsqlite package is already in Debian, and the plinth package is
pending in NEW.  The third and vital part of that puzzle is the
metapackage/setup framework, which is still pending an upload.  Join
us on &lt;a href=&quot;irc://irc.debian.org:6667/%23freedombox&quot;&gt;IRC
(#freedombox on irc.debian.org)&lt;/a&gt; and
&lt;a href=&quot;http://lists.alioth.debian.org/mailman/listinfo/freedombox-discuss&quot;&gt;the
mailing list&lt;/a&gt; if you want to help make this vision come true.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Recipe to test the Freedombox project on amd64 or Raspberry Pi</title>
                <link>https://people.skolelinux.org/pere/blog/Recipe_to_test_the_Freedombox_project_on_amd64_or_Raspberry_Pi.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Recipe_to_test_the_Freedombox_project_on_amd64_or_Raspberry_Pi.html</guid>
                <pubDate>Tue, 10 Sep 2013 14:20:00 +0200</pubDate>
                <description>&lt;p&gt;I was introduced to the
&lt;a href=&quot;http://www.freedomboxfoundation.org/&quot;&gt;Freedombox project&lt;/a&gt;
in 2010, when Eben Moglen presented his vision about serving the need
of non-technical people to keep their personal information private and
within the legal protection of their own homes.  The idea is to give
people back the power over their network and machines, and return
Internet back to its intended peer-to-peer architecture.  Instead of
depending on a central service, the Freedombox will give everyone
control over their own basic infrastructure.&lt;/p&gt;

&lt;p&gt;I&#39;ve intended to join the effort since then, but other tasks have
taken priority.  But this summers nasty news about the misuse of trust
and privilege exercised by the &quot;western&quot; intelligence gathering
communities increased my eagerness to contribute to a point where I
actually started working on the project a while back.&lt;/p&gt;

&lt;p&gt;The &lt;a href=&quot;https://alioth.debian.org/projects/freedombox/&quot;&gt;initial
Debian initiative&lt;/a&gt; based on the vision from Eben Moglen, is to
create a simple and cheap Debian based appliance that anyone can hook
up in their home and get access to secure and private services and
communication.  The initial deployment platform have been the
&lt;a href=&quot;http://www.globalscaletechnologies.com/t-dreamplugdetails.aspx&quot;&gt;Dreamplug&lt;/a&gt;,
which is a piece of hardware I do not own.  So to be able to test what
the current Freedombox setup look like, I had to come up with a way to install
it on some hardware I do have access to.  I have rewritten the
&lt;a href=&quot;https://github.com/NickDaly/freedom-maker&quot;&gt;freedom-maker&lt;/a&gt;
image build framework to use .deb packages instead of only copying
setup into the boot images, and thanks to this rewrite I am able to
set up any machine supported by Debian Wheezy as a Freedombox, using
the previously mentioned deb (and a few support debs for packages
missing in Debian).&lt;/p&gt;

&lt;p&gt;The current Freedombox setup consist of a set of bootstrapping
scripts
(&lt;a href=&quot;https://github.com/petterreinholdtsen/freedombox-setup&quot;&gt;freedombox-setup&lt;/a&gt;),
and a administrative web interface
(&lt;a href=&quot;https://github.com/NickDaly/Plinth&quot;&gt;plinth&lt;/a&gt; + exmachina +
withsqlite), as well as a privacy enhancing proxy based on
&lt;a href=&quot;http://packages.qa.debian.org/privoxy&quot;&gt;privoxy&lt;/a&gt;
(freedombox-privoxy).  There is also a web/javascript based XMPP
client (&lt;a href=&quot;http://packages.qa.debian.org/jwchat&quot;&gt;jwchat&lt;/a&gt;)
trying (unsuccessfully so far) to talk to the XMPP server
(&lt;a href=&quot;http://packages.qa.debian.org/ejabberd&quot;&gt;ejabberd&lt;/a&gt;).  The
web interface is pluggable, and the goal is to use it to enable OpenID
services, mesh network connectivity, use of TOR, etc, etc.  Not much of
this is really working yet, see
&lt;a href=&quot;https://github.com/NickDaly/freedombox-todos/blob/master/TODO&quot;&gt;the
project TODO&lt;/a&gt; for links to GIT repositories.  Most of the code is
on github at the moment.  The HTTP proxy is operational out of the
box, and the admin web interface can be used to add/remove plinth
users.  I&#39;ve not been able to do anything else with it so far, but
know there are several branches spread around github and other places
with lots of half baked features.&lt;/p&gt;

&lt;p&gt;Anyway, if you want to have a look at the current state, the
following recipes should work to give you a test machine to poke
at.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Debian Wheezy amd64&lt;/strong&gt;&lt;/p&gt;

&lt;ol&gt;

&lt;li&gt;Fetch normal Debian Wheezy installation ISO.&lt;/li&gt;
&lt;li&gt;Boot from it, either as CD or USB stick.&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Press [tab] on the boot prompt and add this as a boot argument
to the Debian installer:&lt;p&gt;
&lt;pre&gt;url=&lt;a href=&quot;http://www.reinholdtsen.name/freedombox/preseed-wheezy.dat&quot;&gt;http://www.reinholdtsen.name/freedombox/preseed-wheezy.dat&lt;/a&gt;&lt;/pre&gt;&lt;/li&gt;

&lt;li&gt;Answer the few language/region/password questions and pick disk to
install on.&lt;/li&gt;

&lt;li&gt;When the installation is finished and the machine have rebooted a
few times, your Freedombox is ready for testing.&lt;/li&gt;

&lt;/ol&gt;

&lt;p&gt;&lt;strong&gt;Raspberry Pi Raspbian&lt;/strong&gt;&lt;/p&gt;

&lt;ol&gt;

&lt;li&gt;Fetch a Raspbian SD card image, create SD card.&lt;/li&gt;
&lt;li&gt;Boot from SD card, extend file system to fill the card completely.&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Log in and add this to /etc/sources.list:&lt;/p&gt;
&lt;pre&gt;
deb &lt;a href=&quot;http://www.reinholdtsen.name/freedombox/&quot;&gt;http://www.reinholdtsen.name/freedombox&lt;/a&gt; wheezy main
&lt;/pre&gt;&lt;/li&gt;
&lt;li&gt;&lt;p&gt;Run this as root:&lt;/p&gt;
&lt;pre&gt;
wget -O - http://www.reinholdtsen.name/freedombox/BE1A583D.asc | \
   apt-key add -
apt-get update
apt-get install freedombox-setup
/usr/lib/freedombox/setup
&lt;/pre&gt;&lt;/li&gt;
&lt;li&gt;Reboot into your freshly created Freedombox.&lt;/li&gt;

&lt;/ol&gt;

&lt;p&gt;You can test it on other architectures too, but because the
freedombox-privoxy package is binary, it will only work as intended on
the architectures where I have had time to build the binary and put it
in my APT repository.  But do not let this stop you.  It is only a
short &quot;&lt;tt&gt;apt-get source -b freedombox-privoxy&lt;/tt&gt;&quot; away. :)&lt;/p&gt;

&lt;p&gt;Note that by default Freedombox is a DHCP server on the
192.168.1.0/24 subnet, so if this is your subnet be careful and turn
off the DHCP server by running &quot;&lt;tt&gt;update-rc.d isc-dhcp-server
disable&lt;/tt&gt;&quot; as root.&lt;/p&gt;

&lt;p&gt;Please let me know if this works for you, or if you have any
problems.  We gather on the IRC channel
&lt;a href=&quot;irc://irc.debian.org:6667/%23freedombox&quot;&gt;#freedombox&lt;/a&gt; on
irc.debian.org and the
&lt;a href=&quot;http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/freedombox-discuss&quot;&gt;project
mailing list&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;Once you get your freedombox operational, you can visit
&lt;tt&gt;http://your-host-name:8001/&lt;/tt&gt; to see the state of the plint
welcome screen (dead end - do not be surprised if you are unable to
get past it), and next visit &lt;tt&gt;http://your-host-name:8001/help/&lt;/tt&gt;
to look at the rest of plinth.  The default user is &#39;admin&#39; and the
default password is &#39;secret&#39;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Dr. Richard Stallman, founder of Free Software Foundation, give a talk in Oslo March 1st 2013</title>
                <link>https://people.skolelinux.org/pere/blog/Dr__Richard_Stallman__founder_of_Free_Software_Foundation__give_a_talk_in_Oslo_March_1st_2013.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Dr__Richard_Stallman__founder_of_Free_Software_Foundation__give_a_talk_in_Oslo_March_1st_2013.html</guid>
                <pubDate>Wed, 27 Feb 2013 20:20:00 +0100</pubDate>
                <description>&lt;p&gt;Dr. &lt;a href=&quot;http://www.stallman.org/&quot;&gt;Richard Stallman&lt;/a&gt;,
founder of &lt;a href=&quot;http://www.fsf.org/&quot;&gt;Free Software Foundation&lt;/a&gt;,
is giving &lt;a href=&quot;http://www.nuug.no/aktiviteter/20130301-rms/&quot;&gt;a
talk in Oslo March 1st 2013 17:00 to 19:00&lt;/a&gt;.  The event is public
and organised by &lt;a href=&quot;&quot;&gt;Norwegian Unix Users Group (NUUG)&lt;/a&gt;
(where I am the chair of the board) and
&lt;a href=&quot;http://www.friprog.no/&quot;&gt;The Norwegian Open Source Competence
Center&lt;/a&gt;.  The title of the talk is «The Free Software Movement and
GNU», with this description:

&lt;p&gt;&lt;blockquote&gt;
The Free Software Movement campaigns for computer users&#39; freedom to
cooperate and control their own computing. The Free Software Movement
developed the GNU operating system, typically used together with the
kernel Linux, specifically to make these freedoms possible.
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;The meeting is open for everyone.  Due to space limitations, the
doors opens for NUUG members at 16:15, and everyone else at 16:45.  I
am really curious how many will show up.  See
&lt;a href=&quot;http://www.nuug.no/aktiviteter/20130301-rms/&quot;&gt;the event
page&lt;/a&gt; for the location details.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>1.4 millioner potensielle journalistsamtaler i politiets hender</title>
                <link>https://people.skolelinux.org/pere/blog/1_4_millioner_potensielle_journalistsamtaler_i_politiets_hender.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/1_4_millioner_potensielle_journalistsamtaler_i_politiets_hender.html</guid>
                <pubDate>Tue, 27 Nov 2012 15:20:00 +0100</pubDate>
                <description>&lt;p&gt;I fjor meldte Dagbladet og andre medier at
&lt;a href=&quot;http://www.dagbladet.no/2011/09/27/nyheter/innenriks/terror/anders_behring_breivik/18323147/&quot;&gt;politiet
hadde samlet inn informasjon om 1.4 millioner telefonsamtaler&lt;/a&gt; i
området rundt Akersgata, regjeringskvartalet og Utøya, i forbindelse
med etterforskningen rundt bombeattentatet og massemordet 22. juli
2011.  Politiadvokat Pål-Fredrik Hjort Kraby fortalte i følge
artikkelen at&lt;/p&gt;

&lt;blockquote&gt;
- «Dette er ikke kun samtaler som knyttes til Breivik. Dette er alle
samtaler som er registrert på basestasjoner i tilknytning til både
bomba i Regjeringskvartalet og aksjonen på Utøya. Vi må analysere tid,
lengde og fra hvilke basestasjoner de er registrert på. Vi prøver å
finne ut hvem som har ringt til en hver tid, også i dagene før.»
&lt;/blockquote&gt;

&lt;p&gt;Det triste og merkelige er at ingen presseoppslag tok opp hva dette
egentlig betød for kildevernet.  Et stenkast fra regjeringskvartalet
befinner redaksjonene til blant annet VG, Dagbladet og Aftenposten
seg.  Det betyr at et betydelig antall av journalisters samtaler var
og er tilgjengelig for politiet.  Og dette var ikke en unik hendelse.
Politiet henter rutinemessig ut informasjon om telefonsamtaler i
kriminaletterforskningen, og en kan gå ut ifra at det ofte vil være
noe kriminelt å undersøke nær en redaksjon da redaksjoner holder til i
sentrum og tettsteder, der det meste av annen aktivitet i et område
også foregår.  F.eks. befinner Aftenposten seg like ved Oslo
Sentralstasjon, et ganske kriminelt belastet område, der jeg mistenker
politiet ofte hente ut samtaleinformasjon.  Og avisen Aftenposten
annonserte jo for noen år siden at ansatte kun skulle ha mobiltelefon
(noe de kanskje angret på
&lt;a href=&quot;http://www.digi.no/216833/raadlose-bedrifter-uten-sikkerhetsnett&quot;&gt;da
mobilnettet brøt sammen&lt;/a&gt;), hvilket betyr at alle samtaler
journalistene gjennomfører går via nabolagets mobilbasestasjoner og
dermed blir med og analysert når politiet ber om informasjon om
mobilsamtaler i området.  Det samme gjelder antagelig de fleste
mediehus nå for tiden.&lt;/p&gt;

&lt;p&gt;Konsekvensen er at en må gå ut i fra at politiet kan få tilgang til
informasjon om alle samtaler med journalister, hvilket bør få varslere
og andre som vil tipse journalister til å tenke seg to ganger før de
ringer en journalist.  Det er for meg en svært uheldig situasjon.&lt;/p&gt;

&lt;p&gt;Anders Brenne tipset meg om dette tidligere i år, og har skrevet om
problemstillingen i sin bok
&lt;a href=&quot;http://www.hoyskoleforlaget.no/index.asp?template=40&amp;bokId=978-82-7147-358-7&quot;&gt;Digitalt
kildevern&lt;/a&gt; som ble lansert i år og
&lt;a href=&quot;http://www.netthoder.no/2012/04/dette-ma-du-vite-om-du-vil-sikre-kildevernet-referat/&quot;&gt;presentert
på et NONA-møte i april&lt;/a&gt;.  Oppsummeringen fra møtet inneholder
flere detaljer og bakgrunnsinformasjon.  Jeg synes det er besynderlig
at så få journalister tar opp denne problemstillingen, og ikke stiller
flere kritiske spørsmål til innføringen av datalagringsdirektivet og
den raderingen av personvernet som har foregått i Norge i løpet av
mange år nå.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>FAD tvinger igjennom BankID-tilgang til personsensitiv informasjon om meg</title>
                <link>https://people.skolelinux.org/pere/blog/FAD_tvinger_igjennom_BankID_tilgang_til_personsensitiv_informasjon_om_meg.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/FAD_tvinger_igjennom_BankID_tilgang_til_personsensitiv_informasjon_om_meg.html</guid>
                <pubDate>Wed, 21 Nov 2012 17:10:00 +0100</pubDate>
                <description>&lt;p&gt;I dag fikk jeg svar fra fornyingsdepartementet på min
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/BankID_skal_ikke_gi_tilgang_til_min_personsensitive_informasjon.html&quot;&gt;forespørsel
om å reservere meg mot at BankID&lt;/a&gt; brukes til å få tilgang til
informasjon om meg via ID-porten.  Like etter at svaret kom fikk jeg
beskjed om at min henvendelse har fått
&lt;a href=&quot;http://www.oep.no/search/result.html?caseNumber=2012/3446&amp;searchType=advanced&amp;list2=94&amp;caseSearch=true&amp;sortField=doknr&quot;&gt;saksnummer
12/3446 hos FAD&lt;/a&gt;, som dessverre ikke har dukket opp i Offentlig
Elektronisk Postjournal ennå.  Her er svaret jeg fikk:&lt;/p&gt;

&lt;blockquote&gt;
&lt;p&gt;Date: Wed, 21 Nov 2012 11:18:52 +0000
&lt;br&gt;From: Hornnes Stig &amp;lt;Stig.Hornnes (at) fad.dep.no&amp;gt;
&lt;br&gt;To: Petter Reinholdtsen
&lt;br&gt;Subject: Reservasjon mot BankID&lt;/p&gt;

&lt;p&gt;Hei Petter,&lt;/p&gt;

&lt;p&gt;Du har sendt oss forespørsel om at din bruker blir reservert mot bruk
av BankID i ID-porten. Det er ikke lagt opp til at enkeltpersoner kan
reservere seg på denne måten.&lt;/p&gt;

&lt;p&gt;Tanken bak ID-porten er at innbyggerne skal kunne velge hvilken eID de
ønsker å bruke for å logge på offentlige tjenester. For å sikre
valgfriheten har vi inngått avtaler med BankID, Buypass og
Commfides. I tillegg har vi den offentlige MinID, men hvor utstedelse
skjer til adresse registrert i folkeregisteret, og derfor ikke er
egnet til tjenestene med det høyeste sikkerhetsbehovet.&lt;/p&gt;

&lt;p&gt;Sikkerhet er et viktig tema for oss. Alle leverandørene som er i
ID-porten i dag, inkl. BankID, har oppfylt både kravene som fremgår av
Kravspek PKI (pluss noen tilleggskrav fra Difi i anskaffelsen) og er
selvdeklarerte hos Post og Teletilsynet (PT) som har tilsynsansvar for
denne typen virksomheter. For BankID sin del ble det gjennomført
revisjon av løsningen i 2009, på bestilling fra PT etter en del
negative oppslag knyttet til nettopp sikkerheten i løsningen. Det
fremkom ingen alvorlige sikkerhetsproblemer i revisjonen.&lt;/p&gt;

&lt;p&gt;Når dette er sagt; Ingen løsninger er 100 prosent sikre, verken
papirbaserte systemer eller elektroniske. Eksempelvis vil misbruk av
identitetsbevis for å urettmessig skaffe seg en e-ID, alltid være en
risiko. Men det er en generell risiko for alle nivå 4-e-id-er vi har i
Norge per i dag.  Det er kriminelt, men det er umulig å være ett
hundre prosent sikker på at det ikke kan skje. Vi har imidlertid fokus
på å redusere risikoen så mye som mulig, og skal jobbe videre sammen
med blant annet Justisdepartementet med ulike tiltak som vil bidra til
bedre grunnidentifisering av innbyggere.&lt;/p&gt;

&lt;p&gt;Mvh
&lt;br&gt;Stig Hornnes
&lt;br&gt;Rådgiver - FAD&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Litt merkelig at de har glemt å legge opp til at enkeltpersoner kan
reservere seg på denne måten.  FAD burde være klar over
problemstillingen med reservasjon, da jeg tok det opp med dem da de
presenterte MinID på en presentasjon de holdt på Gardermoen for noen
år siden.  Det burde jo også være teknisk svært enkelt å få støtte for
slikt i en ID-portal.  Her må det visst tyngre virkemidler til enn en
vennlig forespørsel om å reservere seg.  Får tenke igjennom neste
steg.&lt;/p&gt;

&lt;p&gt;Du lurer kanskje på hva som er problemet med BankID?  For å
forklare det, er det greit å gå et steg tilbake og beskrive offentlig
nøkkel-kryptering, eller
&lt;a href=&quot;http://snl.no/asymmetrisk_kryptografi&quot;&gt;asymmetrisk
kryptografi&lt;/a&gt; som det også kalles.  En fin beskrivelse
&lt;a href=&quot;http://www.matematikk.org/artikkel.html?tid=63068&quot;&gt;finnes på
matematikk.org&lt;/a&gt;:&lt;/p&gt;

&lt;blockquote&gt;
Se for deg at person A har en hengelås og at han sender den til deg (i
åpen tilstand), men beholder nøkkelen. Du kan dermed låse inn en
hemmelighet ved hjelp av hengelåsen og sende den til A. Bare A kan
låse opp igjen, siden bare A har den riktige nøkkelen.
&lt;/blockquote&gt;

&lt;p&gt;Signering med asymmetrisk kryptering gjør at en kan vite at kun de
som har tilgang til nøkkelen har signert et gitt dokument.  Mitt
problem med BankID er det er utformet slik at banken beholder nøkkelen
til hengelåsen og kontraktsmessig har lovet å kun bruke den når jeg
ber om det.  Det er ikke godt nok for meg.  Jeg forventer et system
der kun jeg har nøkkelen hvis det skal kunne brukes til å inngå
avtaler på mine vegne eller få tilgang til min personsensitive
informasjon.  Jeg forventer at det velges en teknisk løsning der det
er tvingende nødvendig at jeg er involvert når det skal signeres noe
på mine vegne.  BankID er ikke en slik.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>BankID skal ikke gi tilgang til min personsensitive informasjon</title>
                <link>https://people.skolelinux.org/pere/blog/BankID_skal_ikke_gi_tilgang_til_min_personsensitive_informasjon.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/BankID_skal_ikke_gi_tilgang_til_min_personsensitive_informasjon.html</guid>
                <pubDate>Fri, 16 Nov 2012 12:30:00 +0100</pubDate>
                <description>&lt;p&gt;Onsdag i denne uka annonserte
&lt;a href=&quot;http://www.fad.dep.no/&quot;&gt;Fornyingsdepartementet&lt;/a&gt; at de har
inngått kontrakt med BankID Norge om bruk av BankID for å la borgerne
logge inn på offentlige nettsider der en kan få tilgang til
personsensitiv informasjon.  Jeg skrev i 2009 litt om
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Jeg_vil_ikke_ha_BankID.html&quot;&gt;hvorfor
jeg ikke vil ha BankID&lt;/a&gt; &amp;mdash; jeg stoler ikke nok på en bank til
å gi dem mulighet til å inngå avtaler på mine vegne.  Jeg forlanger at
jeg skal være involvert når det skal inngås avtaler på mine vegne.&lt;/p&gt;

&lt;p&gt;Jeg har derfor valgt å bruke
&lt;a href=&quot;http://www.skandibanken.no/&quot;&gt;Skandiabanken&lt;/a&gt; (det er flere
banker som ikke krever BankID, se
&lt;a href=&quot;http://no.wikipedia.org/wiki/BankID&quot;&gt;Wikipedia for en
liste&lt;/a&gt;) på grunn av at de ikke tvinger sine kunder til å bruke
BankID.  I motsetning til Postbanken, som løy til meg i 2009 da
kundestøtten der sa at det var blitt et krav fra Kreditttilsynet og
BBS om at norske banker måtte innføre BankID, har ikke Skandiabanken
forsøkt å tvinge meg til å ta i bruk BankID.  Jeg fikk nylig endelig
spurt Finanstilsynet (de har byttet navn siden 2009), og fikk beskjed
fra Frank Robert Berg hos Finanstilsynet i epost 2012-09-17 at
Finanstilsynet ikke har fremsatt slike krav.  Med andre ord snakket
ikke Postbankens kundestøtte sant i 2009.&lt;/p&gt;

&lt;p&gt;Når en i tillegg fra
&lt;a href=&quot;http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html&quot;&gt;oppslag
i Aftenposten&lt;/a&gt; vet at de som jobber i alle bankene som bruker
BankID i dag, det være seg utro tjenere, eller de som lar seg lure av
falsk legitimasjon, kan lage og dele ut en BankID som gir tilgang til
mine kontoer og rett til å inngå avtaler på mine vegne, blir det
viktigere enn noen gang å få reservert seg mot BankID.  Det holder
ikke å la være å bruke det selv.  Jeg sendte derfor følgende
epost-brev til Fornyingsdepartementet i går:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
&lt;p&gt;Date: Thu, 15 Nov 2012 11:08:31 +0100
&lt;br&gt;From: Petter Reinholdtsen &amp;lt;pere (at) hungry.com&amp;gt;
&lt;br&gt;To: postmottak (at) fad.dep.no
&lt;br&gt;Subject: Forespørsel om reservasjon mot bruk av BankID i ID-porten&lt;/p&gt;

&lt;p&gt;Jeg viser til nyheten om at staten har tildelt kontrakt for å
levere elektronisk ID for offentlige digitale tjenester til BankID
Norge, referert til blant annet i Digi[1] og i FADs
pressemelding[2].&lt;/p&gt;

&lt;p&gt;1) &amp;lt;URL: &lt;a href=&quot;http://www.digi.no/906093/staten-gaar-for-bankid&quot;&gt;http://www.digi.no/906093/staten-gaar-for-bankid&lt;/a&gt; &amp;gt;
&lt;br&gt;2) &amp;lt;URL: &lt;a href=&quot;http://www.regjeringen.no/nb/dep/fad/pressesenter/pressemeldinger/2012/staten-inngar-avtale-med-bankid.html&quot;&gt;http://www.regjeringen.no/nb/dep/fad/pressesenter/pressemeldinger/2012/staten-inngar-avtale-med-bankid.html&lt;/a&gt; &amp;gt;&lt;/p&gt;

&lt;p&gt;Gitt BankIDs utforming, der BankID-utsteder har både privat og
offentlig del av kundens nøkkel hos seg, er jeg ikke villig til å gi
tilgang til informasjon som hører til min min privatsfære ved hjelp av
innlogging med BankID.&lt;/p&gt;

&lt;p&gt;Jeg ber derfor herved om at løsningen settes opp slik at ingen kan
logge inn som meg på offentlige digitale tjenester ved hjelp av
BankID, det vil si at jeg reserverer meg mot enhver bruk av BankID for
å logge meg inn på slike tjenester som kan inneholde personsensitiv
informasjon om meg.&lt;/p&gt;

&lt;p&gt;Jeg har ikke BankID i dag, men som en kan se i oppslag i Aftenposten
2012-09-13[3] er det ikke til hindrer for at andre kan bruke BankID på
mine vegne for å få tilgang.  Det sikkerhetsproblemet kommer i tillegg
til utformingsproblemet omtalt over, og forsterker bare mitt syn på at
BankID ikke er aktuelt for meg til noe annet enn å logge inn i en
nettbank der banken i større grad bærer risikoen ved misbruk.&lt;/p&gt;

&lt;p&gt;3) &amp;lt;URL: &lt;a href=&quot;http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html&quot;&gt;http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html&lt;/a&gt; &amp;gt;&lt;/p&gt;

&lt;p&gt;Jeg ber om rask tilbakemelding med saksnummer for min henvendelse.
Jeg ber videre om bekreftelse på at BankID-innlogging er blokkert når
det gjelder tilgang til &quot;min&quot; informasjon hos det offentlige, i
forkant av BankID-integrasjon mot ID-porten som i følge
pressemeldingen skal komme på plass i løpet av et par uker.&lt;/p&gt;

&lt;p&gt;-- 
&lt;br&gt;Vennlig hilsen
&lt;br&gt;Petter Reinholdtsen&lt;/p&gt;
&lt;/blockquote&gt;
                 
&lt;p&gt;Jeg venter spent på svaret.  Jeg mistenker jeg må sende tilsvarende
beskjed til mine bankforbindelser for å sikre mine bankkontoer.&lt;/p&gt;

&lt;p&gt;Hvis det skal brukes offentlig nøkkel-teknologi til å inngå avtaler
på mine vegne og skaffe seg personsensitiv informasjon om meg, så er
mitt krav at det kun er jeg som har tilgang på min private nøkkel.
Alt annet blir å gi for mye tillit til andre.  Med BankID sitter andre
på både &quot;min&quot; offentlige og private nøkkel.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>The European Central Bank (ECB) take a look at bitcoin</title>
                <link>https://people.skolelinux.org/pere/blog/The_European_Central_Bank__ECB__take_a_look_at_bitcoin.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/The_European_Central_Bank__ECB__take_a_look_at_bitcoin.html</guid>
                <pubDate>Sun, 4 Nov 2012 08:30:00 +0100</pubDate>
                <description>&lt;p&gt;Slashdot just ran a story about the European Central Bank (ECB)
&lt;a href=&quot;http://www.ecb.europa.eu/pub/pdf/other/virtualcurrencyschemes201210en.pdf&quot;&gt;releasing
a report (PDF)&lt;/a&gt; about virtual currencies and
&lt;a href=&quot;http://www.bitcoin.org/&quot;&gt;bitcoin&lt;/a&gt;.  It is interesting to
see how a member of the bitcoin community
&lt;a href=&quot;http://blog.bitinstant.com/blog/2012/10/30/the-ecb-report-on-bitcoin-and-virtual-currencies.html&quot;&gt;receive
the report&lt;/a&gt;.  As for the future, I suspect the central banks and
the governments will outlaw bitcoin if it gain any popularity, to avoid
competition.  My thoughts go to the
&lt;a href=&quot;http://en.wikipedia.org/wiki/Wörgl&quot;&gt;Wörgl experiment&lt;/a&gt; with
negative inflation on cash which was such a success that it was
terminated by the Austrian National Bank in 1933.  A successful
alternative would be a threat to the current money system and gain
powerful forces to work against it.&lt;/p&gt;

&lt;p&gt;While checking out the current status of bitcoin, I also discovered
that the community already seem to have
&lt;a href=&quot;http://www.theverge.com/2012/8/27/3271637/bitcoin-savings-trust-pyramid-scheme-shuts-down&quot;&gt;experienced
its first pyramid game / Ponzi scheme&lt;/a&gt;.  Not very surprising, given
how members of &quot;small&quot; communities tend to trust each other.  I guess
enterprising crocks will try again and again, as they do anywhere
wealth is available.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>The fight for freedom and privacy</title>
                <link>https://people.skolelinux.org/pere/blog/The_fight_for_freedom_and_privacy.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/The_fight_for_freedom_and_privacy.html</guid>
                <pubDate>Thu, 18 Oct 2012 10:50:00 +0200</pubDate>
                <description>&lt;p&gt;Civil liberties and privacy in the western world are going down the
drain, and it is hard to fight against it.  I try to do my best, but
time is limited.  I hope you do your best too.  A few years ago I came
across a marvellous drawing by
&lt;a href=&quot;http://www.claybennett.com/about.html&quot;&gt;Clay Bennett&lt;/a&gt;
visualising some of what is going on.

&lt;p&gt;&lt;a href=&quot;http://www.claybennett.com/pages/security_fence.html&quot;&gt;
&lt;img src=&quot;http://www.claybennett.com/images/archivetoons/security_fence.jpg&quot;&gt;&lt;/a&gt;&lt;/p&gt;

&lt;blockquote&gt;
«They who can give up essential liberty to obtain a little temporary
safety, deserve neither liberty nor safety.» - Benjamin Franklin
&lt;/blockquote&gt;

&lt;p&gt;Do you feel safe at the airport?  I do not.  Do you feel safe when
you see a surveillance camera?  I do not.  Do you feel safe when you
leave electronic traces of your behaviour and opinions?  I do not.  I
just remember &lt;a href=&quot;http://en.wikipedia.org/wiki/Panopticon&quot;&gt;the
Panopticon&lt;/a&gt;, and can not help to think that we are slowly
transforming our society to a huge Panopticon on our own.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Using NVD and CPE to track CVEs in locally maintained software</title>
                <link>https://people.skolelinux.org/pere/blog/Using_NVD_and_CPE_to_track_CVEs_in_locally_maintained_software.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Using_NVD_and_CPE_to_track_CVEs_in_locally_maintained_software.html</guid>
                <pubDate>Fri, 28 Jan 2011 15:40:00 +0100</pubDate>
                <description>&lt;p&gt;The last few days I have looked at ways to track open security
issues here at my work with the University of Oslo.  My idea is that
it should be possible to use the information about security issues
available on the Internet, and check our locally
maintained/distributed software against this information.  It should
allow us to verify that no known security issues are forgotten.  The
CVE database listing vulnerabilities seem like a great central point,
and by using the package lists from Debian mapped to CVEs provided by
the testing security team, I believed it should be possible to figure
out which security holes were present in our free software
collection.&lt;/p&gt;

&lt;p&gt;After reading up on the topic, it became obvious that the first
building block is to be able to name software packages in a unique and
consistent way across data sources.  I considered several ways to do
this, for example coming up with my own naming scheme like using URLs
to project home pages or URLs to the Freshmeat entries, or using some
existing naming scheme.  And it seem like I am not the first one to
come across this problem, as MITRE already proposed and implemented a
solution.  Enter the &lt;a href=&quot;http://cpe.mitre.org/index.html&quot;&gt;Common
Platform Enumeration&lt;/a&gt; dictionary, a vocabulary for referring to
software, hardware and other platform components.  The CPE ids are
mapped to CVEs in the &lt;a href=&quot;http://web.nvd.nist.gov/&quot;&gt;National
Vulnerability Database&lt;/a&gt;, allowing me to look up know security
issues for any CPE name.  With this in place, all I need to do is to
locate the CPE id for the software packages we use at the university.
This is fairly trivial (I google for &#39;cve cpe $package&#39; and check the
NVD entry if a CVE for the package exist).&lt;/p&gt;

&lt;p&gt;To give you an example.  The GNU gzip source package have the CPE
name cpe:/a:gnu:gzip.  If the old version 1.3.3 was the package to
check out, one could look up
&lt;a href=&quot;http://web.nvd.nist.gov/view/vuln/search?cpe=cpe%3A%2Fa%3Agnu%3Agzip:1.3.3&quot;&gt;cpe:/a:gnu:gzip:1.3.3
in NVD&lt;/a&gt; and get a list of 6 security holes with public CVE entries.
The most recent one is
&lt;a href=&quot;http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-0001&quot;&gt;CVE-2010-0001&lt;/a&gt;,
and at the bottom of the NVD page for this vulnerability the complete
list of affected versions is provided.&lt;/p&gt;

&lt;p&gt;The NVD database of CVEs is also available as a XML dump, allowing
for offline processing of issues.  Using this dump, I&#39;ve written a
small script taking a list of CPEs as input and list all CVEs
affecting the packages represented by these CPEs.  One give it CPEs
with version numbers as specified above and get a list of open
security issues out.&lt;/p&gt;

&lt;p&gt;Of course for this approach to be useful, the quality of the NVD
information need to be high.  For that to happen, I believe as many as
possible need to use and contribute to the NVD database.  I notice
RHEL is providing
&lt;a href=&quot;https://www.redhat.com/security/data/metrics/rhsamapcpe.txt&quot;&gt;a
map from CVE to CPE&lt;/a&gt;, indicating that they are using the CPE
information.  I&#39;m not aware of Debian and Ubuntu doing the same.&lt;/p&gt;

&lt;p&gt;To get an idea about the quality for free software, I spent some
time making it possible to compare the CVE database from Debian with
the CVE database in NVD.  The result look fairly good, but there are
some inconsistencies in NVD (same software package having several
CPEs), and some inaccuracies (NVD not mentioning buggy packages that
Debian believe are affected by a CVE).  Hope to find time to improve
the quality of NVD, but that require being able to get in touch with
someone maintaining it.  So far my three emails with questions and
corrections have not seen any reply, but I hope contact can be
established soon.&lt;/p&gt;

&lt;p&gt;An interesting application for CPEs is cross platform package
mapping.  It would be useful to know which packages in for example
RHEL, OpenSuSe and Mandriva are missing from Debian and Ubuntu, and
this would be trivial if all linux distributions provided CPE entries
for their packages.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Some thoughts on BitCoins</title>
                <link>https://people.skolelinux.org/pere/blog/Some_thoughts_on_BitCoins.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Some_thoughts_on_BitCoins.html</guid>
                <pubDate>Sat, 11 Dec 2010 15:10:00 +0100</pubDate>
                <description>&lt;p&gt;As I continue to explore
&lt;a href=&quot;http://www.bitcoin.org/&quot;&gt;BitCoin&lt;/a&gt;, I&#39;ve starting to wonder
what properties the system have, and how it will be affected by laws
and regulations here in Norway.  Here are some random notes.&lt;/p&gt;

&lt;p&gt;One interesting thing to note is that since the transactions are
verified using a peer to peer network, all details about a transaction
is known to everyone.  This means that if a BitCoin address has been
published like I did with mine in my initial post about BitCoin, it is
possible for everyone to see how many BitCoins have been transfered to
that address.  There is even a web service to look at the details for
all transactions.  There I can see that my address
&lt;a href=&quot;http://blockexplorer.com/address/15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&quot;&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/a&gt;
have received 16.06 Bitcoin, the
&lt;a href=&quot;http://blockexplorer.com/address/1LfdGnGuWkpSJgbQySxxCWhv8MHqvwst3&quot;&gt;1LfdGnGuWkpSJgbQySxxCWhv8MHqvwst3&lt;/a&gt;
address of Simon Phipps have received 181.97 BitCoin and the address
&lt;a href=&quot;http://blockexplorer.com/address/1MCwBbhNGp5hRm5rC1Aims2YFRe2SXPYKt&quot;&gt;1MCwBbhNGp5hRm5rC1Aims2YFRe2SXPYKt&lt;/A&gt;
of EFF have received 2447.38 BitCoins so far.  Thank you to each and
every one of you that donated bitcoins to support my activity. The
fact that anyone can see how much money was transfered to a given
address make it more obvious why the BitCoin community recommend to
generate and hand out a new address for each transaction.  I&#39;m told
there is no way to track which addresses belong to a given person or
organisation without the person or organisation revealing it
themselves, as Simon, EFF and I have done.&lt;/p&gt;

&lt;p&gt;In Norway, and in most other countries, there are laws and
regulations limiting how much money one can transfer across the border
without declaring it.  There are money laundering, tax and accounting
laws and regulations I would expect to apply to the use of BitCoin.
If the Skolelinux foundation
(&lt;a href=&quot;http://linuxiskolen.no/slxdebianlabs/donations.html&quot;&gt;SLX
Debian Labs&lt;/a&gt;) were to accept donations in BitCoin in addition to
normal bank transfers like EFF is doing, how should this be accounted?
Given that it is impossible to know if money can cross the border or
not, should everything or nothing be declared?  What exchange rate
should be used when calculating taxes?  Would receivers have to pay
income tax if the foundation were to pay Skolelinux contributors in
BitCoin?  I have no idea, but it would be interesting to know.&lt;/p&gt;

&lt;p&gt;For a currency to be useful and successful, it must be trusted and
accepted by a lot of users.  It must be possible to get easy access to
the currency (as a wage or using currency exchanges), and it must be
easy to spend it.  At the moment BitCoin seem fairly easy to get
access to, but there are very few places to spend it.  I am not really
a regular user of any of the vendor types currently accepting BitCoin,
so I wonder when my kind of shop would start accepting BitCoins.  I
would like to buy electronics, travels and subway tickets, not herbs
and books. :) The currency is young, and this will improve over time
if it become popular, but I suspect regular banks will start to lobby
to get BitCoin declared illegal if it become popular.  I&#39;m sure they
will claim it is helping fund terrorism and money laundering (which
probably would be true, as is any currency in existence), but I
believe the problems should be solved elsewhere and not by blaming
currencies.&lt;/p&gt;

&lt;p&gt;The process of creating new BitCoins is called mining, and it is
CPU intensive process that depend on a bit of luck as well (as one is
competing against all the other miners currently spending CPU cycles
to see which one get the next lump of cash).  The &quot;winner&quot; get 50
BitCoin when this happen.  Yesterday I came across the obvious way to
join forces to increase ones changes of getting at least some coins,
by coordinating the work on mining BitCoins across several machines
and people, and sharing the result if one is lucky and get the 50
BitCoins.  Check out
&lt;a href=&quot;http://www.bluishcoder.co.nz/bitcoin-pool/&quot;&gt;BitCoin Pool&lt;/a&gt;
if this sounds interesting.  I have not had time to try to set up a
machine to participate there yet, but have seen that running on ones
own for a few days have not yield any BitCoins througth mining
yet.&lt;/p&gt;

&lt;p&gt;Update 2010-12-15: Found an &lt;a
href=&quot;http://inertia.posterous.com/reply-to-the-underground-economist-why-bitcoi&quot;&gt;interesting
criticism&lt;/a&gt; of bitcoin.  Not quite sure how valid it is, but thought
it was interesting to read.  The arguments presented seem to be
equally valid for gold, which was used as a currency for many years.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Pornoskannerne på flyplassene bedrer visst ikke sikkerheten</title>
                <link>https://people.skolelinux.org/pere/blog/Pornoskannerne_p__flyplassene_bedrer_visst_ikke_sikkerheten.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Pornoskannerne_p__flyplassene_bedrer_visst_ikke_sikkerheten.html</guid>
                <pubDate>Sat, 11 Dec 2010 10:45:00 +0100</pubDate>
                <description>&lt;p&gt;Via &lt;a href=&quot;http://webmink.com/2010/12/10/links-for-2010-12-10/&quot;&gt;en
blogpost fra Simon Phipps i går&lt;/a&gt;, fant jeg en referanse til
&lt;a href=&quot;http://www.washingtontimes.com/news/2010/dec/9/exposed-tsas-x-rated-scanner-fraud/&quot;&gt;en
artikkel i Washington Times&lt;/a&gt; som igjen refererer til en artikkel i
det fagfellevurderte tidsskriftet Journal of Transportation Security
med tittelen
&quot;&lt;a href=&quot;http://springerlink.com/content/g6620thk08679160/fulltext.html&quot;&gt;An
evaluation of airport x-ray backscatter units based on image
characteristics&lt;/a&gt;&quot; som enkelt konstaterer at
&lt;a href=&quot;http://www.dailysquib.co.uk/?a=2389&amp;c=124&quot;&gt;pornoscannerne&lt;/a&gt;
som kler av reisende på flyplasser ikke er i stand til å avsløre det
produsenten og amerikanske myndigheter sier de skal avsløre.  Kort
sagt, de bedrer ikke sikkerheten.  Reisende må altså la ansatte på
flyplasser &lt;a href=&quot;http://www.thousandsstandingaround.org/&quot;&gt;se dem
nakne eller la seg beføle i skrittet&lt;/a&gt; uten grunn.  Jeg vil
fortsette å nekte å bruke disse pornoskannerne, unngå flyplasser der
de er tatt i bruk, og reise med andre transportmidler enn fly hvis jeg
kan.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Now accepting bitcoins - anonymous and distributed p2p crypto-money</title>
                <link>https://people.skolelinux.org/pere/blog/Now_accepting_bitcoins___anonymous_and_distributed_p2p_crypto_money.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Now_accepting_bitcoins___anonymous_and_distributed_p2p_crypto_money.html</guid>
                <pubDate>Fri, 10 Dec 2010 08:20:00 +0100</pubDate>
                <description>&lt;p&gt;With this weeks lawless
&lt;a href=&quot;http://www.salon.com/news/opinion/glenn_greenwald/2010/12/06/wikileaks/index.html&quot;&gt;governmental
attacks&lt;/a&gt; on Wikileak and
&lt;a href=&quot;http://www.salon.com/technology/dan_gillmor/2010/12/06/war_on_speech&quot;&gt;free
speech&lt;/a&gt;, it has become obvious that PayPal, visa and mastercard can
not be trusted to handle money transactions.
A blog post from
&lt;a href=&quot;http://webmink.com/2010/12/06/now-accepting-bitcoin/&quot;&gt;Simon
Phipps on bitcoin&lt;/a&gt; reminded me about a project that a friend of
mine mentioned earlier.  I decided to follow Simon&#39;s example, and get
involved with &lt;a href=&quot;http://www.bitcoin.org/&quot;&gt;BitCoin&lt;/a&gt;.  I got
some help from my friend to get it all running, and he even handed me
some bitcoins to get started.  I even donated a few bitcoins to Simon
for helping me remember BitCoin.&lt;/p&gt;

&lt;p&gt;So, what is bitcoins, you probably wonder?  It is a digital
crypto-currency, decentralised and handled using peer-to-peer
networks.  It allows anonymous transactions and prohibits central
control over the transactions, making it impossible for governments
and companies alike to block donations and other transactions.  The
source is free software, and while the key dependency wxWidgets 2.9
for the graphical user interface is missing in Debian, the command
line client builds just fine.  Hopefully Jonas
&lt;a href=&quot;http://bugs.debian.org/578157&quot;&gt;will get the package into
Debian&lt;/a&gt; soon.&lt;/p&gt;

&lt;p&gt;Bitcoins can be converted to other currencies, like USD and EUR.
There are &lt;a href=&quot;http://www.bitcoin.org/trade&quot;&gt;companies accepting
bitcoins&lt;/a&gt; when selling services and goods, and there are even
currency &quot;stock&quot; markets where the exchange rate is decided.  There
are not many users so far, but the concept seems promising.  If you
want to get started and lack a friend with any bitcoins to spare,
you can even get
&lt;a href=&quot;https://freebitcoins.appspot.com/&quot;&gt;some for free&lt;/a&gt; (0.05
bitcoin at the time of writing).  Use
&lt;a href=&quot;http://www.bitcoinwatch.com/&quot;&gt;BitcoinWatch&lt;/a&gt; to keep an eye
on the current exchange rates.&lt;/p&gt;

&lt;p&gt;As an experiment, I have decided to set up bitcoind on one of my
machines.  If you want to support my activity, please send Bitcoin
donations to the address
&lt;b&gt;15oWEoG9dUPovwmUL9KWAnYRtNJEkP1u1b&lt;/b&gt;.  Thank you!&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>DND hedrer overvåkning av barn med Rosingsprisen</title>
                <link>https://people.skolelinux.org/pere/blog/DND_hedrer_overv_kning_av_barn_med_Rosingsprisen.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/DND_hedrer_overv_kning_av_barn_med_Rosingsprisen.html</guid>
                <pubDate>Tue, 23 Nov 2010 14:15:00 +0100</pubDate>
                <description>&lt;p&gt;Jeg registrerer med vond smak i munnen at Den Norske Dataforening
&lt;a
href=&quot;http://www.dataforeningen.no/hedret-med-rosingprisen.4849070-133913.html&quot;&gt;hedrer
overvåkning av barn med Rosingsprisen for kreativitet i år&lt;/a&gt;.  Jeg
er glad jeg nå er meldt ut av DND.&lt;/p&gt;

&lt;p&gt;Å elektronisk overvåke sine barn er ikke å gjøre dem en tjeneste,
men et overgrep mot individer i utvikling som bør læres opp til å ta
egne valg.&lt;/p&gt;

&lt;p&gt;For å sitere Datatilsynets nye leder, Bjørn Erik Thon, i
&lt;a href=&quot;http://www.idg.no/computerworld/article174262.ece&quot;&gt;et intervju
med Computerworld Norge&lt;/A&gt;:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
- For alle som har barn, meg selv inkludert, er førstetanken at det
hadde vært fint å vite hvor barnet sitt er til enhver tid. Men ungene
har ikke godt av det. De er små individer som skal søke rundt og finne
sine små gjemmesteder og utvide horisonten, uten at foreldrene ser dem
i kortene. Det kan være fristende, men jeg ville ikke gått inn i
dette.
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Det er skremmende å se at DND mener en tjeneste som legger opp til
slike overgrep bør hedres.  Å flytte oppveksten for barn inn i en
virtuell
&lt;a href=&quot;http://en.wikipedia.org/wiki/Panopticon&quot;&gt;Panopticon&lt;/a&gt; er et
grovt overgrep og vil gjøre skade på barnenes utvikling, og foreldre
burde tenke seg godt om før de gir etter for sine instinkter her.&lt;/p&gt;

&lt;p&gt;Blipper-tjenesten får meg til å tenke på bøkene til
&lt;a href=&quot;http://en.wikipedia.org/wiki/John_Twelve_Hawks&quot;&gt;John Twelve
Hawks&lt;/a&gt;, som forbilledlig beskriver hvordan et totalitært
overvåkningssamfunn bygges sakte men sikkert rundt oss, satt sammen av
gode intensjoner og manglende bevissthet om hvilke prinsipper et
liberalt demokrati er fundamentert på.  Jeg har hatt stor glede av å
lese alle de tre bøkene.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Datatilsynet mangler verktøyet som trengs for å kontrollere kameraovervåkning</title>
                <link>https://people.skolelinux.org/pere/blog/Datatilsynet_mangler_verkt_yet_som_trengs_for___kontrollere_kameraoverv_kning.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Datatilsynet_mangler_verkt_yet_som_trengs_for___kontrollere_kameraoverv_kning.html</guid>
                <pubDate>Tue, 9 Nov 2010 14:35:00 +0100</pubDate>
                <description>&lt;p&gt;En stund tilbake ble jeg oppmerksom på at Datatilsynets verktøy for
å holde rede på overvåkningskamera i Norge ikke var egnet til annet
enn å lage statistikk, og ikke kunne brukes for å kontrollere om et
overvåkningskamera i det offentlige rom er lovlig satt opp og
registrert.  For å teste hypotesen sendte jeg for noen dager siden
følgende spørsmål til datatilsynet.  Det omtalte kameraet står litt
merkelig plassert i veigrøften ved gangstien langs Sandakerveien, og
jeg lurer oppriktig på om det er lovlig plassert og registrert.&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
&lt;p&gt;Date: Tue, 2 Nov 2010 16:08:20 +0100
&lt;br&gt;From: Petter Reinholdtsen &amp;lt;pere (at) hungry.com&amp;gt;
&lt;br&gt;To: postkasse (at) datatilsynet.no
&lt;br&gt;Subject: Er overvåkningskameraet korrekt registrert?&lt;/p&gt;

&lt;p&gt;Hei.&lt;/p&gt;

&lt;p&gt;I Nydalen i Oslo er det mange overvåkningskamera, og et av dem er
spesielt merkelig plassert like over et kumlokk.  Jeg lurer på om
dette kameraet er korrekt registrert og i henhold til lovverket.&lt;/p&gt;

&lt;p&gt;Finner ingen eierinformasjon på kameraet, og dermed heller ingenting å
søke på i &amp;lt;URL:
&lt;a href=&quot;http://hetti.datatilsynet.no/melding/report_search.pl&quot;&gt;http://hetti.datatilsynet.no/melding/report_search.pl&lt;/a&gt; &amp;gt;.
Kartreferanse for kameraet er tilgjengelig fra
&amp;lt;URL:
&lt;a href=&quot;http://people.skolelinux.no/pere/surveillance-norway/?zoom=17&amp;lat=59.94918&amp;lon=10.76962&amp;layers=B0T&quot;&gt;http://people.skolelinux.no/pere/surveillance-norway/?zoom=17&amp;lat=59.94918&amp;lon=10.76962&amp;layers=B0T&lt;/a&gt; &amp;gt;.

&lt;p&gt;Kan dere fortelle meg om dette kameraet er registrert hos
Datatilsynet som det skal være i henhold til lovverket?&lt;/p&gt;

&lt;p&gt;Det hadde forresten vært fint om rådata fra kameraregisteret var
tilgjengelig på web og regelmessig oppdatert, for å kunne søke på
andre ting enn organisasjonsnavn og -nummer ved å laste det ned og
gjøre egne søk.&lt;/p&gt;

&lt;p&gt;Vennlig hilsen,
&lt;br&gt;--
&lt;br&gt;Petter Reinholdtsen
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Her er svaret som kom dagen etter:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
&lt;p&gt;Date: Wed, 3 Nov 2010 14:44:09 +0100
&lt;br&gt;From: &quot;juridisk&quot; &amp;lt;juridisk (at) Datatilsynet.no&amp;gt;
&lt;br&gt;To: Petter Reinholdtsen
&lt;br&gt;Subject: VS: Er overvåkningskameraet korrekt registrert?

&lt;p&gt;Viser til e-post av 2. november.

&lt;p&gt;Datatilsynet er det forvaltningsorganet som skal kontrollere at
personopplysningsloven blir fulgt. Formålet med loven er å verne
enkeltpersoner mot krenking av personvernet gjennom behandling av
personopplysninger.&lt;/p&gt;

&lt;p&gt;Juridisk veiledningstjeneste hos Datatilsynet gir råd og veiledning
omkring personopplysningslovens regler på generelt grunnlag.&lt;/p&gt;

&lt;p&gt;Datatilsynet har dessverre ikke en fullstendig oversikt over alle
kameraer, den oversikten som finner er i vår meldingsdatabase som du
finner her:
&lt;a href=&quot;http://www.datatilsynet.no/templates/article____211.aspx&quot;&gt;http://www.datatilsynet.no/templates/article____211.aspx&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;Denne databasen gir en oversikt over virksomheter som har meldt inn
kameraovervåkning. Dersom man ikek vet hvilken virksomhet som er
ansvarlig, er det heller ikke mulig for Datatilsynet å søke dette
opp.&lt;/p&gt;

&lt;p&gt;Webkameraer som har så dårlig oppløsning at man ikke kan gjenkjenne
enkeltpersoner er ikke meldepliktige, da dette ikke anses som
kameraovervåkning i personopplysningslovens forstand. Dersom kameraet
du sikter til er et slikt webkamera, vil det kanskje ikke finnes i
meldingsdatabasen på grunn av dette.  Også dersom et kamera med god
oppløsning ikke filmer mennesker, faller det utenfor loven.&lt;/p&gt;

&lt;p&gt;Datatilsynet har laget en veileder som gjennomgår når det er lov å
overvåke med kamera, se lenke:
&lt;a href=&quot;http://www.datatilsynet.no/templates/article____401.aspx&quot;&gt;http://www.datatilsynet.no/templates/article____401.aspx&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;Dersom det ikke er klart hvem som er ansvarlig for kameraet, er det
vanskelig for Datatilsynet å ta kontakt med den ansvarlige for å få
avklart om kameraet er satt opp i tråd med tilsynets regelverk. Dersom
du mener at kameraet ikke er lovlig ut fra informasjonen ovenfor, kan
kameraet anmeldes til politiet.&lt;/p&gt;

&lt;p&gt;Med vennlig hilsen&lt;/p&gt;

&lt;p&gt;Maria Bakke
&lt;br&gt;Juridisk veiledningstjeneste
&lt;br&gt;Datatilsynet&lt;/p&gt;
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Personlig synes jeg det bør være krav om å registrere hvert eneste
overvåkningskamera i det offentlige rom hos Datatilsynet, med
kartreferanse og begrunnelse om hvorfor det er satt opp, slik at
enhver borger enkelt kan hente ut kart over områder vi er interessert
i og sjekke om det er overvåkningskamera der som er satt opp uten å
være registert.  Slike registreringer skal jo i dag fornyes
regelmessing, noe jeg mistenker ikke blir gjort.  Dermed kan kamera
som en gang var korrekt registrert nå være ulovlig satt opp.  Det
burde også være bøter for å ha kamera som ikke er korrekt registrert,
slik at en ikke kan ignorere registrering uten at det får
konsekvenser.&lt;/p&gt;

&lt;p&gt;En ide fra England som jeg har sans (lite annet jeg har sans for
når det gjelder overvåkningskamera i England) for er at enhver borger
kan be om å få kopi av det som er tatt opp med et overvåkningskamera i
det offentlige rom, noe som gjør at det kan komme løpende utgifter ved
å sette overvåkningskamera.  Jeg tror alt som gjør det mindre
attraktivt å ha overvåkningskamera i det offentlige rom er en god
ting, så et slikt lovverk i Norge tror jeg hadde vært nyttig.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Datatilsynet svarer om Bilkollektivets ønske om GPS-sporing</title>
                <link>https://people.skolelinux.org/pere/blog/Datatilsynet_svarer_om_Bilkollektivets__nske_om_GPS_sporing.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Datatilsynet_svarer_om_Bilkollektivets__nske_om_GPS_sporing.html</guid>
                <pubDate>Thu, 14 Oct 2010 15:00:00 +0200</pubDate>
                <description>&lt;p&gt;I forbindelse med Bilkollektivets plan om å skaffe seg mulighet til
å GPS-spore sine medlemmers bevegelser
(&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Bilkollektivet_vil_ha_retten_til____se_hvor_jeg_kj__rer___.html&quot;&gt;omtalt
tidligere&lt;/a&gt;), sendte jeg avgårde et spørsmål til &lt;a
href=&quot;http://www.datatilsynet.no/&quot;&gt;Datatilsynet&lt;/a&gt; for å gjøre dem
oppmerksom på saken og høre hva de hadde å si.  Her er korrespondansen
så langt.&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
Date: Thu, 23 Sep 2010 13:38:55 +0200
&lt;br&gt;From: Petter Reinholdtsen
&lt;br&gt;To: postkasse@datatilsynet.no
&lt;br&gt;Subject: GPS-sporing av privatpersoners bruk av bil?

&lt;p&gt;Hei.  Jeg er med i Bilkollektivet[1] her i Oslo, og ble i dag
orientert om at de har tenkt å innføre GPS-sporing av bilene og krever
at en for fremtidig bruk skal godkjenne følgende klausul i
bruksvilkårene[2]:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
  Andelseier er med dette gjort kjent med at bilene er utstyrt med
  sporingsutstyr, som kan benyttes av Bilkollektivet til å spore biler
  som brukes utenfor gyldig reservasjon.
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Er slik sporing meldepliktig til datatilsynet?  Har Bilkollektivet
meldt dette til Datatilsynet?  Forsøkte å søke på orgnr. 874 538 892
på søkesiden for meldinger[3], men fant intet der.&lt;/p&gt;

&lt;p&gt;Hva er datatilsynets syn på slik sporing av privatpersoners bruk av
bil?&lt;/p&gt;

&lt;p&gt;Jeg må innrømme at jeg forventer å kunne ferdes anonymt og uten
radiomerking i Norge, og synes GPS-sporing av bilen jeg ønsker å bruke
i så måte er et overgrep mot privatlivets fred.  For meg er det et
prinsipielt spørsmål og det er underordnet hvem og med hvilket formål
som i første omgang sies å skulle ha tilgang til
sporingsinformasjonen.  Jeg vil ikke ha mulighet til å sjekke eller
kontrollere når bruksområdene utvides, og erfaring viser jo at
bruksområder utvides når informasjon først er samlet inn.&lt;p&gt;

&lt;p&gt;1 &amp;lt;URL: http://www.bilkollektivet.no/ &gt;
&lt;br&gt;2 &amp;lt;URL: http://www.bilkollektivet.no/bilbruksregler.26256.no.html &gt;
&lt;br&gt;3 &amp;lt;URL: http://hetti.datatilsynet.no/melding/report_search.pl &gt;

&lt;p&gt;Vennlig hilsen,
&lt;br&gt;--
&lt;br&gt;Petter Reinholdtsen
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Svaret fra Datatilsynet kom dagen etter:&lt;/p&gt;

&lt;p&gt;&lt;blockquote&gt;
Date: Fri, 24 Sep 2010 11:24:17 +0200
&lt;br&gt;From: Henok Tesfazghi
&lt;br&gt;To: Petter Reinholdtsen
&lt;br&gt;Subject: VS: GPS-sporing av privatpersoners bruk av bil?

&lt;p&gt;Viser til e-post av 23. september 2010.&lt;/p&gt;

&lt;p&gt;Datatilsynet er det forvaltningsorganet som skal kontrollere at
personopplysningsloven blir fulgt. Formålet med loven er å verne
enkeltpersoner mot krenking av personvernet gjennom behandling av
personopplysninger. Vi gjør oppmerksom på at vår e-post svartjeneste
er ment å være en kortfattet rådgivningstjeneste, slik at vi av den
grunn ikke kan konkludere i din sak, men gi deg innledende råd og
veiledning. Vårt syn er basert på din fremstilling av saksforholdet,
andre opplysninger vi eventuelt ikke kjenner til og som kan være
relevante, vil kunne medføre et annet resultat.&lt;/p&gt;

&lt;p&gt;Det er uklart for Datatilsynet hva slags GPS-sporing Bilkollektivet
her legger opp til. Dette skyldes blant annet manglende informasjon i
forhold til hvilket formål GPS-sporingen har, hvordan det er ment å
fungere, hvilket behandlingsgrunnlag som ligger til grunn, samt om
opplysningene skal lagres eller ikke.&lt;/p&gt;

&lt;p&gt;Behandlingen vil i utgangspunket være meldepliktig etter
personopplysningslovens § 31. Det finnes en rekke unntak fra
meldeplikten som er hjemlet i personopplysningsforskriftens kapittel
7. Da dette er et andelslag, og andelseiere i en utstrekning også kan
karakteriseres som kunder, vil unntak etter
personopplysningsforskriftens § 7-7 kunne komme til anvendelse, se
lenke: &lt;a href=&quot;http://lovdata.no/for/sf/fa/ta-20001215-1265-009.html#7-7&quot;&gt;http://lovdata.no/for/sf/fa/ta-20001215-1265-009.html#7-7&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;Datatilsynet har til orientering en rekke artikler som omhandler
henholdsvis sporing og lokalisering, samt trafikanter og passasjerer,
se lenke:
&lt;br&gt;&lt;a href=&quot;http://www.datatilsynet.no/templates/article____1730.aspx&quot;&gt;http://www.datatilsynet.no/templates/article____1730.aspx&lt;/a&gt; og
&lt;br&gt;&lt;a href=&quot;http://www.datatilsynet.no/templates/article____1098.aspx&quot;&gt;http://www.datatilsynet.no/templates/article____1098.aspx&lt;/a&gt;&lt;/p&gt;


&lt;p&gt;Vennlig hilsen
&lt;br&gt;Henok Tesfazghi
&lt;br&gt;Rådgiver, Datatilsynet
&lt;/blockquote&gt;&lt;/p&gt;

&lt;p&gt;Vet ennå ikke om jeg har overskudd til å ta opp kampen i
Bilkollektivet, mellom barnepass og alt det andre som spiser opp
dagene, eller om jeg bare finner et annet alternativ.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Bilkollektivet vil ha retten til å se hvor jeg kjører...</title>
                <link>https://people.skolelinux.org/pere/blog/Bilkollektivet_vil_ha_retten_til___se_hvor_jeg_kj_rer___.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Bilkollektivet_vil_ha_retten_til___se_hvor_jeg_kj_rer___.html</guid>
                <pubDate>Thu, 23 Sep 2010 11:55:00 +0200</pubDate>
                <description>&lt;p&gt;Jeg er med i
&lt;a href=&quot;http://www.bilkollektivet.no/&quot;&gt;Bilkollektivet&lt;/a&gt; her i Oslo,
og har inntil i dag vært fornøyd med opplegget.  I dag kom det brev
fra bilkollektivet, der de forteller om nytt webopplegg og nye
rutiner, og at de har tenkt å angripe min rett til å ferdes anonymt
som bruker av Bilkollektivet.  Det gjorde meg virkelig trist å
lese.&lt;/p&gt;

&lt;p&gt;Brevet datert 2010-09-16 forteller at Bilkollektivet har tenkt å gå
over til biler med &quot;bilcomputer&quot; og innebygget sporings-GPS som lar
administrasjonen i bilkollektivet se hvor bilene er til en hver tid,
noe som betyr at de også kan se hvor jeg kjører når jeg bruker
Bilkollektivet.
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Anonym_ferdsel_er_en_menneskerett.html&quot;&gt;Retten
til å ferdes anonymt&lt;/a&gt; er som tidligere nevnt viktig for meg, og jeg
finner det uakseptabelt å måtte godta å bli radiomerket for å kunne
bruke bil.  Har ikke satt meg inn i hva som er historien for denne
endringen, så jeg vet ikke om det er godkjent av
f.eks. andelseiermøtet.  Ser at
&lt;a href=&quot;http://www.bilkollektivet.no/bilbruksregler.26256.no.html&quot;&gt;nye
bilbruksregler&lt;/a&gt; med følgende klausul ble vedtatt av styret
2010-08-26:&lt;/p&gt;

&lt;blockquote&gt;&lt;p&gt;Andelseier er med dette gjort kjent med at bilene er
utstyrt med sporingsutstyr, som kan benyttes av Bilkollektivet til å
spore biler som brukes utenfor gyldig reservasjon.&lt;/p&gt;&lt;/blockquote&gt;

&lt;p&gt;For meg er det prinsipielt uakseptabelt av Bilkollektivet å skaffe
seg muligheten til å se hvor jeg befinner meg, og det er underordnet
når informasjonen blir brukt og hvem som får tilgang til den.  Får se
om jeg har energi til å forsøke å endre planene til Bilkollektivet
eller bare ser meg om etter alternativer.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Anonym ferdsel er en menneskerett</title>
                <link>https://people.skolelinux.org/pere/blog/Anonym_ferdsel_er_en_menneskerett.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Anonym_ferdsel_er_en_menneskerett.html</guid>
                <pubDate>Wed, 15 Sep 2010 12:15:00 +0200</pubDate>
                <description>&lt;p&gt;Debatten rundt sporveiselskapet i Oslos (Ruter AS) ønske om
&lt;a href=&quot;http://www.aftenposten.no/nyheter/iriks/article3808135.ece&quot;&gt;å
radiomerke med RFID&lt;/a&gt; alle sine kunder og
&lt;a href=&quot;http://www.aftenposten.no/nyheter/article3809746.ece&quot;&gt;registrere
hvor hver og en av oss beveger oss&lt;/a&gt; pågår, og en ting som har
kommet lite frem i debatten er at det faktisk er en menneskerett å
kunne ferdes anonymt internt i ens eget land.&lt;/p&gt;

&lt;p&gt;Fant en grei kilde for dette i et
&lt;a href=&quot;http://www.datatilsynet.no/upload/Microsoft%20Word%20-%2009-01399-2%20H+%C2%A9ringsnotat%20-%20Samferdselsdepartementet%20-%20Utkas%C3%94%C3%87%C2%AA.pdf&quot;&gt;skriv
fra Datatilsynet&lt;/a&gt; til Samferdselsdepartementet om tema:&lt;/p&gt;

&lt;blockquote&gt;&lt;p&gt;Retten til å ferdes anonymt kan utledes av
menneskerettskonvensjonen artikkel 8 og av EUs personverndirektiv.
Her heter det at enkeltpersoners grunnleggende rettigheter og frihet
må respekteres, særlig retten til privatlivets fred.  I både
personverndirektivet og i den norske personopplysningsloven er
selvråderetten til hver enkelt et av grunnprinsippene, hovedsaklig
uttrykt ved at en må gi et frivillig, informert og uttrykkelig
samtykke til behandling av personopplysninger.&lt;/p&gt;&lt;/blockquote&gt;

&lt;p&gt;For meg er det viktig at jeg kan ferdes anonymt, og det er litt av
bakgrunnen til at jeg handler med kontanter, ikke har mobiltelefon og
forventer å kunne reise med bil og kollektivtrafikk uten at det blir
registrert hvor jeg har vært.  Ruter angriper min rett til å ferdes
uten radiopeiler med sin innføring av RFID-kort, og dokumenterer sitt
ønske om å registrere hvor kundene befant seg ved å ønske å gebyrlegge
oss som ikke registrerer oss hver gang vi beveger oss med
kollektivtrafikken i Oslo.  Jeg synes det er hårreisende.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Forslag i stortinget om å stoppe elektronisk stemmegiving i Norge</title>
                <link>https://people.skolelinux.org/pere/blog/Forslag_i_stortinget_om___stoppe_elektronisk_stemmegiving_i_Norge.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Forslag_i_stortinget_om___stoppe_elektronisk_stemmegiving_i_Norge.html</guid>
                <pubDate>Tue, 31 Aug 2010 21:00:00 +0200</pubDate>
                <description>&lt;p&gt;Ble tipset i dag om at et forslag om å stoppe forsøkene med
elektronisk stemmegiving utenfor valglokaler er
&lt;a href=&quot;http://www.stortinget.no/no/Saker-og-publikasjoner/Saker/Sak/?p=46616&quot;&gt;til
behandling&lt;/a&gt; i Stortinget.
&lt;a href=&quot;http://www.stortinget.no/Global/pdf/Representantforslag/2009-2010/dok8-200910-128.pdf&quot;&gt;Forslaget&lt;/a&gt;
er fremmet av Erna Solberg, Michael Tetzschner og Trond Helleland.&lt;/p&gt;

&lt;p&gt;Håper det får flertall.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Sikkerhetsteateret på flyplassene fortsetter</title>
                <link>https://people.skolelinux.org/pere/blog/Sikkerhetsteateret_p__flyplassene_fortsetter.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Sikkerhetsteateret_p__flyplassene_fortsetter.html</guid>
                <pubDate>Sat, 28 Aug 2010 10:40:00 +0200</pubDate>
                <description>&lt;p&gt;Jeg skrev for et halvt år siden hvordan
&lt;a href=&quot;http://people.skolelinux.org/pere/blog/Sikkerhet__teater__og_hvordan_gj__re_verden_sikrere.html&quot;&gt;samfunnet
kaster bort ressurser på sikkerhetstiltak som ikke fungerer&lt;/a&gt;.  Kom
nettopp over en
&lt;a href=&quot;http://www.askthepilot.com/essays-and-stories/terrorism-tweezers-and-terminal-madness-an-essay-on-security/&quot;&gt;historie
fra en pilot fra USA&lt;/a&gt; som kommenterer det samme.  Jeg mistenker det
kun er uvitenhet og autoritetstro som gjør at så få protesterer.  Har
veldig sans for piloten omtalt i &lt;a
href=&quot;http://www.aftenposten.no/nyheter/iriks/article2057501.ece&quot;&gt;Aftenposten&lt;/a&gt; 2007-10-23,
og skulle ønske flere rettet oppmerksomhet mot problemet.  Det gir
ikke meg trygghetsfølelse på flyplassene når jeg ser at
flyplassadministrasjonen kaster bort folk, penger og tid på tull i
stedet for ting som bidrar til reell økning av sikkerheten.  Det
forteller meg jo at vurderingsevnen til de som burde bidra til økt
sikkerhet er svært sviktende, noe som ikke taler godt for de andre
tiltakene.&lt;/p&gt;

&lt;p&gt;Mon tro hva som skjer hvis det fantes en enkel brosjyre å skrive ut
fra Internet som forklarte hva som er galt med sikkerhetsopplegget på
flyplassene, og folk skrev ut og la en bunke på flyplassene når de
passerte.  Kanskje det ville fått flere til å få øynene opp for
problemet.&lt;/p&gt;

&lt;p&gt;Personlig synes jeg flyopplevelsen er blitt så avskyelig at jeg
forsøker å klare meg med tog, bil og båt for å slippe ubehaget.  Det
er dog noe vanskelig i det langstrakte Norge og for å kunne besøke de
delene av verden jeg ønsker å nå.  Mistenker at flere har det slik, og
at dette går ut over inntjeningen til flyselskapene.  Det er antagelig
en god ting sett fra et miljøperspektiv, men det er en annen sak.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Elektronisk stemmegiving er ikke til å stole på - heller ikke i Norge</title>
                <link>https://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til___stole_p____heller_ikke_i_Norge.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Elektronisk_stemmegiving_er_ikke_til___stole_p____heller_ikke_i_Norge.html</guid>
                <pubDate>Mon, 23 Aug 2010 19:30:00 +0200</pubDate>
                <description>&lt;p&gt;I Norge pågår en prosess for å
&lt;a href=&quot;http://www.e-valg.dep.no/&quot;&gt;innføre elektronisk
stemmegiving&lt;/a&gt; ved kommune- og stortingsvalg.  Dette skal
introduseres i 2011.  Det er all grunn til å tro at valg i Norge ikke
vil være til å stole på hvis dette blir gjennomført.  Da det hele var
oppe til høring i 2006 forfattet jeg
&lt;a href=&quot;http://www.nuug.no/dokumenter/valg-horing-2006-09.pdf&quot;&gt;en
høringsuttalelse fra NUUG&lt;/a&gt; (og EFN som hengte seg på) som skisserte
hvilke punkter som må oppfylles for at en skal kunne stole på et valg,
og elektronisk stemmegiving mangler flere av disse.  Elektronisk
stemmegiving er for alle praktiske formål å putte ens stemme i en sort
boks under andres kontroll, og satse på at de som har kontroll med
boksen er til å stole på - uten at en har mulighet til å verifisere
dette selv.  Det er ikke slik en gjennomfører demokratiske valg.&lt;/p&gt;

&lt;p&gt;Da problemet er fundamentalt med hvordan elektronisk stemmegiving
må fungere for at også ikke-krypografer skal kunne delta, har det vært
mange rapporter om hvordan elektronisk stemmegiving har sviktet i land
etter land.  En
&lt;a href=&quot;http://wiki.nuug.no/uttalelser/2006-elektronisk-stemmegiving&quot;&gt;liten
samling referanser&lt;/a&gt; finnes på NUUGs wiki.  Den siste er fra India,
der valgkomisjonen har valgt
&lt;a href=&quot;http://www.freedom-to-tinker.com/blog/jhalderm/electronic-voting-researcher-arrested-over-anonymous-source&quot;&gt;å
pusse politiet på en forsker&lt;/a&gt; som har dokumentert svakheter i
valgsystemet.&lt;/p&gt;

&lt;p&gt;Her i Norge har en valgt en annen tilnærming, der en forsøker seg
med teknobabbel for å få befolkningen til å tro at dette skal bli
sikkert.  Husk, elektronisk stemmegiving underminerer de demokratiske
valgene i Norge, og bør ikke innføres.&lt;/p&gt;

&lt;p&gt;Den offentlige diskusjonen blir litt vanskelig av at media har
valgt å kalle dette &quot;evalg&quot;, som kan sies å både gjelde elektronisk
opptelling av valget som Norge har gjort siden 60-tallet og som er en
svært god ide, og elektronisk opptelling som er en svært dårlig ide.
Diskusjonen gir ikke mening hvis en skal diskutere om en er for eller
mot &quot;evalg&quot;, og jeg forsøker derfor å være klar på at jeg snakker om
elektronisk stemmegiving og unngå begrepet &quot;evalg&quot;.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Rob Weir: How to Crush Dissent</title>
                <link>https://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Rob_Weir__How_to_Crush_Dissent.html</guid>
                <pubDate>Sun, 15 Aug 2010 22:20:00 +0200</pubDate>
                <description>&lt;p&gt;I found the notes from Rob Weir on
&lt;a href=&quot;http://feedproxy.google.com/~r/robweir/antic-atom/~3/VGb23-kta8c/how-to-crush-dissent.html&quot;&gt;how
to crush dissent&lt;/a&gt; matching my own thoughts on the matter quite
well.  Highly recommended for those wondering which road our society
should go down.  In my view we have been heading the wrong way for a
long time.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>One step closer to single signon in Debian Edu</title>
                <link>https://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/One_step_closer_to_single_signon_in_Debian_Edu.html</guid>
                <pubDate>Sun, 25 Jul 2010 10:00:00 +0200</pubDate>
                <description>&lt;p&gt;The last few months me and the other Debian Edu developers have
been working hard to get the Debian/Squeeze based version of Debian
Edu/Skolelinux into shape.  This future version will use Kerberos for
authentication, and services are slowly migrated to single signon,
getting rid of password questions one at the time.&lt;/p&gt;

&lt;p&gt;It will also feature a roaming workstation profile with local home
directory, for laptops that are only some times on the Skolelinux
network, and for this profile a shortcut is created in Gnome and KDE
to gain access to the users home directory on the file server.  This
shortcut uses SMB at the moment, and yesterday I had time to test if
SMB mounting had started working in KDE after we added the cifs-utils
package.  I was pleasantly surprised how well it worked.&lt;/p&gt;

&lt;p&gt;Thanks to the recent changes to our samba configuration to get it
to use Kerberos for authentication, there were no question about user
password when mounting the SMB volume.  A simple click on the shortcut
in the KDE menu, and a window with the home directory popped
up. :)&lt;/p&gt;

&lt;p&gt;One step closer to a single signon solution out of the box in
Debian Edu.  We already had PAM, LDAP, IMAP and SMTP in place, and now
also Samba.  Next step is Cups and hopefully also NFS.&lt;/p&gt;

&lt;p&gt;We had planned a alpha0 release of Debian Edu for today, but thanks
to the autobuilder administrators for some architectures being slow to
sign packages, we are still missing the fixed LTSP package we need for
the release.  It was uploaded three days ago with urgency=high, and if
it had entered testing yesterday we would have been able to test it in
time for a alpha0 release today.  As the binaries for ia64 and powerpc
still not uploaded to the Debian archive, we need to delay the alpha
release another day.&lt;/p&gt;

&lt;p&gt;If you want to help out with implementing Kerberos for Debian Edu,
please contact us on debian-edu@lists.debian.org.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Åpne trådløsnett er et samfunnsgode</title>
                <link>https://people.skolelinux.org/pere/blog/_pne_tr_dl_snett_er_et_samfunnsgode.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/_pne_tr_dl_snett_er_et_samfunnsgode.html</guid>
                <pubDate>Sat, 12 Jun 2010 12:45:00 +0200</pubDate>
                <description>&lt;p&gt;Veldig glad for å oppdage via
&lt;a href=&quot;http://yro.slashdot.org/story/10/06/11/1841256/Finland-To-Legalize-Use-of-Unsecured-Wi-Fi&quot;&gt;Slashdot&lt;/a&gt;
at folk i Finland har forstått at åpne trådløsnett er et samfunnsgode.
Jeg ser på åpne trådløsnett som et fellesgode på linje med retten til
ferdsel i utmark og retten til å bevege seg i strandsonen.  Jeg har
glede av åpne trådløsnett når jeg finner dem, og deler gladelig nett
med andre så lenge de ikke forstyrrer min bruk av eget nett.
Nettkapasiteten er sjelden en begrensning ved normal browsing og enkel
SSH-innlogging (som er min vanligste nettbruk), og nett kan brukes til
så mye positivt og nyttig (som nyhetslesing, sjekke været, kontakte
slekt og venner, holde seg oppdatert om politiske saker, kontakte
organisasjoner og politikere, etc), at det for meg er helt urimelig å
blokkere dette for alle som ikke gjør en flue fortred.  De som mener
at potensialet for misbruk er grunn nok til å hindre all den positive
og lovlydige bruken av et åpent trådløsnett har jeg dermed ingen
forståelse for.  En kan ikke la eksistensen av forbrytere styre hvordan
samfunnet skal organiseres.  Da får en et kontrollsamfunn de færreste
ønsker å leve i, og det at vi har et samfunn i Norge der tilliten til
hverandre er høy gjør at samfunnet fungerer ganske godt.  Det bør vi
anstrenge oss for å beholde.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Magnetstripeinnhold i billetter fra Flytoget og Hurtigruten</title>
                <link>https://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Magnetstripeinnhold_i_billetter_fra_Flytoget_og_Hurtigruten.html</guid>
                <pubDate>Fri, 21 May 2010 16:00:00 +0200</pubDate>
                <description>&lt;p&gt;For en stund tilbake kjøpte jeg en magnetkortleser for å kunne
titte på hva som er skrevet inn på magnetstripene til ulike kort.  Har
ikke hatt tid til å analysere mange kort så langt, men tenkte jeg
skulle dele innholdet på to kort med mine lesere.&lt;/p&gt;

&lt;p&gt;For noen dager siden tok jeg flyet til Harstad og Hurtigruten til
Bergen.  Flytoget fra Oslo S til flyplassen ga meg en billett med
magnetstripe.  Påtrykket finner jeg følgende informasjon:&lt;/p&gt;

&lt;pre&gt;
Flytoget Airport Express Train

Fra - Til        : Oslo Sentralstasjon
Kategori         : Voksen
Pris             : Nok 170,00
Herav mva. 8,00% : NOK 12,59
Betaling         : Kontant
Til - Fra        : Oslo Lufthavn
Utstedt:         : 08.05.10
Gyldig Fra-Til   : 08.05.10-07.11.10
Billetttype      : Enkeltbillett

102-1015-100508-48382-01-08
&lt;/pre&gt;

&lt;p&gt;På selve magnetstripen er innholdet
&lt;tt&gt;;E?+900120011=23250996541068112619257138248441708433322932704083389389062603279671261502492655?&lt;/tt&gt;.
Aner ikke hva innholdet representerer, og det er lite overlapp mellom
det jeg ser trykket på billetten og det jeg ser av tegn i
magnetstripen.  Håper det betyr at de bruker kryptografiske metoder
for å gjøre det vanskelig å forfalske billetter.&lt;/p&gt;

&lt;p&gt;Den andre billetten er fra Hurtigruten, der jeg mistenker at
strekkoden på fronten er mer brukt enn magnetstripen (det var i hvert
fall den biten vi stakk inn i dørlåsen).&lt;/p&gt;

&lt;p&gt;Påtrykket forsiden er følgende:&lt;/p&gt;

&lt;pre&gt;
Romnummer 727
Hurtigruten
Midnatsol
Reinholdtsen
Petter
Bookingno: SAX69   0742193
Harstad-Bergen
Dep: 09.05.2010 Arr: 12.05.2010
Lugar fra Risøyhamn
Kost: FRO=4
&lt;/pre&gt;

&lt;p&gt;På selve magnetstripen er innholdet
&lt;tt&gt;;1316010007421930=00000000000000000000?+E?&lt;/tt&gt;.  Heller ikke her
ser jeg mye korrespondanse mellom påtrykk og magnetstripe.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Forcing new users to change their password on first login</title>
                <link>https://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Forcing_new_users_to_change_their_password_on_first_login.html</guid>
                <pubDate>Sun, 2 May 2010 13:47:00 +0200</pubDate>
                <description>&lt;p&gt;One interesting feature in Active Directory, is the ability to
create a new user with an expired password, and thus force the user to
change the password on the first login attempt.&lt;/p&gt;

&lt;p&gt;I&#39;m not quite sure how to do that with the LDAP setup in Debian
Edu, but did some initial testing with a local account.  The account
and password aging information is available in /etc/shadow, but
unfortunately, it is not possible to specify an expiration time for
passwords, only a maximum age for passwords.&lt;/p&gt;

&lt;p&gt;A freshly created account (using adduser test) will have these
settings in /etc/shadow:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
root@tjener:~# chage -l test
Last password change                                    : May 02, 2010
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 99999
Number of days of warning before password expires       : 7
root@tjener:~#
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;The only way I could come up with to create a user with an expired
account, is to change the date of the last password change to the
lowest value possible (January 1th 1970), and the maximum password age
to the difference in days between that date and today.  To make it
simple, I went for 30 years (30 * 365 = 10950) and January 2th (to
avoid testing if 0 is a valid value).&lt;/p&gt;

&lt;p&gt;After using these commands to set it up, it seem to work as
intended:&lt;/p&gt;

&lt;blockquote&gt;&lt;pre&gt;
root@tjener:~# chage -d 1 test; chage -M 10950 test
root@tjener:~# chage -l test
Last password change                                    : Jan 02, 1970
Password expires                                        : never
Password inactive                                       : never
Account expires                                         : never
Minimum number of days between password change          : 0
Maximum number of days between password change          : 10950
Number of days of warning before password expires       : 7
root@tjener:~#  
&lt;/pre&gt;&lt;/blockquote&gt;

&lt;p&gt;So far I have tested this with ssh and console, and kdm (in
Squeeze) login, and all ask for a new password before login in the
user (with ssh, I was thrown out and had to log in again).&lt;/p&gt;

&lt;p&gt;Perhaps we should set up something similar for Debian Edu, to make
sure only the user itself have the account password?&lt;/p&gt;

&lt;p&gt;If you want to comment on or help out with implementing this for
Debian Edu, please contact us on debian-edu@lists.debian.org.&lt;/p&gt;

&lt;p&gt;Update 2010-05-02 17:20: Paul Tötterman tells me on IRC that the
shadow(8) page in Debian/testing now state that setting the date of
last password change to zero (0) will force the password to be changed
on the first login.  This was not mentioned in the manual in Lenny, so
I did not notice this in my initial testing.  I have tested it on
Squeeze, and &#39;&lt;tt&gt;chage -d 0 username&lt;/tt&gt;&#39; do work there.  I have not
tested it on Lenny yet.&lt;/p&gt;

&lt;p&gt;Update 2010-05-02-19:05: Jim Paris tells me via email that an
equivalent command to expire a password is &#39;&lt;tt&gt;passwd -e
username&lt;/tt&gt;&#39;, which insert zero into the date of the last password
change.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Great book: &quot;Content: Selected Essays on Technology, Creativity, Copyright, and the Future of the Future&quot;</title>
                <link>https://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Great_book___Content__Selected_Essays_on_Technology__Creativity__Copyright__and_the_Future_of_the_Future_.html</guid>
                <pubDate>Mon, 19 Apr 2010 17:10:00 +0200</pubDate>
                <description>&lt;p&gt;The last few weeks i have had the pleasure of reading a
thought-provoking collection of essays by Cory Doctorow, on topics
touching copyright, virtual worlds, the future of man when the
conscience mind can be duplicated into a computer and many more. The
book titled &quot;Content: Selected Essays on Technology, Creativity,
Copyright, and the Future of the Future&quot; is available with few
restrictions on the web, for example from
&lt;a href=&quot;http://craphound.com/content/&quot;&gt;his own site&lt;/a&gt;. I read the
epub-version from
&lt;a href=&quot;http://www.feedbooks.com/book/2883&quot;&gt;feedbooks&lt;/a&gt; using
&lt;a href=&quot;http://www.fbreader.org/&quot;&gt;fbreader&lt;/a&gt; and my N810. I
strongly recommend this book.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Sikkerhet, teater, og hvordan gjøre verden sikrere</title>
                <link>https://people.skolelinux.org/pere/blog/Sikkerhet__teater__og_hvordan_gj_re_verden_sikrere.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Sikkerhet__teater__og_hvordan_gj_re_verden_sikrere.html</guid>
                <pubDate>Wed, 30 Dec 2009 16:35:00 +0100</pubDate>
                <description>&lt;p&gt;Via Slashdot fant jeg en
&lt;a href=&quot;http://www.cnn.com/2009/OPINION/12/29/schneier.air.travel.security.theater/index.html&quot;&gt;nydelig
kommentar fra Bruce Schneier&lt;/a&gt; som ble publisert hos CNN i går.  Den
forklarer forbilledlig hvorfor sikkerhetsteater og innføring av
totalitære politistatmetoder ikke er løsningen for å gjøre verden
sikrere.  Anbefales på det varmeste.&lt;/p&gt;

&lt;p&gt;Oppdatering: Kom over
&lt;a href=&quot;http://gizmodo.com/5435675/president-obama-its-time-to-fire-the-tsa&quot;&gt;nok
en kommentar&lt;/a&gt; om den manglende effekten av dagens sikkerhetsteater
på flyplassene.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Jeg vil ikke ha BankID</title>
                <link>https://people.skolelinux.org/pere/blog/Jeg_vil_ikke_ha_BankID.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Jeg_vil_ikke_ha_BankID.html</guid>
                <pubDate>Fri, 30 Oct 2009 13:05:00 +0100</pubDate>
                <description>&lt;p&gt;Min hovedbankforbindelse,
&lt;a href=&quot;http://www.postbanken.no/&quot;&gt;Postbanken&lt;/a&gt;, har fra 1. oktober
blokkert tilgangen min til nettbanken hvis jeg ikke godtar vilkårene
for &lt;a href=&quot;https://www.bankid.no/&quot;&gt;BankID&lt;/a&gt; og går over til å
bruke BankID for tilgangskontroll.  Tidligere kunne jeg bruke en
kodekalkulator som ga tilgang til nettbanken, men nå er dette ikke
lenger mulig.  Jeg blokkeres ute fra nettbanken og mine egne penger
hvis jeg ikke godtar det jeg anser som urimelige vilkår i
BankID-avtalen.&lt;/p&gt;

&lt;p&gt;BankID er en løsning der banken gis rett til å handle på vegne av
meg, med avtalemessig forutsetning at jeg i hvert enkelt tilfelle har
bedt banken gjøre dette.  BankID kan brukes til å signere avtaler,
oppta lån og andre handlinger som har alvorlige følger for meg.
Problemet slik jeg ser det er at BankID er lagt opp slik at banken har
all informasjon og tilgang som den trenger for å bruke BankID, også
uten at jeg er involvert.  Avtalemessing og juridisk skal de kun bruke
min BankID når jeg har oppgitt pinkode og passord, men praktisk og
konkret kan de gjøre dette også uten at min pinkode eller mitt passord
er oppgitt, da de allerede har min pinkode og passord tilgjengelig hos
seg for å kunne sjekke at riktig pinkode og passord er oppgitt av meg
(eller kan skaffe seg det ved behov).  Jeg ønsker ikke å gi banken
rett til å inngå avtaler på vegne av meg.&lt;/p&gt;

&lt;p&gt;Rent teknisk er BankID et offentlig nøkkelpar, en privat og en
offentlig nøkkel, der den private nøkkelen er nødvendig for å
&quot;signere&quot; på vegne av den nøkkelen gjelder for, og den offentlige
nøkkelen er nødvendig for å sjekke hvem som har signert.  Banken
sitter på både den private og den offentlige nøkkelen, og sier de kun
skal bruke den private hvis kunden ber dem om det og oppgir pinkode og
passord.&lt;/p&gt;


&lt;p&gt;I postbankens
&lt;a href=&quot;https://www.postbanken.no//portalfront/nedlast/no/person/avtaler/BankID_avtale.pdf&quot;&gt;vilkår
for BankID&lt;/a&gt; står følgende:&lt;/p&gt;

&lt;blockquote&gt;
  &lt;p&gt;&quot;6. Anvendelsesområdet for BankID&lt;/p&gt;

  &lt;p&gt;PersonBankID kan benyttes fra en datamaskin, eller etter nærmere
  avtale fra en mobiltelefon/SIM-kort, for pålogging i nettbank og til
  identifisering og signering i forbindelse med elektronisk
  meldingsforsendelse, avtaleinngåelse og annen form for nettbasert
  elektronisk kommunikasjon med Banken og andre brukersteder som har
  tilrettelagt for bruk av BankID. Dette forutsetter at brukerstedet
  har inngått avtale med bank om bruk av BankID.&quot;&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;Det er spesielt retten til &quot;avtaleinngåelse&quot; jeg synes er urimelig
å kreve for at jeg skal få tilgang til mine penger via nettbanken, men
også retten til å kommunisere på vegne av meg med andre brukersteder og
signering av meldinger synes jeg er problematisk.  Jeg må godta at
banken skal kunne signere for meg på avtaler og annen kommunikasjon
for å få BankID.&lt;/p&gt;

&lt;p&gt;På spørsmål om hvordan jeg kan få tilgang til nettbank uten å gi
banken rett til å inngå avtaler på vegne av meg svarer Postbankens
kundestøtte at &quot;Postbanken har valgt BankID for bl.a. pålogging i
nettbank , så her må du nok ha hele denne løsningen&quot;.  Jeg nektes
altså tilgang til nettbanken inntil jeg godtar at Postbanken kan
signere avtaler på vegne av meg.&lt;/p&gt;

&lt;p&gt;Postbankens kundestøtte sier videre at &quot;Det har blitt et krav til
alle norske banker om å innføre BankID, bl.a på grunn av
sikkerhet&quot;, uten at jeg her helt sikker på hvem som har framsatt
dette kravet. [Oppdatering: Postbankens kundestøtte sier kravet er
fastsatt av &lt;a href=&quot;http://www.kredittilsynet.no/&quot;&gt;kreditttilsynet&lt;/a&gt;
og &lt;a href=&quot;http://www.bbs.no/&quot;&gt;BBS&lt;/a&gt;.]  Det som er situasjonen er
dog at det er svært få banker igjen som ikke bruker BankID, og jeg
vet ikke hvilken bank som er et godt alternativ for meg som ikke vil
gi banken rett til å signere avtaler på mine vegne.&lt;/p&gt;

&lt;p&gt;Jeg ønsker mulighet til å reservere meg mot at min BankID brukes
til annet enn å identifisere meg overfor nettbanken før jeg vil ta i
bruk BankID.  Ved nettbankbruk er det begrenset hvor store skader som
kan oppstå ved misbruk, mens avtaleinngåelse ikke har tilsvarende
begrensing.&lt;/p&gt;

&lt;p&gt;Jeg har klaget vilkårene inn for &lt;a
href=&quot;http://www.forbrukerombudet.no/&quot;&gt;forbrukerombudet&lt;/a&gt;, men
regner ikke med at de vil kunne bidra til en rask løsning som gir meg
nettbankkontroll over egne midler. :(

&lt;p&gt;Oppdatering 2012-09-13: Aftenposten melder i dag at det er
&lt;a href=&quot;http://www.aftenposten.no/nyheter/iriks/Tyver-kan-tappe-kontoen-din---selv-uten-passord-og-pinkode--6989793.html&quot;&gt;sikkerhetsproblem
med BankID&lt;/a&gt; som gjør at ens bankkonto kan tappes helt uten at en
har delt passord og pinkode med noen.  Dette illustrerer veldig bra
mitt poeng om at banken kan operere på kontoen (og signere avtaler
etc) helt uten at jeg er involvert.  Jeg takker derfor fortsatt nei
til BankID-modellen.&lt;/p&gt;

&lt;p&gt;Oppdatering 2015-11-17: Fant en
&lt;a href=&quot;http://1and1are2.blogspot.no/2014/05/bankid-elektronisk-sppel.html&quot;&gt;bloggpost
fra Britt Lysaa som belyser hvilke inngrep i privatsfæren bruken av
BankID utgjør&lt;/a&gt;, i tillegg til de sikkerhetsmessige vurderingene
omtalt over.  Anbefalt lesning.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Sikkerhet til sjøs trenger sjøkart uten bruksbegresninger</title>
                <link>https://people.skolelinux.org/pere/blog/Sikkerhet_til_sj_s_trenger_sj_kart_uten_bruksbegresninger.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Sikkerhet_til_sj_s_trenger_sj_kart_uten_bruksbegresninger.html</guid>
                <pubDate>Sun, 23 Aug 2009 10:00:00 +0200</pubDate>
                <description>&lt;p&gt;Sikkerhet til sjøs burde være noe som opptar mange etter den siste
oljeutslippsulykken med Full City, som har drept mye liv langs sjøen.
En viktig faktor for å bedre sikkerheten til sjøs er at alle som
ferdes på sjøen har tilgang til oppdaterte sjøkart som forteller hvor
det grunner og annet en må ta hensyn til på sjøen.&lt;/p&gt;

&lt;p&gt;Hvis en er enig i at tilgang til oppdaterte sjøkart er viktig for
sikkerheten på sjøen, så er det godt å vite at det i dag er teknisk
mulig å sikre alle enkel tilgang til oppdaterte digitale kart over
Internet.  Det trenger heller ikke være spesielt kostbart.&lt;/p&gt;

&lt;p&gt;Både ved Rocknes-ulykken i Vatlestraumen, der 18 mennesker mistet
livet, og ved Full City-ulykken utenfor Langesund, der mange tonn olje
lekket ut i havet, var det registrert problemer relatert til
oppdaterte sjøkart.  Ved Rocknes-ulykken var de elektroniske kartene
som ble brukt ikke oppdatert med informasjon om nyoppdagede grunner og
losen kjente visst ikke til disse nye grunnene.  Papirkartene var dog
oppdaterte.  Ved Full City-ulykken hadde en kontroll av skipet noen
uker tidligere konstatert manglende sjøkart.&lt;/p&gt;

&lt;p&gt;Jeg tror en løsning der digitale sjøkart kunne lastes ned direkte
fra sjøkartverket av alle som ønsket oppdaterte sjøkart, uten
brukerbetaling og uten bruksbegresninger knyttet til kartene, vil
gjøre at flere folk på sjøen vil holde seg med oppdaterte sjøkart,
eller sjøkart i det hele tatt.  Resultatet av dette vil være økt
sikkerhet på sjøen.  En undersøkelse gjennomført av Opinion for
Gjensidige i 2008 fortalte at halvparten av alle båteierne i landet
ikke har sjøkart i båten.&lt;/p&gt;

&lt;p&gt;Formatet på de digitale sjøkartene som gjøres tilgjengelig fra
sjøkartverket må være i henhold til en fri og åpen standard, slik at
en ikke er låst til enkeltaktørers godvilje når datafilene skal tolkes
og forstås, men trenger ikke publiseres fra sjøkartverket i alle
formatene til verdens skips-GPS-er i tillegg.  Hvis det ikke er
kostbart for sjøkartverket bør de gjerne gjøre det selv, men slik
konvertering kan andre ta seg av hvis det er et marked for det.&lt;/p&gt;

&lt;p&gt;Hvis staten mener alvor med å forbedre sikkerheten til sjøs, må de
gjøre sitt for at alle båteiere har oppdaterte kart, ikke bare snakke
om hvor viktig det er at de har oppdaterte kart.  Det bør være
viktigere for staten at båtene &lt;strong&gt;har&lt;/strong&gt; oppdaterte kart
enn at de er pålagt å ha oppdaterte kart.&lt;/p&gt;

&lt;p&gt;Sjøkartene er &lt;a href=&quot;http://kart.kystverket.no/&quot;&gt;tilgjengelig på web
fra kystverket&lt;/a&gt;, men så vidt jeg har klart å finne, uten
bruksvilkår som muliggjør gjenbruk uten bruksbegresninger.&lt;/p&gt;

&lt;p&gt;OpenStreetmap.org-folk er lei av mangel på sjøkart, og har startet
på et dugnadsbasert fribrukskart for havet,
&lt;a href=&quot;http://openseamap.org/&quot;&gt;OpenSeaMap&lt;/a&gt;.  Datagrunnlaget er
OpenStreetmap, mens framvisningen er tilpasset bruk på sjøen.  Det
gjenstår mye før en kan bruke dette til å seile sikkert på havet, men
det viser at behovet for fribruks-sjøkart er til stedet.&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Litt om valgfusk og problemet med elektronisk stemmegiving</title>
                <link>https://people.skolelinux.org/pere/blog/Litt_om_valgfusk_og_problemet_med_elektronisk_stemmegiving.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Litt_om_valgfusk_og_problemet_med_elektronisk_stemmegiving.html</guid>
                <pubDate>Wed, 17 Jun 2009 14:20:00 +0200</pubDate>
                <description>&lt;p&gt;&lt;a href=&quot;http://www.aftenposten.no/nyheter/uriks/article3127058.ece&quot;&gt;Aftenposten
melder&lt;/a&gt; at det kan se ut til at Iran ikke har lært av USA når det
gjelder valgfusk.  En bør endre tallene før de publiseres, slik at en
kandidat aldri får færre stemmer under opptellingen, ellers blir det
veldig tydelig at tallene ikke er til å stole på.  I USA er det
derimot &lt;a href=&quot;http://www.blackboxvoting.org/&quot;&gt;rapporter om at
tallene har vært endret&lt;/a&gt; på tur mot opptellingen, ikke etter at
tallene er publiserte (i tillegg til en rekke andre irregulariteter).
En ting Iran åpenbart har forstått, er verdien av å kunne
kontrolltelle stemmer.  Det ligger an til kontrolltelling i hvert fall
i noen områder.  Hvorvidt det har verdi, kommer an på hvordan
stemmene har vært oppbevart.&lt;/p&gt;

&lt;p&gt;&lt;a href=&quot;http://universitas.no/kronikk/48334/kan-vi-stole-pa-universitetets-elektroniske-valgsystem-/&quot;&gt;Universitetet
i Oslo derimot&lt;/a&gt;, har ikke forstått verdien av å kunne
kontrolltelle.  Her har en valgt å ta i bruk elektronisk stemmegiving
over Internet, med et system som ikke kan kontrolltelles hvis det
kommer anklager om juks med stemmene.  Systemet har flere kjente
problemer og er i mine øyne ikke bedre enn en spørreundersøkelse, og
jeg har derfor latt være å stemme ved valg på UiO siden det ble
innført.&lt;/p&gt;

&lt;p&gt;Universitet i Bergen derimot har klart det kunststykket å aktivt gå
inn for å gjøre det kjent at det elektroniske stemmegivingssystemet
over Internet &lt;a href=&quot;http://nyheter.uib.no/?modus=vis_nyhet&amp;id=43404&quot;&gt;kan
spore hvem som stemmer hva&lt;/a&gt; (det kan en forøvrig også ved UiO), og tatt
kontakt med stemmegivere for å spørre hvorfor de stemte som de gjorde.
Hemmelige valg står for fall.  Mon tro hva stemmesedlenne hadde
inneholdt i Iran hvis de ikke hadde hemmelige valg?&lt;/p&gt;
</description>
        </item>
        
        <item>
                <title>Kryptert harddisk - naturligvis</title>
                <link>https://people.skolelinux.org/pere/blog/Kryptert_harddisk___naturligvis.html</link>
                <guid isPermaLink="true">https://people.skolelinux.org/pere/blog/Kryptert_harddisk___naturligvis.html</guid>
                <pubDate>Sat, 2 May 2009 15:30:00 +0200</pubDate>
                <description>&lt;p&gt;&lt;a href=&quot;http://www.dagensit.no/trender/article1658676.ece&quot;&gt;Dagens
IT melder&lt;/a&gt; at Intel hevder at det er dyrt å miste en datamaskin,
når en tar tap av arbeidstid, fortrolige dokumenter,
personopplysninger og alt annet det innebærer.  Det er ingen tvil om
at det er en kostbar affære å miste sin datamaskin, og det er årsaken
til at jeg har kryptert harddisken på både kontormaskinen og min
bærbare.  Begge inneholder personopplysninger jeg ikke ønsker skal
komme på avveie, den første informasjon relatert til jobben min ved
Universitetet i Oslo, og den andre relatert til blant annet
foreningsarbeide.  Kryptering av diskene gjør at det er lite
sannsynlig at dophoder som kan finne på å rappe maskinene får noe ut
av dem.  Maskinene låses automatisk etter noen minutter uten bruk,
og en reboot vil gjøre at de ber om passord før de vil starte opp.
Jeg bruker Debian på begge maskinene, og installasjonssystemet der
gjør det trivielt å sette opp krypterte disker.  Jeg har LVM på toppen
av krypterte partisjoner, slik at alt av datapartisjoner er kryptert.
Jeg anbefaler alle å kryptere diskene på sine bærbare.  Kostnaden når
det er gjort slik jeg gjør det er minimale, og gevinstene er
betydelige.  En bør dog passe på passordet.  Hvis det går tapt, må
maskinen reinstalleres og alt er tapt.&lt;/p&gt;

&lt;p&gt;Krypteringen vil ikke stoppe kompetente angripere som f.eks. kjøler
ned minnebrikkene før maskinen rebootes med programvare for å hente ut
krypteringsnøklene.  Kostnaden med å forsvare seg mot slike angripere
er for min del høyere enn gevinsten.  Jeg tror oddsene for at
f.eks. etteretningsorganisasjoner har glede av å titte på mine
maskiner er minimale, og ulempene jeg ville oppnå ved å forsøke å
gjøre det vanskeligere for angripere med kompetanse og ressurser er
betydelige.&lt;/p&gt;
</description>
        </item>
        
        </channel>
</rss>