Petter Reinholdtsen: Where did that package go?

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +

Introducing ical-archiver to split out old iCalendar entries @@ -116,7 +283,7 @@ activities, please send Bitcoin donations to my address

2017

January (1)
January (2)

@@ -384,7 +551,7 @@ activities, please send Bitcoin donations to my address

@@ -414,7 +581,7 @@ activities, please send Bitcoin donations to my address

@@ -432,7 +599,7 @@ activities, please send Bitcoin donations to my address

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -440,7 +607,7 @@ activities, please send Bitcoin donations to my address

@@ -468,9 +635,9 @@ activities, please send Bitcoin donations to my address

@@ -482,7 +649,7 @@ activities, please send Bitcoin donations to my address

vitenskap (4)

web (38)

web (39)

diff --git a/blog/index.html b/blog/index.html index 566a2d035c..3b80d5caca 100644 --- a/blog/index.html +++ b/blog/index.html @@ -19,6 +19,167 @@ +

Where did that package go? — geolocated IP traceroute

9th January 2017

Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request.

+ +

There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in Debian.

+ +

This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others).

+ +

Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking PhantomJS to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +their +netsniff example. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page.

+ +

When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +my +kmltraceroute git repository. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from the +KML file I created using the GeoLite City dataset from MaxMind. + +

+ +

I also had a look at the visual traceroute graph created by +the scrapy project, +showing IP network ownership (aka AS owner) for the IP address in +question. +The +graph display a lot of useful information about the traceroute in SVG +format, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA.

+ +

In the process, I came across the +web service GeoTraceRoute by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +the NUUG assosiation, and get the +trace in KML format for further processing.

+ +

Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority.

+ +

Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project.

+ +

Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet.

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Introducing ical-archiver to split out old iCalendar entries

4th January 2017

@@ -1135,160 +1296,6 @@ nynorsk.

Hyperions magasin Pegasus gÃ¥r for Creative Commons

22nd November 2016

For noen dager siden ble jeg tipset av min venn Andreas -Aanerud om at magasinet -Pegasus skulle ta i bruk -Creative -Commons-lisensiering pÃ¥ sine artikler. Han fortalte at den -direkte Ã¥rsaken var at han hadde blitt inspirert av Ã¥ lese -boken -Fri kultur -(github) -og foreslÃ¥tt endringen. Jeg ble veldig glad for Ã¥ hÃ¸re -dette, da det er det fÃ¸rste konkrete tilfellet jeg har hÃ¸rt om der den -norske oversettelsen av -Lawrence Lessigs bok Free Culture som jeg ga ut i fjor hÃ¸st hadde -fÃ¥tt noen til Ã¥ ta i bruk Creative Commons.

- -

Andreas fikk boken av meg som takk for at han inviterte meg til -The Gathering, og jeg er veldig -glad for at den falt i smak. Jeg ble nysgjerrig pÃ¥ hva som var -bakgrunnen for denne policy-endringen hos Hyperion og han sa seg -villig til Ã¥ la seg intervjue til bloggen min.

- -

- -
Hvilke tanker gjorde du deg da boken lÃ¥ i hÃ¥nden fÃ¸rste -gang?
- -
Jeg husker da jeg fikk boken, etter en omvisning pÃ¥ The Gathering i -2016, der jeg var Core Organizer. The Gathering er jo et sted hvor en -fremmer delingskultur, i alt fra kode, til lÃ¸sninger og Â«hacksÂ», sÃ¥ en -kan vel si at boken er veldig relevant!
- -
Mine fÃ¸rste tanker om boken, var at den trengte et grafisk lÃ¸ft. -Selv har jeg dysleksi og er ikke verdens beste i Ã¥ lese, men for meg -sÃ¥ skal ikke det bety at jeg ikke klarer Ã¥ lese. Jeg har jo ogsÃ¥ mine -egne tanker om Â«Fri kulturÂ», ettersom jeg har jobbet med noen norske -filmer via NRK og TV2 og nÃ¥ sitter som en teknisk leder i -filmavdelingen til SchjÃ¦rven ReklamebyrÃ¥.
- -
Har du lest boken, og hva tenker du om den nÃ¥?
- -
Jeg har lest boken, og for meg er det jo veldig moro Ã¥ kunne si at -Disney var en pirat og nÃ¥ ha bevisene. Men det Ã¥ gÃ¥ fra Disney via -RIAA, og sÃ¥ igjennom en jungel av teknikk og programmering og ende opp -med spÃ¸rsmÃ¥let om vi alle piratkopierer litt, er enda bedre. For ja, -boken klarer Ã¥ fÃ¥ frem en diskusjon om Ã¥ndsverk pÃ¥ en god mÃ¥te -gjennom en samling historier, men den viste meg ogsÃ¥ et bilde, hvor -teknologi blir kneblet, og ikke fÃ¥r lov til Ã¥ utvikle seg, ettersom -Â«opphavsrettsinnehaverneÂ» bryr seg mer om sin industri enn om verden -gÃ¥r fremover. Ta f.eks. internettradio! Hvorfor tuller vi med DAB+ -og alt det der, nÃ¥r radio kan vÃ¦re en app pÃ¥ alle telefoner i dag. -Men den stÃ¸rste tanken som jeg satt igjen med, er at vi mÃ¥ fÃ¥ fÃ¦rre -advokater og flere tenkere som kan dra oss vekk fra de feilene vi er i -ferd med Ã¥ ende opp i.
- -
Har budskapet i boken pÃ¥virker deg og det du holder pÃ¥ -med?
- -
The Gathering sin moderforening er -KANDU, som er et stolt medlem av Hyperion. Hyperion har et mandat igjennom -sitt interne magasin Pegasus Ã¥ fremme Hyperion sine -medlemsarrangementer og kultur. Dette tror jeg er veldig viktig, og en -av de viktigste virkemidlene det magasinet nÃ¥ har fÃ¥tt, er pÃ¥legget om -Ã¥ publisere alt under de forskjellige Creative Commons -retningslinjer. Grunnen til at Pegasus kan velge fritt blant lisensene -til Creative Commons er deres bruk av freelancere m.m. som ogsÃ¥ mÃ¥ fÃ¥ -sine rettigheter dekket.
- -
Det er et steg i riktig retning som jeg hÃ¥per, vil gi lokalaviser, -nasjonale aviser, bloggere m.m. muligheten til Ã¥ referere til Pegasus -sitt innhold uten Ã¥ mÃ¥tte be om tillatelse fÃ¸rst, som i bunnen vil -hjelpe oss Ã¥ spre vÃ¥r kultur i Hyperion.
- -
Hva fikk Pegasus til Ã¥ vedta retninglinjer om bruk av -Creative Commons, og hvordan kom dere frem til en slik -policy?
- -
Dette skjedde pÃ¥ Hyperion sitt landsting, hvor jeg Ã¸nsket Ã¥ fremme -Creative Commons som en retning som flere mener magasinet burde ta, -hvordan Pegasus tar det i bruk er mer opp til redaksjonen. Det som var -trist er at en del har misforstÃ¥tt hva Creative Commons er. Vi fikk -en veldig het Â«debattÂ» pÃ¥ facebook i etterkant hvor noen blant annet -mener at dette vedtaket har drept Pegasus.
- -
Personlig syntes jeg disse reaksjonene er rare, ettersom Pegasus er -et medlemsmagasin og magasinet sitt mÃ¥l er Ã¥ spre vÃ¥r fantastiske -kultur. Jeg mener at Ceative Commons-bruksvilkÃ¥r pÃ¥ artikler skaper -en veldig god mulighet til Ã¥ spre denne kulturen. Det gjÃ¸r at stÃ¸rre -og mindre aviser kan lÃ¥ne artikler fra medlemsmagasinet og publisere -det hos seg, slik at effekten nettopp er fremme vÃ¥r kultur.
- -
Jeg gleder meg til Ã¥ se hvordan redaksjonen hÃ¥ndhever bruken av -Creative Commons.
- -
Hvem tror du kunne ha mest nytte av Ã¥ lese Fri -kultur?
- -
Jeg tror at boken Fri kultur bÃ¸r leses av de som Ã¸nsker en debatt -om nye medier, samt de som jobber med medier og fÃ¸ler seg Â«truetÂ» av -utviklingen. Kanskje det kan vÃ¦re et lysglimt om at vi mÃ¥ heller vÃ¦re -med Ã¥ utvikle oss, enn Ã¥ stoppe opp og Â«beskytteÂ» vÃ¥re eier-, penge- -og materielle interesser.
- -
SpÃ¸rsmÃ¥let for redaksjoner vil vel vÃ¦re om de Â«tjenerÂ» pÃ¥ klikk og -sine artikler via annonser, i sÃ¥ fall ville jeg tenkt litt rundt -spredningen. Nettavisen Digi.no gjorde en analyse i 2015 som var -veldig fin. Hvor de mÃ¥tte konkludere med at de fikk ut budskapet -bedre, men de mistet inntekter pÃ¥ annonsevisning.
- -
Derfor for et magasin som skal Â«spreÂ» kultur, sÃ¥ burde Creative -Commons vÃ¦re en no-brainer, en kunne ogsÃ¥ kanskje argumentere med at -NRK ogsÃ¥ burde gjÃ¸re dette, ettersom de ikke lever av reklame, og vi -betaler for innholdet deres.
- -
Kommer du til Ã¥ anbefale boken til noen du -kjenner?
- -
Absolutt! Jeg har faktisk tenkt Ã¥ gi den videre som en vandrebok, -til redaksjonen i Pegasus slik at de kan lese den og fÃ¥ noen ider og -tanker om fri kultur.
- -
Du sier at boken klarer Ã¥ fÃ¥ frem viktig en diskusjon om - vern av Ã¥ndsverk. Boken er jo skrevet med bakgrunn i USAs - Copyright-lovgiving og ikke den norske Ã¥ndsverksloven. Hva gjÃ¸r at - du mener boken er relevant for den norske debatten?
- -
En av tingene boken pekte pÃ¥ var tanken om hvor opphavsretten skal -ligge. Skal den ligge hos den som skriver sangen, den som fremfÃ¸rer -eller den som tar opp sangen. Og nÃ¥r spÃ¸rsmÃ¥let kom tilbake i en -software-utgave, Â«hvordan kan Adobe styre opphavsretten i sin eBook -PublisherÂ» sÃ¥ fÃ¸ler jeg at vi kommer inn pÃ¥ spennende tanker som jeg -mener vi glemmer i norsk Ã¥ndsverksdebatt. USA har rett Ã¥ slett et -Â«stÃ¸rre bildeÂ» som kanskje vi kan ta lÃ¦rdom av.
- -

- -

Jeg er veldig spent pÃ¥ hvordan redaksjonen i Pegasus kommer til Ã¥ -ta i bruk Creative Commons, og gleder meg til neste tegn pÃ¥ at -bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens -Ã¥ndsverksvern.

- - - Tags: freeculture, norsk, opphavsrett. - - -

@@ -1300,7 +1307,7 @@ bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens

2017

January (1)
January (2)

@@ -1568,7 +1575,7 @@ bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens

@@ -1598,7 +1605,7 @@ bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens

@@ -1616,7 +1623,7 @@ bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1624,7 +1631,7 @@ bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens

@@ -1652,9 +1659,9 @@ bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens

@@ -1666,7 +1673,7 @@ bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens

vitenskap (4)

web (38)

web (39)

diff --git a/blog/index.rss b/blog/index.rss index 4d13a2fd4d..fb8af7e19b 100644 --- a/blog/index.rss +++ b/blog/index.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Introducing ical-archiver to split out old iCalendar entries http://people.skolelinux.org/pere/blog/Introducing_ical_archiver_to_split_out_old_iCalendar_entries.html @@ -1068,153 +1223,5 @@ nynorsk. - - Hyperions magasin Pegasus gÃ¥r for Creative Commons - http://people.skolelinux.org/pere/blog/Hyperions_magasin_Pegasus_g_r_for_Creative_Commons.html - http://people.skolelinux.org/pere/blog/Hyperions_magasin_Pegasus_g_r_for_Creative_Commons.html - Tue, 22 Nov 2016 20:10:00 +0100 - For noen dager siden ble jeg tipset av min venn Andreas -Aanerud om at <a href="http://magasinetpegasus.no">magasinet -Pegasus</a> skulle ta i bruk -<a href="https://creativecommons.org/">Creative -Commons</a>-lisensiering pÃ¥ sine artikler. Han fortalte at den -direkte Ã¥rsaken var at han hadde blitt inspirert av Ã¥ lese -<a href=" http://www.lulu.com/shop/http://www.lulu.com/shop/lawrence-lessig/fri-kultur/paperback/product-22441576.html">boken -Fri kultur</a> -(<a href="https://github.com/petterreinholdtsen/free-culture-lessig">github</a>) -og foreslÃ¥tt endringen. Jeg ble veldig glad for Ã¥ hÃ¸re -dette, da det er det fÃ¸rste konkrete tilfellet jeg har hÃ¸rt om der den -norske oversettelsen av <a href="http://www.free-culture.cc/"> -Lawrence Lessigs bok Free Culture</a> som jeg ga ut i fjor hÃ¸st hadde -fÃ¥tt noen til Ã¥ ta i bruk Creative Commons. - -Andreas fikk boken av meg som takk for at han inviterte meg til -<a href="http://www.gathering.org/">The Gathering</a>, og jeg er veldig -glad for at den falt i smak. Jeg ble nysgjerrig pÃ¥ hva som var -bakgrunnen for denne policy-endringen hos Hyperion og han sa seg -villig til Ã¥ la seg intervjue til bloggen min. - -<blockquote> - -Hvilke tanker gjorde du deg da boken lÃ¥ i hÃ¥nden fÃ¸rste -gang? - -Jeg husker da jeg fikk boken, etter en omvisning pÃ¥ The Gathering i -2016, der jeg var Core Organizer. The Gathering er jo et sted hvor en -fremmer delingskultur, i alt fra kode, til lÃ¸sninger og Â«hacksÂ», sÃ¥ en -kan vel si at boken er veldig relevant! - -Mine fÃ¸rste tanker om boken, var at den trengte et grafisk lÃ¸ft. -Selv har jeg dysleksi og er ikke verdens beste i Ã¥ lese, men for meg -sÃ¥ skal ikke det bety at jeg ikke klarer Ã¥ lese. Jeg har jo ogsÃ¥ mine -egne tanker om Â«Fri kulturÂ», ettersom jeg har jobbet med noen norske -filmer via NRK og TV2 og nÃ¥ sitter som en teknisk leder i -filmavdelingen til SchjÃ¦rven ReklamebyrÃ¥. - -Har du lest boken, og hva tenker du om den nÃ¥? - -Jeg har lest boken, og for meg er det jo veldig moro Ã¥ kunne si at -Disney var en pirat og nÃ¥ ha bevisene. Men det Ã¥ gÃ¥ fra Disney via -RIAA, og sÃ¥ igjennom en jungel av teknikk og programmering og ende opp -med spÃ¸rsmÃ¥let om vi alle piratkopierer litt, er enda bedre. For ja, -boken klarer Ã¥ fÃ¥ frem en diskusjon om Ã¥ndsverk pÃ¥ en god mÃ¥te -gjennom en samling historier, men den viste meg ogsÃ¥ et bilde, hvor -teknologi blir kneblet, og ikke fÃ¥r lov til Ã¥ utvikle seg, ettersom -Â«opphavsrettsinnehaverneÂ» bryr seg mer om sin industri enn om verden -gÃ¥r fremover. Ta f.eks. internettradio! Hvorfor tuller vi med DAB+ -og alt det der, nÃ¥r radio kan vÃ¦re en app pÃ¥ alle telefoner i dag. -Men den stÃ¸rste tanken som jeg satt igjen med, er at vi mÃ¥ fÃ¥ fÃ¦rre -advokater og flere tenkere som kan dra oss vekk fra de feilene vi er i -ferd med Ã¥ ende opp i. - -Har budskapet i boken pÃ¥virker deg og det du holder pÃ¥ -med? - -The Gathering sin moderforening er -<a href="http://www.kandu.no/">KANDU</a>, som er et stolt medlem av <a -href="http://n4f.no/">Hyperion</a>. Hyperion har et mandat igjennom -sitt interne magasin Pegasus Ã¥ fremme Hyperion sine -medlemsarrangementer og kultur. Dette tror jeg er veldig viktig, og en -av de viktigste virkemidlene det magasinet nÃ¥ har fÃ¥tt, er pÃ¥legget om -Ã¥ publisere alt under de forskjellige Creative Commons -retningslinjer. Grunnen til at Pegasus kan velge fritt blant lisensene -til Creative Commons er deres bruk av freelancere m.m. som ogsÃ¥ mÃ¥ fÃ¥ -sine rettigheter dekket. - -Det er et steg i riktig retning som jeg hÃ¥per, vil gi lokalaviser, -nasjonale aviser, bloggere m.m. muligheten til Ã¥ referere til Pegasus -sitt innhold uten Ã¥ mÃ¥tte be om tillatelse fÃ¸rst, som i bunnen vil -hjelpe oss Ã¥ spre vÃ¥r kultur i Hyperion. - -Hva fikk Pegasus til Ã¥ vedta retninglinjer om bruk av -Creative Commons, og hvordan kom dere frem til en slik -policy? - -Dette skjedde pÃ¥ Hyperion sitt landsting, hvor jeg Ã¸nsket Ã¥ fremme -Creative Commons som en retning som flere mener magasinet burde ta, -hvordan Pegasus tar det i bruk er mer opp til redaksjonen. Det som var -trist er at en del har misforstÃ¥tt hva Creative Commons er. Vi fikk -en veldig het Â«debattÂ» pÃ¥ facebook i etterkant hvor noen blant annet -mener at dette vedtaket har drept Pegasus. - -Personlig syntes jeg disse reaksjonene er rare, ettersom Pegasus er -et medlemsmagasin og magasinet sitt mÃ¥l er Ã¥ spre vÃ¥r fantastiske -kultur. Jeg mener at Ceative Commons-bruksvilkÃ¥r pÃ¥ artikler skaper -en veldig god mulighet til Ã¥ spre denne kulturen. Det gjÃ¸r at stÃ¸rre -og mindre aviser kan lÃ¥ne artikler fra medlemsmagasinet og publisere -det hos seg, slik at effekten nettopp er fremme vÃ¥r kultur. - -Jeg gleder meg til Ã¥ se hvordan redaksjonen hÃ¥ndhever bruken av -Creative Commons. - -Hvem tror du kunne ha mest nytte av Ã¥ lese Fri -kultur? - -Jeg tror at boken Fri kultur bÃ¸r leses av de som Ã¸nsker en debatt -om nye medier, samt de som jobber med medier og fÃ¸ler seg Â«truetÂ» av -utviklingen. Kanskje det kan vÃ¦re et lysglimt om at vi mÃ¥ heller vÃ¦re -med Ã¥ utvikle oss, enn Ã¥ stoppe opp og Â«beskytteÂ» vÃ¥re eier-, penge- -og materielle interesser. - -SpÃ¸rsmÃ¥let for redaksjoner vil vel vÃ¦re om de Â«tjenerÂ» pÃ¥ klikk og -sine artikler via annonser, i sÃ¥ fall ville jeg tenkt litt rundt -spredningen. Nettavisen Digi.no gjorde en analyse i 2015 som var -veldig fin. Hvor de mÃ¥tte konkludere med at de fikk ut budskapet -bedre, men de mistet inntekter pÃ¥ annonsevisning. - -Derfor for et magasin som skal Â«spreÂ» kultur, sÃ¥ burde Creative -Commons vÃ¦re en no-brainer, en kunne ogsÃ¥ kanskje argumentere med at -NRK ogsÃ¥ burde gjÃ¸re dette, ettersom de ikke lever av reklame, og vi -betaler for innholdet deres. - -Kommer du til Ã¥ anbefale boken til noen du -kjenner? - -Absolutt! Jeg har faktisk tenkt Ã¥ gi den videre som en vandrebok, -til redaksjonen i Pegasus slik at de kan lese den og fÃ¥ noen ider og -tanker om fri kultur. - -Du sier at boken klarer Ã¥ fÃ¥ frem viktig en diskusjon om - vern av Ã¥ndsverk. Boken er jo skrevet med bakgrunn i USAs - Copyright-lovgiving og ikke den norske Ã¥ndsverksloven. Hva gjÃ¸r at - du mener boken er relevant for den norske debatten? - -En av tingene boken pekte pÃ¥ var tanken om hvor opphavsretten skal -ligge. Skal den ligge hos den som skriver sangen, den som fremfÃ¸rer -eller den som tar opp sangen. Og nÃ¥r spÃ¸rsmÃ¥let kom tilbake i en -software-utgave, Â«hvordan kan Adobe styre opphavsretten i sin eBook -PublisherÂ» sÃ¥ fÃ¸ler jeg at vi kommer inn pÃ¥ spennende tanker som jeg -mener vi glemmer i norsk Ã¥ndsverksdebatt. USA har rett Ã¥ slett et -Â«stÃ¸rre bildeÂ» som kanskje vi kan ta lÃ¦rdom av. - -</blockquote> - -Jeg er veldig spent pÃ¥ hvordan redaksjonen i Pegasus kommer til Ã¥ -ta i bruk Creative Commons, og gleder meg til neste tegn pÃ¥ at -bokutgivelsen har fÃ¥tt noen til Ã¥ tenke mer pÃ¥ problemene med dagens -Ã¥ndsverksvern. - - - diff --git a/blog/jXplorer__a_very_nice_LDAP_GUI.html b/blog/jXplorer__a_very_nice_LDAP_GUI.html index aca882398d..90a85fe66d 100644 --- a/blog/jXplorer__a_very_nice_LDAP_GUI.html +++ b/blog/jXplorer__a_very_nice_LDAP_GUI.html @@ -56,7 +56,7 @@ and remove the failing query. Nothing big, but very annoying.

2017

January (1)
January (2)

@@ -324,7 +324,7 @@ and remove the failing query. Nothing big, but very annoying.

@@ -354,7 +354,7 @@ and remove the failing query. Nothing big, but very annoying.

@@ -372,7 +372,7 @@ and remove the failing query. Nothing big, but very annoying.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -380,7 +380,7 @@ and remove the failing query. Nothing big, but very annoying.

@@ -408,9 +408,9 @@ and remove the failing query. Nothing big, but very annoying.

@@ -422,7 +422,7 @@ and remove the failing query. Nothing big, but very annoying.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/listadmin__the_quick_way_to_moderate_mailman_lists___nice_free_software.html b/blog/listadmin__the_quick_way_to_moderate_mailman_lists___nice_free_software.html index 48f8872043..52c50b5c4d 100644 --- a/blog/listadmin__the_quick_way_to_moderate_mailman_lists___nice_free_software.html +++ b/blog/listadmin__the_quick_way_to_moderate_mailman_lists___nice_free_software.html @@ -125,7 +125,7 @@ sure why.

2017

January (1)
January (2)

@@ -393,7 +393,7 @@ sure why.

@@ -423,7 +423,7 @@ sure why.

@@ -441,7 +441,7 @@ sure why.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -449,7 +449,7 @@ sure why.

@@ -477,9 +477,9 @@ sure why.

@@ -491,7 +491,7 @@ sure why.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/sitemap.xml b/blog/sitemap.xml index 3a5fb7ff90..5e467c7960 100644 --- a/blog/sitemap.xml +++ b/blog/sitemap.xml @@ -3105,6 +3105,11 @@ 0.50 weekly + + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + 0.50 + weekly + http://people.skolelinux.org/pere/blog/Which_module_is_loaded_for_a_given_PCI_and_USB_device_.html 0.50 diff --git a/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html b/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html index 335e1c5d5c..d99db2615f 100644 --- a/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html +++ b/blog/syslog_trusted_timestamp___chain_of_trusted_timestamps_for_your_syslog.html @@ -149,7 +149,7 @@ activities, please send Bitcoin donations to my address

2017

January (1)
January (2)

@@ -417,7 +417,7 @@ activities, please send Bitcoin donations to my address

@@ -447,7 +447,7 @@ activities, please send Bitcoin donations to my address

@@ -465,7 +465,7 @@ activities, please send Bitcoin donations to my address

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -473,7 +473,7 @@ activities, please send Bitcoin donations to my address

@@ -501,9 +501,9 @@ activities, please send Bitcoin donations to my address

@@ -515,7 +515,7 @@ activities, please send Bitcoin donations to my address

vitenskap (4)

web (38)

web (39)

diff --git a/blog/systemd__an_interesting_alternative_to_upstart.html b/blog/systemd__an_interesting_alternative_to_upstart.html index e9b2a990a8..4af5031e58 100644 --- a/blog/systemd__an_interesting_alternative_to_upstart.html +++ b/blog/systemd__an_interesting_alternative_to_upstart.html @@ -74,7 +74,7 @@ with parallel booting enabled by default.

2017

January (1)
January (2)

@@ -342,7 +342,7 @@ with parallel booting enabled by default.

@@ -372,7 +372,7 @@ with parallel booting enabled by default.

@@ -390,7 +390,7 @@ with parallel booting enabled by default.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -398,7 +398,7 @@ with parallel booting enabled by default.

@@ -426,9 +426,9 @@ with parallel booting enabled by default.

@@ -440,7 +440,7 @@ with parallel booting enabled by default.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/3d-printer/index.html b/blog/tags/3d-printer/index.html index adaf4f89d3..429c04021e 100644 --- a/blog/tags/3d-printer/index.html +++ b/blog/tags/3d-printer/index.html @@ -606,7 +606,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

2017

January (1)
January (2)

@@ -874,7 +874,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -904,7 +904,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -922,7 +922,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -930,7 +930,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -958,9 +958,9 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -972,7 +972,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/amiga/index.html b/blog/tags/amiga/index.html index c33af4fccf..435bf73572 100644 --- a/blog/tags/amiga/index.html +++ b/blog/tags/amiga/index.html @@ -60,7 +60,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

2017

January (1)
January (2)

@@ -328,7 +328,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -358,7 +358,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -376,7 +376,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -384,7 +384,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -412,9 +412,9 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -426,7 +426,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/aros/index.html b/blog/tags/aros/index.html index d45a3d0847..f3013e9a5c 100644 --- a/blog/tags/aros/index.html +++ b/blog/tags/aros/index.html @@ -60,7 +60,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

2017

January (1)
January (2)

@@ -328,7 +328,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -358,7 +358,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -376,7 +376,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -384,7 +384,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -412,9 +412,9 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

@@ -426,7 +426,7 @@ pakke. Kanskje Aros kunne vÃ¦rt interessant for et NUUG-foredrag?

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/bankid/index.html b/blog/tags/bankid/index.html index c75b525a5f..3fa2a3ce14 100644 --- a/blog/tags/bankid/index.html +++ b/blog/tags/bankid/index.html @@ -472,7 +472,7 @@ omtalt over. Anbefalt lesning.

2017

January (1)
January (2)

@@ -740,7 +740,7 @@ omtalt over. Anbefalt lesning.

@@ -770,7 +770,7 @@ omtalt over. Anbefalt lesning.

@@ -788,7 +788,7 @@ omtalt over. Anbefalt lesning.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -796,7 +796,7 @@ omtalt over. Anbefalt lesning.

@@ -824,9 +824,9 @@ omtalt over. Anbefalt lesning.

@@ -838,7 +838,7 @@ omtalt over. Anbefalt lesning.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/bitcoin/index.html b/blog/tags/bitcoin/index.html index a8f5010341..9cbf227279 100644 --- a/blog/tags/bitcoin/index.html +++ b/blog/tags/bitcoin/index.html @@ -629,7 +629,7 @@ donations to the address

2017

January (1)
January (2)

@@ -897,7 +897,7 @@ donations to the address

@@ -927,7 +927,7 @@ donations to the address

@@ -945,7 +945,7 @@ donations to the address

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -953,7 +953,7 @@ donations to the address

@@ -981,9 +981,9 @@ donations to the address

@@ -995,7 +995,7 @@ donations to the address

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/bootsystem/index.html b/blog/tags/bootsystem/index.html index 2a50351859..124a03d8f4 100644 --- a/blog/tags/bootsystem/index.html +++ b/blog/tags/bootsystem/index.html @@ -1272,7 +1272,7 @@ insserv'. Will need to test if that work. :)

2017

January (1)
January (2)

@@ -1540,7 +1540,7 @@ insserv'. Will need to test if that work. :)

@@ -1570,7 +1570,7 @@ insserv'. Will need to test if that work. :)

@@ -1588,7 +1588,7 @@ insserv'. Will need to test if that work. :)

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1596,7 +1596,7 @@ insserv'. Will need to test if that work. :)

@@ -1624,9 +1624,9 @@ insserv'. Will need to test if that work. :)

@@ -1638,7 +1638,7 @@ insserv'. Will need to test if that work. :)

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/bsa/index.html b/blog/tags/bsa/index.html index 0564a16c70..7fcac7004c 100644 --- a/blog/tags/bsa/index.html +++ b/blog/tags/bsa/index.html @@ -148,7 +148,7 @@ pÃ¥ Slashdot.

2017

January (1)
January (2)

@@ -416,7 +416,7 @@ pÃ¥ Slashdot.

@@ -446,7 +446,7 @@ pÃ¥ Slashdot.

@@ -464,7 +464,7 @@ pÃ¥ Slashdot.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -472,7 +472,7 @@ pÃ¥ Slashdot.

@@ -500,9 +500,9 @@ pÃ¥ Slashdot.

@@ -514,7 +514,7 @@ pÃ¥ Slashdot.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/chrpath/index.html b/blog/tags/chrpath/index.html index dfebab75b6..270de5aa29 100644 --- a/blog/tags/chrpath/index.html +++ b/blog/tags/chrpath/index.html @@ -155,7 +155,7 @@ include a testsuite check.

2017

January (1)
January (2)

@@ -423,7 +423,7 @@ include a testsuite check.

@@ -453,7 +453,7 @@ include a testsuite check.

@@ -471,7 +471,7 @@ include a testsuite check.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -479,7 +479,7 @@ include a testsuite check.

@@ -507,9 +507,9 @@ include a testsuite check.

@@ -521,7 +521,7 @@ include a testsuite check.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/debian edu/index.html b/blog/tags/debian edu/index.html index d71b8a1f06..61f44b883b 100644 --- a/blog/tags/debian edu/index.html +++ b/blog/tags/debian edu/index.html @@ -14948,7 +14948,7 @@ be the only one fitting our needs. :/

2017

January (1)
January (2)

@@ -15216,7 +15216,7 @@ be the only one fitting our needs. :/

@@ -15246,7 +15246,7 @@ be the only one fitting our needs. :/

@@ -15264,7 +15264,7 @@ be the only one fitting our needs. :/

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -15272,7 +15272,7 @@ be the only one fitting our needs. :/

@@ -15300,9 +15300,9 @@ be the only one fitting our needs. :/

@@ -15314,7 +15314,7 @@ be the only one fitting our needs. :/

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/debian/debian.rss b/blog/tags/debian/debian.rss index 6cd5cfb702..50adf0e980 100644 --- a/blog/tags/debian/debian.rss +++ b/blog/tags/debian/debian.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Appstream just learned how to map hardware to packages too! http://people.skolelinux.org/pere/blog/Appstream_just_learned_how_to_map_hardware_to_packages_too_.html diff --git a/blog/tags/debian/index.html b/blog/tags/debian/index.html index e7f3c43f1a..208a676ce1 100644 --- a/blog/tags/debian/index.html +++ b/blog/tags/debian/index.html @@ -20,6 +20,173 @@

Entries tagged "debian".

+ Where did that package go? — geolocated IP traceroute +

+ 9th January 2017 +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Appstream just learned how to map hardware to packages too! @@ -11897,7 +12064,7 @@ be the only one fitting our needs. :/

2017

January (1)
January (2)

@@ -12165,7 +12332,7 @@ be the only one fitting our needs. :/

@@ -12195,7 +12362,7 @@ be the only one fitting our needs. :/

@@ -12213,7 +12380,7 @@ be the only one fitting our needs. :/

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -12221,7 +12388,7 @@ be the only one fitting our needs. :/

@@ -12249,9 +12416,9 @@ be the only one fitting our needs. :/

@@ -12263,7 +12430,7 @@ be the only one fitting our needs. :/

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/digistan/index.html b/blog/tags/digistan/index.html index ebce970906..eab786e11b 100644 --- a/blog/tags/digistan/index.html +++ b/blog/tags/digistan/index.html @@ -1247,7 +1247,7 @@ produkter basert pÃ¥ standarden.

2017

January (1)
January (2)

@@ -1515,7 +1515,7 @@ produkter basert pÃ¥ standarden.

@@ -1545,7 +1545,7 @@ produkter basert pÃ¥ standarden.

@@ -1563,7 +1563,7 @@ produkter basert pÃ¥ standarden.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1571,7 +1571,7 @@ produkter basert pÃ¥ standarden.

@@ -1599,9 +1599,9 @@ produkter basert pÃ¥ standarden.

@@ -1613,7 +1613,7 @@ produkter basert pÃ¥ standarden.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/dld/index.html b/blog/tags/dld/index.html index 0992e2cd16..7756a7bbc9 100644 --- a/blog/tags/dld/index.html +++ b/blog/tags/dld/index.html @@ -1524,7 +1524,7 @@ fÃ¥r snart se om det stemmer.

2017

January (1)
January (2)

@@ -1792,7 +1792,7 @@ fÃ¥r snart se om det stemmer.

@@ -1822,7 +1822,7 @@ fÃ¥r snart se om det stemmer.

@@ -1840,7 +1840,7 @@ fÃ¥r snart se om det stemmer.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1848,7 +1848,7 @@ fÃ¥r snart se om det stemmer.

@@ -1876,9 +1876,9 @@ fÃ¥r snart se om det stemmer.

@@ -1890,7 +1890,7 @@ fÃ¥r snart se om det stemmer.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/docbook/index.html b/blog/tags/docbook/index.html index 92294c2867..1896696a39 100644 --- a/blog/tags/docbook/index.html +++ b/blog/tags/docbook/index.html @@ -1578,7 +1578,7 @@ slik at du kan oppdatere direkte.

2017

January (1)
January (2)

@@ -1846,7 +1846,7 @@ slik at du kan oppdatere direkte.

@@ -1876,7 +1876,7 @@ slik at du kan oppdatere direkte.

@@ -1894,7 +1894,7 @@ slik at du kan oppdatere direkte.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1902,7 +1902,7 @@ slik at du kan oppdatere direkte.

@@ -1930,9 +1930,9 @@ slik at du kan oppdatere direkte.

@@ -1944,7 +1944,7 @@ slik at du kan oppdatere direkte.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/drivstoffpriser/index.html b/blog/tags/drivstoffpriser/index.html index 2c306fe55a..3de3aa92ab 100644 --- a/blog/tags/drivstoffpriser/index.html +++ b/blog/tags/drivstoffpriser/index.html @@ -489,7 +489,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

2017

January (1)
January (2)

@@ -757,7 +757,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

@@ -787,7 +787,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

@@ -805,7 +805,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -813,7 +813,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

@@ -841,9 +841,9 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

@@ -855,7 +855,7 @@ en liste med stasjoner pÃ¥ samme format som PriserVedStasjoner.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/english/index.html b/blog/tags/english/index.html index 185670a5a5..69d93768ff 100644 --- a/blog/tags/english/index.html +++ b/blog/tags/english/index.html @@ -27397,7 +27397,7 @@ be the only one fitting our needs. :/

2017

January (1)
January (2)

@@ -27665,7 +27665,7 @@ be the only one fitting our needs. :/

@@ -27695,7 +27695,7 @@ be the only one fitting our needs. :/

@@ -27713,7 +27713,7 @@ be the only one fitting our needs. :/

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -27721,7 +27721,7 @@ be the only one fitting our needs. :/

@@ -27749,9 +27749,9 @@ be the only one fitting our needs. :/

@@ -27763,7 +27763,7 @@ be the only one fitting our needs. :/

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/fiksgatami/index.html b/blog/tags/fiksgatami/index.html index 2489bc3983..0c41773af4 100644 --- a/blog/tags/fiksgatami/index.html +++ b/blog/tags/fiksgatami/index.html @@ -1340,7 +1340,7 @@ med dem. Dette blir bra.

2017

January (1)
January (2)

@@ -1608,7 +1608,7 @@ med dem. Dette blir bra.

@@ -1638,7 +1638,7 @@ med dem. Dette blir bra.

@@ -1656,7 +1656,7 @@ med dem. Dette blir bra.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1664,7 +1664,7 @@ med dem. Dette blir bra.

@@ -1692,9 +1692,9 @@ med dem. Dette blir bra.

@@ -1706,7 +1706,7 @@ med dem. Dette blir bra.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/fildeling/index.html b/blog/tags/fildeling/index.html index 797145f6e4..328e8945af 100644 --- a/blog/tags/fildeling/index.html +++ b/blog/tags/fildeling/index.html @@ -633,7 +633,7 @@ og fildeling av slike filer er fullt ut lovlig.

2017

January (1)
January (2)

@@ -901,7 +901,7 @@ og fildeling av slike filer er fullt ut lovlig.

@@ -931,7 +931,7 @@ og fildeling av slike filer er fullt ut lovlig.

@@ -949,7 +949,7 @@ og fildeling av slike filer er fullt ut lovlig.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -957,7 +957,7 @@ og fildeling av slike filer er fullt ut lovlig.

@@ -985,9 +985,9 @@ og fildeling av slike filer er fullt ut lovlig.

@@ -999,7 +999,7 @@ og fildeling av slike filer er fullt ut lovlig.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/freeculture/index.html b/blog/tags/freeculture/index.html index cfc19618f2..7b2e7a1565 100644 --- a/blog/tags/freeculture/index.html +++ b/blog/tags/freeculture/index.html @@ -2113,7 +2113,7 @@ slik at du kan oppdatere direkte.

2017

January (1)
January (2)

@@ -2381,7 +2381,7 @@ slik at du kan oppdatere direkte.

@@ -2411,7 +2411,7 @@ slik at du kan oppdatere direkte.

@@ -2429,7 +2429,7 @@ slik at du kan oppdatere direkte.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -2437,7 +2437,7 @@ slik at du kan oppdatere direkte.

@@ -2465,9 +2465,9 @@ slik at du kan oppdatere direkte.

@@ -2479,7 +2479,7 @@ slik at du kan oppdatere direkte.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/freedombox/index.html b/blog/tags/freedombox/index.html index 29365bb1d4..aa16b66ac8 100644 --- a/blog/tags/freedombox/index.html +++ b/blog/tags/freedombox/index.html @@ -934,7 +934,7 @@ default password is 'secret'.

2017

January (1)
January (2)

@@ -1202,7 +1202,7 @@ default password is 'secret'.

@@ -1232,7 +1232,7 @@ default password is 'secret'.

@@ -1250,7 +1250,7 @@ default password is 'secret'.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1258,7 +1258,7 @@ default password is 'secret'.

@@ -1286,9 +1286,9 @@ default password is 'secret'.

@@ -1300,7 +1300,7 @@ default password is 'secret'.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/frikanalen/index.html b/blog/tags/frikanalen/index.html index 5d1ce6885a..c2c6309cfd 100644 --- a/blog/tags/frikanalen/index.html +++ b/blog/tags/frikanalen/index.html @@ -1420,7 +1420,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

2017

January (1)
January (2)

@@ -1688,7 +1688,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

@@ -1718,7 +1718,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

@@ -1736,7 +1736,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1744,7 +1744,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

@@ -1772,9 +1772,9 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

@@ -1786,7 +1786,7 @@ NUUG lykkes med Ã¥ fÃ¥ ut sine opptak med like stor suksess.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/h264/index.html b/blog/tags/h264/index.html index 0a3319b352..c88732d97c 100644 --- a/blog/tags/h264/index.html +++ b/blog/tags/h264/index.html @@ -2506,7 +2506,7 @@ sure hope it was using the announced Ogg Theora support. :)

2017

January (1)
January (2)

@@ -2774,7 +2774,7 @@ sure hope it was using the announced Ogg Theora support. :)

@@ -2804,7 +2804,7 @@ sure hope it was using the announced Ogg Theora support. :)

@@ -2822,7 +2822,7 @@ sure hope it was using the announced Ogg Theora support. :)

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -2830,7 +2830,7 @@ sure hope it was using the announced Ogg Theora support. :)

@@ -2858,9 +2858,9 @@ sure hope it was using the announced Ogg Theora support. :)

@@ -2872,7 +2872,7 @@ sure hope it was using the announced Ogg Theora support. :)

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/intervju/index.html b/blog/tags/intervju/index.html index 79f4975e95..fc90e0d6ae 100644 --- a/blog/tags/intervju/index.html +++ b/blog/tags/intervju/index.html @@ -5128,7 +5128,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

2017

January (1)
January (2)

@@ -5396,7 +5396,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

@@ -5426,7 +5426,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

@@ -5444,7 +5444,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -5452,7 +5452,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

@@ -5480,9 +5480,9 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

@@ -5494,7 +5494,7 @@ veldig bra utvalg av gratis spill som er av hÃ¸y kvalitet. Veldig lett

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/isenkram/index.html b/blog/tags/isenkram/index.html index 69d6c40431..0db0e533f5 100644 --- a/blog/tags/isenkram/index.html +++ b/blog/tags/isenkram/index.html @@ -1588,7 +1588,7 @@ please send me an email. :)

2017

January (1)
January (2)

@@ -1856,7 +1856,7 @@ please send me an email. :)

@@ -1886,7 +1886,7 @@ please send me an email. :)

@@ -1904,7 +1904,7 @@ please send me an email. :)

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1912,7 +1912,7 @@ please send me an email. :)

@@ -1940,9 +1940,9 @@ please send me an email. :)

@@ -1954,7 +1954,7 @@ please send me an email. :)

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/kart/index.html b/blog/tags/kart/index.html index 8487b30640..3797638874 100644 --- a/blog/tags/kart/index.html +++ b/blog/tags/kart/index.html @@ -20,6 +20,173 @@

Entries tagged "kart".

+ Where did that package go? — geolocated IP traceroute +

+ 9th January 2017 +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Hva henger under skibrua over E16 pÃ¥ SollihÃ¸gda? @@ -1410,7 +1577,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

2017

January (1)
January (2)

@@ -1678,7 +1845,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

@@ -1708,7 +1875,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

@@ -1726,7 +1893,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1734,7 +1901,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

@@ -1762,9 +1929,9 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

@@ -1776,7 +1943,7 @@ det viser at behovet for fribruks-sjÃ¸kart er til stedet.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/kart/kart.rss b/blog/tags/kart/kart.rss index f4773be585..2b74f9ca6a 100644 --- a/blog/tags/kart/kart.rss +++ b/blog/tags/kart/kart.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Hva henger under skibrua over E16 pÃ¥ SollihÃ¸gda? http://people.skolelinux.org/pere/blog/Hva_henger_under_skibrua_over_E16_p__Sollih_gda_.html diff --git a/blog/tags/ldap/index.html b/blog/tags/ldap/index.html index a4fb36a020..eb79ff0af1 100644 --- a/blog/tags/ldap/index.html +++ b/blog/tags/ldap/index.html @@ -1050,7 +1050,7 @@ new IETF work group?

2017

January (1)
January (2)

@@ -1318,7 +1318,7 @@ new IETF work group?

@@ -1348,7 +1348,7 @@ new IETF work group?

@@ -1366,7 +1366,7 @@ new IETF work group?

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1374,7 +1374,7 @@ new IETF work group?

@@ -1402,9 +1402,9 @@ new IETF work group?

@@ -1416,7 +1416,7 @@ new IETF work group?

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/lenker/index.html b/blog/tags/lenker/index.html index 18123c5061..0802103e3c 100644 --- a/blog/tags/lenker/index.html +++ b/blog/tags/lenker/index.html @@ -645,7 +645,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

2017

January (1)
January (2)

@@ -913,7 +913,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

@@ -943,7 +943,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

@@ -961,7 +961,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -969,7 +969,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

@@ -997,9 +997,9 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

@@ -1011,7 +1011,7 @@ Word 2007 hÃ¥ndterer ODF dÃ¥rlig

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/lsdvd/index.html b/blog/tags/lsdvd/index.html index a1db26136c..4d5656ca2b 100644 --- a/blog/tags/lsdvd/index.html +++ b/blog/tags/lsdvd/index.html @@ -131,7 +131,7 @@ list. :)

2017

January (1)
January (2)

@@ -399,7 +399,7 @@ list. :)

@@ -429,7 +429,7 @@ list. :)

@@ -447,7 +447,7 @@ list. :)

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -455,7 +455,7 @@ list. :)

@@ -483,9 +483,9 @@ list. :)

@@ -497,7 +497,7 @@ list. :)

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/ltsp/index.html b/blog/tags/ltsp/index.html index e6fc561c59..4d4d3c04f1 100644 --- a/blog/tags/ltsp/index.html +++ b/blog/tags/ltsp/index.html @@ -65,7 +65,7 @@ of these cards.

2017

January (1)
January (2)

@@ -333,7 +333,7 @@ of these cards.

@@ -363,7 +363,7 @@ of these cards.

@@ -381,7 +381,7 @@ of these cards.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -389,7 +389,7 @@ of these cards.

@@ -417,9 +417,9 @@ of these cards.

@@ -431,7 +431,7 @@ of these cards.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/mesh network/index.html b/blog/tags/mesh network/index.html index 9811047bd8..b82287e6e5 100644 --- a/blog/tags/mesh network/index.html +++ b/blog/tags/mesh network/index.html @@ -715,7 +715,7 @@ mesh system.

2017

January (1)
January (2)

@@ -983,7 +983,7 @@ mesh system.

@@ -1013,7 +1013,7 @@ mesh system.

@@ -1031,7 +1031,7 @@ mesh system.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1039,7 +1039,7 @@ mesh system.

@@ -1067,9 +1067,9 @@ mesh system.

@@ -1081,7 +1081,7 @@ mesh system.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/multimedia/index.html b/blog/tags/multimedia/index.html index 972adc912a..5ff637f3cd 100644 --- a/blog/tags/multimedia/index.html +++ b/blog/tags/multimedia/index.html @@ -3294,7 +3294,7 @@ be the only one fitting our needs. :/

2017

January (1)
January (2)

@@ -3562,7 +3562,7 @@ be the only one fitting our needs. :/

@@ -3592,7 +3592,7 @@ be the only one fitting our needs. :/

@@ -3610,7 +3610,7 @@ be the only one fitting our needs. :/

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -3618,7 +3618,7 @@ be the only one fitting our needs. :/

@@ -3646,9 +3646,9 @@ be the only one fitting our needs. :/

@@ -3660,7 +3660,7 @@ be the only one fitting our needs. :/

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/nice free software/index.html b/blog/tags/nice free software/index.html index fa5401f7fe..d74e4d67b9 100644 --- a/blog/tags/nice free software/index.html +++ b/blog/tags/nice free software/index.html @@ -1053,7 +1053,7 @@ section.

2017

January (1)
January (2)

@@ -1321,7 +1321,7 @@ section.

@@ -1351,7 +1351,7 @@ section.

@@ -1369,7 +1369,7 @@ section.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1377,7 +1377,7 @@ section.

@@ -1405,9 +1405,9 @@ section.

@@ -1419,7 +1419,7 @@ section.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/norsk/index.html b/blog/tags/norsk/index.html index 4a279970f2..cc5df36224 100644 --- a/blog/tags/norsk/index.html +++ b/blog/tags/norsk/index.html @@ -25672,7 +25672,7 @@ forsÃ¸k.

2017

January (1)
January (2)

@@ -25940,7 +25940,7 @@ forsÃ¸k.

@@ -25970,7 +25970,7 @@ forsÃ¸k.

@@ -25988,7 +25988,7 @@ forsÃ¸k.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -25996,7 +25996,7 @@ forsÃ¸k.

@@ -26024,9 +26024,9 @@ forsÃ¸k.

@@ -26038,7 +26038,7 @@ forsÃ¸k.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/nuug/index.html b/blog/tags/nuug/index.html index 98f67ff96a..ef241aa4aa 100644 --- a/blog/tags/nuug/index.html +++ b/blog/tags/nuug/index.html @@ -20,6 +20,173 @@

Entries tagged "nuug".

+ Where did that package go? — geolocated IP traceroute +

+ 9th January 2017 +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Techno TV broadcasting live across Norway and the Internet (#debconf16, #nuug) on @frikanalen @@ -12862,7 +13029,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

2017

January (1)
January (2)

@@ -13130,7 +13297,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -13160,7 +13327,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -13178,7 +13345,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -13186,7 +13353,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -13214,9 +13381,9 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -13228,7 +13395,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/nuug/nuug.rss b/blog/tags/nuug/nuug.rss index 9af2c008ee..3101fe3f09 100644 --- a/blog/tags/nuug/nuug.rss +++ b/blog/tags/nuug/nuug.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Techno TV broadcasting live across Norway and the Internet (#debconf16, #nuug) on @frikanalen http://people.skolelinux.org/pere/blog/Techno_TV_broadcasting_live_across_Norway_and_the_Internet___debconf16___nuug__on__frikanalen.html diff --git a/blog/tags/offentlig innsyn/index.html b/blog/tags/offentlig innsyn/index.html index 25d10701b4..44fa1f2ce6 100644 --- a/blog/tags/offentlig innsyn/index.html +++ b/blog/tags/offentlig innsyn/index.html @@ -3380,7 +3380,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

2017

January (1)
January (2)

@@ -3648,7 +3648,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

@@ -3678,7 +3678,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

@@ -3696,7 +3696,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -3704,7 +3704,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

@@ -3732,9 +3732,9 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

@@ -3746,7 +3746,7 @@ til Ã¥ levere hver uke. Har ikke undersÃ¸kt noen av de andre.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/open311/index.html b/blog/tags/open311/index.html index 967f793e96..6947c58d97 100644 --- a/blog/tags/open311/index.html +++ b/blog/tags/open311/index.html @@ -160,7 +160,7 @@ work like the free software project communities I am used to.

2017

January (1)
January (2)

@@ -428,7 +428,7 @@ work like the free software project communities I am used to.

@@ -458,7 +458,7 @@ work like the free software project communities I am used to.

@@ -476,7 +476,7 @@ work like the free software project communities I am used to.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -484,7 +484,7 @@ work like the free software project communities I am used to.

@@ -512,9 +512,9 @@ work like the free software project communities I am used to.

@@ -526,7 +526,7 @@ work like the free software project communities I am used to.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/opphavsrett/index.html b/blog/tags/opphavsrett/index.html index 138029b339..67c8394f85 100644 --- a/blog/tags/opphavsrett/index.html +++ b/blog/tags/opphavsrett/index.html @@ -7247,7 +7247,7 @@ database.

2017

January (1)
January (2)

@@ -7515,7 +7515,7 @@ database.

@@ -7545,7 +7545,7 @@ database.

@@ -7563,7 +7563,7 @@ database.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -7571,7 +7571,7 @@ database.

@@ -7599,9 +7599,9 @@ database.

@@ -7613,7 +7613,7 @@ database.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/personvern/index.html b/blog/tags/personvern/index.html index 97db587fe0..6b2fa5afc6 100644 --- a/blog/tags/personvern/index.html +++ b/blog/tags/personvern/index.html @@ -20,6 +20,173 @@

Entries tagged "personvern".

+ Where did that package go? — geolocated IP traceroute +

+ 9th January 2017 +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Er lover brutt nÃ¥r personvernpolicy ikke stemmer med praksis? @@ -9195,7 +9362,7 @@ kontanter for noen dager siden.

2017

January (1)
January (2)

@@ -9463,7 +9630,7 @@ kontanter for noen dager siden.

@@ -9493,7 +9660,7 @@ kontanter for noen dager siden.

@@ -9511,7 +9678,7 @@ kontanter for noen dager siden.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -9519,7 +9686,7 @@ kontanter for noen dager siden.

@@ -9547,9 +9714,9 @@ kontanter for noen dager siden.

@@ -9561,7 +9728,7 @@ kontanter for noen dager siden.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/personvern/personvern.rss b/blog/tags/personvern/personvern.rss index 42251affb8..06dc2d719f 100644 --- a/blog/tags/personvern/personvern.rss +++ b/blog/tags/personvern/personvern.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Er lover brutt nÃ¥r personvernpolicy ikke stemmer med praksis? http://people.skolelinux.org/pere/blog/Er_lover_brutt_n_r_personvernpolicy_ikke_stemmer_med_praksis_.html diff --git a/blog/tags/raid/index.html b/blog/tags/raid/index.html index ac22bf9be3..ea7f9fc014 100644 --- a/blog/tags/raid/index.html +++ b/blog/tags/raid/index.html @@ -101,7 +101,7 @@ disk(s) is failing when the RAID is running short on disks.

2017

January (1)
January (2)

@@ -369,7 +369,7 @@ disk(s) is failing when the RAID is running short on disks.

@@ -399,7 +399,7 @@ disk(s) is failing when the RAID is running short on disks.

@@ -417,7 +417,7 @@ disk(s) is failing when the RAID is running short on disks.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -425,7 +425,7 @@ disk(s) is failing when the RAID is running short on disks.

@@ -453,9 +453,9 @@ disk(s) is failing when the RAID is running short on disks.

@@ -467,7 +467,7 @@ disk(s) is failing when the RAID is running short on disks.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/reactos/index.html b/blog/tags/reactos/index.html index cad23bc419..e7fdf89c15 100644 --- a/blog/tags/reactos/index.html +++ b/blog/tags/reactos/index.html @@ -100,7 +100,7 @@ image.

2017

January (1)
January (2)

@@ -368,7 +368,7 @@ image.

@@ -398,7 +398,7 @@ image.

@@ -416,7 +416,7 @@ image.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -424,7 +424,7 @@ image.

@@ -452,9 +452,9 @@ image.

@@ -466,7 +466,7 @@ image.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/reprap/index.html b/blog/tags/reprap/index.html index 6853dcba1c..5db4ace665 100644 --- a/blog/tags/reprap/index.html +++ b/blog/tags/reprap/index.html @@ -527,7 +527,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

2017

January (1)
January (2)

@@ -795,7 +795,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -825,7 +825,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -843,7 +843,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -851,7 +851,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -879,9 +879,9 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

@@ -893,7 +893,7 @@ hÃ¥per det ikke gÃ¥r tapt pÃ¥ samme vis.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/rfid/index.html b/blog/tags/rfid/index.html index 23c7041f7a..1c03a69acc 100644 --- a/blog/tags/rfid/index.html +++ b/blog/tags/rfid/index.html @@ -431,7 +431,7 @@ mer om de nye biometriske passene.

2017

January (1)
January (2)

@@ -699,7 +699,7 @@ mer om de nye biometriske passene.

@@ -729,7 +729,7 @@ mer om de nye biometriske passene.

@@ -747,7 +747,7 @@ mer om de nye biometriske passene.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -755,7 +755,7 @@ mer om de nye biometriske passene.

@@ -783,9 +783,9 @@ mer om de nye biometriske passene.

@@ -797,7 +797,7 @@ mer om de nye biometriske passene.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/robot/index.html b/blog/tags/robot/index.html index 9bfd2c3402..ebb4951b69 100644 --- a/blog/tags/robot/index.html +++ b/blog/tags/robot/index.html @@ -537,7 +537,7 @@ firmwaren. :)

2017

January (1)
January (2)

@@ -805,7 +805,7 @@ firmwaren. :)

@@ -835,7 +835,7 @@ firmwaren. :)

@@ -853,7 +853,7 @@ firmwaren. :)

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -861,7 +861,7 @@ firmwaren. :)

@@ -889,9 +889,9 @@ firmwaren. :)

@@ -903,7 +903,7 @@ firmwaren. :)

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/rss/index.html b/blog/tags/rss/index.html index 87f6abaa2c..68c344841e 100644 --- a/blog/tags/rss/index.html +++ b/blog/tags/rss/index.html @@ -54,7 +54,7 @@ forsÃ¸k.

2017

January (1)
January (2)

@@ -322,7 +322,7 @@ forsÃ¸k.

@@ -352,7 +352,7 @@ forsÃ¸k.

@@ -370,7 +370,7 @@ forsÃ¸k.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -378,7 +378,7 @@ forsÃ¸k.

@@ -406,9 +406,9 @@ forsÃ¸k.

@@ -420,7 +420,7 @@ forsÃ¸k.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/ruter/index.html b/blog/tags/ruter/index.html index 5f6a3505fe..1d459c14b7 100644 --- a/blog/tags/ruter/index.html +++ b/blog/tags/ruter/index.html @@ -273,7 +273,7 @@ OsloomrÃ¥det.

2017

January (1)
January (2)

@@ -541,7 +541,7 @@ OsloomrÃ¥det.

@@ -571,7 +571,7 @@ OsloomrÃ¥det.

@@ -589,7 +589,7 @@ OsloomrÃ¥det.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -597,7 +597,7 @@ OsloomrÃ¥det.

@@ -625,9 +625,9 @@ OsloomrÃ¥det.

@@ -639,7 +639,7 @@ OsloomrÃ¥det.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/scraperwiki/index.html b/blog/tags/scraperwiki/index.html index 9069c3de0f..45bfb56b1b 100644 --- a/blog/tags/scraperwiki/index.html +++ b/blog/tags/scraperwiki/index.html @@ -143,7 +143,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

2017

January (1)
January (2)

@@ -411,7 +411,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

@@ -441,7 +441,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

@@ -459,7 +459,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -467,7 +467,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

@@ -495,9 +495,9 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

@@ -509,7 +509,7 @@ av Ã¥ dele informasjon med andre uten bruksbegresninger.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/sikkerhet/index.html b/blog/tags/sikkerhet/index.html index a1e69f0853..4f773d72d8 100644 --- a/blog/tags/sikkerhet/index.html +++ b/blog/tags/sikkerhet/index.html @@ -4250,7 +4250,7 @@ betydelige.

2017

January (1)
January (2)

@@ -4518,7 +4518,7 @@ betydelige.

@@ -4548,7 +4548,7 @@ betydelige.

@@ -4566,7 +4566,7 @@ betydelige.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -4574,7 +4574,7 @@ betydelige.

@@ -4602,9 +4602,9 @@ betydelige.

@@ -4616,7 +4616,7 @@ betydelige.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/sitesummary/index.html b/blog/tags/sitesummary/index.html index 366012e189..f80921e7df 100644 --- a/blog/tags/sitesummary/index.html +++ b/blog/tags/sitesummary/index.html @@ -259,7 +259,7 @@ everything is taken care of.

2017

January (1)
January (2)

@@ -527,7 +527,7 @@ everything is taken care of.

@@ -557,7 +557,7 @@ everything is taken care of.

@@ -575,7 +575,7 @@ everything is taken care of.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -583,7 +583,7 @@ everything is taken care of.

@@ -611,9 +611,9 @@ everything is taken care of.

@@ -625,7 +625,7 @@ everything is taken care of.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/skepsis/index.html b/blog/tags/skepsis/index.html index 6f14c0761d..3e8011d566 100644 --- a/blog/tags/skepsis/index.html +++ b/blog/tags/skepsis/index.html @@ -439,7 +439,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

2017

January (1)
January (2)

@@ -707,7 +707,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -737,7 +737,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -755,7 +755,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -763,7 +763,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -791,9 +791,9 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -805,7 +805,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/standard/index.html b/blog/tags/standard/index.html index 41ecf678ab..50fdbcdd57 100644 --- a/blog/tags/standard/index.html +++ b/blog/tags/standard/index.html @@ -4652,7 +4652,7 @@ Kjenner kun til ufullstendige lÃ¸sninger for slikt.

2017

January (1)
January (2)

@@ -4920,7 +4920,7 @@ Kjenner kun til ufullstendige lÃ¸sninger for slikt.

@@ -4950,7 +4950,7 @@ Kjenner kun til ufullstendige lÃ¸sninger for slikt.

@@ -4968,7 +4968,7 @@ Kjenner kun til ufullstendige lÃ¸sninger for slikt.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -4976,7 +4976,7 @@ Kjenner kun til ufullstendige lÃ¸sninger for slikt.

@@ -5004,9 +5004,9 @@ Kjenner kun til ufullstendige lÃ¸sninger for slikt.

@@ -5018,7 +5018,7 @@ Kjenner kun til ufullstendige lÃ¸sninger for slikt.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/stavekontroll/index.html b/blog/tags/stavekontroll/index.html index 296a73a547..8218386d88 100644 --- a/blog/tags/stavekontroll/index.html +++ b/blog/tags/stavekontroll/index.html @@ -376,7 +376,7 @@ stavekontrollen.

2017

January (1)
January (2)

@@ -644,7 +644,7 @@ stavekontrollen.

@@ -674,7 +674,7 @@ stavekontrollen.

@@ -692,7 +692,7 @@ stavekontrollen.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -700,7 +700,7 @@ stavekontrollen.

@@ -728,9 +728,9 @@ stavekontrollen.

@@ -742,7 +742,7 @@ stavekontrollen.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/stortinget/index.html b/blog/tags/stortinget/index.html index 3ac4e3e693..b4c483bd2c 100644 --- a/blog/tags/stortinget/index.html +++ b/blog/tags/stortinget/index.html @@ -20,6 +20,173 @@

Entries tagged "stortinget".

+ Where did that package go? — geolocated IP traceroute +

+ 9th January 2017 +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Alle Stortingets mobiltelefoner kontrolleres fra USA... @@ -910,7 +1077,7 @@ at vi i NUUG har fÃ¥tt operativ en norsk utgave av

2017

January (1)
January (2)

@@ -1178,7 +1345,7 @@ at vi i NUUG har fÃ¥tt operativ en norsk utgave av

@@ -1208,7 +1375,7 @@ at vi i NUUG har fÃ¥tt operativ en norsk utgave av

@@ -1226,7 +1393,7 @@ at vi i NUUG har fÃ¥tt operativ en norsk utgave av

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1234,7 +1401,7 @@ at vi i NUUG har fÃ¥tt operativ en norsk utgave av

@@ -1262,9 +1429,9 @@ at vi i NUUG har fÃ¥tt operativ en norsk utgave av

@@ -1276,7 +1443,7 @@ at vi i NUUG har fÃ¥tt operativ en norsk utgave av

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/stortinget/stortinget.rss b/blog/tags/stortinget/stortinget.rss index 2f4aae49da..0b90ea1089 100644 --- a/blog/tags/stortinget/stortinget.rss +++ b/blog/tags/stortinget/stortinget.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Alle Stortingets mobiltelefoner kontrolleres fra USA... http://people.skolelinux.org/pere/blog/Alle_Stortingets_mobiltelefoner_kontrolleres_fra_USA___.html diff --git a/blog/tags/surveillance/index.html b/blog/tags/surveillance/index.html index 6e3da03101..c78b056aaa 100644 --- a/blog/tags/surveillance/index.html +++ b/blog/tags/surveillance/index.html @@ -20,6 +20,173 @@

Entries tagged "surveillance".

+ Where did that package go? — geolocated IP traceroute +

+ 9th January 2017 +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Er lover brutt nÃ¥r personvernpolicy ikke stemmer med praksis? @@ -4070,7 +4237,7 @@ automatisk over i spesialkartet.

2017

January (1)
January (2)

@@ -4338,7 +4505,7 @@ automatisk over i spesialkartet.

@@ -4368,7 +4535,7 @@ automatisk over i spesialkartet.

@@ -4386,7 +4553,7 @@ automatisk over i spesialkartet.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -4394,7 +4561,7 @@ automatisk over i spesialkartet.

@@ -4422,9 +4589,9 @@ automatisk over i spesialkartet.

@@ -4436,7 +4603,7 @@ automatisk over i spesialkartet.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/surveillance/surveillance.rss b/blog/tags/surveillance/surveillance.rss index bbb9a55d65..cac858c405 100644 --- a/blog/tags/surveillance/surveillance.rss +++ b/blog/tags/surveillance/surveillance.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Er lover brutt nÃ¥r personvernpolicy ikke stemmer med praksis? http://people.skolelinux.org/pere/blog/Er_lover_brutt_n_r_personvernpolicy_ikke_stemmer_med_praksis_.html diff --git a/blog/tags/sysadmin/index.html b/blog/tags/sysadmin/index.html index 87f1af0a29..c390d2aac0 100644 --- a/blog/tags/sysadmin/index.html +++ b/blog/tags/sysadmin/index.html @@ -212,7 +212,7 @@ and DHCP updates I wanted to do.

2017

January (1)
January (2)

@@ -480,7 +480,7 @@ and DHCP updates I wanted to do.

@@ -510,7 +510,7 @@ and DHCP updates I wanted to do.

@@ -528,7 +528,7 @@ and DHCP updates I wanted to do.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -536,7 +536,7 @@ and DHCP updates I wanted to do.

@@ -564,9 +564,9 @@ and DHCP updates I wanted to do.

@@ -578,7 +578,7 @@ and DHCP updates I wanted to do.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/usenix/index.html b/blog/tags/usenix/index.html index 6b081d9da3..2b342a3f25 100644 --- a/blog/tags/usenix/index.html +++ b/blog/tags/usenix/index.html @@ -229,7 +229,7 @@ for other sites to consider too?

2017

January (1)
January (2)

@@ -497,7 +497,7 @@ for other sites to consider too?

@@ -527,7 +527,7 @@ for other sites to consider too?

@@ -545,7 +545,7 @@ for other sites to consider too?

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -553,7 +553,7 @@ for other sites to consider too?

@@ -581,9 +581,9 @@ for other sites to consider too?

@@ -595,7 +595,7 @@ for other sites to consider too?

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/valg/index.html b/blog/tags/valg/index.html index a282512ec1..ce7dda1e79 100644 --- a/blog/tags/valg/index.html +++ b/blog/tags/valg/index.html @@ -941,7 +941,7 @@ inneholdt i Iran hvis de ikke hadde hemmelige valg?

2017

January (1)
January (2)

@@ -1209,7 +1209,7 @@ inneholdt i Iran hvis de ikke hadde hemmelige valg?

@@ -1239,7 +1239,7 @@ inneholdt i Iran hvis de ikke hadde hemmelige valg?

@@ -1257,7 +1257,7 @@ inneholdt i Iran hvis de ikke hadde hemmelige valg?

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -1265,7 +1265,7 @@ inneholdt i Iran hvis de ikke hadde hemmelige valg?

@@ -1293,9 +1293,9 @@ inneholdt i Iran hvis de ikke hadde hemmelige valg?

@@ -1307,7 +1307,7 @@ inneholdt i Iran hvis de ikke hadde hemmelige valg?

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/video/index.html b/blog/tags/video/index.html index ff90172bad..36c334e8e3 100644 --- a/blog/tags/video/index.html +++ b/blog/tags/video/index.html @@ -4914,7 +4914,7 @@ larger stick as well.

2017

January (1)
January (2)

@@ -5182,7 +5182,7 @@ larger stick as well.

@@ -5212,7 +5212,7 @@ larger stick as well.

@@ -5230,7 +5230,7 @@ larger stick as well.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -5238,7 +5238,7 @@ larger stick as well.

@@ -5266,9 +5266,9 @@ larger stick as well.

@@ -5280,7 +5280,7 @@ larger stick as well.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/vitenskap/index.html b/blog/tags/vitenskap/index.html index 2ab56134de..e4db40eb57 100644 --- a/blog/tags/vitenskap/index.html +++ b/blog/tags/vitenskap/index.html @@ -395,7 +395,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

2017

January (1)
January (2)

@@ -663,7 +663,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -693,7 +693,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -711,7 +711,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -719,7 +719,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -747,9 +747,9 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

@@ -761,7 +761,7 @@ skyskrapere. Takke meg til en tur til mÃ¥nen.

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/web/index.html b/blog/tags/web/index.html index 7e0531fae3..52fab86c13 100644 --- a/blog/tags/web/index.html +++ b/blog/tags/web/index.html @@ -20,6 +20,173 @@

Entries tagged "web".

+ Where did that package go? — geolocated IP traceroute +

+ 9th January 2017 +

+traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets
+ 1  uio-gw10.uio.no (129.240.202.1)  0.447 ms  0.486 ms  0.621 ms
+ 2  uio-gw8.uio.no (129.240.24.229)  0.467 ms  0.578 ms  0.675 ms
+ 3  oslo-gw1.uninett.no (128.39.65.17)  0.385 ms  0.373 ms  0.358 ms
+ 4  te3-1-2.br1.fn3.as2116.net (193.156.90.3)  1.174 ms  1.172 ms  1.153 ms
+ 5  he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48)  3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234)  2.857 ms
+ 6  ae1.ar8.oslosda310.as2116.net (195.0.242.39)  0.662 ms  0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23)  0.622 ms
+ 7  89.191.10.146 (89.191.10.146)  0.931 ms  0.917 ms  0.955 ms
+ 8  * * *
+ 9  * * *
+[...]
+

+ +

PS: KML files are drawn using +the KML viewer from Ivan +Rublev , as it was less cluttered than the local Linux application +Marble. There are heaps of other options too.

+ +

+ + + Tags: debian, kart, nuug, personvern, stortinget, surveillance, web. + + +

Nedlasting fra NRK, som Matroska med undertekster @@ -3478,7 +3645,7 @@ be the only one fitting our needs. :/

2017

January (1)
January (2)

@@ -3746,7 +3913,7 @@ be the only one fitting our needs. :/

@@ -3776,7 +3943,7 @@ be the only one fitting our needs. :/

@@ -3794,7 +3961,7 @@ be the only one fitting our needs. :/

norsk (285)

nuug (182)

nuug (183)

offentlig innsyn (26)

@@ -3802,7 +3969,7 @@ be the only one fitting our needs. :/

@@ -3830,9 +3997,9 @@ be the only one fitting our needs. :/

@@ -3844,7 +4011,7 @@ be the only one fitting our needs. :/

vitenskap (4)

web (38)

web (39)

diff --git a/blog/tags/web/web.rss b/blog/tags/web/web.rss index 4ac97d6ec0..94a48916de 100644 --- a/blog/tags/web/web.rss +++ b/blog/tags/web/web.rss @@ -6,6 +6,161 @@ http://people.skolelinux.org/pere/blog/ + + Where did that package go? — geolocated IP traceroute + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + http://people.skolelinux.org/pere/blog/Where_did_that_package_go___mdash__geolocated_IP_traceroute.html + Mon, 9 Jan 2017 12:20:00 +0100 + Did you ever wonder where the web trafic really flow to reach the +web servers, and who own the network equipment it is flowing through? +It is possible to get a glimpse of this from using traceroute, but it +is hard to find all the details. Many years ago, I wrote a system to +map the Norwegian Internet (trying to figure out if our plans for a +network game service would get low enough latency, and who we needed +to talk to about setting up game servers close to the users. Back +then I used traceroute output from many locations (I asked my friends +to run a script and send me their traceroute output) to create the +graph and the map. The output from traceroute typically look like +this: + +<pre> +traceroute to www.stortinget.no (85.88.67.10), 30 hops max, 60 byte packets + 1 uio-gw10.uio.no (129.240.202.1) 0.447 ms 0.486 ms 0.621 ms + 2 uio-gw8.uio.no (129.240.24.229) 0.467 ms 0.578 ms 0.675 ms + 3 oslo-gw1.uninett.no (128.39.65.17) 0.385 ms 0.373 ms 0.358 ms + 4 te3-1-2.br1.fn3.as2116.net (193.156.90.3) 1.174 ms 1.172 ms 1.153 ms + 5 he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.627 ms he16-1-1.cr2.oslosda310.as2116.net (195.0.244.48) 3.172 ms he16-1-1.cr1.san110.as2116.net (195.0.244.234) 2.857 ms + 6 ae1.ar8.oslosda310.as2116.net (195.0.242.39) 0.662 ms 0.637 ms ae0.ar8.oslosda310.as2116.net (195.0.242.23) 0.622 ms + 7 89.191.10.146 (89.191.10.146) 0.931 ms 0.917 ms 0.955 ms + 8 * * * + 9 * * * +[...] +</pre> + +This show the DNS names and IP addresses of (at least some of the) +network equipment involved in getting the data traffic from me to the +www.stortinget.no server, and how long it took in milliseconds for a +package to reach the equipment and return to me. Three packages are +sent, and some times the packages do not follow the same path. This +is shown for hop 5, where three different IP addresses replied to the +traceroute request. + +There are many ways to measure trace routes. Other good traceroute +implementations I use are traceroute (using ICMP packages) mtr (can do +both ICMP, UDP and TCP) and scapy (python library with ICMP, UDP, TCP +traceroute and a lot of other capabilities). All of them are easily +available in <a href="https://www.debian.org/">Debian</a>. + +This time around, I wanted to know the geographic location of +different route points, to visualize how visiting a web page spread +information about the visit to a lot of servers around the globe. The +background is that a web site today often will ask the browser to get +from many servers the parts (for example HTML, JSON, fonts, +JavaScript, CSS, video) required to display the content. This will +leak information about the visit to those controlling these servers +and anyone able to peek at the data traffic passing by (like your ISP, +the ISPs backbone provider, FRA, GCHQ, NSA and others). + +Lets pick an example, the Norwegian parliament web site +www.stortinget.no. It is read daily by all members of parliament and +their staff, as well as political journalists, activits and many other +citizens of Norway. A visit to the www.stortinget.no web site will +ask your browser to contact 8 other servers: ajax.googleapis.com, +insights.hotjar.com, script.hotjar.com, static.hotjar.com, +stats.g.doubleclick.net, www.google-analytics.com, +www.googletagmanager.com and www.netigate.se. I extracted this by +asking <a href="http://phantomjs.org/">PhantomJS</a> to visit the +Stortinget web page and tell me all the URLs PhantomJS downloaded to +render the page (in HAR format using +<a href="https://github.com/ariya/phantomjs/blob/master/examples/netsniff.js">their +netsniff example</a>. I am very grateful to Gorm for showing me how +to do this). My goal is to visualize network traces to all IP +addresses behind these DNS names, do show where visitors personal +information is spread when visiting the page. + +<a href="www.stortinget.no-geoip.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geoip-small.png" alt="map of combined traces for URLs used by www.stortinget.no using GeoIP"/></a> + +When I had a look around for options, I could not find any good +free software tools to do this, and decided I needed my own traceroute +wrapper outputting KML based on locations looked up using GeoIP. KML +is easy to work with and easy to generate, and understood by several +of the GIS tools I have available. I got good help from by NUUG +colleague Anders Einar with this, and the result can be seen in +<a href="https://github.com/petterreinholdtsen/kmltraceroute">my +kmltraceroute git repository</a>. Unfortunately, the quality of the +free GeoIP databases I could find (and the for-pay databases my +friends had access to) is not up to the task. The IP addresses of +central Internet infrastructure would typically be placed near the +controlling companies main office, and not where the router is really +located, as you can see from <a href="www.stortinget.no-geoip.kml">the +KML file I created</a> using the GeoLite City dataset from MaxMind. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy-small.png" alt="scapy traceroute graph for URLs used by www.stortinget.no"/></a> + +I also had a look at the visual traceroute graph created by +<a href="http://www.secdev.org/projects/scapy/">the scrapy project</a>, +showing IP network ownership (aka AS owner) for the IP address in +question. +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-scapy.svg">The +graph display a lot of useful information about the traceroute in SVG +format</a>, and give a good indication on who control the network +equipment involved, but it do not include geolocation. This graph +make it possible to see the information is made available at least for +UNINETT, Catchcom, Stortinget, Nordunet, Google, Amazon, Telia, Level +3 Communications and NetDNA. + +<a href="https://geotraceroute.com/index.php?node=4&host=www.stortinget.no"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-small.png" alt="example geotraceroute view for www.stortinget.no"/></a> + +In the process, I came across the +<a href="https://geotraceroute.com/">web service GeoTraceRoute</a> by +Salim Gasmi. Its methology of combining guesses based on DNS names, +various location databases and finally use latecy times to rule out +candidate locations seemed to do a very good job of guessing correct +geolocation. But it could only do one trace at the time, did not have +a sensor in Norway and did not make the geolocations easily available +for postprocessing. So I contacted the developer and asked if he +would be willing to share the code (he refused until he had time to +clean it up), but he was interested in providing the geolocations in a +machine readable format, and willing to set up a sensor in Norway. So +since yesterday, it is possible to run traces from Norway in this +service thanks to a sensor node set up by +<a href="https://www.nuug.no/">the NUUG assosiation</a>, and get the +trace in KML format for further processing. + +<a href="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.kml"><img +src="http://people.skolelinux.org/pere/blog/images/2017-01-09-www.stortinget.no-geotraceroute-kml-join.png" alt="map of combined traces for URLs used by www.stortinget.no using geotraceroute"/></a> + +Here we can see a lot of trafic passes Sweden on its way to +Denmark, Germany, Holland and Ireland. Plenty of places where the +Snowden confirmations verified the traffic is read by various actors +without your best interest as their top priority. + +Combining KML files is trivial using a text editor, so I could loop +over all the hosts behind the urls imported by www.stortinget.no and +ask for the KML file from geotraceroute, and create a combined KML +file with all the traces (unfortunately only one of the IP addresses +behind the DNS name is traced this time. To get them all, one would +have to request traces using IP number instead of DNS names from +geotraceroute). That might be the next step in this project. + +Armed with these tools, I find it a lot easier to figure out where +the IP traffic moves and who control the boxes involved in moving it. +And every time the link crosses for example the Swedish border, we can +be sure Swedish Signal Intelligence (FRA) is listening, as GCHQ do in +Britain and NSA in USA and cables around the globe. (Hm, what should +we tell them? :) Keep that in mind if you ever send anything +unencrypted over the Internet. + +PS: KML files are drawn using +<a href="http://ivanrublev.me/kml/">the KML viewer from Ivan +Rublev<a/>, as it was less cluttered than the local Linux application +Marble. There are heaps of other options too. + + + Nedlasting fra NRK, som Matroska med undertekster http://people.skolelinux.org/pere/blog/Nedlasting_fra_NRK__som_Matroska_med_undertekster.html

+ Petter Reinholdtsen + +

Archive

Tags

Entries from January 2017.

Entries tagged "debian".

Entries tagged "kart".

Entries tagged "nuug".

Entries tagged "personvern".

Entries tagged "stortinget".

Entries tagged "surveillance".

Entries tagged "web".