Planet SoC -

Government wants good hash

uhoreg — Fri, 07 Nov 2008 23:09:00 +0100

No, not that kind of hash. The NIST is holding a contest for a
new cryptographic hash function.
Vulnerabilities have been found in the most commonly used hash functions, MD5
and SHA-1, and the contest is for the new SHA-3 standard. The deadline for
submissions was last Friday, so if you missed it, too bad.

Schneier et al. have submitted their algorithm, called
skein, and Rivest et al. have submitted
MD6.

The NIST held a similar contest several years back for encryption algorithms,
which resulted in Rijndael being officially named as the Advanced Encryption
Standard. That contest took 5 years. We’ll see how long this one takes.
Hashing is generally less well-understood, and harder to do, than encryption.

Open Knowledge Technologies

uhoreg — Thu, 06 Nov 2008 23:11:00 +0100

personal, jobs, technical
17:11 -0500

It’s probably about time that I blogged about this…

Starting last week Tuesday (October 28), I started working at
Open Knowledge Technologies (a.k.a. OKTech). They
mainly do custom development on Moodle, which is an
online learning/education platform.

Moodle is free/open source software, which is great because I actually get paid
to work on free software. If that doesn’t make sense to you, well, it actually
works quite well in this case. Moodle is free, which means that anyone can
take it an run it and/or modify it. However, in the educational setting,
there’s a lot of variety in needs, without (usually) the technical skills to
customize, and so there’s a lot of demand for custom development. The free
nature of Moodle means that an educational organization can hire anyone to do
the customization work, which is good for them. It’s also good for companies
like OKTech, because it lowers the barrier to entry. Instead of needing to
write your own online learning platform, you have all the hard, boring stuff
(or at least a good chunk of it) done for you already, and you can focus on
the customization that’s needed.

Server down, starting from scratch

uhoreg — Mon, 13 Oct 2008 19:50:00 +0200

personal, technical
13:50 -0400

It appears that on October 8,
VPSVille got hacked,
which resulted in data loss for many of their customers, including me. I have
a copy of my own website, since I edit it on my own computer, then copy it to
my server, but a lot of other stuff has been lost, including my brother’s
website.

I am in the process of setting up a new server, this time at
UltraHosting, but it’s taking a while, since
I’ve lost all my configuration. Last time I set up a new server, I had my old
server up, so I could just copy the configuration. I’m starting first with
getting my email up, then the web server, then Jabber, and then my version
control. It looks like email is by far the most complicated, because of all
the filtering that needs to be done. The web server is probably the simplest.

Honestly, I’m a bit disappointed that I had to switch hosts. VPSVille seems
like a good host. They have a nice control panel that lets me shut off the
firewall in case I lock myself out, reboot my server, set up my PTR record,
etc. UltraHosting’s control panel gives me… information on my order, and
profile information. But it seems like VPSVille is too inexperienced yet, and
they’re expanding at an insane rate. Personally, I’d give them a couple of
years, and then maybe try them again.

As for myself, I’m going to keep backups of everything on my server from now
on. (I’m working on my own backup software. More on that later.)

Data mining can't identify terrorists

uhoreg — Wed, 08 Oct 2008 02:11:00 +0200

bookmark, news, security, privacy
20:11 -0400

URL:: http://news.cnet.com/8301-13578_3-10059987-38.html?part=rss&subj=news&tag=2547-1_3-0-20
Tags:: news, security, privacy

(see also: /.)

The National Research Council has released a 352-page report that tells us what
most of us knew already: trying to use data mining to find bad guys doesn’t
work very well. The problem being that there are too many false positives.

Whether or not this will actually stop anyone from trying to do it anyways
remains to be seen.

Speeqe to me

uhoreg — Fri, 03 Oct 2008 02:38:00 +0200

bookmark, technical, jabber
20:38 -0400

URL:: http://www.speeqe.com/
Tags:: technical, jabber

Web-based chatrooms. Thanks to the magic of
XMPP/Jabber, BOSH, JavaScript, etc. it works just like
regular chatrooms, except that it’s all in the comfort of your web browser.
You can create your own room, set themes, etc. You can even join Jabber
conference rooms on other servers.

It’s somewhat similar to an idea that I had, except that I’m not sure that the
traditional chatroom format is what people want. But I could be wrong. (Who
am I to tell people what they want.)

Nevertheless, it illustrates how XMPP can make the web more dynamic and
interactive. Like my Talk-to-me web chat. And it
looks like the Jabber website will soon have more
lively content.

(Speeqe is also
Free/Open Source, so
you can, among other things, download it and run your own server, and modify it
to your heart’s content. (As long as you follow the licensing terms.))

Elvis sighted in Netherlands

uhoreg — Thu, 02 Oct 2008 18:52:00 +0200

news, technical, security
12:52 -0400

URL:: http://blog.thc.org/index.php?/archives/4-The-Risk-of-ePassports-and-RFID.html
Tags:: news, technical, security

(see also:
PC Pro,
/.)

At least, Elvis’ passport was sighted. And despite being dead, Elvis managed
to get a new “un-forgeable” RFID passport.

Security researchers managed to modify an RFID-based passport so that it seems
to belong to “Elvis Aaron Presley,” complete with photo.

The problem is not so much with the ability to forge passports, but rather with
the claims that they are un-forgeable, and the false sense of security. If
security personnel believe that the passports are un-forgeable, then we
actually become less secure because of it.

Talk to me

uhoreg — Fri, 26 Sep 2008 22:44:00 +0200

technical, jabber, personal
16:44 -0400

I have created a new project, which I have dubbed
“Talk-to-me”, which is a web-based instant
messaging client designed for the sole purpose of enabling website visitors to,
well, talk to me via my Jabber account. Well, not to me, per se. I’m
not conceited enough to think that anyone would want to talk to me… But
perhaps there are others out there who are.

In fact, the main reason that I wrote it was that it could be one half of a
live chat system for companies. With a correct back end, it could be used to
allow website visitors to chat with sales/support/etc. staff. Without going
into too many details, the backend would be a double-headed bot, where the
forward-facing end would talk to the web client, and the backward-facing end
would … do something, which would depend on how you want the system set up,
to distribute the chat requests between staff. Probably the best way would be
to use MUC somehow, so that
multiple staff members could talk to the same client. But I won’t go into much
detail, because for one thing, there are so many ways to do it, and, for
another thing, I’d much rather code it than to write about it.

(I’ve been (re-)reading The Chronicles of Narnia, and I think it’s affected
my writing style a bit. Well, as much as Lewis can affect your writing style
when you’re talking about coding…)

mDNS/Bonjour over OpenVPN without bridging.

uhoreg — Fri, 12 Sep 2008 22:33:00 +0200

technical, networking
16:33 -0400

Apparently, Apple’s Bonjour (a.k.a. mDNS/ZeroConf/Rendezvous) does not work
over OpenVPN’s default configuration (as much as
OpenVPN can be said to have a default configuration); mDNS does not work over a
point-to-point IP tunnel.

But you don’t need to use Ethernet Bridging
to get it to work - as long as the only Bonjour-advertised services that you
want to use are on the OpenVPN server. Just use “dev tap” instead of
“dev tun” in both the server and client configuration files. This
will make OpenVPN use a level 2 device instead of level 3, which Bonjour is
happy to use.

If you want to use Bonjour services that are not on your OpenVPN server, you
may or may not be able to use
mbridge on the OpenVPN
server to do this. I haven’t tried it yet, as I don’t need it yet.

We Survived New York

uhoreg — Sun, 03 Aug 2008 02:35:00 +0200

personal
20:35 -0400

We got back from our travels on Thursday. New York was
crowded, busy, noisy,… While we were there, we (in semi-random order):

saw Mamma-Mia! on Broadway. It was a lot of
fun, especially if you like ABBA. I was told that the movie version is good
too.
saw the Metropolitan Museum of Art. Big, lots
of stuff. We saw less than half of it, and a bunch of it was being renovated.
We also went to the cloisters, which is
part of the museum, but located at the northern tip of Manhattan Island. It’s
probably one of the quieter parts of the island.
saw the Statue of Liberty from afar (from Battery Park). You aren’t allowed
to go up to the top of the statue any more, so there’s not much point in taking
the ferry to Liberty Island. You’d only be able to go into the museum at the
base, after going through a security search.
saw the Brooklyn Bridge.
walked through Central Park.
ate New York cheesecake, bagels, hotdogs from a street vendor, and deli
sandwiches, the food.
visited the Chelsea Market. It wasn’t quite the type of market that we
expected.
walked the
labyrinth in Battery Park.
Nobody seems to know about the labyrinth, and it is completely unmarked. It is
right next to Castle Clinton and the Korean War monument, and the street. In
fact, if we didn’t read about it in the magazine on the Amtrak train, we would
never have known about it.
saw Grand Central Terminal.

If you’re ever in New York, don’t even think of driving. The drivers there are
crazy. A MetroCard may be well worth it,
depending on how many days you’re there. We were there for four days, and we
made good use of the card.

Accommodations in New York are expensive. The
bed & breakfast that we stayed at was $150 per
night (private apartment, discounted price because of a cancellation). Hotel
rooms can easily run over $300 per night.

In terms of my interviews, I’ll find out whether or not they like me enough to
hire me in a couple of weeks or so.

Interviews

uhoreg — Thu, 17 Jul 2008 23:33:00 +0200

personal
17:33 -0400

The past week has been fairly crazy. And the next couple of weeks will be
somewhat busy too due to job interviews.

Interviews so far:

AideRSS: a small local startup. It looks like it
would be an interesting place to work, and the people I met there are fairly
nice. Unfortunately, as a startup, I’m not sure how stable it would be, and
they’re looking for Ruby developers, which I am not (yet). If there are any
good Ruby developers out there who want to work at an exciting startup, look
them up.
Synopsys: produces software for designing
microchips, and other related technology. Headquartered in California, with
offices all over. The position that I’m interviewing for is in the Ottawa
area. So far, I’ve done a few phone interviews.
Google: everyone knows about Google. I’m
interviewing for a position at the Waterloo office. So far, I’ve done three
phone interviews, and an in-person interview in the Waterloo office.

Coming up:

Synopsis on Monday July 21 at the Ottawa office. Seven interview sessions in
one day, starting at around 10:00am, until 4:00pm. Wow. Busy day.
Google on Monday, July 28 at the New York office. Three interview sessions.
I haven’t been in New York for a long time, and Amanda’s never been.
Naturally, we’ll have to spend a few days there to see the sights.