NICK JENSEN

Some advice on external hard drives for my technically-inclined dad

2010-02-21T11:37:00.002-05:00

Hmmm... this is something I've been thinking about over the past couple years... in addition to a building desire to build a new desktop, multi-display system.... I consider this sort of thing to be more useful from the network (hence "server-side"), that way all the various laptops/computers in the house can access it centrally and can push their own files themselves. I make heavy use of linux and the ext3 filesystem in my setup to allow for relatively simple things like symlinks (which allow the real file to be stored in a single place, but then have various file "pointers" around in whichever folders and filenames I want that all point back to the same single central file). I also use multiple servers/protocols to get at the files (web-based, ftp, ssh...). Anyway, that's my preference...

For hard drives, I prefer the Samsung Spinpoint's and you can find the best deal on Amazon by searching for "samsung spinpoint sata 3.5" (http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Daps&field-keywords=samsung+spinpoint+sata+3.5&x=0&y=0).

Then for the unit, there are choices. Mostly they consist of: (a) how to connect, i.e. usb, firewire, e-sata, ethernet, etc. I'll point out that I'm still not very impressed with the network interfaces available, and usually I want to do my own thing in that regard... (b) raid options; see the wikipedia article for a quick refresher on raid (especially what it does/doesn't do), generally you'll need to select whether you want aggregation (combine all drives into one logical drive), striping (lose one drive of capacity), or mirroring (lose half the drives of capacity), (c) how many bays, (d) whether they come with drives, in which case they're not usually meant to be serviced by the user; or don't come with drives, possibly offer advanced options in the settings, and allow you to pick the drives you want and service them yourself.

Some good searches:
Amazon "nas 2-bay" http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Delectronics&field-keywords=nas+2-bay&x=0&y=0
Amazon "nas 4-bay" http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Delectronics&field-keywords=nas+4-bay&x=0&y=0
Amazon "linksys nas" (somehow has results from netgear, d-link, hp...) http://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Delectronics&field-keywords=linksys+nas&x=0&y=0

I also like the Wiebetech brand... the ones I've used before were very good quality, much better than the more recognizable consumer brands, but I haven't done a lot of price checking on their consumer models. The bottom 3 models below are Wiebetech's. (http://www.wiebetech.com/)

Here's a couple that might be good for home use...

Linksys by Cisco Network Storage System with 2 Bays (NAS200)

Buy new: ~~$139.99~~ $94.98

2 Bay External Enclosure Sata Raid 0/1 FW800/FW400/ESATA/USB2

Buy new: ~~$499.95~~ $450.04

RTX400H-SV-0 4BAY Sata Jbod Hardend

Buy new: ~~$929.95~~ $706.18

And here's something at the extreme end:

RTX800-IR Raid 8BAY Iscsi 16TB

Buy new: ~~$5,028.11~~ $4,547.99

Shmoocon 2010 Schedule For Mobile Devices

2010-02-03T07:16:00.005-05:00

Edit: tabs fell out, sorry! Download the original file here: shmoocon2010.txt.

Instructions: Select, highlight, copy, paste, save, send to self.

Shmoocon 2010 Schedule For Mobile Devices

http://shmoocon.org
http://shmoocon.org/presentations.html

Time Track Title Presenter(s)

Friday
1230 Registration Opens
1500 Opening Remarks Bruce Potter
1600 GPU vs. CPU Supercomputing Security Shootout Collin Brack
1630 Information disclosure via P2P networks: Why stealing an identity via Gnutella is like clubbing baby seals Larry Pesce, Mick Douglas
1700 Economics of Cyber Crime Peter Guerra
1730 Windows File Pseudonyms Dan Crowley
1800 Learning by Breaking: A New Project for Insecure Web Applications Doug Wilson
1830 Guest Stealing...The VMware Way Justin Morehouse, Tony Flick
1900 Keynote - Closing the TLS Authentication Gap Steve Dispensa and Marsh Ray
2000 Hack or Halo Practice

Saturday
0930 Registration Opens
0945 Administrivia
1000 Build It! Jsunpack-network Edition Release: JavaScript Decoding and Intrusion Detection Blake Hartstein
1000 Break It! The New World of Smartphone Security - What Your iPhone Disclosed About You Trevor Hawthorn
1000 Bring It On! Detection of rogue access points using clock skews: does it really work? Sergey Bratus, Anna Shubina, Chrisil Arackaparambil
1100 Build It! WLCCP - Analysis of a Potentially Flawed Protocol Enno Rey, Oliver Roeschke
1100 Break It! Social Zombies II: Your Friends Need More Brains Tom Eston, Kevin Johnson, Robin Wood
1100 Bring It On! Flying Instruments-Only: Legal and Privacy Issues in Cloud Computing Richard Goldberg
1200 Build It! WiFi Bombs shaken not stirred Kingtuna and TheX1le
1200 Break It! GSM: SRSLY? Chris Paget, Karsten Nohl
1200 Bring It On! Tales from the Crypto G. Mark Hardy
1300 Lunch
1400 Build It! Build your own Predator UAV @ 99.95% Discount Michael Weigand
1400 Break It! How To Be An RSol: Effective Bug Hunting in Solaris Matt Hillman
1400 Bring It On! De Gustibus - Adventures in Hacking Taste Sandy Clark
1500 Build It! Ring -1 vs. Ring -2: Containerizing Malicious SMM Interupt Handlers on AMD-V Peter Markowsky
1500 0Break It! Bluetooth Keyboards: Who Owns Your Keystrokes? Michael Ossmann
1500 Bring It On! Cyborg Information Security: Defense Against the Dark Arts Esteban Gutierrez, Adam Cecchetti
1600 Build It! HoneyM: A Framework For Virtual Mobile Device Honeyclients Karlo Navas, David Brasefield, Nate Grunzweig, TJ OConnor
1600 Break It! BaSO4: A Dynamic Dataflow Analysis Tool for Auditing and Reversing Dion Blazakis
1600 Bring It On! Recovering Evidentiary Artifacts from Virtual Machines and Hypervisor Environments Eric Fiterman
1700 Build It! DIY Hard Drive Diagnostics: Understanding a Broken Drive Scott Moulton
1700 Break It! A Tale of Infrastructural Weaknesses in Distributed Wireless Communication Services Zack Fasel and Matt Jakubowski
1700 Bring It On! The Splendiferous Story of Archive Team and the Rapidly Disappearing Digital Heritage Jason Scott
1830 Hack or Halo
2000 Saturday Night Party @ Club Heaven and Hell

Sunday
0930 Registration Opens
0945 Administrivia
1000 Build It! Blackberry Mobile Spyware - The Monkey Steals the Berries Tyler Shields
1000 Break It! Exposed | More: Attacking the Extended Web Nathan Hamiel
1000 Bring It On! Becoming Jack Flack: Real Life Cloak & Dagger Taylor Banks, Adam Bregenzer
1100 Build It! PCI: An Existential Threat To Security As We Know It Joshua Corman, Michael Dahn, Anton Chuvakin, Jack Daniel
1100 Break It! The Friendly Traitor: Our Software Wants to Kill Us Kevin Johnson, Mike Poor
1100 Bring It On! Back to the Glass House Jim Manley
1200 Build It! 0wn the Con The Shmoo Group
1200 Break It! Cracking the Foundation: Attacking WCF Web Services Brian Holyfield
1200 Bring It On! Pulling the Plug: Security Risks in the Next Generation of Offline Web Applications Michael Sutton
1300 Room Split Break
1330 Better Approaches to Physical Tamper Detection Roger Johnston, Jon Warner
1400 Closing Remarks

old_mcdonald.pl

2010-01-31T20:52:00.002-05:00

# the result of geek dad and daughters doing some good coding work...
use Android;
use Data::Dumper;
my $a = Android->new();
my $animal = $a->getInput('Which animal would you like?');
$animal = $animal->{'result'};
#print Data::Dumper->Dump([$animal], [qw/animal/]);
#die;
my $an = $animal =~ /^[aeiou]/ ? 'an' : 'a';
my $sound = $a->getInput("What sound does $an $animal make?");
$sound = $sound->{'result'};
my ($s1, $s2) = split /\s+/, $sound;
my $song = "Old McDonald had a farm, E I E I O. And on that farm he had $an $animal, E I E I O. With a $sound here, and a $sound there. Here a $s1, there a $s2, everywhere a $sound. Old McDonald had a farm, E I E I O.";
print Data::Dumper->Dump([$animal, $an, $sound, $s1, $s2, $song], [qw/animal an sound s1 s1 song/]);
$a->speak($song);

Desktop Screenshot

2010-01-31T14:33:00.003-05:00

OS: Arch Linux
Window Manager: Fluxbox
Background: a slightly modified version of this image
Apps: Gnome Terminal, GKrellM
Rig: Asus Eeepc 1005HA

How IRC should look

2009-11-29T11:33:00.002-05:00

This is good... I love how Hollywood directors and actors, non-technical managers and the general population are equally afflicted by ADD/ADHD when it comes to describing/understanding technology (even if it's 16 1/2 years old).

Originally Posted by Alexander Færøy on November 12th 2009

It has been brought to our attention that we have done something completely wrong. This is what the upcoming Irssi release is going to look like:

tinyurl + qrcode

2009-11-17T08:00:00.004-05:00

QR-Code Generator

tinyurl.com/nickjensen

Happy 234th Birthday, Marines!

2009-11-10T15:10:00.003-05:00

Oohrah! Errggg.

Podcast rant

2009-11-06T10:24:00.000-05:00

Please ignore if you already listen to podcasts or have a commute less than 15 minutes. All others: start. Really what else do you have to do while driving or riding metro the hours and hours we do every day? True, much of this content is summarized in the show notes, but will your searches find them if you don't know about them? How hard is it to read a webpage while commuting? If you need some recommendations (in other words, which podcasts I'm listening to), please visit http://www.google.com/reader/shared/user%2F03147939074776871853%2Flabel%2Fpodcasts. Another suggestion: learn how to use an RSS feed reader, the text-based version of podcasts.

ping.fm test 2

2009-11-06T07:14:00.001-05:00

body

2009-11-06T07:13:00.001-05:00

ping.fm test

This quote describes some people I know

2009-10-14T06:54:00.001-04:00

Abraham Maslow: If the only tool you have is a hammer, you tend to see every problem as a nail.

Source

My answer to "How do I remove viruses from my computer?" (LinkedIn)

2009-10-14T06:51:00.002-04:00

You don't. Backup any necessary data to network, usb hard drive or optical media. Wipe the drive with something like DBAN. Restore from a known good backup (using Norton Ghost or Acronis) or reinstall the operating system from scratch. Install and update antivirus software. Virus scan the entire drive. Make a known good backup if you don't already have one. Install major applications. Make another known good backup if you don't have one. Restore your data. Virus scan the entire drive again. Ensure that your antivirus software is set to scan upon execution, email plugins enabled, automatic updates enabled. Make another known good backup. If the system ever gets infected again, repeat the process, except restore to a chosen known good backup state to shorten the process without compromising trust in your system.

Source

How to Learn to Program

2009-09-25T08:16:00.003-04:00

On Fri, Sep 25, 2009 XXXXX wrote:
I don't know why I can't learn computer programming from books. I've tried before and there's always something I'm doing wrong. But I know several people who do this for a living.

The method that works for me is:
- Go learn a little bit about the language... enough to have an opinion on its reason for existence, general philosophy, scalability to future ideas, popularity, has a good community, documentation, means to ask for advice, etc. Wikipedia is excellent for this because the articles are fairly broad, not too deep and not too long.
- It's all important, but I think that philosophy is more so... I read a decent article the other day that really explained the difference between "freedom" languages and "safety" languages.
- Try out the hello world example almost every language has, and see if you like how it is
- Second step would be to think of a test problem, or take an existing actual problem, and use that as the reason for learning the language, i.e. read enough at the beginning that you know how to get started... but then stop before you find yourself memorizing useless commands... that's for reference... you think through your specific problem in a programmatic way and then for each step of it, you do some amount of research (reading or googling) to find the best way to do what you want with that language.

For example: Many programs have need of looping mechanism to iterate through a list of things... so you flip to the sections on control statements or looping... you find a "while" loop and a "for" loop. So you read enough to pick between them and press on to the next step.

After several projects, you'll know more and more through direct experience, rather than just book knowledge but you will also be familiar with where in book and online are good places to find answers, and you'll have gained the programs you created. The more the better.

Rules:
- You can bail (give up) on the language at any moment
- You can always return to it later if it meets your needs better down the road
- You can learn/know more than one language; some languages aren't good for certain types of projects
- You can do it on your own schedule... it won't really be a time-saver until you can code something faster than you can do it manually.
- Google it first

An origin example: Python was created by a mathematician and Perl by a pair of linguists. So when it comes to a semantic debate... it is usually won over by the side that makes more sense in the community and mindset and purpose the language was originally intended for. Python will always make more sense to mathematicians and Perl to linguists.

Time-saver example: you need a list of every third number starting at 1, until 1000... (should be in a file list.txt with each line containing one number) three options:
a) manually: open notepad and start typing: 147... , save as list.txt
b) excel: open excel and type in cell a1: 1, go to cell a2 and type: "=a1+3" (w/o quotes), hit enter and up arrow, ctrl+c to copy cell a2, then select cells a3 through somewhere around 333 via select cell a3 and hit pgdn while holding shift several times, and paste (ctrl+v), now highlight back up to the top with shift+pgup's and copy (ctrl+v), open notepad and paste (ctrl+v), save as list.txt.
c) perl: open cmd prompt and type: perl -e "for (1..1000) { next unless $_ % 3 == 1; print \"$_\n\" }" >list.txt
note) step c really also could be accomplished in relatively short syntax by batch, powershell, python, ruby, javascript, java...

I'd always recommend Perl or Python to anyone... some that might be better starting for you because they're more immediately available (ie they're already installed) would be Windows batch scripting and PowerShell (installed if you have Vista or 7, you have to install it on xp, but that's pretty easy).

Concurrently, I'd also recommend you start learning about version control systems like subversion (tortoise-svn is excellent), bazaar-ng, git... also recommend going to wikipedia to get a high level understanding of the strengths and weaknesses of each.

And then, not to be rude or dishelpful... only you know truly what you really want to do... as you've experienced in our recent exchange with $project... you know how tough it is to explain the problem in detail for the programmer to go and write up a program. So, I'd recommend as a general practice, attempting to answer the question or problem first yourself, googling allowed... also might be worthwhile to have a gander at a paper, How to Ask Questions the Smart Way, which really should be required reading for anyone using the Internet.

FREE Switchover to Auto-Renewal (FAIL)

2009-08-24T21:35:00.002-04:00

According to an email my wife received, McAfee's pushing the ol' "it's free to pay me" scheme. FAIL!

Subject: FREE Switchover to Auto-Renewal
Date: Mon, 24 Aug 2009 16:31:11 -0700
From: subscriptions@mcafee.com

Every time you go online, you and your computer are bombarded by a never-ending barrage of new Internet hazards (in fact, a new online threat is discovered every 13 seconds*). You simply can't afford to risk even the briefest lapse in your protection—and now you don't have to, thanks to our foolproof way to stay safe without having to remember to renew.

When you choose our auto-renewal program, you sign up once and then relax while we take care of the rest. Not only do you get continual data updates and product improvements as soon as they're available, we make sure your McAfee SecurityCenter coverage continues seamlessly, every year, for as long as you stay in the program.

Because you rely on your PC, it makes perfect sense to rely on our convenient auto-renewal program. Sign-up is fast, adds no extra cost to your renewal, and is the hassle-free way to know that McAfee will keep protecting you 24/7. Sign up now.

McAfee SecurityCenter

Developed Specifically for your Dell PC
Your protection maximizes security, speed, and seamless operation on your Dell PC.

McAfee Active Protection
Provides the fastest protection against malicious threats to your PC. New threats are analyzed and blocked in milliseconds, rather than hours.

Quick Scan
Checks for threats in the areas of your computer that are attacked most often.

Faster Performance
Runs faster and more efficiently during startup, shutdown, and scanning. SecurityCenter also works silently in the background without interrupting activities or slowing down your PC.

Age-appropriate Searching
Automatically sets the proper content filtering levels of popular search engines.

Enterprise-class Anti-spam
Powerful industry-grade protection helps keep your inbox free from fraudulent and offensive spam and phishing emails.

Stops Viruses
Automatically blocks, cleans, and removes viruses so you can safely surf the web and download files.

Safe Search and Surf
Helps you avoid potentially dangerous websites with color-coded alerts from McAfee SiteAdvisor.

Secures Your Identity
Guards your online identity so you can shop, bank, email, and send and receive instant messages without worry.

Blocks Spyware
Intercepts spyware before it installs on your computer and removes existing spyware.

McAfee Always On Protection

Your security software includes McAfee Always On Protection, a service that automatically renews your annual McAfee subscription before expiration. This ensures that your computer security is never interrupted. The renewal fee is charged to your credit card on file. Without automatic renewal, your PC is not protected against new threats once your subscription expires. You authorize McAfee to renew your subscription. You will be automatically renewed at the then-current renewal rate (billed to the credit card we have on file). If you wish, you may cancel McAfee Always On Protection by contacting McAfee Customer Support here. To confirm your automatic renewal status at your account page, go here.

*Source: McAfee Avert Labs, January-March 2009

This message is being sent to customers who have a current McAfee subscription.

Questions: Please do not reply to this e-mail. For support-related questions, go here.
McAfee Account: If you have a question or concern about your McAfee account, please go here.
Unsubscribe: If you prefer not to receive future email from McAfee, please unsubscribe now.
Subscribe: For help purchasing your McAfee subscription, please call (866) 622-3911.
Legal Note: This software does not guarantee protection against all possible threats. Product featured is a subscription download only and will not be shipped in a box.

View our privacy policy. McAfee, Avert, and SiteAdvisor are registered trademarks or Trademarks of McAfee, Inc. and/or its affiliates in the US and/or other countries. All other registered and unregistered trademarks herein are the sole property of their respective owners.

3965 Freedom Circle, Santa Clara, CA 95054, (866) 622-3911
© 2009, McAfee, Inc. All Rights Reserved.

Computers are our slaves

2009-08-22T08:26:00.003-04:00

Excerpt from an email to a friend re: programming advice...

To me, there are a million ways to do it. It could be done in batch, JavaScript, Java, Perl, BASH, Python, Ruby, C, C++, Lisp, many others or even Microsoft Excel (using functions). The important thing is for me to ask enough questions that I get an idea of the way you currently work it, and write something that takes care of the most mundane and monotonous parts a computer is perfectly capable of handling with minimal impact to you and your computers, and the way you want to work. <philosophical tangent>This idea comes from a deep internal belief that computers are our slaves... yes they need to be properly cared for, and I'm not above a token amount of gratitude... but their job is to do what we tell them. I am above doing something in a way that the computer needs it... but is also laborious to me to no end.</philosophical tangent>

In the spirit of Larry Wall's laziness virtue, the absolute best solution ends with the least effort by the user, programmer and computer. And everyone is happy.

aggregated feed for defcon UPDATED

2009-07-28T18:05:00.000-04:00

So far, I'm aggregating:

DEFCON Announcements!
Twitter / _defcon_
#defcon - Twitter Search
_defcon_'s Recent Qik Videos
Flickr: Recent Uploads tagged defcon17

If you know of or find other ones that should be here, please let me know via comments.

Aggregated feed for defcon: WWW/RSS

aggregated feed for blackhat

2009-07-27T21:15:00.000-04:00

Here's the same idea for Black Hat... so far I'm incorporating:

Twitter / BlackHatEvents
#blackhat - Twitter Search
Black Hat Announcements
Black Hat Webcasts RSS Feed
Flickr photostream
Delicious

Suggest any others via comments!

Aggregated feed for blackhat: WWW/RSS

Workflow

2009-07-25T15:07:00.004-04:00

In reference to previous post, I've begun the process of organizing my RSS feeds. Some of the folder names have changed for consistency's sake... namely those that began with a capital letter. There is a new section on the left side of my blog entitled "RSS Categories" which contains a list of the folders I've set up in Google Reader. For anyone not familiar with Google Reader, folders are like automatic tags. All posts to a particular feed can be assigned to a folder, actually multiple folders. My full OPML can be downloaded for those who'd like to import it into their own feed reader or understand my setup from a top-down view.

iPod Touch Skype phone

2009-07-18T11:56:00.000-04:00

Sweet! I just tested out using my iPod Touch as a Skype phone and it works! I'm using: iPod Touch, Sennheiser MM50 iP Earbuds and the Skype app.

Just added 4 new podcasts (to me anyway)

2009-07-17T23:46:00.003-04:00

The Rear Guard: WWW/RSS
The Command Line: WWW/RSS
EFF Line Noise: WWW/RSS
Linux Outlaws: WWW/RSS

How to escape single quotes in bash

2009-07-16T21:48:00.005-04:00

Short answer is '\''

Example:

echo 'it's' #obvious error
echo 'it\'s' #still no joy
echo 'it'\''s' #ugly as f***, but works as desired

Workflow [EDIT]

2009-07-15T19:26:00.001-04:00

Excerpt from an email I wrote to a friend:

I am convinced that if one wants to collaborate via internet (blog, share news items from feeds, etc), it is essential to find the least intrusive (most natural) way to do it and integrate the method into their workflow. This way the sharing part just works, and I can focus on whatever I'm researching. So for my personal research/collaboration effort, I've been pretty happy with my combination of blogger (for creations of my own design and re-posting), google reader for rss news feeds, and google notebook for sharing various other things I find on the internet. All one needs to do to stay informed of my "public" activites/interests is subscribe to all three feeds (which are linked to at top right on my blog: http://jensen-nick.blogspot.com):

Blog
News (EDIT: fixed link)
Notebook

EDIT: I set up a FriendFeed account today. It basically aggregates the feeds above into just one: RSS/WWW. The one negative is that it summarizes the posts, and you can't see them entirely in your feed aggregator.

EDIT: Found the "folders" feature in Google Reader... which I'm thinking of more as "automatic tagging". For example, I've created three new feeds that are special subset categories of my subscriptions:

CLI One-Liners: WWW/RSS
Leaks: WWW/RSS
Podcasts: WWW/RSS

EDIT: Added two more folders in Google Reader:

alerts: WWW/RSS
dataviz: WWW/RSS

One of these days I'm going to need to properly collect the various resources...

He's Barack Obama

2009-06-20T20:16:00.000-04:00

Try JibJab Sendables® eCards today!

Bruce Lee Ping Pong

2009-05-21T22:01:00.000-04:00

Ubuntu 9.04

2009-04-13T18:39:00.001-04:00

Monty Python scenes now on YouTube!

2009-01-25T10:39:00.002-05:00

The Knights Who Say "Ni!"

Battlestar Galactica Returns Friday @ 10pm EST!

2009-01-13T07:48:00.000-05:00

El baile de Kozo

2008-12-29T04:50:00.001-05:00

40 Inspirational Speeches in 2 Minutes

2008-12-12T20:09:00.001-05:00

Time for Some Campaignin'

2008-11-30T22:14:00.001-05:00

Star Trek vs. Star Wars

2008-11-15T14:37:00.001-05:00

Warner Brothers Tells Harry Potter Fans To F#$% Off

2008-11-15T14:24:00.000-05:00

Quotes: Big Government

2008-11-15T12:03:00.000-05:00

"A government big enough to give you everything you want is a government big enough to take from you everything you have." - Gerald R. Ford

BLACK HAT WASHINGTON DC CFP NOW OPEN

2008-11-11T10:17:00.000-05:00

From an email:

Held February 16-19, 2009 at the Hyatt Regency Crystal City. Black Hat DC is
the leading security conference focused on the needs of government and
infrastructure security professionals, with tracks focused on Hardware and
Embedded Devices, Reverse Engineering and Malware, Client Wars and
Application Security, and Forensics and Network Protection. We hope to see
you there for another highly technical and refreshingly vendor-neutral
event.

Submitters will have until January 1 to get their papers into the Black Hat
CFP system at :
https://www.blackhat.com/html/bh-dc-09/bh-dc-09-cfp.html.

We expect to have the final selections for speakers and trainers made by
January 15, 2009. For those who wish to attend, you can get the best rates
by registering early and online registration is open at:
https://www.blackhat.com/html/bh-registration/bh-registration-dc-09.html

Information about this year's venue can be located on the BH DC 09 venue
page at:
https://www.blackhat.com/html/bh-dc-09/bh-dc-09-venue.html.

Americans With No Abilities Act

2008-11-10T13:20:00.003-05:00

From an email:

The newly-elected Congress will be considering sweeping legislation that will provide new benefits for many Americans. The Americans With No Abilities Act (AWNAA) is being hailed as a major legislative goal by advocates of the millions of Americans who lack any real skills or ambition. "Roughly 50 percent of Americans do not possess the competence and drive necessary to carve out a meaningful role for themselves in society," said the planned legislation's proposer, California Senator Barbara Boxer. "We can no longer stand by and allow People of Inability to be ridiculed and passed over. With this legislation, employers will no longer be able to grant special favors to a small group of workers, simply because they have some idea of what they are doing."

In a Capitol Hill press conference, House Majority Leader Nancy Pelosi (D) and Senate Majority Leader Harry Reid (D) pointed to the success of the U.S. Postal Service, which has a long-standing policy of providing opportunity without regard to performance. Approximately 74 percent of postal employees lack any job skills, making this agency the single largest U.S employer of Persons of Inability. Private-sector industries with good records of non-discrimination against the Inept include retail sales (72%), the airline industry (68%), and home improvement 'warehouse' stores (65%). At the state government level, the Department of Motor Vehicles also has an excellent record of hiring Persons of Inability (63%).

Under The Americans With No Abilities Act, more than 25 million "middle-person" positions will be created, with important-sounding titles but little real responsibility, thus providing an illusory sense of purpose and performance. Mandatory non-performance-based raises and promotions will be given so as to guarantee upward mobility for even the most unremarkable employees.

The legislation provides substantial tax breaks to corporations that promote a significant number of Persons of Inability into middle-management positions, and gives a tax credit to small and medium-sized businesses that agree to hire one clueless worker for every two talented hires. Finally, the AWNAA contains tough new measures to make it more difficult to discriminate against the Non-abled, banning, for example, discriminatory interview questions such as, "Do you have any skills or experience that relate to this job?"

"As a Non-abled person, I can't be expected to keep up with people who have something going for them," said Mary Lou Gertz, who lost her position as a lug-nut twister at the GM plant in Flint, Michigan, due to her inability to remember "rightey tightey, lefty loosey." "This new law should be real good for people like me," Gertz added. With the passage of this bill, Gertz and millions of other untalented citizens will finally see a light at the end of the tunnel.

Said Senator Boxer: "As a Senator with no abilities, I believe the same privileges that elected officials enjoy ought to be extended to every American with no abilities. It is our duty as lawmakers to provide each and every American citizen, regardless of his or her inadequacy, with some sort of space to take up in this great nation and a good salary for doing so."

President-Elect Obama has acknowledged his debt to those who will be qualified under new AWNAA law for their vital, near-100% voting record for him in Tuesday's election. He noted his shared bond with them, as well as his commitment to prompt passage of the new legislation. Senator Reid and Congresswoman Pelosi have assured the President-Elect that its passage in January by the new farther-left Congress is a "done deal".

Obama Win Causes Obsessive Supporters To Realize How Empty Their Lives Are

2008-11-10T06:59:00.001-05:00

Obama Win Causes Obsessive Supporters To Realize How Empty Their Lives Are

Google Visualization API on Google Spreadsheets

2008-11-02T14:21:00.000-05:00

End of The World

2008-10-28T12:48:00.000-04:00

A creative approach to redistribution of wealth

2008-10-24T19:54:00.002-04:00

From an email:

Today on my way to lunch I passed a homeless guy with a sign that read 'Vote Obama, I need the money.' The guy had more guts than a gut factory sitting there showing his support..... but then...

I sat down in the restaurant and my server had on a 'Obama 08' tie, again I smiled as he had given away his political preference -- I wanted to get up and leave, but a flash of insight hit me. I stayed. I could not believe it. I am amongst them.... of all things just imagine the coincidence.

When the bill came I decided not to tip the server and explained to him that I would not tip him because I was exploring the Obama redistribution of wealth concept. He stood there in disbelief while I told him that I was going to redistribute his tip to someone who I deemed more in need--the homeless guy outside. The server angrily cussed me out as a cheap old S.O.B. and stormed from my sight along the way telling the others servers that he just got stiffed by the gray-haired wrinkled old S.O.B. I just smiled and held my Irish Temper.

I went outside, gave the homeless guy a $7.00 and told him to thank the server inside as I've decided he could use the money more. The homeless guy was grateful.

At the end of my rather unscientific redistribution experiment I realized the homeless guy was grateful for the money he did not earn, but the waiter was pretty damm angry that I gave away the money he did earn even though the actual recipient deserved money more.
I guess redistribution of wealth is an easier thing to swallow in concept than in practical application.

OR IS IT......... REDISTRIBUTION OF SOMEONE ELSE'S WEALTH IS A GREAT IDEA.............. or just a fools game!

Schwarzenegger's full view on Palin's readiness

2008-10-24T13:22:00.000-04:00

TFSU... ha ha ha!

2008-10-24T08:07:00.003-04:00

Source

Emperor McCain vs. Jedi Obama

2008-10-22T22:01:00.002-04:00

Ref in on tackle

2008-10-22T09:20:00.000-04:00

Chimpanzee rides Segway

2008-10-20T20:26:00.001-04:00

MobileMe ===> X Exchange

2008-10-20T06:00:00.003-04:00

"This update provides better support for syncing a large number of contacts (more than 2,000) and prevents syncing of data between Microsoft Exchange Server and MobileMe, a configuration that is not supported."

Thoughts:

Well that is a run-on sentence if I ever heard one.
"Prevents syncing"... Can I hear a "Hell, YES!" for interoperability?
"a configuration that is not supported"... and the lame excuse comes out.

When are these people (or the general public) going to realize that proprietary vendors really aren't doing us any favors by trying to force us to use over-complicated applications and protocols that do more to get in your way than help you?

Now there's a run-on for ya!

The Ant and the Grasshopper

2008-10-18T12:28:00.001-04:00

From an email:

TRADITIONAL VERSION:

The ant works hard in the withering heat all summer long, building his house and laying up supplies for the winter. The grasshopper thinks the ant is a fool and laughs and dances and plays the summer away. Come winter, the ant is warm and well fed. The grasshopper has no food or shelter, so he dies out in the cold.

MORAL OF THE STORY: Be responsible for yourself!

MODERN VERSION:

The ant works hard in the withering heat all summer long, building his house and laying up supplies for the winter.

The grasshopper thinks the ant is a fool and laughs and dances and plays the summer away.

Come winter, the shivering grasshopper calls a press conference and demands to know why the ant should be warm and well fed while others are cold and starving.

CBS, NBC, PBS, CNN, and ABC show up to provide pictures of the shivering grasshopper next to a video of the ant in his comfortable home with a table filled with food. America is stunned by the sharp contrast. How can this be, that in a country of such wealth, this poor grasshopper is allowed to suffer so? Kermit the Frog appears on Oprah with the grasshopper, and everybody cries when they sing, "It's Not Easy Being Green." Jesse Jackson stages a demonstration in front of the ant's house where the news stations film the group singing, "We shall overcome." Jesse then has the group kneel down to pray to God for the grasshopper's sake.

Nancy Pelosi, John Kerry & Harry Reid exclaim in an interview with Larry King that the ant has gotten rich off the back of the grasshopper, and both call for an immediate tax hike on the ant to make him pay his fair share.

Finally, the EEOC drafts the Economic Equity and Anti-Grasshopper Act retroactive to the beginning of the summer! The ant is fined for failing to hire a proportionate number of green bugs and, having nothing left to pay his retroactive taxes, his home is confiscated by the government.

Hillary gets her old law firm to represent the grasshopper in a defamation suit against the ant, and the case is tried before a panel of federal judges that Bill Clinton appointed from a list of single-parent welfare recipients. The ant loses the case.

The story ends as we see the grasshopper finishing up the last bits of the ant's food while the government house he is in, which just happens to be the ant's old house, crumbles around him because he doesn't maintain it.

The ant has disappeared in the snow. The grasshopper is found dead in a drug related incident and the house, now abandoned, is taken over by a gang of spiders who terrorize the once peaceful neighborhood.

MORAL OF THE STORY: Be careful how you vote in 2008.

Genuine Windows is Ubuntu

2008-10-16T08:54:00.001-04:00

America's Marines at the Marine Corps Museum

2008-10-11T08:33:00.001-04:00

Vader 2008 Campaign

2008-10-07T12:17:00.001-04:00

Congressional Math in the Bailout

2008-10-07T12:13:00.003-04:00

HeX 2.0, codename "Bonobo" released!

2008-10-06T10:10:00.002-04:00

FYI

---------- Forwarded message ----------

From: Lee Hinman <matthew.hinman@gmail.com>
Date: Sun, Oct 5, 2008 at 10:33 PM
Subject: HeX 2.0, codename "Bonobo" released!
To: HeX liveCD <HeX-liveCD@googlegroups.com>

Hey All,
After 8 months, we're finally releasing HeX 2.0, here's the updated
info, directly from the "What's New" page (https://
trac.security.org.my/hex/wiki/WhatsNew)

ISO links:

http://hexbit.csc.gatech.edu/hex-iso/hex-i386-2.0.iso
http://hexbit.csc.gatech.edu/hex-iso/hex-i386-2.0.iso.md5
http://hexbit.csc.gatech.edu/hex-iso/hex-i386-2.0.iso.sha256

http://us.rawpacket.org/image/hex-i386-2.0.iso
http://us.rawpacket.org/image/hex-i386-2.0.iso.md5
http://us.rawpacket.org/image/hex-i386-2.0.iso.sha256

http://my.rawpacket.org/hex-i386-2.0.iso
http://my.rawpacket.org/hex-i386-2.0.iso.md5
http://my.rawpacket.org/hex-i386-2.0.iso.sha256

HeX System 2.0
Base System
- FreeBSD 7.0 Stable
- Unionfs Integration
- Default ULE scheduler instead of BSD
Application Tweaking
- Fluxbox menu modification and improvement
Menu Tools
aguri
pktstat
isic
silktools
argus3
dhcpdump
ipsectrace
raddump
rtpbreak
tftpgrab
aimage
nast
flowtag
- Shell options - bash/zsh
- Liferea
Security Rss Feeds
- Firefox
Plugin
Foxyproxy
Firebug
Hostipfox
Bookmark
http://www.rawpacket.org
http://www.cyber-ta.org/Honeynet/
http://www.team-cymru.org/?sec=8
http://fixedorbit.com/search.htm
http://www.robtex.com/
http://www.cidr-report.org/as2.0/
http://virustotal.com
http://watchlist.security.org.my/
http://anubis.iseclab.org/
http://www.malwaredomainlist.com/
http://www.spybye.org:8080/stats
http://www.malware.com.br/
http://www.hostip.info/
http://h4k.in/encoding
http://www.isecom.org/research/oprp.shtml
HeX Ports
- Flowtag
- Spybye
- Erlswf(not included)
- Ftester
- Trace-summary
- Pysubnettree
- http://tools.netsa.cert.org/silk/
Yaf
Naf
Fixbuf
Ipa
Airdbc
Airframe
FreeBSD Ports
- rtpbreak
- ruby-tk
- isnprober
- dumpasn1
- ipex
- pdb
- py-pcs
- py-impacket
- raddump
- dhcpdump
- urlendec
- scanhill
- nast
- aslookup
- colordiff
- afflib
- aimage
- evtviewer
- hcidump
- iextract
- recoverdm
NSM-Console updates
- Updated to NSM-Console 0.8-dev
- pcapparser supports NULL ethernet types
- pcapparser supports flag printing
- print command supports printing full packets
- list command supports filtering by enabled/disabled modules
- Added dnstop module
- encode and decode commands now work on files as well as strings
- Added ip2asn module & command
- Added iplist command
- Added ability to pipe output into a command using >, >> and |
- Added yahsnarf module
- Added bro-ids-connection module
And lots more! Check the NSM-Console CHANGELOG in the ~/rp-NSM/nsm-
console/ directory for the full changelog.
Analysis Scripts
- iploc
- aimsnarf
- yahsnarf
- flowtime
Shell Aliases
- base64d and base64e uses openssl to decode base64 string and encode
strings into base64.
- delta reads numbers from standard input and outputs the difference
between the current number and the last number.
- enhex encodes standard in into hex output. [BR]] - unhex decodes hex
input into ascii output.
- ipsort uses the sort command, but has the flags to correctly sort IP
addresses.
- ipusort does the same as ipsort, but it removes duplicates (u =
unique).
- rot13 performs Rot13 on the standard input.
- urlde and urlen perform decoding and encoding of URL escaped
strings.
Shell Scripts
- asn2netblock.sh uses Robtex to translate an ASN number to all the
allocated networks.
- bingrep.pl
- bucketize.pl
- bytefreq.pl
- color_tcpdump.pl
- flow_watch.pl
- int2ip.sh
- ip2int.sh
- pcapcui.pl
- ruscert.sh
- ssh_rate.pl
- zencheck.sh
Tools Signatures
- Fl0p(16 Sigs)
- Pads(12 Sigs)
- TcpXtract?(4 Sigs)
Artworks
- 2 new wallpapers with various resolutions
- 10 new fluxbox styles
IDS Testing Toolkit(not confirmed)
- http://searchsecurity.techtarget.com.au/contents/21190-How-to-test-Snort
- http://dev.inversepath.com/trac/ftester
Windows Based Net Analysis Toolkit(not confirmed)
- Networkminer http://sourceforge.net/projects/networkminer/
- Wireshark http://wireshark.org
- Ntop-xtra http://www.openxtra.co.uk/freestuff/ntop-xtra.php
- Ngrep http://www.packetfactory.net/Projects/Ngrep/
- Windump http://www.winpcap.org/windump/
- Snort http://www.snort.org/dl/binaries/win32/
- Cain&Abel http://www.oxid.it/cain.html
- Ettercap http://ettercap.sourceforge.net/
- York http://www.geocities.com/the_real_sz/misc/york_.htm
HeX Sensor
- sguil
- bro-ids
- ourmon
- nfdump
- nfsen
- flow viewer
- cflowd
- silktools
- argus3

Enjoy!
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "HeX liveCD" group.
To post to this group, send email to HeX-liveCD@googlegroups.com
To unsubscribe from this group, send email to HeX-liveCD+unsubscribe@googlegroups.com
For more options, visit this group at http://groups.google.com/group/HeX-liveCD?hl=en
-~----------~----~----~----~------~----~------~--~---

--
(\) | ( |<
--.- - ..-. .. -- .. -.-
http://jensen-nick.blogspot.com/

Intrepid Countdown

2008-10-04T08:04:00.003-04:00

A good job in America

2008-09-29T08:50:00.002-04:00

From an email:

Joe Smith started the day early having set his alarm clock (MADE IN JAPAN) for 6 am. While his coffeepot (MADE IN CHINA) was perking, he shaved with his electric razor (MADE IN HONG KONG). He put on a dress shirt (MADE IN SRI LANKA), and his designer jeans (MADE IN SINGAPORE) and tennis shoes (MADE IN KOREA). After cooking his breakfast in his new electric skillet (MADE IN INDIA) he sat down with his calculator (MADE in MEXICO) to see how much he could spend today. After setting his watch (MADE IN TAIWAN) to the radio (MADE IN INDIA) he got in his car (MADE IN JAPAN) filled it with GAS (from Saudi Arabia) and continued his search for a good paying AMERICAN JOB. At the end of yet another discouraging and fruitless day checking his computer (Made In Malaysia), Joe decided to relax for a while. He put on his sandals (MADE IN BRAZIL) poured himself a glass of wine (MADE IN FRANCE) and turned on his TV (MADE IN INDONESIA), and then wondered why he can't find a good paying job in AMERICA.

Eddie Izzard- Death Star Canteen

2008-09-28T22:18:00.000-04:00

Monty Python Holy Grail Lego Spoof

2008-09-28T22:17:00.000-04:00

Welcome to the Republican Party

2008-09-17T12:01:00.002-04:00

Re-posting of an email, author unknown:

I asked my friend's little girl what she wanted to be when she grows up. She said she wanted to be President some day.

Both of her parents, liberal Democrats, were standing there, so I asked her, 'If you were President what would be the first thing you would do?' She replied, 'I'd give food and houses to all the homeless people.' 'Wow...what a worthy goal,' I told her, 'You don't have to wait until you're President to do that.

You can come over to my house and mow, pull weeds, and sweep my yard, and I'll pay you $50.

Then I'll take you over to the grocery store where the homeless guy hangs out, and you can give him the $50 to use toward food and a new house.'

She thought that over for a few seconds while her Mom glared at me, then she looked me straight in the eye and asked, 'Why doesn't the homeless guy come over and do the work, and you can just pay him the $50?'

I said, 'Welcome to the Republican Party.'

Her folks still aren't talking to me.

Heroes season 3 premieres 22 Sep!

2008-09-16T19:54:00.000-04:00

If a man speaks in the woods...

2008-09-04T12:18:00.003-04:00

If a man speaks in the woods and there is no woman to hear him, is he still wrong?

- A colleague

Is McCain Palin's Bitch?

2008-09-03T14:40:00.000-04:00

I've been this frustrated before

2008-08-02T09:18:00.003-04:00

Source

Condensed World History

2008-07-18T11:46:00.001-04:00

From a colleague:

For those that don't know about history...... here is a condensed version.

Humans originally existed as members of small bands of nomadic hunters/gatherers. They lived on deer in the mountains during the summer and would go to the coast and live on fish and lobster in the winter.

The two most important events in all of history were:

1. The invention of beer, and

2. The invention of the wheel.

The wheel was invented to get man to the beer.

These were the foundation of modern civilization and together were the catalyst for the splitting of humanity into two distinct subgroups:

1. Liberals

2. Conservatives.

Once beer was discovered, it required grain and that was the beginning of agriculture. Neither the glass bottle nor aluminum can were invented yet, so while our early humans were sitting around waiting for them to be invented, they just stayed close to the brewery. That's how villages were formed.

Some men spent their days tracking and killing animals to barbecue at night while they were drinking beer. This was the beginning of what is known as the Conservative movement.

Other men who were weaker and less skilled at hunting learned to live off the conservatives by showing up for the nightly barbeque's and doing the sewing, fetching, and hairdressing. This was the beginning of the Liberal movement.

Some of these liberal men eventually evolved into women. The rest became known as girlie-men.

Some noteworthy liberal achievements include the domestication of cats, the invention of group therapy, group hugs, and the concept of Democratic voting to decide how to divide the meat and beer that conservatives provided.

Over the years Conservatives came to be symbolized by the largest, most powerful land animal on earth, the elephant. Liberals are symbolized by the jackass.

Modern liberals like imported beer (with lime added), but most prefer white wine or imported bottled water. They eat raw fish but like their beef well done. Sushi, tofu, and French food are standard liberal fare. Another interesting evolutionary side note: most of their women have higher testosterone levels than their men. Most social workers, personal injury attorneys, journalists, dreamers in Hollywood and group therapists are liberals. Liberals invented the designated hitter rule because it wasn't fair to make the pitcher also bat.

Conservatives drink domestic beer. They eat red meat and still provide for their women. Conservatives are big-game hunters, rodeo cowboys, lumberjacks, construction workers, firemen, medical doctors, police officers, corporate executives, athletes, Marines, and generally anyone who works productively. Conservatives who own companies hire other conservatives who want to work for a living.

Liberals produce little or nothing. They like to govern the producers and decide what to do with the production. Liberals believe Europeans are more enlightened than Americans. That is why most of the liberals remained in Europe when conservatives were coming to America. They crept in after the Wild West was tamed and created a business of trying to get more for nothing.

Here ends today's lesson in world history....... It should be noted that a Liberal may have a momentary urge to angrily respond to the above before forwarding it.

A Conservative will simply laugh and be so convinced of the absolute truth of this history that it will be forwarded immediately to other true believers and to more liberals just to piss them off....

Bay bridge crossing

2008-05-01T15:19:00.003-04:00

How to easily author a firefox plugin?

2008-04-16T07:40:00.001-04:00

I'm looking for a way to read the page's source as stdin to a command and have firefox display the stdout in the browser.

Ubuntu Brainstorm: idea #1235: A way to create custom spins of the live CD/installer images from the scratch

2008-04-11T07:00:00.002-04:00

My comments...

jensen.nick wrote on the 11 Apr 08 at 08:51

I have been searching for MONTHS for such a script or tool (and/or enough information to write my own)... for example, what is used to generate the daily builds at http://cdimage.ubuntu.com/daily/current/ ? It can't not be an automated process! There are certain nuggets of info regarding the seeding and other various major steps of the official iso creation process barely available, but so far my search has turned up no script, just the ubuntu help page LiveCDCustomizationFromScratch (https://help.ubuntu.com/community/LiveCDCustomizationFromScratch)... which is very close to what I'm looking for but it's not exactly my goal. I might guess that the official ubuntu people might not want to release such a script as part of an effort to minimize the potential to fork ubuntu-based distros, in a similar way as the true reason for why they haven't gotten around to simplifying usplash. Ubuntu is after all, an open source project... so where are the sources to build it from scratch?

Original Idea:

idea #1235: A way to create custom spins of the live CD/installer images from the scratch

Written by tj the 29 Feb 08 at 10:41. Category: System. Status: New

Description

I've encountered this issue before several times, and every time there's some vocal people who say that there is no need for customized Ubuntu live CDs as there's no demand for this. Well you know, if you don't have the need to customize Ubuntu live CDs, it doesn't mean nobody is missing the feature. I am, for instance.

Even this brainstorming project as at least two similar requests [1], [2], so the demand is there. However, I don't want to be able just to remaster the official images, I want to be able to _create_ my custom images using the same tools that are used to create the official images.

As far as I know, Ubuntu is about free software and ideas behind this. So I see no reason why the tools used by Ubuntu internally are kept as some kind of a secret. I would like to be able to improve the tools, and contribute the changes back, and if they are liked, they would get incorporated to the official tree, just like with any free software project.

I think Fedora is leading the way in this matter [3]. They have developed a tool for this, pungi [4]. I'm not suggesting that Ubuntu should start using this tool as image creation tool since the pungi codes is probably coupled quite tightly with Fedora/RPM infrastructure, but similar project for Ubuntu would be very nice to have. Of course, if pungi or some other existing tool would be feasible for the task, using existing code is of course a good thing to do.

[1] http://brainstorm.ubuntu.com/idea/320/
[2] http://brainstorm.ubuntu.com/idea/432/
[3] http://fedoraproject.org/wiki/CustomSpins
[4] https://hosted.fedoraproject.org/pungi

sweded tron

2008-03-27T07:57:00.000-04:00

Tron
by freres-hueon

DCMBASSES: Lane Ends Merge Left

2008-03-06T06:12:00.004-05:00

The Chesapeake Bay Bridge has been doing construction on the west-bound span late at night. They generally begin to direct west-bound traffic over to one lane of the two lane east-bound span around 8pm.

At the beginning of the bridge, after you pass the toll booth and when you finally get down to two lanes which have to merge together into one lane in order to get onto the single open lane on the bridge, there is a sign. It reads:

LANE ENDS
MERGE LEFT

Tonight, and in a couple recent nights, there appears to have been an amazing convergence of illiterate people in that single place at the coinciding with my own presence there. Beyond belief, everyone nears the sign and due to some yet unexplained phenomena other than a sign clearly instructing everyone to merge left, everyone does the exact opposite: they all merge right into the lane which is obviously ending!

Not understanding why they might be merging in the opposite direction, perhaps out of fear to avoid closeness with oncoming traffic, their collective action opens the lane which clearly goes directly onto the bridge. Well, I was already on the right, and following the posted sign, wanted to merge left to get onto the bridge when I encounter 10 or so drivers damn near cutting me off to merge into my lane, which is ending. So I turn my left blinker on, find a hole to safely merge left and pass all these idiots merging into the wrong lane.

Of course one dumbass takes my non-idiotic driving personally, and decides to tailgate me for the first half of the bridge. Okay, fine. You hit me, and we'll have words. It only took one time of the 18 wheeler in front of me to slam on his brakes, and myself in turn also, to get the tailgater off my ass, as I'm sure their life flashed before their eyes. I guess some people can learn.

They're still a dumbass for merging right though.

DCMBASSES: About

2008-03-06T06:12:00.002-05:00

I have been commuting about 100 miles per day in the Washington D.C. metro area since 2003. I have encountered many, many dumbasses. This new column are their stories.

Why I still don't trust Microsoft

2008-03-03T12:27:00.006-05:00

See this is why I still don't trust Microsoft... even when they're supposed to be getting better at security they come out with bs like this.

The comments also underline the fact that while the gov't gives Microsoft billions of dollars, it's not their primary source of income and they don't have as much of a "corporate culture" for caring about things that the gov't cares about, nor those related but tricky business areas like corporate espionage.

But they sure can sell turds for OS's!

I'll retreat to my long standing chorus: Microsoft should stick to making keyboards, mice and xbox's.

Sent in response to this email from a colleague:

Subject: Microsofts response to cold boot.

Seriously? This is the response?

“The whole thing is unlikely, Humphries argued in a post to the Vista security team's blog. To make his case, he ticked off several preconditions:

-- The attacker would have to have physical access to the machine.
(No shit? You have to have access for a non-remote, physical memory vulnerability? Well thank god you’re working in IT Security. Good news guys, we don’t have to do anything to the laptops since they’re in our possession.)

-- The laptop would likely have to be in "sleep" mode, rather than in "hibernate" mode or powered off.
(Unless you actually read the white paper.)

-- The person who finds/steals the laptop must be knowledgeable and interested enough to execute the attack.
(Wow. Well then we’re set. Cause anyone who steals my laptop would never be interested in gaining access to its contents. Ever. This guy makes more money than everyone on the floor put together. I could have come up with a better argument drunk, typing with my toes. How is it ok that he makes more money than me?)”

You can read the rest of the abortion of an article here.

The power of wind

2008-02-28T22:19:00.003-05:00

I had originally seen this on tv in Spain, but was recently reminded about it by the recent Gizmodo post, Turbine Ad Showcases a Bored, Possibly Brain Damaged Troublemaker.

Easy to root?

2008-02-22T09:56:00.003-05:00

As pointed out on the Metasploit blog, Rise Security recently rooted a stock Asus Eeepc. Well I'm not surprised in the least given that the package repositories (/etc/apt/sources.list) are comprised (nearly?) entirely of Asus & Xandros controlled repositories. This generally contributes to a system that is prone to get out-of-date quickly because new versions of packages not only have to propagate through the Debian package management system, but then they must trickle down to the manufacturer's and distribution's repositories. This depends on the manufacturer and the distribution developers keeping a keen and watchful eye on new packages. This should be a lesson to manufacturers who are shipping products with Linux to select not only an easy to use operating system, but one that is easily (if not automatically) updated. Had Asus chosen Ubuntu, they could be benefiting from a large community of support that is not present in Xandros. This was one of the reasons why I took a quick tour of Xandros on my Eeepc, and then blew it away with a custom Ubuntu install via debootstrap.

The Starbucks Oracle

2008-02-21T16:10:00.001-05:00

Astrology is lame and Myers-Briggs is for losers. The omniscient Oracle of Starbucks can tell you everything about your personality by what you drink at Starbucks. Simply enter your full drink order -- including size -- into the field below and the all-knowing Oracle will tell you everything about your personality. Better yet, input your friends' orders to find out what they're really like.

Unlike other imitations, the Oracle is 100% accurate.

The Oracle of Starbucks

Flight of the Conchords: The Humans Are Dead

2008-02-16T08:43:00.001-05:00

2008 Toyota Yaris Sedan Mileage: Updated

2008-02-10T10:53:00.000-05:00

Please refer to my previous post for background details.

Changes:

Added Miles column to Statistics to calculate minimum, average, and maximum miles traveled per tank.
Added sheets: MPG Chart, Miles Chart to graph actual MPG and Miles against the minimum, average and maximum values.

Sample charts:

The images embedded here are only current as of this posting and do not automatically update (a limitation of Google Docs). To download the current chart, click on either image.

Open invitation to the "US Marines" LinkedIn Group

2008-01-29T09:42:00.000-05:00

All current and former Marines are invited to join a new group over at LinkedIn. The group is simply called "US Marines" and proudly displays the black eagle, globe and anchor insignia on your profile in the groups area.

Since I have no realistic way to verify that an invitee was or is in fact a Marine, anyone who requests membership will be approved.

Depending on the popularity of the group, I'm currently evaluating whether to set up a forum, wiki or blog to enhance communication among the group.

I'm also looking for a few motivated individuals to assist me as co-managers of the group. Duties would include approving requests to join the group as well as taking over management if anything should happen to me.

Please comment here or send me an InMail (from LinkedIn) to voice your opinion or volunteer.

Request to join the "US Marines" LinkedIn group

To Our Americans Serving in Iraq

2008-01-27T19:35:00.000-05:00

Geeking Out

2008-01-27T17:08:00.000-05:00

If anyone ever wanted to know what "geeking out" is... here's an example:

CISSP (Certified Information Systems Security Professional)

2008-01-26T13:44:00.001-05:00

Well, folks... it's official! I received notice yesterday that I've been accepted as a CISSP (Certified Information Systems Security Professional) and my member card and certificate are in the mail.

2008 Toyota Yaris Sedan Mileage

2008-01-14T20:09:00.000-05:00

As I was previously doing with my 2006 Toyota Matrix before its untimely death, I've set up a spreadsheet to record my new Yaris' mileage if anyone is interested. The main point of entry is:

http://spreadsheets.google.com/pub?key=p9naDS_s9RMThrZbf7Pq7Ug

However, you could get at the data in lots of formats. If you have such need, leave a comment with your requirements and I can try to help you with the details.

You can also find this link in the Online Presence section of links on my blog.

Notice the SYN SYN/ACK ACK in the confetti?

2008-01-01T12:15:00.000-05:00

Atlantic Broadband Also Forging RST Packets?

2007-11-29T21:14:00.001-05:00

Here is a sample of packets that were logged by my iptables firewall during a recent legal bittorrent download session (with the IP and MAC address masked for privacy reasons):

Nov 26 23:08:22 box kernel: [11153.176000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=19653 PROTO=TCP SPT=26630 DPT=47838 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.176000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=19900 PROTO=TCP SPT=26356 DPT=52173 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.180000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=32238 PROTO=TCP SPT=6881 DPT=43605 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.180000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=19855 PROTO=TCP SPT=51576 DPT=42756 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.180000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=7416 PROTO=TCP SPT=65535 DPT=45164 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.180000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=26581 PROTO=TCP SPT=51413 DPT=50647 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.180000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=21435 PROTO=TCP SPT=41537 DPT=32791 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.184000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=4173 PROTO=TCP SPT=9496 DPT=55228 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.184000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=28160 PROTO=TCP SPT=8815 DPT=54824 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.184000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=17698 PROTO=TCP SPT=18798 DPT=50511 WINDOW=0 RES=0x00 RST URGP=0
Nov 26 23:08:22 box kernel: [11153.184000] INPUT-DROP IN=eth0 OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=XXX.XXX.XXX.XXX DST=XXX.XXX.XXX.XXX LEN=40 TOS=0x00 PREC=0x00 TTL=255 ID=27050 PROTO=TCP SPT=44008 DPT=43070 WINDOW=0 RES=0x00 RST URGP=0

I was forced by my ISP to switch over to the linux side of my dual-boot machine (from Windows) because Azureus wouldn't keep the torrent downloading for more than about 30 seconds. Then as if possessed, it would stop the download, presumably due to traffic like the above. Except in this case, the disfunctional Windows Firewall happily accepts the forged rst's.

Since I'm using linux with a reasonable firewall configured, it seems these packets are being dropped because iptables can tell that they are forged assumingly because they are not related to an existing connection.

Don't take anything for granted

2007-10-18T09:03:00.001-04:00

Click the image to play

Fluxbuntu 7.10: Coming Soon!

2007-10-18T08:38:00.001-04:00

Ubuntu 7.10 Countdown

2007-10-17T09:27:00.000-04:00

and another one

2007-10-10T05:10:00.001-04:00

Found It!

2007-10-09T05:27:00.001-04:00

"sublinks" idea

2007-10-05T07:56:00.000-04:00

I was talking with a colleague yesterday when we stumbled onto a modification of an idea that is commonly used in programming projects and known to many as "modularization". Modularization is a method of reusing source code by placing a single copy of the code in question in a single place and via both filesystem organization and actual programming techniques achieve re-usability of the code. An example of the programming technique to make use of modularized code could be Perl's use, require and do statements. This kind of solution work basically by blocking the main program, and evaluating the code in the second file, and then resuming execution in the main program. Well another idea hit me yesterday... what if you could have something like symlinks, except that instead of pointing to files and existing alongside files, you could have "sublinks", which might exist inside files and point to other files or just parts of other files? It would be just like Perl's use, except instead of seeing the use statement, you would see all the code the use points to. This would accomplish a logical "flattening" of the organizational structure. It would also be language independent. A possible side benefit is that any update to a portion of code that is part of a "sublink" would update anywhere the sublink is used, or at the author's option, the sublink could be broken and forked to contain either individual code or linked to a different sublink in the current file. If I were to write something implementing this sort of functionality, I would probably write frontends to common commands in Perl which intercept regular operations and force to use the sublinks idea. Perhaps there is an existing project already? or maybe it can be done at greater speed at the lower filesystem level?

Another patch for VMware Server 1.0.3 on Ubuntu

2007-09-22T12:05:00.000-04:00

After already following the patching instruction found here, vmware-config.pl still complained during install of VMware-server-1.0.3-44356.tar.gz on Ubuntu 7.10 Gutsy (Tribe 5):

CC [M] /tmp/vmware-config0/vmnet-only/userif.o
/tmp/vmware-config0/vmnet-only/userif.c: In function `VNetCopyDatagramToUser':
/tmp/vmware-config0/vmnet-only/userif.c:630: error: `const struct sk_buff' has no member named `h'
/tmp/vmware-config0/vmnet-only/userif.c:630: error: `const struct sk_buff' has no member named `nh'
/tmp/vmware-config0/vmnet-only/userif.c:636: error: `const struct sk_buff' has no member named `h'
make[2]: *** [/tmp/vmware-config0/vmnet-only/userif.o] Error 1
make[1]: *** [_module_/tmp/vmware-config0/vmnet-only] Error 2
make[1]: Leaving directory `/usr/src/linux-headers-2.6.22-12-generic'
make: *** [vmnet.ko] Error 2
make: Leaving directory `/tmp/vmware-config0/vmnet-only'
Unable to build the vmnet module.

For more information on how to troubleshoot module-related problems, please
visit our Web site at "http://www.vmware.com/download/modules/modules.html" and
"http://www.vmware.com/support/reference/linux/prebuilt_modules_linux.html".

Execution aborted.

EDIT: I just found out that VMware has released VMware server 1.0.4 this week! I have already downloaded it and tested it under Ubuntu 7.10 Tribe 5 without problem. It's nice to not have to patch things again. I'd recommend upgrading, but if you absolutely must have 1.0.3, here's the fix that worked for me:

cd /usr/lib/vmware/modules/source/
sudo mv vmnet.tar vmnet.tar.orig
sudo wget http://npw.net/~phbaer/vmnet.tar
sudo chmod 444 vmnet.tar
sudo vmware-config.pl

More information is available on the vmware forums and also here.

Eavesdropping on Bluetooth Headsets

2007-09-22T11:54:00.000-04:00

2 Steps to Easy Vim Colorschemes

2007-09-17T15:46:00.000-04:00

1. Add the output of this one-liner to your .vimrc or /etc/vim/vimrc file(s):

ls /usr/share/vim/vim70/colors/ |grep vim |perl -pe 's/\.vim$//;s/^/"colorscheme /'

2. Then uncomment the one you want to use.

Voila!

MS-DOS 5 Upgrade Video

2007-09-12T16:22:00.000-04:00

Reasons the Internet is Better than School

2007-09-03T13:27:00.000-04:00

Getting pwned in Warsong Gulch is much less painful than getting pwned by football players.
On the Internet, creative spelling appreciated much more.
Ride on the schoolbus takes longer than booting up the computer.
Getting a comment upmodded on Reddit much easier than getting an A in AP Calculus.
Bringing a gun into school can get you suspended, bringing a gun to online games encouraged.
Much easier to get people to call you The Incredible Shaft online than at school.
Not penalized for making pronouncements without any facts.
The hot chicks at school aren't usually naked.
On the Internet, nobody cares if you didn't shower that day.
Online friends less likely to be judgmental of your mullet.
Being drunk at school less tolerated than being drunk online.

Repost

live linux work 2

2007-09-02T16:03:00.001-04:00

In reference to my earlier posting, I finally stumbled back across Finnix, as the answer to my problems... this seems to be the point where I have a live, minimalist/console-only, environment that also uses apt-get/dpkg natively. As an added bonus, many of the "additional" packages I need to add also come with Finnix by default, like the build tools... gcc, g++ and make. So now I just add bzr, svn, cvs, checkout some repos, install some dependencies, compile and run stage1/stage2 and should be good to go. I haven't yet settled on the name... but for now am calling nsf (for network security finnix), more or less along the same theme I was using for the other candidate base systems: netsu (network security ubuntu), ns2 (network security slax), & nsw (network security wolvix)... but then I'm still pondering one which I won't release just yet... ;-)

Btw, I've already done a "dry-run" of the finnix remastering process w/o actually making any changes and everything worked w/o problem, so on to the customization!

linux live work

2007-08-28T02:13:00.000-04:00

i've been working hard at trying to make slax frodo work for me and here are my issues:
- doesn't include slapt-get by default, which in turns has all kinds of dependencies, and the whole point was to relieve the dependency hell!
- getting a dev suite on there is equally difficult manually, next try will be to use the official dev module
- it looks like about the only feasible console only possibility w/o having to remove a ton of crap from others, of course we'll need some way to put our software on there...
- the most promising way to add tools to frodo is probably going to bang my head through the slapt-get install and then new installs should be "easy"
- the only "reason" i've seen to answer why do the slackware people like doing package management without any dependency resolution is that they "like it that way", coming from the debian/ubuntu world... it's a pretty messed up way to go about it

there's another promising possibility but at a higher initial size penalty and perhaps undesired software installed is wolvix, of norway, which happens to come w/ fluxbox and xfce as well as slapt-get and gslapt. unfortunately, it doesn't come in a console only version like frodo, but does come in 242mb "cub" version and 483mb "hunter" version which includes extra software like qemu, qemulator, SAMBA, Java, and CUPS... granted if you just want qemu/kvm, i'd say just add that to the cub version; another distinct difference between slax and wolvix is that wolvix mods are lzm aka lzma compression on its squashfs-based modules, which means more software at less size hit as a default design benefit; slax just uses squashfs

so i'm thinking to try to do the frodo+dev suite+tools(svn repos) for the console-only livecd <128mb, make another one identical except adding fluxbox and then also try w/ wolvix cub and adding dev suite and tools

-----

i just converted a 44mb mo (squashfs) into a 33mb lzm (lzma'd squashfs)... wow!

-----

so i just booted up wolvix cub in vmware server... and decided to do a test using gslapt, slapt-get, and the tgz/lzm tools... so let's install subversion...

I opened up gslapt from the well-designed fluxbox menu (perhaps over-designed, looks like a kde menu) and decided that it does in fact look and function more or less like synaptic, so give that up for now until I trust it more...

using slapt-get:
slapt-get --install subversion

try to run subversion:
svn help #gives apr-util error, so...

slapt-get --install apr-util
and so on until svn help works

eventually the full list of tgz's to install becomes:
apr-1.2.7-i486-1.tgz
apr-util-1.2.7-i486-1.tgz
neon-0.25.5-i486-2.tgz
subversion-1.4.0-i486-1.tgz
all from the slackware 11 repo

then to convert the tgz's into an lzm:
cp /var/slapt-get/slackware/*/*.tgz .
mkdir temp
ROOT=temp/ installpkg *.tgz
dir2lzm temp subversion+deps.lzm

now I have the lzm scp'd off of the livecd's ram... so i can simply extract the iso, and throw this lzm in the wolvix/modules/ directory, run the make_iso.sh script, and boot that and I'll have wolvix cub plus a working subversion install

granted slax works near identically, in theory... i've just not had success so quickly with it! of course slapt-get is doing a huge favor for me simply by fetching the tgz's for me... there might be a way to have it do dependencies too, hmmm

Dilbert (Sun 26 Aug)

2007-08-26T14:17:00.000-04:00

It must be Patch Tuesday!

2007-08-15T05:58:00.000-04:00

My otherwise fine Windows XP Pro blue-screened this morning as result of yesterday's updates.

Oh sorry Microsoft, "allegedly" blue-screened... wouldn't want to incur the wrath of defamation lawsuit for speaking my own mind. I've got an idea... how about I'll stop making fun of you when you actually do something useful for mankind, besides brainwashing everyone.

Sorry, it's just I'm still fuming from some story I read in a feed the other day other how the linux community should be "nice". I'm sorry, but it pisses me off that there isn't a complete and total computing solution out there. I'm just happy that I happen to enjoy tinkering and hacking on the things available and that there are lots of different things out there to tinker with... it's just that I happen to pay for Windows.

Now I'm just rambling...

Spynote

2007-07-12T07:47:00.000-04:00

An online notepad featuring encryption

Firefox / IE Vulnerability

2007-07-10T19:04:00.000-04:00

From Critical Security Flaw Discovered In IE & Firefox via [H]ardOCP News/Article Feed on Jul 10, 2007

If you are a Firefox user with IE installed (most of us), you need to be aware of a new security flaw that can lead to your system being compromised.

A user could face a "highly critical" risk if they have both IE and Firefox version 2.0, or later, loaded on their computer. The trouble begins when they begin browsing a malicious site while using IE and it registers, a "firefoxurl://" URI (uniform resource identifier) handler, which allows the browser to interact with specific resources on the Web. A user, as a result, may find their system remotely compromised.

How can you have IE installed if you're using Linux? ;-)

Terrorist kitten

2007-07-09T07:26:00.000-04:00

I love this avatar:

Beryl & XGL working!

2007-07-08T01:25:00.000-04:00

Just in time for the Beryl/Compiz merge, I finally got it working on my personal laptop. The magic that worked for my x700 ATI card was Beryl and XGL as instructed over at ubuntuguide.org. Very nice!

UPDATE: Here's a bash script that performs an automatic install.

Dilbert (Saturday, June 16th, 2007)

2007-06-29T07:53:00.000-04:00