Taking Security Seriously

16. July, 2009

Security of todays operating systems is slowly getting better, meaning that it becomes more and more hard for some fraud to get your credit card number by asking your computer. Asking the person in front of the computer still works. But I digress.

On the DailyWTF is a report how the military handled the problem.

While the idea to actually carry vulnerable parts of the computer away when someone not trustworthy comes close, the solution is really what the military is all about: Make it work, no matter what might go wrong. And be creative about what could go wrong but take the most simple solution (which is the main difference to geeks: we almost never pick the most simple solution).

Which also explains why they clipped parts away from the printouts: Just blackening them might be undone (just holding the paper against the light might be enough) but data, that isn’t there, can’t be abused.

A pity that this simple idea is shunned today. Instead of collecting as little data as possible for a job, as much data as possible is hoarded.


5’024

20. February, 2009

Just came in to find my reputation on StackOverflow.com has reached 5’024. Sweet 🙂


Things You Can’t Do Anymore After 9/11

19. February, 2009

A few years ago, I helped a friend out. He was working for a small project of a guy, let’s call him Tom, in Munich to build a system to etch waver masks with plasma. The setup was simple enough: A standard PC running Linux with a very simple control language which would send commands to various devices attached via the serial bus. Piece of cake. My job was to complete the “read the recipe” and “send the commands to the devices” (plus read some status data back).

If you’ve ever been in contact with Linux, you know that the words “hardware driver” can cause nightmares even today and that was 1995! Linux 1.2! one-point-freaking-two. After eight hours of frustration, I considered my options: Hack the kernel (and the multi-IO driver in it; only the driver I needed was closed source), give up or try a different hardware with a better driver. Did I mention that the whole thing had to be ready for oversea delivery by 14:00 the next day? Piece of cake.

I pulled out a Linux magazine and browsed through the ads (Finding companies on the Internet? 1995? You’re joking, right?). Lo and behold, there was an ad from a company which was selling eight port multi IO cards. I checked the kernel docs for this card. There seemed to be an open source driver. I checked the clock. 18:00. I checked the address. Hamburg. OK. That might just work. I called the company. Ring … ring … ring … YES! Okay … I didn’t get someone from the company but a security guy. He knew what I was talking about and he was willing to sell me one … but I had to pick it up. Hm. My mother is from Hamburg. One call later, I had the number of an old school friend of her’s. Let’s call him John.

Ring … ring … ring … come on … ring … Yay! He was just back from work, I had literally got hold of him with the door key still in his hands. I explained the situation to him: “Can you pick up a package at [some address], go to the airport and put it on the next airplane to Munich? Oh, I’m the son of your old friend Barbara.”

“Sure,” John said, “can do.” A few minutes later, he was on his way to the north of the city to pick up the package. I called the security guy to tell him that someone was on the way.

Time passed. I called my mother’s friend. No answer. I called again. And again. I got nervous. Again. Oh-dear-God-thank-you, he answered. Things had been a bit complicated, he explained to me. When he arrived at the company, he had no cash, only a credit card. The guard couldn’t operate the credit card reader. After a short discussion, he would accept a written statement that the bill would be paid plus a copy of John’s passport.

Next, he went to the airport, just in time for the last plane to Munich. I had worried how to get the package on the plane but that hadn’t been a problem; he only had to pay for a full seat. Uh … OK. You try that now … my guess is that airport security will shoot you on the spot, not even bothering with trying an arrest. Anyway, the package was on it’s way to Munich. The plane would arrive around 23.00. The clock said: 21:30. Time to pick up the phone again.

Tom, the project owner, had had a meeting in Munich and was on his way back to us (we were in a small city some 20 miles to the south of Munich). Thank God for mobiles! He answered on the highway. We told him to turn back and head for the airport.

23:30. Tom called to tell us that he had the package and he was heading back.

0:00 I got my new toy. Nice. I checked the driver module which loaded perfectly into my kernel. I ran my tests again. They worked. They f******g worked right away after refusing to do anything for eight hours! Can you imagine my feelings? I wanted to scream in frustration and joy at the same time. Anyway. Time to get the recipes to work.

6:30 I have my limits and now, I’d reached them. Usually, I type blind but now, the stuff on the screen didn’t look what I told my fingers, anymore. I made more mistakes than I fixed. But most of the stuff was in place and a first simple recipe, which triggers every system at least once, ran through. An eerie blue glow filled the garage as the plasma comes to life. Cool. I wonder what the neighbors might have been thinking. Forgetting to close the chamber would cause every computer within a 10km radius to burn through. Cool. I drag myself to bed before that little devil in my head gets any ideas.

11:00 I’ve slept only a few hours but there is still some more work to do. When I arrive back at the garage, I find the machine gone. Panic. They have already started to take everything apart and shove it into a freight container. Uff. Whatever bugs are still left in my code will have to be fixed in Asia.

So they sent me home, my colleague would go to Asia. One of Tom’s friends dropped me off at a gas station on the autobahn. There, I asked the owner whether he could call me a cab. Strangely enough, he did, even without asking any questions or even asking anything for the call. Must have been the look on my face. Exhaustion, you know. I bought some sweets in return.

A couple of minutes later, a cab pulled in. The driver, a woman, didn’t seem to be too surprised to pick someone up close to nowhere. Huh. It was her second job today (and it was afternoon), the last customer wanted to visit Zurich. It’s interesting how cheap those far runs are, compared to in-city. We arrived at Meersburg just as the ferry was about to leave. I paid, left a tip and jumped on. On the other side, the bus was already waiting.

It was a mad ride but a very satisfying one. In retrospect, it is a miracle that everything worked out, so much could have failed. I got some money out of it, too, which I invested in stock. It was a fixed date transaction and a few days after I got paid out, the stock market took a steep plunge.


Reasons Against Second Class Citizens

19. February, 2009

If you ever need a reason to avoid dividing your workforce into first and second class citizens, consider this: Non-Compliant By Design.


Being On The Losing End Can Help You Win

11. February, 2009

This one made me laugh: Damn the River


3,337

4. February, 2009

Just a small post to celeberate my StackOverflow reputation of 3,337 🙂


Stackoverflow: Reputation over 1000 :)

2. December, 2008

Just a tiny post to cheer the fact that my reputation on Stackoverflow.com has transcended 1,000. Yay!


Space: Not So Black And Empty After All

28. November, 2008

If you always wanted to know what NASA does with all the billions of dollars spent, here are some images.


Failure is not an Option

22. October, 2008

Everyone loves war stories. Here is one of mine. I need a special diet, especially bread. So one Friday evening, I was taking the train home after buying a couple of custom made loafs of bread. In Dübendorf, I left the train and walked home.

About halfway home, I noticed that I had my head, my arms, my bag … but not my bread! ARGH! Stupid, stupid, stupid! I knew I should have stuffed them in my rucksack but didn’t because it was so full and … yeah … okay. My baker needs three days to make these breads so that meant about a week without any for me.

Arriving home, an idea struck me and I fired up the VBZ online service to find out where the train was and when the driver would make the next break. A few moments later, the SBB Train Police got a really strange call by me: “I need my bread. It’s in this train and can you please, please ask the driver to check if the white plastic bag with the bread is still there?”

The woman on the other end was surprised and promised to call me back.

Ten minutes can be sooo long.

From the timetable, I knew that my train would probably come through my town in about twenty minutes when I got the call. Yes, they found it and the driver would take the plastic bag into his cabin and she told me where to wait on the platform so he could hand it over.

Try train was on time (as usual), the driver handed me my bag (and it really was mine and all the bread was still there) and I was really relieved. After thanking him, I went home to have my dinner. Thanks to the SBB train police, a train driver and an unknown person who put my bread in the overhead compartment when I left it behind, I didn’t go hungry that weekend.

Lesson: If all seems lost, take a step back, do something else and you might have the idea which will save the day.

Train related joke: The SBB (Schweizer Bundesbahn – Swiss federation train company) and the German Bundesbahn (the counterpart of the SBB in Germany) wanted to save some money and decided to buy the same information system to inform about arriving trains on the platform. After a longer evaluation, the plan was dropped. The SBB needed signs which said “Train is 1, 2, 3, 4, 5 minutes late” and the German Bundesbahn needed “Train is half an hour, 1 hour, 2 hours, 3 hours, 4 hours, Train Cancelled.”


Name of the Longest Distance Between Two Points

7. October, 2008

Q: What’s the name of the shortest distance between two points?

A: The straight line.

Q: What’s the name of the longest distance between two points?

A: The shortcut.