- Open up a text document in a simple editor. Over the years I found that writing first drafts in fancy office programs to make things worse as I spend hours trying to figure out which font to use, how large to make the margins, etc. etc. would derail the paper. For a simple editor I use Emacs .. well its not simple or small but it is a good OS while I look for a simple editor :).
- Get all the distractions of the day out of the way. That means read through my Facebook queue to find out if I have cat pictures to like, friends political posts to ignore, and family birthdays to say "Happy .." to. Go through the large Fedora email queue and find out which emails I need to answer and what tickets needs to get done.
- Stare at the empty editor page for an hour. Try various first sentences and delete them. Realize you don't know where you will be meeting people tomorrow.
- Figure out where I need to go tomorrow in Raleigh. Red Hat moved offices during the summer and I need to get to the new ones in downtown. Go look at various maps to figure the best way to get to the offices.
- Look intently at the empty page... put a bunch of ideas down for what should be noted in the paper and what should not. Go research some papers by Alec Muffet (the writer of Crack and other tools).
- Get some tea.
- Take the ideas from the page and put them in a different file. See an empty page and type lalalalala for a while.
- Run out of the house yelling "You will never take me alive!!!!" For extra points remember half-way that clothes would be a good idea.
- Go back and start typing in the page. Get about 4 paragraphs done.
- Get a page about systems and go do steps 1-9 again.
- Remember that you needed to post a before the FAD post and go do that.
- Go back to typing because you have nothing left to distract yourself for a good 10 minutes.
2012-11-25
Fedora Infrastructure Security FAD: Day -1
Today was mainly spent writing a paper... well attempting to write a paper on Password Security in Fedora. The process of writing seems to be the following:
2012-11-24
Fedora Infrastructure Security FAD: Day -2
From Monday evening til Thursday morning, various system administrators will be meeting in Raleigh, North Carolina for a Fedora Activity Day (FAD). We will be discussing and working on improving the security of Fedora's Infrastructure to bring in various 2 factor security methods via Yubikeys and Google Authentication. Many of the parts have been worked on in the past, but getting all the people in the same place to focus on them took a lot longer than expected :). Most people will be travelling to North Carolina by plane on Monday, but I decided to come in early and spend the weekend with my parents in South Carolina. Then on Monday I will drive up and pick up people from the airport and get them to the hotel and such.
My original goal was to use my parent's truck and put people in the back, but the laws have changed and system administrators are no longer classified as cattle. So I have had to borrow a different car and people will just have to get in the trunk :). After I get them to the hotel, we will all check in and do an evening get together of what our goals for Tuesday are and anything that is thought hackable starting off.
While I won't be working on the Fedora Account System (FAS) integration of 2 factor, I will be working on mapping our security controls with the top 20 Critical Controls and the Top 35 Mitigation Strategies. These aren't much different from other security documents but I decided to pick something and SANS looked like a good place (and going through the 400+ pages of NIST documents usually makes people insane.) This will basically be a goal of just pointing out our good practices, figuring out what we might want to check, and where we could improve in a way that outsiders can compare with their own tools (if they use those security documents and not one of the myriad other ones). [This isn't about locking down a system but more about how to protect as much as usable and deal with the eventual breakins and problems that occur.]
I also plan to finish off a talk on what changes in Password Security over the last 3 years have "bought" us as an organization. I want to have this as a finished talk at FUDcon as this all started from FUDcon Phoenix.
Anyway, happy hacking.
My original goal was to use my parent's truck and put people in the back, but the laws have changed and system administrators are no longer classified as cattle. So I have had to borrow a different car and people will just have to get in the trunk :). After I get them to the hotel, we will all check in and do an evening get together of what our goals for Tuesday are and anything that is thought hackable starting off.
While I won't be working on the Fedora Account System (FAS) integration of 2 factor, I will be working on mapping our security controls with the top 20 Critical Controls and the Top 35 Mitigation Strategies. These aren't much different from other security documents but I decided to pick something and SANS looked like a good place (and going through the 400+ pages of NIST documents usually makes people insane.) This will basically be a goal of just pointing out our good practices, figuring out what we might want to check, and where we could improve in a way that outsiders can compare with their own tools (if they use those security documents and not one of the myriad other ones). [This isn't about locking down a system but more about how to protect as much as usable and deal with the eventual breakins and problems that occur.]
I also plan to finish off a talk on what changes in Password Security over the last 3 years have "bought" us as an organization. I want to have this as a finished talk at FUDcon as this all started from FUDcon Phoenix.
Anyway, happy hacking.
2012-11-06
Voted Today
Wow, I have not posted in a long long time. Well I will start doing so with today's topic starting with a non-Fedora one... US Elections. I voted. It was easy, it was fast, and I think our local county clerk did a great job in making it so that every voting place could be 'your' voting place by moving the printing of ballots to each place. There were multiple receipts and coverage so that verification of the correct ballot and correct voter could be done after the election. Which is nice after watching the videos of people who are trying to vote for X candidate but getting Y chosen for them due to either capacitive touch problems (or possibly other issues.)
In the backyard right now I am watching the mountain birds begin to arrive at the bird feeders. They haven't found the "suet" feeder as attractive as the Nyger seed or the regular seed. The local pigeons have grown fat over the summer... the dog actually was able to grab one yesterday.. which after eating her share, decided to give the rest to me. Good doggie... but I am not sure I want rat-bird to eat. But it has meant that the back yard has fewer pigeons in it today so I am happy.
In Fedora news. I am working on some papers for the FUDcon.. have to finish them up in the next week or so. For relaxation, I built a box out of various spare parts from friends.. it is about 2 year old hardware and probably the fastest system in my house :). The story of Frankenbox will be my next post.
In the backyard right now I am watching the mountain birds begin to arrive at the bird feeders. They haven't found the "suet" feeder as attractive as the Nyger seed or the regular seed. The local pigeons have grown fat over the summer... the dog actually was able to grab one yesterday.. which after eating her share, decided to give the rest to me. Good doggie... but I am not sure I want rat-bird to eat. But it has meant that the back yard has fewer pigeons in it today so I am happy.
In Fedora news. I am working on some papers for the FUDcon.. have to finish them up in the next week or so. For relaxation, I built a box out of various spare parts from friends.. it is about 2 year old hardware and probably the fastest system in my house :). The story of Frankenbox will be my next post.
2012-06-06
Deleting your LinkedIn Account
So I decided it was better to just deleted the account. With no idea if the hackers are still there, and what little benefit I personally get from it.. it is not worth keeping it open. If you are paying for a professional account etc it is a different matter, but for me I just can not trust a company that stores passwords in unsalted format. [Hopefully all the other sites, I trust but can't look at their source code don't.. *snort*.]
Anyway to delete your LinkedIn account. I pretty much followed the settings that LinkedIn's help page gave. Login, go to settings, go to account settings, and click close account. Tada, closed account... supposedly. The reason I say this is that I didn't receive any email telling me that the account has been closed. And there is no proof that someone who has my password can not just open it up again. Oh well. One step at a time.
Anyway to delete your LinkedIn account. I pretty much followed the settings that LinkedIn's help page gave. Login, go to settings, go to account settings, and click close account. Tada, closed account... supposedly. The reason I say this is that I didn't receive any email telling me that the account has been closed. And there is no proof that someone who has my password can not just open it up again. Oh well. One step at a time.
Why I am not immediately changing my LinkedIn password
So supposedly LinkedIn has had a massive breach, and 2->6 million password hashes have been harvested from some system. While this is bad, and most people watching it are urging people to go change their passwords on LinkedIn, I am waiting and will probably close my account if the problem is confirmed.
The passwords being found in this set look very corporate in how they are setup. People were using "good" password rules: mixing Uppercase, Punctuation, LowerCased, Number, longer than 10 characters, etc. These are probably the ones most likely used elsewhere.
If you used your LinkedIn password anywhere else, or you use a similar pattern (say your password was 123LinkedInQ@$ and you use that pattern elsewhere so your Fedora password was 123FedoraQ@$, please change your password at those other locations, and please please use a different pattern.
- There is no indication that the hacker is "out" of LinkedIn at the moment. So any passwords that are being changed currently could end up going to the hackers again. And with the fact that the most likely password a person is going to use is one they use elsewhere.. that means the hackers have a much larger set to use.
- The password hashes are stored in an Unsalted SHA1 format. This is criminally poor judgement of whoever implemented this part of the password system. The SHA1sum is a very very fast to match passwords to. This means that even 5 year old hardware can work through a terabyte dictionary in a day or so even with millions of hashes to check against. So most passwords less than 8 characters is going to be found within months and passwords longer than that but easily found via "rulesets" will be found in a similar timeframe.
The passwords being found in this set look very corporate in how they are setup. People were using "good" password rules: mixing Uppercase, Punctuation, LowerCased, Number, longer than 10 characters, etc. These are probably the ones most likely used elsewhere.
If you used your LinkedIn password anywhere else, or you use a similar pattern (say your password was 123LinkedInQ@$ and you use that pattern elsewhere so your Fedora password was 123FedoraQ@$, please change your password at those other locations, and please please use a different pattern.
2012-05-02
A History behind Code Names
Having kept a history of the Red Hat Linux code names a long time ago ... ** I wanted to remind people that they started off as an inside joke. Up until the late Red Hat Linux releases, most of the release names were done in a very closed mode. The release leads (Mark Ewing, Eric Troan, Preston Brown) might ask for a name (but you couldn't tell anyone except them what the link was) or a small cabal of people on a late night during the alpha process would choose a name.
The reasons for the names at that time was to a) blow off steam during long nights and little pay, and b) to get fans energized in trying to figure out what links they could come up with between releases. At some point the answer would be revealed and people got "points" on how close they were.. lots of little discussions on IRC, USEnet newsgroups, and mailing lists and it was free marketing. Looking at it this way, the original names were always an inside joke or puzzle.
After the puzzle was revealed, the names rarely were used by the community. Instead the people attracted to Red Hat Linux were more numbers versus names oriented. It is just how some people are.. the engineering types that who will call a CPU a 6500 Xeon versus a Beckton. They will know its die numbers and probably only remember Beckton from some joke about Intel marketing kicking cpus like Beckton to make it sound better. At its extremes, some people see codenames as meaningless marketing jingoism that hides the underneath true data from them.
Other people store information by names and connotations. They know that a Beckton class system is part of the Nehalem family of CPUs and what relationship it is between previous and later CPUs. In this case, the name is a bond, a way to tell what the product is, why the person is linked to it, and how they will get others to use this. In its extreme, numbers are codes that obscure why something exists. ***
If there is any way I can tell "Debian/Ubuntu users" from "Red Hat/Mandrake/Suse" users it is not the .deb/.rpm rift. It is how they remember each OS and the relationship between them. One group is very name oriented and the others is very number oriented.
In the end, I am looking at our (Fedora's) naming "crisis" as partially release day jitters (ever notice before every release we have a OMG CAN YOU BELIEVE X?) we have always had (since RHL 4.2 at least) and partially a difference in how people remember and communicate. Trying to come up with a way to make sure we communicate between these two groups **** will be something for the next 6 months.
** I need to update my website. Dear lord that is so 1998 HTML3.
*** I am not going to say whether this is left brained/right brained/front brained/backbrained.. because god I don't know. Has anyone done real high def brainscans to see if there is any orientation. To me without that data it is like saying "Left handed people use Fedora and Right handed people use Ubuntu.. I know this because I am left handed." EG complete malarky.
**** Yes there are people who can think both ways. There are always people who never fit into the simple dichotomies we humans like to make up to simplify our Spherical Chickens.
The reasons for the names at that time was to a) blow off steam during long nights and little pay, and b) to get fans energized in trying to figure out what links they could come up with between releases. At some point the answer would be revealed and people got "points" on how close they were.. lots of little discussions on IRC, USEnet newsgroups, and mailing lists and it was free marketing. Looking at it this way, the original names were always an inside joke or puzzle.
After the puzzle was revealed, the names rarely were used by the community. Instead the people attracted to Red Hat Linux were more numbers versus names oriented. It is just how some people are.. the engineering types that who will call a CPU a 6500 Xeon versus a Beckton. They will know its die numbers and probably only remember Beckton from some joke about Intel marketing kicking cpus like Beckton to make it sound better. At its extremes, some people see codenames as meaningless marketing jingoism that hides the underneath true data from them.
Other people store information by names and connotations. They know that a Beckton class system is part of the Nehalem family of CPUs and what relationship it is between previous and later CPUs. In this case, the name is a bond, a way to tell what the product is, why the person is linked to it, and how they will get others to use this. In its extreme, numbers are codes that obscure why something exists. ***
If there is any way I can tell "Debian/Ubuntu users" from "Red Hat/Mandrake/Suse" users it is not the .deb/.rpm rift. It is how they remember each OS and the relationship between them. One group is very name oriented and the others is very number oriented.
In the end, I am looking at our (Fedora's) naming "crisis" as partially release day jitters (ever notice before every release we have a OMG CAN YOU BELIEVE X?) we have always had (since RHL 4.2 at least) and partially a difference in how people remember and communicate. Trying to come up with a way to make sure we communicate between these two groups **** will be something for the next 6 months.
** I need to update my website. Dear lord that is so 1998 HTML3.
*** I am not going to say whether this is left brained/right brained/front brained/backbrained.. because god I don't know. Has anyone done real high def brainscans to see if there is any orientation. To me without that data it is like saying "Left handed people use Fedora and Right handed people use Ubuntu.. I know this because I am left handed." EG complete malarky.
**** Yes there are people who can think both ways. There are always people who never fit into the simple dichotomies we humans like to make up to simplify our Spherical Chickens.
2012-05-01
Why I voted for Spherical Cow
OK I liked it because it was an old physics joke.. actually the version I had dealt with was Spherical Chickens, (the Big Bang Theory used chickens), but the canonical version is cows. The joke as it was told to me many years ago had to do with Centralized Soviet planning and putting physicists in charge of dealing with egg production. The punch line of course being "First we assume a spherical chicken..." at which point any one who has had to deal with Physics realizes how far away it is from the real world and engineering.
I actually hoped my suggestion of Pop Soda would win so that we could bring up Mr Hotdogs long lost friend.. but it would seem it was not to be. But I voted for Spherical Cow because I was worried I would end up with the "Sulphur" release again. I also voted that naming conventions need to be revisited. Out of the list (stolen from Mo):
I actually hoped my suggestion of Pop Soda would win so that we could bring up Mr Hotdogs long lost friend.. but it would seem it was not to be. But I voted for Spherical Cow because I was worried I would end up with the "Sulphur" release again. I also voted that naming conventions need to be revisited. Out of the list (stolen from Mo):
- Yarrow
- Tettnang
- Heidelberg
- Stentz
- Bordeaux
- Zod
- Moonshine
- Werewolf
- Sulphur
- Cambridge
- Leonidas
- Constantine
- Goddard
- Laughlin
- Lovelock
- Verne
- Beefy Miracle
- Spherical Cow
Subscribe to:
Posts (Atom)
