January 2015 - Talk - lists.gtalug.org

Crypto Question: Where do you get your entropy
by D. Hugh Redelmeier 20 Jan '15

20 Jan '15

[Scott asked that we post our questions from tonight's meeting] Where do you get your entropy? Entropy (real bytes of random numbers, not pseudo-random numbers) is key for cryptography. - when generating keys for public-key cryptosystems (RSA, ECC, ...) - when generating session keys via a Diffie-Hellman exchange - challenging the other side in various ways (eg. proving liveness or proving possession of a private key) - probably other cases that I'm not remembering at the moment In many cases a Cryptographic Pseudo-Random Number Generator (PRNG) is good enough, but not these. Sometimes a Cryptographic PRNG can be used to "stretch" entropy: kind of like stretching soup by adding water or milk. Adversaries can easily break your cryptosystem if you don't have sufficient entropy. It's that bad. What sources do you use? /dev/random and /dev/urandom are the Linux channel for entropy. There are various sources that can be pooled by the kernel: - timing of unpredictable event (e.g. user keystokes, disk seek timing, ethernet packet timing, ...). The only one I kind of trust is the keystrokes thing, and that doesn't work for servers. Others might be controlled by or predictable to foes. Keystrokes are not as good as one would like. For example, USB keyboards have keystroke timing quantized by the USB scanning rate. - Recent Intel CPUs have true RNGs. (Assuming that they were not subverted by the US Government or something else. Or just plain buggy, something that might not be detectable) - external entropy source. - Scott mentioned several. One DIY example: harvest the americium pellet from a smoke detector and place it directly on a camera sensor. This makes a kind of Geiger Counter and Geiger Generator (I made that second term up). Physicists think that radioactive emissions are unpredictable (except for chain reactions) and thus should be good entropy generators. - Chris mentioned a Kickstarter(?) project that has produced what they claim is an entropy generator on a USB stick.

8 9

scary article about DRAM
by D. Hugh Redelmeier 20 Jan '15

20 Jan '15

It seems that certain access patterns can induce memory errors. <http://www.zdnet.com/article/flipping-dram-bits-maliciously/> This also links to a five year old article which shows DRAM errors are not as rare as I thought/hoped. <http://www.zdnet.com/article/flipping-dram-bits-maliciously/>

2 1

Just how cheap is an OEM license for Windows 8.1 with Bing?
by D. Hugh Redelmeier 20 Jan '15

20 Jan '15

This disclosure is interesting: <http://www.zdnet.com/article/how-much-does-microsoft-make-from-pc-makers-wi…> I commented on this article: What is a "configuration discount"? Is it just some fig leaf to claim that this isn't free? If I were DoJ's anti-trust folks, I'd be very interested. Microsoft is giving OEMs Win8.1bing while trying to charge those that use Android.

2 1

Talk for February?
by Matt Lee 18 Jan '15

18 Jan '15

I'm coming to Toronto for the week of 16th-20th February, and if nobody's talking, I'd like to talk about some of the cool stuff we're doing at Creative Commons. --- Matt Lee Creative Commons Boston, MA, USA

3 2

Ubuntu need Adobe Flash?
by Chris Aitken 18 Jan '15

18 Jan '15

Hi, I haven't posted here for years. I guess Ubuntu has been working well for me, so I haven't had the need. I can't play videos on the Internet. I get an error that ... "Firefox has prevented the outdated plugin "Adobe Flash" from running on youtube.com." I get similar errors (that Adobe Flash needs updating) from other sites - fo instance trying to play videos Posted on facebook. My Firefox is 29.0 Mozilla Firefox for Ubuntu canonical - 1.0 I'm running Ubuntu 12.10. I tried to install in this way ... chris@owner-HP-Compaq-dc5750-Small-Form-Factor:~$ sudo apt-get install fashplugin-nonfree [sudo] password for chris: Reading package lists... Done Building dependency tree Reading state information... Done E: Unable to locate package fashplugin-nonfree chris@owner-HP-Compaq-dc5750-Small-Form-Factor:~$ ^C chris@owner-HP-Compaq-dc5750-Small-Form-Factor:~$ I thought re-installing Firefox might bring with it updates, but it seems I already have the latest version ... chris@owner-HP-Compaq-dc5750-Small-Form-Factor:~$ sudo apt-get install firefox Reading package lists... Done Building dependency tree Reading state information... Done firefox is already the newest version. The following packages were automatically installed and are no longer required: linux-headers-3.5.0-17 linux-headers-3.5.0-17-generic suckless-tools Use 'apt-get autoremove' to remove them. 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. chris@owner-HP-Compaq-dc5750-Small-Form-Factor:~$ I tried the gui Synaptic Package Manager, which offered the hope that ... flashplugin-installer (version 11.2.202.359ubuntu0.12.10.1) will be re-installed No such luck ... W: Failed to fetch http://security.ubuntu.com/ubuntu/pool/multiverse/f/flashplugin-nonfree/fla… 404 Not Found [IP: 91.189.92.201 80] Also, I tried Epiphany, to see if the problem is system-wide or browser-specific. I got similar errors trying to play videos. Sigh. Any ideas? I'm off to be soon, but I'll stay up for a little while, in case anyone is online. Chris Aitken

18 42

Seminar by Professor Grabriella Coleman at York on Tuesday
by D. Hugh Redelmeier 18 Jan '15

18 Jan '15

I went to her talk at U of T on Friday and found it very interesting. I imagine that Tuesday's talk is the same. <http://www.yorku.ca/yuevents/index.asp?Event=33152&Category=0&ShowCal=&Time…> Unfortunately the York description is scant so I'm including the U of T description. ---------- Forwarded message ---------- From: Dimitris Hatzinakos <dimitris(a)COMM.UTORONTO.CA> To: IPSI-L(a)listserv.utoronto.ca Date: Mon, 5 Jan 2015 11:20:21 -0500 Subject: [GW-C] Seminar by Professor Grabriella Coleman, Friday Jan. 16 IPSL-L List Occasional postings from the Identity, Privacy and Security Institute, University of Toronto http://www.ipsi.utoronto.ca ----------------------------------- SEMINAR ANNOUNCEMENT Friday, January 16, 2015 12:00 noon Room MC254 (5 King’s Colllege Road) Professor Gabriella Coleman McGill University “Hacker, Hoaxer, Whistleblower, Spy: The Many Faces of Anonymous” Anonymous, a group of hackers and activists came to the fore in 2008 when they attacked the church of Scientology. Since then their collective action has come up against corporations and supported the Arab revolutionaries. Coleman will share her story of becoming an Anonymous confidante and interpreter. She talk about the motivations of the group, the many facets of their culture, and the increasing importance of hacker activism more generally. Gabriella (Biella) Coleman holds the Wolfe Chair in Scientific and Technological Literacy at McGill University. Trained as a cultural anthropologist, she researches, writes, and teaches on computer hackers and digital activism. She is the author of “Coding Freedom: The Ethics and Aesthetics of Hacking” published by Princeton University Press and Hacker, Ho -- Dimitrios Hatzinakos Professor Bell Canada Chair in Multimedia Director, Identity, Privacy and Security Institute (IPSI) Electrical and Computer Engineering University of Toronto dimitris(a)comm.utoronto.ca ---------------------------------------------------- IPSI-L Listserv IPSI-L is a low-traffic moderated list of news and upcoming events sent to members of the privacy and security community from the Identity, Privacy and Security Institute of the University of Toronto (http://www.ipsi.utoronto.ca) If you have an event you would like to promote or news to share, send an email to IPSI-L(a)listserv.utoronto.ca. Messages will be reviewed before posting. To SUBSCRIBE, send a blank email to: IPSI-L-subscribe-request(a)LISTSERV.UTORONTO.CA. To UNSUBSCRIBE, send a blank email to: IPSI-L-unsubscribe-request(a)LISTSERV.UTORONTO.CA.

1 0

China's Baidu builds its own supercomputer to beat Google at image search
by Thomas Milne 16 Jan '15

16 Jan '15

*China's Baidu builds its own supercomputer to beat Google at image search* http://news360.com/article/274664893 Shared via News360 <http://www.news360.com/app>

2 1

Running Hadoop on a 32 bit linux (Fedora 21 or Linuxmint 17) computer
by Clive DaSilva 16 Jan '15

16 Jan '15

Hello all I decided to take a shot at Hadoop as a lot of my career adventures deal with manipulating large data streams. While Hadoop usually runs from a cluster of Linux boxes, for self-experimental purposes, some of the distros have included Hadoop or work- alikes( Apache Bigtop for Ubuntu being one example which insists on a 64 bit box) for single node activity, but it's not clear as to whether you need a 32 or 64 bit computer, as after two days of googling the subject, I find the documentation to be quite vague. Does anyone here have experience with this beast? Any suggestions, links, etc would be appreciated. --------- Clive DaSilva - cdasilva(a)iprimus.ca --------- GTALUG Talk Mailing List - <mailto:talk@gtalug.org> talk(a)gtalug.org <http://gtalug.org/mailman/listinfo/talk> http://gtalug.org/mailman/listinfo/talk

2 2

OFF: The worst HTML/javascript code I've ever seen
by Mauro Souza 16 Jan '15

16 Jan '15

I was browsing the interwebs today when I got an article on The Daily WTF: http://thedailywtf.com/articles/comments/pass-by-nullpointer There's a Java null pointer exception triggered by javascript, there's funny collor definitions (like blueBackground = #F6F9FC), there's recreation of date functions, there's a table inside a div inside a span inside a li... The offending site is hosted at http://203.143.139.44:8080/wps/portal/en/site/home?country=vietnam But, please, use curl or wget (or axel, aria2, lynx -dump -source, telnet, netcat) to get that page. You browser will curse you if you force it load this heavily garbled code. Mauro http://mauro.limeiratem.com - registered Linux User: 294521 Scripture is both history, and a love letter from God.

1 0

LeafletJS workshop at #maptime next Thursday
by Richard Weait 16 Jan '15

16 Jan '15

LeafletJS is a general purpose library to put maps on web pages. A LeafletJS workshop will be part of #maptimeTO, next Thursday. LeafletJS is open source (MIT license) and runs on Linux (plus probably everything else with a browser) Event announcement follows. Please RSVP http://www.meetup.com/OpenStreetMap-Toronto/events/219769107/ regards, Richard Time: 1830H Date: Thursday 22 January 2015 Location: Mozilla Community Space, 5th Floor, 366 Adelaide Street West Map: http://www.openstreetmap.org/way/61430204 #Maptime is time for learning and sharing knowledge at the intersection of "Maps" and "The Internet". Beginners are welcome. Bring your computer so that you can work on your projects. Maptime starts with short show and tell. Attendees demonstrate their current projects and share key lessons, or ask for assistance. Maptime proceeds with workshop time when attendees self-study, or assemble in ad-hoc groups for collaboration. Maptime is friendly, diverse and inclusive. Join us. This month Joshua Frazier will lead a workshop on the basics of the Leaflet JavaScript library (leafletjs.com) the most popular open source solution for publishing maps on the Web. Join us to create a map on a web page, learn about map tiles and how Leaflet uses them, explore a variety of map tiles based on OpenStreetMap data, add and customize markers and popups, manipulate mouse interactions, and more! No web development or JavaScript experience necessary. Maptime is dedicated to providing a harassment-free experience for everyone, regardless of colour, ethnic origin, gender, gender identity and expression, sexual orientation, disability, physical appearance, body size, race, age or religion. We do not tolerate harassment of event participants in any form. Sexual language and imagery is not appropriate for our events. Participants violating these rules may be sanctioned or expelled from the event at the discretion of the organizers.

1 0