The Substantially Similar Weblog

I’ve been moving into a new (to us) house over the last week and will probably be tied up another week or so before things settle down and the Internet connection is installed. I’ve gotten a lot of new stuff lately, ranging from a new phone (the Motorola v710, more on that when I have time) to a new coffee-maker to a new (electrical cordless) lawnmower. It’s been a long time since I was in the market for “new” (my last phone was a 1992-era Nokia) and — despite the wastefulness and consumerism of all this new stuff — I have to say a lot of stuff has improved noticeably in the last decade.

Anyway, expect more regular blog entries again in a week or two.

A few weeks ago, security guru Bruce Schneier wrote a blistering critique of the “Tree” security system· in the “doghouse” section of his newsletter, Crypto-Gram· (at the moment, the website for the product reports “the website you have requested has exceeded its daily bandwidth quota of 56MB and has been temporarily de-activated”). Ken Lavender, apparently an executive of the company, wrote the following retort, which I reproduce in full to insure with the hope that it will be widely disseminated:

 From: "Ken Lavender"  Subject: ICS Atlanta I am APPAULED at your "comments" that you had made on your website: ·> You have statements are nothing but slander & defamation. They shall be dealt with accordingly. Lie #1: "How do they demonstrate Tree's security? 'Over 100 professionals in mathematics & in computer science at Massachusetts Institute of Technology & at Georgia Tech, had sample encoded messages submitted to them. Not a single person could break this code!'" That is not the ONLY way we prove it. We have examples & offer to allow people to submit their OWN messages to have encoded to SEE how good the code is. So there are THREE methods, NOT just ONE as you IMPLY. Lie #2: "These guys sent unsolicited e-mails..." HOW do you KNOW that this was the case? Have any PROOF of such? NO! Lie #3: "And if all that isn't enough to make you run screaming from these guys, their website proudly proclaims: 'Tree Encoded Files Can Be "Zipped."'" Because they can be "zipped" does NOT mean that it is "bad encoding." The "code talkers" of ww2 used LANGUAGE to "code" the messages, and THOSE COULD BE "ZIPPED"!!! And that code was NEVER BROKEN!!! Lie #4: "That's right; their encryption is so lousy that the ciphertext doesn't even look random." AGAIN, HOW would you KNOW??? Did you break it? NO! And what is "random"??? random : without definite aim, direction, rule, or method "So lousy"? HOW WOULD YOU KNOW??? You would have to KNOW how we encode BEFORE you can make such a statement, & YOU DO NOT KNOW HOW!!! If it is SO LOUSY, how come NOBODY HAS BROKEN IT YET??? And we have people ALL THE TIME trying to, with ZERO SUCCESS. I do not like you slandering something that you do not understand. ATALL!!! The ONLY question you asked was "how long is the key" AND THAT WAS IT! HOW long was the key that the 'code talkers' used? ZERO!!! JUST AS OUR IS. The encoding routine was created, tested, & verified on PAPER & PENCIL WITHOUT COMPUTERS! A child could encode data using our routine. The computer is merely used to "speed-up" the process, NOT TO CREATE IT. Our routine is based on LANGUAGE, NOT MATH. So all of you "comments" are just false, misleading & just plain ole lies! SHOW & PROVE that it is NOT random. What is the PATTERN THEN??? I am DEMANDING A FULL RETRACTION OF YOUR COMMENTS & A FULL, COMPLETE APOLOGY TO THESE AND ALL STATEMENTS. I am a person who tries to work with people as a man w/o having to "drag" others into the mess. Others? THE COURTS. You have violated Calf law by your statements. [Text of California Civil Code Section 46 deleted.] Your LIES have damaged my respect in my job & has damaged any sales of this routine. You have ZERO proof of your "comments," ANY OF THEM!!! I beseech of you, do the RIGHT THING and comply. I DO NOT wish to escalate this matter any higher. And remember this, Tree is based on LANGUAGE, NOT MATH!!!!!!!!!!!!!!!!! [Phone number deleted out of mercy.] 

Oops! My sources inform me that the animal I identified as an alpaca is actually a llama. In the interest of accuracy and completeness, here is the real alpaca, who was not helpful with the RAID problem, either. This award-winning alpaca’s owner’s face has been clumsily obscured for her own privacy.

In case you were wondering, this is the alpaca I was standing by while troubleshooting the RAID issue. (click for the full-sized image).

The alpaca did not have any ideas why the hard drives were failing, although it did suggest that perhaps I check to see if the the drives were too hot with the S.M.A.R.T. tools.

Update: my sources tell me this is a llama; I’ve fixed the image name accordingly for the benefit of Google images.

I’ve been in Michigan for a few weeks now with my wife and her family and will be here another week. Internet access is at best intermittent, so I haven’t (and won’t) be blogging much.

The technical highlight so far has been trying to troubleshoot problems with the RAID on bostoncoop.net over a cell phone while at the county fair, surrounded by pigs and alpacas.

Speaking of RAID problems: can anyone suggest why more than half of our 200G drives would fail in various ways within a year of installation? They are from various manufacturers (WDC and Maxtor), and have failed differently, and some are giving SMART errors only days after installation. Almost all of the other equipment is new as well. Most commonly the failure shows up as kernel DMA errors, which as best I can tell don’t really point to any particular cause. We suspect temperature problems—is 50-60 celsius enough to be a serious problem?

In particular, I’d appreciate any suggestions as to how to limit the problem to hardware vs. software, hard drives vs. controller(s) vs. motherboard vs. memory… And so forth.

At long last, my bug #184361 is fixed and my one line patch has been accepted! This is a happy day for me. I receive dozens of hits per day related to this bug, which prevents users from cancelling their own print jobs without authentication. I’ve also had to respond to a lot of email over the last couple of years helping people rebuild cups with this patch.

My only regret is that my useful linux page is slightly less useful now that my patch has been accepted.

I finished the second half of the bar exam Thursday evening. I was actually going to write a blog entry during the lunch break, perhaps to enter the book of world records as the only person ever to blog in the middle of a bar exam, but I decided it would be better to review Secured Transactions. As it turns out, there were no Secured Transactions questions on the essay portion, nor were there any Commercial Paper questions or several other areas of law I had studied intensely. It was a bit of a let-down, although I’m sure many people were happy not to see these questions.

I am firmly convinced that the material tested on the bar exam—particularly the multiple choice section—has almost no bearing on one’s ability to practice law. In fact, it might even prepare you to be a worse lawyer than you otherwise would be. Most legal questions are arguable, and if you’re in litigation it’s probably because the outcome isn’t clear. The most important skills you need to be a competent attorney involve dealing with clients, researching, writing, negotiating, developing creative arguments, etc.. Answering 200 multiple choice questions on doctrines that aren’t even the law any more in any jurisdiction (the Doctrine of Worthier Title, Shelley’s Rule, … even the Rule Against Perpetuities hardly exists anywhere unmodified) is pretty far off base.

Someday, when I have some stature in the legal community, I want to lead a charge to change this ridiculous examination once and for all. I admit that some sort of threshold exam is probably a good thing; and there might be some value to learning certain basic legal doctrine that you would not otherwise cover in law school (I certainly never learned anything about negotiable instruments).

A better exam, I think, would present you with a fact pattern that you couldn’t possibly have seen before that doesn’t fit neatly into any legal box, and ask you to analyze the situation and present possible theories for resolving the problem. Ideally, you wouldn’t even be able to classify the question as fitting into a particular doctrinal area, e.g., corporations vs. evidence. You would have to discuss how these all fit together: for example, there might be an issue of breach of fiduciary duty in a partnership but it might be difficult to ever prevail in court because of the hearsay rule and the statute of limitations.

Instead, we get questions like this:

I finished the multiple choice part of the Massachusetts Bar Exam today. Now just ten essays, and by 6pm tomorrow I’ll be a free man, although not yet a lawyer.

One of the basic canons of the multiple choice portion of the bar exam is “if the answer is a doctrine you’ve never heard of, it’s the wrong choice.” Unfortunately, a countervailing canon is “the bar examiners often like to use less-known synonyms for well known concepts to trick you.” (I made this canon up myself, but it’s true.)

I got one of these today, and went with my intuition/countervailing canon idea, and as I’m checking it out now, it turns out I was right. The “doctrine of after-acquired title” is equivalent to “estoppel by deed.” Well, it’s actually not quite equivalent, because estoppel by deed only applies to prevent the grantor from denying the validity of a deed, invalid at the time of the conveyance because the grantor didn’t have good title at the time but did at a later date after the conveyance, while the doctrine of after-acquired title is good against other claimants, but it’s basically the same idea.

So, at least one right out of 200!

(How many hits will I get in the future on a google search for “doctrine of after-acquired title”? We shall see…)

Update: Ari points out that a google search for doctrine of after-acquired title with no quotation marks gives this blog entry as the number one result.

Alas, the meanies have finally started to invade bostoncoop.net, my own little web/mail/email list server. I knew it would happen sooner or later, but I just wish attackers would focus on the bad guys.

First, I’m starting to see more and more spam in the various wikis hosted at bostoncoop.net. Apparently, the spammers have developed bots that insert commercial links into common wikis that don’t restrict access. I’ve gone through and manually removed the commercial links (although of course they persist in the wiki history).

I feel like I deeded my back yard as an open nature conservancy in public trust, and people are leaving cigarette butts all over the place.

I’m also experiencing fairly regular attempts to crack into the system by people who scour the web for PHP vulnerabilities. None of them have been successful, and I’ve been learning more and more about what I need to do to better lock down the system, but it’s still sad to have more and more volunteer sysadmin time going to these sorts of “nonproductive” uses.

A word of advice to any server admin newbies out there: if you have any place where people are allowed to upload files on your site, don’t call it “upload.php,” “upload.html,” or anything similar. I expect I could have avoided 99% of the PHP-based cracking attempts just by renaming the upload URL to something nonobvious. (I know this isn’t “real” security, but just about every attack I’ve seen starts with a google search for upload.php or something similar).

Another tip: most Apache/PHP installations run PHP as an Apache module rather than as a CGI script. This means that the standard means for controlling CGI—Options ExecCGI in httpd.conf and .htaccess—are ineffective. If you allow anything with a .php extension to run by default, you are inviting trouble (trust me). You would think it would be well documented and easy to find how to turn off PHP execution except where enabled, but in fact it wasn’t. The best solution I found was to put the following in httpd.conf for your site’s directories:

php_flag engine off

Then any user who needs PHP enabled can enable it on a directory-by-directory basis by putting the following in .htaccess:

php_flag engine on

I tried disabling PHP per-directory with RemoveType .php RemoveHandler .php in the .htaccess file, but this apparently had no effect.

As GNU/Linux and other free software enters the mainstream, it’s important for all of us to do what we can to maintain proper hygiene. There are plenty of people interested in exposing security failures in the free software world, and we should give them as little fodder as possible. The recent Mozilla shell glitch (affecting only Mozilla on Windows systems) may be only the tip of the iceberg.