Archive 6.2.2006 - 16.2.2006

Beautiful, New RFID World

RFID: Password cracking made easy

"A normal cell phone contains all the components needed to compromise all RFID tags in the immediate vicinity," explained Shamir. He did not examine all types of transponders, but only those of the most widespread brand, and they are completely unprotected. However, he attributes the vulnerabilities found less to this specific, unnamed manufacturer than to the need to reduce the production costs of RFID transponders at all costs. This forced developers to throw all security requirements overboard.

And when will they found the Stasi again?

The German Bundestag supports suspicionless surveillance of telecommunications:

With almost all the votes of the grand coalition, the Bundestag decided today, Thursday, after an intense debate, to apply for the storage of telephone and internet data for six months (PDF file). The federal government is thus called upon to implement the directive, approved by the European Parliament, for recording user traces "with moderation" and in the "minimum requirements". The directive must first be confirmed by the EU Council, which the ministers of justice and the interior have planned for the beginning of next week.

You have to let that sink in: the Bundestag is demanding the implementation of the EU directive - before the EU Council has even confirmed this directive itself. With such commitment, we can be sure that the federal government will massively push to destroy the last bit of data protection on the net.

The fact that the whole story in the EU was massively discussed among the states themselves and that the current approach is nothing more than a brazen collusion to push it through - that doesn't matter. We also only creatively interpret the Basic Law when we plan to murder innocent people, so why shouldn't we also serve the rights of citizens on a silver platter to the surveillance authorities.

All of this, of course, garnished with the squealing of "data protection is protection for criminals" and other smear slogans. Where are the great investigative successes through the already existing excessive surveillance possibilities? No presentable results - because it's all just stupid lies.

Disgusting, how under the guise of fighting terrorism, citizens are betrayed and sold out. With what persistence our elected representatives shit on our rights and only have a police state in mind - red or black, both just scum. They all outraged themselves about the GDR, and now they are all so keen on building the same surveillance state themselves.

angry face

Google Maps Plugin for Address Book - Brian Toth - a plugin for the Apple Address Book that allows you to jump directly to Google Maps from an address.

Karlsruhe overturns Aviation Security Act

Karlsruhe slaps down the government:

The legislator would not have been allowed to pass this far-reaching provision in the Aviation Security Act at all, the constitutional judges further criticized. Article 35 of the Basic Law only authorizes the deployment of the Bundeswehr in the event of disasters and accidents, the court clarified.

Fortunately, this absurd law is now off the table - provided the government follows the directive. At least its harshest representative - Schily - is no longer in office, hopefully his successors have more sense (what am I telling myself - now the wheelchair user is in charge ...)

Management by Stupidity or by Corruption?

How is the ALGII software actually doing?

The subsidiary of Deutsche Telekom has, however, by now realized that the existing solution is "no longer repairable." There are simply too many fundamental errors in the software's architecture.

Ok, so far, so bad. And what is the Federal Employment Agency doing? Quite simple:

The series of mishaps with the unemployment software A2LL has, according to information from Netzeitung, prompted the Federal Employment Agency (BA) to commission T-Systems with the programming of a completely new software. "T-Systems is working on a fundamental solution," it was said in circles familiar with the situation. The creation of a new program is taking place "within the framework of the existing contract." The BA did not want to comment on request from Netzeitung.

Translated: someone has massively messed up a software, admits themselves that it is no good and gets the order for a new software within existing contracts (i.e. without tender!). This is how our tax money and unemployment insurance contributions are wasted. And the reason?

The crucial point for the BA is the compatibility with A2LL. "It must be possible to easily take over all eight million data records," it was said. For this reason, the authority has also decided to commission T-Systems again with the programming. It is important to have T-Systems "on board," even if the company is partly responsible for the A2LL fiasco. The BA has explicitly decided against the decentralized solution of the company Prosoz.

Please what? There was an alternative solution offered. But the loser from last time was used again to make the data records transferable? Who guarantees this? T-Systems has already proven its inability - why does anyone believe that they can correctly transfer the data if they cannot process it correctly?

Data transfers are really not tied to individuals or companies - instead of making the goat the gardener again, T-Systems should have been obliged to document and disclose all interfaces, data formats, and structures. And then make a tender based on this - and simply define compatibility with the old data base as a condition. This time, please with severe penalty clauses for non-fulfillment.

Either someone in the project management at the BA is completely incompetent, or completely corrupt. I can't think of any other explanation. When you consider the debacle with the online system, the whole thing becomes clear - with the money that was squandered there, one could have helped some unemployed people well over the winter.

MUlliNER.ORG : Nokia770 - a whole range of tools for the Nokia pad, such as the Wireless Tools or dsniff. Interesting for analysis in case of WLAN problems

SlimserverAndNokia770 - how to use the Nokia Pad with the SlimServer as a music player.

Show the flag against Nazis

The Netreaper reminds me that there is a counter-action to the Nazi march in Münster on February 18th. So actually even several counter-actions.

Show flag against Nazis

Data Protection and Security Interests

A real gem from the Niedersachsen data protection dispute, which concerns the transfer of data protection functions to the Interior Ministry:

Critics fear that moving to the Interior Ministry could compromise the independence of oversight. Minister Schünemann dismissed this concern but acknowledged that security interests and data protection interests are not always aligned.

Wow, what a novel idea, who would have thought that conflicts with data protection interests might exist in the Interior Ministry? Could this perhaps be the reason why data protection officers should be independent of ministries?

Pressure on Hardware Manufacturers

Suse Linux in the future without proprietary drivers - good thing, in my opinion. The more pressure is put on hardware manufacturers, the more likely we will actually get better OpenSource drivers or interface disclosures.

I actually enjoy the job... - "Fiction" of a monitor and his comment on data retention.

Mobile? 870 MB are Mobile?

Mobile Offline-Variante der Wikipedia massiv erweitert - it is now 870 MB in size. Somehow, this scares me, as we are already hitting the limit with the 1 GB memory card in mobile devices. Hey, for my Nokia Tablet I only have 512 MB on the memory card! (well, with that I can always search online)

Embarrassing SSL Blunder at GeoTrust

In the USA, there is a case of phishing with valid SSL certificates. There, a certificate was issued via GeoTrust - the guys who also bought Trustcenter in Hamburg after it went bankrupt - to someone who then used it to fake a banking site. And so well that it is no longer easily possible for a customer to determine its authenticity.

SSL is no guarantee - it is only proof that someone has been issued a certificate. But you have to know whether you trust the certificate issuer - and unlike Web-of-Trust approaches, there is usually exactly one single certificate issuer, not a group or even an entire network.

If the vulnerability is in the certification of the certificate issuer, it doesn't matter how many or few bits the key works with ...

pyOpenSSL - Python interface to the OpenSSL library - quite complete bindings. Looks much better than the previous libs I have looked at.

Sabrina and Twister - interesting "fictions" that unfortunately are not quite as fictional as one would like. Well-written stories about data protection, privacy, surveillance, etc.

Statistical programming with R

I had already seen the first part (environment and basic structure) of "Statistical programming with R" earlier. Meanwhile, part 2 (functional programming and data analysis) and part 3 (object-oriented programming) are also online. Exciting for number crunchers.

Yahoo! Design Pattern Library - A collection of standard patterns in web GUI applications and how to solve them with the Yahoo JS library. Very interesting as a cookbook.

Yahoo! UI Library - the JS/Ajax lib used by Yahoo for its own applications. BSD license!

You just have to love Ask MetaFilter

Honestly - someone has a hole in their head and tries to see how deep it is with a paperclip. And what's the comment?

Not to derail, but, does anyone else think it's a really really bad idea to put random objects down holes in your head?

What if it was a reset button?!

screen4DSLR : Changing Focusing screen for Canon DSLR - another provider for replacement focusing screens for digital SLRs (not just Canon!). This one has lower prices (probably because it uses standard focusing screens and just cuts them to size).

Spirit reaches Homeplate

Spirit hat Homeplate erreicht - a rather strange rock formation on Mars. The area really does look quite strange.

Kids ...

My image blog hugoesk.de (meanwhile deactivated again) seems to be enjoying great popularity lately - various images have appeared as background graphics on myspace.com and xanga.com sites. It's kind of strange to owe several GB of transfer volume (about ten times the traffic my main blog has) to some kids... (and I haven't even written anything about Tokio Hotel).

Well, so educational measures have been activated again (and no, the image used is neither obscene nor offensive - just a polite request):

# Deeplinking von http://www.xanga.com/
RewriteCond %{REQUEST_FILENAME} ^.*\.jpg$
RewriteCond %{HTTP_REFERER} ^http://www\.xanga\.com/.*$
RewriteRule .* /wp-images/bilderklau.jpeg [L]

# Deeplinking von http://www.myspace.com/
RewriteCond %{REQUEST_FILENAME} ^.*\.jpg$
RewriteCond %{HTTP_REFERER} ^http://.*\.myspace\.com/.*$
RewriteRule .* /wp-images/bilderklau.jpeg [L]

Of course, my images are all under a CC license, so they can take them if they want. But that doesn't mean my traffic and my computer resources are also under a CC license - and especially with full-size JPGs, that's quite a bit of volume and computer resources. One should at least follow the forms (e.g. ask first if you can't handle the traffic yourself).

A single image in January with 3500 and this month already with 1500 hits has easily consumed several GB of volume - and these are only two sites that link to it. They seem to have a really big (and online-active) circle of friends, those two girls.

And backlinks (which would have been the minimum according to the CC license I use) they naturally haven't set either...

Strategic Labor Market Policy

Müntefering wants to cut ALG II for young unemployed people - because if you don't want to do anything about youth unemployment and the lack of training places, then you at least want to reach into the pockets of those who have nothing. It's logical, right? No? Well, it's the SPD's idea of labor market policy ...

But no one knew anything about us

CIA asked Germans for Al-Masri information - the whole edifice of lies is slowly collapsing:

The news magazine "Der Spiegel" reports that there were contacts between US and German security authorities about the case during the abduction of the German Khaled Al Masri by the CIA. According to this, during Al Masri's captivity in Afghanistan in May 2004, two US agents contacted Bavarian and Baden-Württemberg investigators who were monitoring the Islamist scene in Al Masri's hometown of Neu-Ulm.

Online aerial images of Germany

Ok, I officially admit, I am impressed! Honestly, the idea of simply linking an address to a point on the map is great. Even if our area is only available with rather sparse resolution again. Great web application, big praise to the developers.

I'm not a hater, I just flush a lot.

It's always fascinating to see what questions are asked on the internet - and get answers!

Devil's grin

Clear, I pack data to Google ...

Privacy advocates are not enthusiastic about Google Desktop Search 3:

On February 9, 2006, a beta version of Google Desktop Search was released, which allows you to find documents stored on different computers. This is achieved by storing the relevant files on the Google server, so you need to have and use a Google account to use this feature.

Great idea. Of course, I'll put data from my workplace on a Google server. Where it's readily available for anyone who gains access to the boxes. Very big idea. Google may have the motto "don't be evil" - but they should also think about the motto "don't be stupid" ...

Language Design Is Not Just Solving Puzzles

Language Design Is Not Just Solving Puzzles is a rather interesting article by Guido van Rossum about the impossibility of an elegant syntax for multi-line lambdas in Python. Worth reading, and in large parts I agree with him. However, I then stumble over such a last paragraph:

And there's the rub: there's no way to make a Rube Goldberg language feature appear simple. Features of a programming language, whether syntactic or semantic, are all part of the language's user interface. And a user interface can handle only so much complexity or it becomes unusable. This is also the reason why Python will never have continuations, and even why I'm uninterested in optimizing tail recursion. But that's for another installment.

I am quite willing to accept that continuations are complex - but not because of the interface. For the interface for continuations, you only need the callcc call to bind the continuation and a simple function syntax to trigger the continuation. The main problem with continuations lies in the cooperation with generators and exceptions - what happens when a continuation is triggered within a generator? What happens when an exception is triggered within a continuation? These are the difficult aspects - which, by the way, also make Scheme implementers sweat, which is why exceptions are not particularly popular there (the same problem, just viewed from the other direction).

So okay, no continuations in Python - even though we already have poor-man's continuations with pickable generators (or with greenlets, or with cloneable coroutines, or one of the many other approaches to obtain subsets of continuation features).

But what on earth is complex about tail-call optimization (because it's not just about tail recursion)? It is so primitive that it can be implemented transparently for the programmer - if a tail call is present, do not note a return address on the stack, but reload the parameters in the stack frame and note a simple jump. If you want to be nice, you can introduce a pseudo-function "tailcall" that throws an exception if it is not to be executed in a tail call position. There may be further conditions under which tail calls cannot be optimized - but these can also be incorporated into a corresponding check.

It is precisely the function overhead that makes some algorithms only awkwardly implementable in scripting languages. And tail-call optimization would definitely help here. Especially in situations where you have a chain of small function calls. As far as I'm concerned, it can also be an optimization that is only activated at -O (or -O2 or something else).

Powerful Remote X Displays with FreeNX - interesting for remote servers, as it has significantly better responses and lower bandwidth requirements than X or VNC.

RENAISSANCE Le site officiel du film de Christian Volckman - en salles en mars 2006. - looks interesting. Ok, I don't understand a word, but the pictures ...

Sin City

Sin City I somehow didn't manage to watch in the cinema - every time we wanted to there were either no tickets, or no one could, or then the movie was no longer in the cinema. Quite stupid - but now I bought it on DVD. Wow. Impressive - absolutely impressive. Of course, the plot is like in the comics - relatively little demand, relatively much violence. But the implementation is gigantic.

By the way, I now also know why the Apple cinema displays are called that.

VMware Server now free

VMware Server is now free like free beer - and it should remain so after the beta. Great deal, because VMware is after all still the undisputed king among virtualizers - even under Linux. The open-source projects still have a lot to offer to get close to what VMware Server offers.

But if you want to try it out on your own host (which is quite easy due to the simple installation): make sure that the host does not have any other user accounts. Because VMware Server mercilessly uses all accounts that are set up on the system itself. Every user with whom you can log in - and that can indeed be a trivial mail user - can then create virtual machines and control public virtual machines (which are basically all created as root) and delete them.

The whole permission management is generally a bit of a hairy topic with VMware Server - it is decided based on the system permissions for the configuration file of the virtual machine. This is convenient - you just need the known tools - but also quite unintuitive during a first installation. And for example, I couldn't get the permission management for creating machines activated (for this, a special check file is created, whose permissions then say whether a user is allowed to create a new machine or not).

But once it's running smoothly (I had more trouble with X11 on the Mac - ssh -Y instead of ssh -X is the answer), it's a fine thing. Debian guests use minimal memory through the VMware tools, at least when they are not actively in use - and the management with the graphical console or the web interface is also quite nice. I think with a new machine this could really appeal to me - especially since you can then set up such a machine from the beginning with minimal users and push all services into the virtual machines.

However, I have already noticed that my simon is somewhat underpowered when it comes to virtualization. But a Hetzner DS 5000 or 7000 with extra storage could fit quite well there.

Django Templates are not limited

shannon -jj behrens thinks that Django template language is limited - because it doesn't have functions with parameters to do html snippet reuse. Of course the official - and simplified - answer to this is, that Djangos template language is that simple by design, so that it can easily be learned by non-programmers (as often designers aren't necessarily programmers). This is a quite good reasoning, but I think it's a bit too simplified.

So here is the longer - more complete - answer to this accusition: the Django template language isn't limited at all. Yes, I know that the "include" and "block" tags aren't parameterizable and so aren't often that useful for more complex situations (at least if you don't want to end in namespace hell due to passing some template-globals in the context).

So what should you do if you notice that your templates would need more complex code? One way would be to precompute the data in the view function and pass it on via the context to the template - that way the template has the ready data and can directly present it.

But what to do if you can't precompute, because you are using generic views? You could wrap your generic view with your own code and call the original generic view in that function with the modified context. That way you have the same benefit as above - youre templates have the data readily available. If you have many view functions that all need the same context enrichment, you can write your wrapper as a decorator - and just decorate the generic views and use those decorated functions in your urlpatterns.

But what if even wrapping isn't the answer? Shouldn't there be some way to do more complex code without all that wrapping? Sure there is! The answer are custom template tags. This might sound like a bit of overkill, but believe me, writing some template tags isn't really that hard. There is documentation on using and extending the template system in python

An even easier way to write your own tags is to use the "simple_tag" or "inclusion_tag" helpers in django.template.Library. Those functions allow to build simple tags very easily - the inclusion tag will base it's output on some template snippet, so you can see it as a template function with paramerters. A lot of usage of custom templates is in the contrib/admin stuff.

The main problem with the newer stuff in the code is, there is documentation missing for it. Hopefully that will be solved over time. But please, if the next time someone tries to tell you that the Django Template Language is to primitive, don't believe him. The Django Template Language is easy to grasp for non-programmers - but it's very extensible for Python programmers. And you extend it in the language you like - in Python.

.eu Domain Debacle - about the dirty tricks used to infiltrate the Sunrise Period.

HolisTech Limited Free Software, pwsafe - Password-Safe for the Nokia Tablet.

People Sacrificed to the Markets

This is what Yahoo - which, according to Reporters Without Borders, has handed over data of dissidents to the Chinese police does:

The human rights organization Reporters Without Borders calls on the Internet service provider and portal operator Yahoo to publish a list of all "cyberdissidents" whose data the company has handed over to Chinese authorities, particularly. The organization claims to have uncovered that the dissident Li Zhi was sentenced to an eight-year prison term with the help of Yahoo in December 2003.

So people are sacrificed and betrayed just to reach the Chinese market, which is interesting for companies. What a great achievement. The arrogance of companies is sometimes really disgusting.

angry face

What can come out of such an "unholy alliance" should also be considered for Europe - because here too, the demands of law enforcement are becoming louder and louder, it is only a matter of time before authorities in Europe also ask for search queries and similar protocols from search engines. And such a demand could even be covered by the absurd laws. And whether search engine operators will really stand up against this is rather questionable in view of the recent activities of Google, Yahoo and MSN.

Password Safe - by Bruce Schneier. The Java version 0.5 is compatible with the Maemo version.

pwsafe password database - Command line tool for Password Safe databases.

Traces on the Net

Older, but very interesting: Rogers Cadenhead demonstrates, what you can find out about a person just from comments on websites. He only uses the comments on Metafilter to create a profile of a regular Metafilter user.

One should indeed think about what data and information one voluntarily gives away - bloggers and frequent commentators are often quite generous with their information. Efficient search engines can certainly help create a profile of a person that can be far more detailed than what Rogers did on Metafilter.

Benford's Law - why so many numbers in statistical series start with 1.

EU loses GMO dispute with the USA

The WTO rules against the EU's Genfood moratorium:

Andreas Bauer, a genetic engineering expert from the Umweltinstitut München e.V., comments: "The WTO's decision puts the interests of genetic engineering corporations like Monsanto, Dow, and Dupont/Pioneer above those of European consumers and farmers. The majority of Europeans reject agro-genetic engineering."

Not only do the majority of European citizens reject this, but a large number of regions also do not want to import or cultivate genetically modified foods. Very fitting is Germany's stance, which believes it must pave the way for American corporations here instead of joining the genfood-critical states and regions in Europe.

Hedgehog - Never underestimate the power of a small tactical Lisp interpreter.

LEGO Technic Difference Engine - Babbage would be jealous

Holes in the Java Sandbox

Unauthorized file access through Java vulnerabilities - ouch. A sandbox is only as good as its programmers, unfortunately. It must be admitted, however, that the sandbox rarely shows holes. But just because Java is now also spreading further to mobile devices and other devices, such things are naturally becoming more interesting.

Scientists find new species in 'Garden of Eden' - hopefully it will remain a Garden of Eden. Areas like this should be immediately placed under nature protection, otherwise it will be exploited by "exotic enthusiasts" sooner or later.

CSS Fisheye - CSS magnifying glass effect in a text block.

GREYCSTORATION - denoising algorithm as an open source CLI tool.

Lightbox JS - Display photos with JS on the page. Nice effect.

AVM could simply write drivers under GPL

AVM warns of restrictions for proprietary kernel modules:

The consequence for AVM would be to stop supporting Linux. A reaction to the email is not yet available. The kernel developers are likely to be little bothered by AVM's threat, as their goal of keeping the kernel and its entire environment free seems to take priority due to their mixed experiences with proprietary drivers. Alternatives to AVM exist, and GPL drivers for AVM hardware are not excluded, even if they do not come from AVM.

Exactly that: Alternatives exist. It's time for the alternatives to pay off with better Linux support - then maybe AVM will also become reasonable. The binary modules without source cause more trouble than joy.

HOWTO: Bluetooth GPS and GPSDrive on the Nokia 770 - because someone recently told me that the Nokia 770 is useless without a navigation system: here it is.