Rosio Pavoris

There’s this sentiment, primarily in the US, that civilians owning guns is a good thing because it keeps their government afraid of them. This is mostly repeated by the idiots at the NRA, but also by people who are supposed to know better (such as Penn and Teller in their Bullshit! episode on gun control), so it bears addressing.

There are two things fundamentally retarded about the statement. The first is that the government should be afraid of the populace.
This meme is surprisingly popular in the US, but almost unheard of outside it, at least in the Western world, and with good reason. The idea that the government is the enemy in a democratic society is mind-boggling. Protip: the government isn’t the enemy of the people. It is the people.

Unfortunately, it’s become a self-fulfilling prophecy in the US, which, of course, has only helped the popularity of the meme.
I don’t think it’s a reversible trend for as long as a significant portion of the voting population keeps believing it can’t be any other way, though. The American populace doesn’t seem to have a clue what a democratic society is anymore (if they ever did), and wide-spread apathy creates fun vicious cycles.

Anyway. The second flawed assumption here is that an armed populace scares the government.
This is just a schoolboy fantasy that sadly carried over into adulthood, and its considerably more harmful than you might think.

What are you going to do when the police knock on your door, with or without a warrant? Refuse them entry? They’ll break down your door, regardless of whether you’re armed. Are you going to open fire? That’s a great way to get yourself (and your family) killed rather than detained for a bit. Yeah, you may take one or two of them down with you. I’m sure the families of the victims will appreciate that as well. At “best”, this mentality leads to situations like Waco.

Or maybe you’d like to organise an armed revolution? Get a few of your buddies together and burn down city hall? Depending on the city and the number of buddies you can gather, you may succeed, until they call in the military.
Most people seem to forget half the global military expenditure is the US’s, and despite efforts to cripple science on all fronts, they still have the most advanced army on the planet. Iraq may tie up a lot of resources, but you can be pretty sure they’ll be able to scrounge up enough firepower to take out your little insurgency.

Or maybe you think a nation-wide revolution is on the table? Surely even the US military wouldn’t be able to counter that!
If you really think you can organise that many people, why not just vote? The US is still nominally a democracy, despite your best efforts, and while vote fraud can fudge the numbers a bit (and has in the past), you don’t just disappear the opinion of, say, two hundred million people.

But no, what this basically boils down to is puerile schoolboy fancy. Surprisingly, though, owning big guns does not give you a bigger penis, it just advertises your insecurity to the rest of the world.
If there are good arguments against gun control (and I haven’t seen any yet, except possibly to defend against a zombie plague, and everyone knows only shotguns work for that), this is very much not one of them. Grow the fuck up.

So I probably should too.
This video describes a simple but effective attack again whole disk encryption and similar cryptosystems, based on the fact that, contrary to popular belief, modern DRAM retains its data for some time after power is cut, and the encryption key is stored in said DRAM.

There’s some more information in the full paper.

There are some obvious ways to defend against this as a user. One is to not leave your computer unattended while you’re logged in, or for several minutes after you’ve logged out and powered down.
The former should be obvious, but isn’t, and BitLocker’s thing that lets you boot straight to log-in makes it less than straightforward. Though if you use Vista, chances are you’re only doing the encryption thing because your boss made you anyway, and you don’t care about security or privacy.
Basically, if you aren’t typing the encryption password as well as your account password every time you boot, you have a problem.

It shouldn’t be too difficult to have the OS or some hardware device clear the entire RAM (or just a given area of it) as soon as a power failure is detected (it can keep running for a few milliseconds after the PSU sends the power failure signal, which is still a few thousand clock cycles), but that would be just as easy to get around, so it’s not worth the effort.

Another option is to just not store the key in RAM, but in a CPU register or the cache or something. I’m not sure how long their retain their information, but presumably it’s not nearly as long; possibly short enough to prevent this attack.
Of course, keeping something in the cache or the registers all the time isn’t something most OSes will play nice with, so that will require some OS-level retooling, and encryption keys tend to be comparatively large (128 to 256 bits may not seem like a lot, but a CPU register is 32 or 64 bits wide nowadays, and there aren’t that many of them), so that’s only going to increase the performance hit of whole disk encryption (which isn’t as big as people expect, but big enough that you don’t want to increase it).

The easiest thing is just to keep people away from your precious RAMs.

When stories like this break, which they do every few months, weeks, or days, depending on which corner of the internets you live in, it’s important to wonder not just why this particular product was crap (I’m guessing a severe case of NIH), but also why there are so many crap security products on the market in the first place.
The answer isn’t just that it’s hard to develop good security products; it is (and it’s complicated by Schneier’s Law), but that doesn’t explain how many of these crap products are actually quite popular.
At least part of the answer is in the concept of a lemon market.

George Akerlof famously discussed this in his 1970 paper The Market for Lemons: Quality Uncertainty and the Market Mechanism, and Bruce Schneier himself has been mentioning it in his talks for some time now, but since few people can be bothered to read an entire paper on economics or listen to hour-long talks, I thought I’d sum it up.

The example Akerlof used was of the used car market. Suppose that there are crappy used cars (”lemons”) worth $2,000, high-quality used cars worth $6,000, and everything in between, and that the buyer cannot reliably tell the difference between them before buying them.
Naturely, crappy cars will be worth less than high-quality cars, but the buyer, not being able to distinguish between them (price is not a reliable indicator, since car salesmen aren’t known for their honesty), will generally only be willing to pay what an average car is worth (in our simplified example, $4,000, say). This will be the equilibrium price for used cars in this market.

However, there’s a problem. The user car salesmen can accurately assess the value of the cars they sell, and they know very well that the high-quality cars are worth more than $4,000, so they won’t sell them at that price. However, the buyer, not having a way to distinguish overpriced crap cars from correctly priced good cars, won’t buy them at the higher price.
The result is that the high-quality cars don’t sell, and are driven out of the market by lower-quality cars.

The basic criterion that makes a lemon market possible is information asymmetry. That is, sellers are aware which of their products are crap, but buyers cannot accurately determine a product’s value before buying it.
I’m sure you can see how this applies to many other markets, not just security. Operating systems comes to mind. So does the MP3 player market.

This is one of the points where the free market breaks down. For the free market to work, it is required that consumers are informed. In practice, they very rarely are.

So how do you solve this?

One of the ways to do it is through government regulation. Laws against false advertising exist in many countries, and you can regulate the quality of many products directly.
While this is certainly part of the answer, there are other ways.

Another way, which may not work for all markets, is through warranties and guarantees offered by the seller. A car salesman can offer to let the customer use the car for a while, and if he doesn’t like it, he can bring it back and get his money back.
This is trickier to do in the security business, since most people aren’t in any position to evaluate the quality of the product even after getting to use it for quite a while (really, you generally don’t notice when your firewall protects you; you only notice when it fails to, and that might not happen for months, or even years), and things like penetration tests are expensive. It does work for some products, though.
These warranties can also be enforced through government regulation.

What probably works best in the security market is public quality assurances.
While individual buyers can’t really assess the quality of their products even after buying them, security researchers certainly can. The buyer could then rely on reviews by these researches to assess the quality (or lack thereof) of a product. Quality labels are already used in many industries, and are basically a quicker form of the same thing.
Of course, this isn’t a perfect system. Unscrupulous companies could buy good reviews from unscrupulous researchers or computer magazines (which is something that happened a lot in the firewall market of the ’90s, which is one of Schneier’s favorite examples), seriously confusing market signals. Then it’s up to the publication to establish them as reliable, probably in much the same way as the security products.

There is no silver bullet.
Educating users would at least weed out the obviously retarded products, and would increase security across the board even with mediocre products, but most users just aren’t very interested (which would be fine by me, if it was only themselves they’re harming; however, as botnets prove, it very obviously isn’t), and snake oil products will always be around either way.
It seems the only thing to do is to pay attention to security researchers, and to sue people who make crap products into oblivion, forever.

So apparently I own an iMac now.
I didn’t spend any money on it, obviously; I inherited it from my grandfather, who was given it by my uncle for his fiftieth wedding anniversary six or seven years ago. I think if you’re going to get a Mac, it should involve death in some capacity.

It’s a G3, but a relatively late model, so it’s still almost usable; 450 MHz CPU, 128 MB RAM, 20 GB HD, DVD drive.
It also came with Mac OS 9.1, which is painful. I was initially going to dualboot with a real OS, but Mac OS turned out to be too impossible to use to keep, so I just wiped the whole thing and installed Debian.

I just realised this was actually the first time I installed Debian; I’d used it before, and I’ve installed other Linux distributions (Ubuntu on my laptop, Fedora and Gentoo on my desktop), but never Debian itself.
The installer is straightforward to use, though obviously it lacks Ubuntu’s shiny buttons, so it’s “too difficult for the average user”. What surprised me, though, is that it supports encrypted partitions at install-time (it has for a while now, I just haven’t used it in so long I didn’t know).

I doubt my mom, who wants to use that computer for random typings, is going to appreciate having to blindly enter a 40ish-letter passphrase (in English) every time it boots, but whatever. Encryption is shiny.

(Incidentally, my low opinion of Apple products has only been reinforced by this iMac. The G3 form factor makes it impossible to cool adequately, so it smells vaguely like burning plastic most of the time (though it hasn’t started smoking yet), and the input devices it came with are fucktarded.
The keyboard I can deal with, though I question the placement of the ⌘ keys, the labelling of the Home, End, Page Up, and Page Down keys (which just have cryptic arrows on them), and the replacement of those three keys at the top by F13 through F15 (because we really need more F keys; not that the ones that were there originally saw much use, though (except Print-Screen)).
The mouse, though, is actively user-hostile: no right-click (Ctrl + click isn’t a valid alternative), no scrollwheel (and the fact that it’s seven years old is no excuse), literally painful to use for any length of time because of its shape, and it cost $59 new. Oh, but you can adjust the intensity of the light!
Jesus fucking Christ. Good thing I have plenty of USB back-up mice.)

I’ve complained about my “college” before (though not nearly as much as they deserve), but this time they’ve outdone themselves.
Our department is moving to a new building this semester, for reasons I’m not entirely clear on (I’d think it’s because the old building is falling apart, but apparently the KUL (that is, the parent university) is kicking them out because they want to use it themselves; or so I’ve been told), so they’ve been building said building for forever now.
Today, the first day of the semester, we were expected to gather at the old building for one last time, and then we’d all walk to the new building (despite the fact that it’s quite literally on the other side of the city). The direct route would’ve taken us about twenty minutes, but we took a ridiculously circuitous one so as not to interfere with bus traffic, so it ended up taking well over an hour.

The new building itself, though. Holy fuck, it should be legal to shoot architects that crap.

It very obviously isn’t finished, first of all. By what I’ve seen, it needs at least another two months of work, though I admit I haven’t seen a lot, since the ventilation was out (and natural ventilation or windows that fucking open were apparently beyond them), and there wasn’t nearly enough oxygen to sustain all of us. I think some of the girls actually fainted.
None of the toilets work, many of the doors still need to be installed (though a lot of places that really need doors won’t get any, because heaven forbid students could have a quiet place to study that’s more modern), there’s concrete dust everywhere (though a lot of the walls are painted to give an indication of what floor you’re on (the bottom three are blood red (which is very conducive to avoiding school shootings, really), another one’s orange, and the top one is green, IIRC), which I’m pretty sure will have to be redone soon), and it would surprise me very much if any of the computer labs had actual computers in them.
We were all crammed into one of the “polyvalent” rooms for a welcoming speech, and when the person giving it (I still don’t know what it is she actually does) mentioned she was so relieved it was finally finished, the students (which I’m sure I’ve mentioned aren’t exactly known for their perceptiveness) burst into laughter and applauded. It’s that obviously unfinished.

But even if it were finished, the building is just complete and utter crap.
One of the reasons they gave us for the move is that the new building is much bigger (which is also why they’re cramming another department in there as well). As it turns out, they didn’t mean it has more rooms; in fact, it has fewer computer labs than the old one (which certainly didn’t have an excess of them).
It does, however, have much higher ceilings, which ruin the acoustics to the point where they had to install microphones in each room (though they don’t, obviously, work yet). It also has a lot more corridors and dead space, including a rather large (but inaccessible, and godawfully ugly) courtyard. Well, not so much courtyard as courtsteelgrid.

The adequate if not excessive parking space available behind the old building has been replaced with an underground bicycle dungeon (which requires student ID to enter, much like the building itself; they should have spent the money they wasted on that on a better architect). Cars and motorbikes are expected to rent parking space from the nearby hospital.
You can’t fucking make this stuff up.

And then there are the entertaining little details.
The various stairs, which consist of fuck-off big slabs of concrete stacked roughly on top of each other, vibrate visibly when people walk on them. The concrete slabs that are trying to pass as walls and floors are already cracked in places. The bike dungeon is very obviously going to flood at the first sign of rain, and the path down to it is slippery as fuck even when it’s dry.
And of course, the whole building is a giant fucking Faraday cage, so cell phone reception is non-existent. Which means that if you forget your student ID, you can’t even call someone inside to let you in.
And going back home to retrieve it is non-trivial, since it’s in the middle of fucking nowhere, unlike the old building, which was within walking distance of everything.

I was planning to move to Leuven next semester so it wouldn’t take a fucking hour to get to class every day, but that appears to be pointless, as the closest residential area is still way too far away to bother. It looks like I’m going to have to take the train to Leuven every day (which I already did), and then the bus from the train station to aforementioned hospital.

Expert fucking planning, KHL.
Maybe the next building could be designed by four-year-olds, and built on the fucking moon.

I really wonder who Jack Chick’s target audience is. I find it hard to believe anyone could be so deeply ignorant of human nature and science they could find any of them at all credible. In fact, I’ve yet to meet any non-Americans who don’t think they’re parodies.
Outside of the US, depending on which people you hang out with, their tract on Dungeons & Dragons (Dark Dungeons) is probably the most famous one, but another one fundies are fond of throwing around is Big Daddy?, which (near as I can tell) they think is about evolution.

Needless to say, it’s full of straw men, non-sequiturs, and just made-up bullshit. The “six basic concepts of evolution”? The nonsense about circular dating methods? The idiocy about polystrate trees? Haeckel?

Judging by how long these claims have been discredited, you might guess this tract to be somewhere between 70 and 150 years old. You’d be wrong.
The first version of the tract appeared in 1972. The current version (which is also the one on the Chick website) was written in 1992 (by our good friend Kent Hovind).
Since even AiG refuses to endorse Hovind anymore, you might think it’s time to just let this tract fade into obscurity, but apparently a lot of creationists disagree. It’s still being pushed as fact, so I think it merits a brief response.

I’m just going to address the bit that seems to be subject of copy pasta most often: the faux “human evolution” chart.

(For the other claims, and a whole lot more, I refer you to TalkOrigins’ Index.)

I’m not sure why they’re presented as if they represent a direct lineage, as nobody has ever claimed they do.
Anyway, one by one.

Read the rest of this entry »

As you may or may not have heard, a new version of TrueCrypt was released yesterday. As you may remember, it’s a cross-platform encryption type program, which has the ability to (among other things) create hidden containers, which is a simple but effective steganography.

Last time I mentioned TrueCrypt, I lamented the absense of full disk encryption, unlike a rivalling (non-free) product by the PGP Corporation, but apparently they added that in this version, complete with a pre-boot authentication prompt. Unfortunately, this seems to be Windows-only, which is, to put it plainly, retarded.
Still, if you use Windows, use this whole disk encryption (and remember to back up your data first, and store your backups in a safe location if you aren’t going to encrypt them). There’s no good reason not to.

The Linux version gets a GUI, though it apparently comes at the cost of the command line interface. While Ubuntu users everywhere will undoubtedly rejoice, I want my command line. I guess it makes the learning curve a bit less steep, even though it’s not actually more user-friendly for experienced users.
A useful change, though, is that you now no longer have to recompile TrueCrypt every time you update your kernel, though the fact that that’s finally fixed isn’t as good as the fact that that was an issue in the first place was bad.

And there’s also a Mac OS version now, which was a long time coming. It’s been announced as “real soon now!” for forever, so it’s about time they got around to it. They don’t get whole disk encryption either.

It’s becoming more and more obvious that TrueCrypt only cares about its Windows users, and that it only has the other versions for e-penis points. Being able to claim your software is cross-platform impresses certain types of people, even if the versions available for other platforms are severely crippled.
And of course, the license still sucks, which seriously limits its usefulness for anyone but home users.

So basically, if you’re a Windows user, use the whole disk encryption. If you’re a Linux user, OpenSSL actually does more than TrueCrypt if you don’t need hidden volumes (and even if you do, they’re not too hard to simulate using other tools). If you’re a Mac user, who cares?
If you’re a developer, you’re much, much better off avoiding TrueCrypt entirely and just finding your libraries elsewhere (such as with OpenSSL).

Still, projects like TrueCrypt are steps in the right direction; in a world where governments increasingly see privacy rights as a threat, it’s up to citizens to step in and take control of their own privacy themselves.
And to stop voting for idiots, obviously.

(No, not blogging about Supercalifragilistuesday. Go away.)