Skip to main content

Songs on the Security of Networks
a blog by Michał "rysiek" Woźniak

Terroristcopters

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

Oh 28C3 and Telecomix, why u so inspiring!

On the Congress in Berlin there were a lot of quadcopters, hexacopters and other flying and – what is more important here – hovering drones. Mighty cool stuff, mighty cool people. This sparked an interesting discussion with a fellow Telecomix agent pwntus, which basically led us to a simple statement of fact:
Quadcopters and similar, hovering-capable drones will be soon banned, probably as weapons, probably under “anti-terrorism” laws.

Why, you ask? That’s why!

Suddenly, everybody with a few dollars is able to directly oversee (pun intended!) Police actions: film them, stream them, document them real-time and with almost no way of the Police actually knowing they are being filmed.

Certainly, this will not play well with the Police, as already for years they fight (and, unfortunately, so far win) with citizens’ rights to videotape and record their actions. Something that should be obvious in a democratic society – citizens being able to supervise how their rights are being defended by the Force – is slowly becoming tagged as a “terrorist” activity. On the other hand, the police has no problems with spying on citizens, but that’s just one of many signs of hypocrisy therein.

Now, back to *copters. They will get banned, and will get banned as “terrorist devices”. You will hear arguments that, for example, they are able to help “terrorists” plant explosives or create havoc and are very hard to take down once airborne.

The funny part is: we had flying drones in the form of RC planes and copters for years upon years and nobody thought about banning them. Moreover, these would be much better-suited for the supposed “terrorists”, as they are bigger and more powerful – able to carry a bigger amount of explosives, on a longer distance, faster and therefore harder to intercept.

I am willing to bet, however, that these will not be even touched by the ban that I and pwntus envision.

Because what those devices are unable to do is hover near-silently and almost undetected and videotape, register and stream audio and video for prolonged periods of time. Which is near-useless of “them terrorists”, but extremely helpful for activists documenting Police actions.

Hence, the only real reason – make no mistake about it – for upcoming banning of *copters is that they are the perfect tool the populace can use to document Police brutality and other missteps of the law enforcement. The “bad terrorist device” argument will be only a smoke screen, albeit a very effective and trumpeted one.

And as soon you hear about plans to ban *copters and drones, you know you are closer than ever to a police state. And that it’s about time you do something about it.


Update:
Seems it already begins.

IceWeasel and Privacy

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

Some time ago, Mozilla decided to implement a Do Not Track feature – a nice idea in this age of pervasive outright spying by more and more Internet entities on us mere mortals. That was soon also implemented by Microsoft IE team, which is great news (by the way, you gotta love how both links give directions on how to enable Do-Not-Track in the rival’s offering).

Problem, though, is that it’s not enabled by default in Firefox. And it’s not that visible and easy to enable for the regular Joe.

So why doesn’t Mozilla make it enabled by default, one might ask? Basically, they say, if everybody does it, it won’t work, because it’s supposed to be “personal choice”. Well, to that, I would say, that it should be the other way around – I should be asked and given a chance to decide if I want to be tracked, instead of having to find an obscure checkbox somewhere in the Preferences not to be tracked.

But then it dawned at me: in Debian (and a few other distros), instead of Firefox, we get IceWeasel (due to a complicated copyright issues I won’t go into here) – a Debian-run re-branding of Mozilla Firefox.

So, you probably already see where this is heading. If Debian is already re-branding Firefox as IceWeasel, why not make the sane, privacy-enhancing decision and enable Do Not Track by default? It’s just a single checkbox to flip. Whaddya say, Debian et al?

Yes, I submitted a bug report via mail, waiting for it to show up.
Update: The bug is now on-line.

Good Uncle Stal... Putin

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

Quoting the Polish Gazeta.pl portal:

In his [Putin’s] opinion, opposition polititians should create some kind of a common platform, so that “it would be possible to understand what people want”. Putin also noted that in the oposition ranks there’s the democratic party Jabloko, Communist Party of the Russian Federation, along with liberal and nationalist organizations. “It seems necessary to talk with everyone – regarding their grievances and problems. We’ll have to think this through.” – said the Prime Minister.

In short, Putin tries to send a message along the lines of:

  • yes, I am a Good Uncle and I want to help;
  • but you are so undecided and you have so many different, not compatible postulates;
  • please decide and choose something, we’ll talk.

Obviously, this is a response to lasting protests after apparently rigged elections in Russia. And it’s a very cunning – and at the same time very, very perfidious method of handling the situation. It builds image of Putin being a caring Head of the Nation that Wants to Help, at the same time belittling the opposition as silly, quarrelling children, without a leader and not even knowing what they want – wishing for some toys but unable to decide on which exactly.

And that is extremely dangerous. I hope neither Russians nor the World will fall for that.

As the reality is that Putin is not a “good uncle” – he’s an authoritarian ruler. Opposition is not “quarrelling, leaderless” – they’re just diverse, as they should in a democracy. And the solution is not a “dialogue with the opposition”. The solution is to run proper, legitimate, not fraudulent elections, so that The People can choose for themselves.

You know, like in a democracy.

Useful Bash defaults done right

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

I finally got to do some holiday clean-ups on many of (Debian) the servers I administer. And so, I got around to cleaning-up my Bash configs and finding out how everything I wanted done exactly should be done. The Right Way.

What I wanted

My expectations are meager:

  • screen, starting by default with each login, connecting to an already running screen session or starting a new one should that be unavailable;
  • some nice aliases (for me – ls and grep with colour; ll for ls -l);
  • colourful prompt;
  • system-wide default editor set to vim.

This isn’t much, but helps in my day-to-day sysadmin life.

How it’s achieved - for normal users

Starting screen by default
Just add a single line at the very end of /etc/skel/.profile:

screen -xRR

Nice aliases
That’s all in /etc/skel/.bashrc, just uncomment the ones you like.

Colourful prompt
The best way to do this is, again, to edit /etc/skel/.bashrc file and simply un-comment the line:

#force_color_prompt=yes

I also set my custom colourful prompt style

if [ "$color_prompt" = yes ]; then PS1='${debian_chroot:+($debian_chroot)}\[echo "\w" | sed "s/\//\[\e[0;34m\](\e[1;36m\]\u\[\e[0;37m\]@\[\e[0;36m\]\h\[\e[0;37m\]:\[\e[1;34m\]$()\/\[)\[\e[1;37m\](\e[1;34m\]/g")\$\[\e[0m\] '

Vim as the system default editor
That will actually work for all users, including root. Just install vim and (as root) run:

update-alternatives --config editor

Therein, select the editor of choice. Done.

Every single new user on the system will have the above as defaults. However, remember to copy /etc/skel/.profile and /etc/skel/.bashrc to homedirs of any users already present in the system!

Some tweaks for root

The root account does not use /etc/skel/ files as base, so we need to edit /root/.bashrc and put there the aliases we need, etc. Also, using screen auto-startup with root doesn’t seem to be a good idea, so I just pass on that.

As for root user’s colourful prompt, I want it to be nice and red, but without the (superfluous) username. So, here it is:

PS1='${debian_chroot:+($debian_chroot)}\[echo "\w" | sed "s/\//\[\e[0;34m\](\e[0;31m\]\h\[\e[0;33m\]:\[\e[1;34m\]$()\/\[)\[\e[1;31m\](\e[1;34m\]/g")\$\[\e[0m\] '

That’s it.

Google Mail, or how mail becomes publication

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

Have you ever spent a moment to read through Google Terms of Service? As Marcin “sirmacik” Karpezo pointed out interesting stipulations are present therein, basically two paragraphs – 11.1:

You retain copyright and any other rights you already hold in Content which you submit, post or display on or through, the Services. By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services. This license is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services.

And 11.2:

You agree that this license includes a right for Google to make such Content available to other companies, organizations or individuals with whom Google has relationships for the provision of syndicated services, and to use such Content in connection with the provision of those services.

Let’s translate it from lawyerspeak, shall we? By agreeing to the Terms of Service (required to create an account), and then by “publishing” (gotta love the lingo!) anything through Google’s services, each and every User agrees to give Google – and its partners! – full rights to basically do whatever they feel like with the published data, free of charge and without asking any further.

And yes, those “published data” are all of your “confidential” Google Docs documents and all of your “private” GMail e-mails. Because, as we can read in the TOS, sending a private e-mail to a friend or a loved one is not “correspondence” – it’s a “publication”.

A publication that you give Google full rights to.

Occupy Gotham

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

I would like to direct your attention to a “Dark Knight Rises” trailer, including this interesting quote:

“There’s a storm coming, Mr. Wayne… when it hits, you’re all going to wonder how you ever thought you could live so large and leave so little for the rest of us.”

One doesn’t have to be a mastermind to spot that this seems to be a very clear reference to the Occupy movement, so vocal lately about the inequalities between the rich, and the remaining 99%.

Well, maybe “the mainstream culture is finally getting upt to speed with the Occupy movement”? Unfortunately, the quote is uttered by Catwoman – definitely not a protagonist in the film; and it’s the (apparent) main antagonist that tells Gotham City dwellers to “take over their city”.

Could it be that somebody decided to use the Hollywood propaganda machine against Occupy?..


Update 20.07.2012:
Apparently I was right – and it’s a part of a trend, too.

Copyfraud

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

I have already written about the War on Fun, the uneven fight that big business – conceived in time when copying and distribution of cultural works was hard, hence completely unprepared to function in today’s world – continues (with the help of lawyers, polititians and media) against their own clients.

This war is uneven for both sides. Old institutions and their allies have at their disposal seemingly unlimited resources – at least from the perspective of a mere mortal. They are able to use tools that are absolutely out of reach for us, citizens, including secret international trade treaties, subverting democratic processes. But then, it appears as if “all the king’s horses and all the king’s men”, however powerfull they may be, and whatever resources they are able to throw at the problem, arent able to solve “piracy”.

That doesn’t, of course, prevent enlightened polititians (helped, no question about it, by the best and brightest the “copyright-defending” entities could find) from proposing, say, to tax the Internet. Indeed, soon every Internet user in France will pay a special tax to “offset the losses” of the entertainment business (not the artists, mind you) stemming from illegal copying happening on-line.

One doesn’t need to ponder it too long to get to a simple conclusion that it’s a form of collective responsibility, punishing (financially, in a form of a tax) all the users of the Intertubes for the actions of just some of them. And let’s not forget that it’s also an infraction against the presumption of innocence principle. The law assumes that all Internauts are guilty. And that’s that.

Obviously, one could think that when everybody on-line in France already pays such a fee for copying, the act should become legal, as it’s already paid for. Well, no. Why should the entertainment business settle for being paid once, when they can be paid many times over for the same service rendered? So, no dice.

Well, one could say, at least the money will help fund artists so they create some more of this sweet, sweet cultural stuff, right? Ah, but yet again reason fails where the copyrights are involved! Money from the tax will go to a huge bureaucratic machine. And as is the rule with such bureaucracy, not much will get spat out.

And now we’re getting at the true fun part of it all. See, apparently the laws, while often written by the entertainment business, are not meant to be binding for the entertainment business. Or at least the business seems to think so – as exemplified by trying to extort a “license fee” from a Creative Commons event; or by using an audio track – without getting an appropriate license! – in their own anti-piracy media campaign (just stop here for a second to appreciate the irony!); or, finally, by abusing the DMCA to illegaly block content they do not have a claim on.

It has become apparent that the copyright law is misused and abused massively; that it’s completely unfit for duty in the digital era; that serves not the artists, but corporations that should adapt to the new circumstances or die, but instead try to adapt the circumstances to themselves. Extortion in accordance with the law seems to nicely describe the situation here.

The mainstream starts to “get the hint”, apparently, even regardless of huge cash pumped by the business into media campaigns and (let’s call it by it’s name) crude propaganda. And from the mainstream it’s slowly getting to the political elite – as exemplified by the recent talk given by EU Commisioner Neelie Kroes, calling for a much-needed all-out copyright reform.

Let’s keep in mind, though, that one swallow doesn’t make a summer. Both in the United States and in the European Union there is legislation proposed to “crack down” on illegal filesharing, the exact opposite what Commisioner Kroes talked about.

What we have is a strong signal that there are already polititians ready to question the “filesharing bad; copyright good” false dichotomy and the current copyright model, speaking openly that instead of stronger enforcement – what the world actually needs is simply getting the law up to speed with the new technology and circumstance.

One-way cutting

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

A great Internet comic, Saturday Morning Breakfast Cereal, celebrated the American Censorship Day with an episode, that is both fun and thought-provoking.

Now, while I usually agree with what SMBC convey in their comic (and the appealing form only helps here), this time I must protest.

The right to privacy (or lack thereof ) does not cut both ways. It cuts one way – but in fact the other way that we’re led to believe today.

Currently governments (and corporations – we all remember Schmidt’s and Zuckerberg’s remarks) are trying to make us think that right to privacy and having secrets is their own domain, while the citizens (not: “users”) are subject to invigilation – and can’t even talk about it too loud.

Well, once somebody made me aware of a simple yet powerful rule of democracy:
Citizens have rights; government agents have duties.

Right to privacy, secrecy of correspondence, freedom of speech – all belong to citizens. In the SMBC episode that would be the second frame. And keep in mind, even such an answer to governments’ “fear” of free speech, as the one given there, should only be a nice albeit voluntary gesture on our (citizens’) part.

We do not have to explain ourselves of exercising our rights, nor of controlling the way governments execute their duties. We should not agree to how this simple fact is subverted and inverted. We should not agree to being mute and under constant surveillance.

Users and Citizens

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

We had a bit of a commotion around an “agreement”, negotiated with the help of Polish Ministry of Coulture and National Heritage between Polish copyright collectives and the ICT companies (including ISPs).

There is much to be said about it – for instance, I could say it’s another salvo in the War on Fun – but after participating in a meeting regarding it, I would like to appeal to all those defending freedoms and rights in the Internet (and outside of it):

Let’s call things by their names – and stop saying “Users” when we mean “Citizens”!

In this whole discussion both sides are locked on interests of rights holders, ICT industry, and users. I believe allowing that makes our fight much more of an uphill battle than it needs to be.

First of all, it frames the discussion in a very convenient way for the other side. When we’re talking about users, we’re talking about people with contracts signed with companies, or about people consuming cultural works one way or the other. In other words, from square one we seemingly agree to play on the “business turf”, and on their terms.

Then there’s the problem that things that look beneficial for users can be unacceptable for citizens. For example lowering the fee by an ISP if the user agrees to use only certain web services (vide the whole Net Neutrality debacle). This might look like a good deal for a user, but a citizen should be able to see that it’s dangerous for free speech, among others.

And finally – and most importantly – rights and freedoms that we defend are citizen’s, not user’s. We should not be ashamed to call upon them if we’re supposed to defend them! And seemingly all other sides to this dispute (and many beside it) have to be reminded, over and over again, that people are citizens first and foremost; they can be users afterwards.

Adhocracy and Net4Change

This is an ancient post, published more than 4 years ago.

As such, it might not anymore reflect the views of the author or the state of the world. It is provided as historical record.

Last week (Oct 25-26, to be precise) I went to Stockholm for two great events around the topic of hacktivism and how ICT can shape the dynamics of social changes.

Adhocracy

The first of those – Power of Adhocracy – was an activist-organised meet-up, an “inofficial warm-up” before the next day conference. Activists (including Jacob Appelbaum, of TOR Project fame) from the USA, through Europe to Kenya were talking in a casual manner about their ideas and projects. Unfortunately I was only able to get there for the last two talks, but nonetheless that meant a fun and interesting evening with the speakers and the great people of Telecomix.

Net4Change

The second one – Internet and Democratic Change – was a much more official conference. Organized by the Julia Group in co-operation with SIDA, an agency of the Swedish Ministry of Foreign Affairs, with participation of media and activists from around the world, but focused mainly on the Arab Spring.

The Agenda was full of great talks, unfortunately one had to choose their track. I am very happy with my choice, though.

Scott Lucas of EA World View described how new methods of contacting sources (like social networks) and new media (blogs, internet sites) allow for following and commenting on global situation from any corner of the world, provided Internet access is available.
Stephen Urbach, a Telecomix hacktivist, provided an insider perspective on “revolutions from the couch”, or how hacktivists, IT proffesionals, programmers and other volunteers co-operating with Telecomix helped Egiptians circumvent government-mandated Internet blockades during anti-Mubarack protests.
Mahnaz Afkhami, founder of Women’s Learning Partnership, talked about tools that help change situation of women in the MENA region and deliberated on new ways of fighting gender discrimination globally.
Maryam Al-Khawaja reflected on role of social media in social change in Bahrain, and that new technologies are being actively used there bo both sides, which was well exemplified in the twitter feed of the conference (where the presence of negative comments posted from newly created accounts was very visible).
Hamza Fakhr – by an audio/video link, as he was unable to come personally due to unforseen difficulties – described changes in the way ICT was being used in the Syrian revolution.
Dima Khatib and Sultan al-Quassemi, in a panel discussion moderated by Yasmine El Rafie, pondered on how they received first information on the beginning of the protests in Northern Africa, where did they get further info from and how they became important sources for others. Of course, they continued to use their social network accounts while on-stage.

Highlights

A very interesting talk, as usually, was given by Jacob Appelbaum: on surveillance and invigilation we all endure – being aware of that, or not; with our consent, or not – all the time, and how network censorship (under the guise of fighting the bogeyman of the day like “terrorism” or “child porn”; or without any guise at all, like in Syria or Egipt) is just a logical extension to such surveillance, simply putting the infrastructure and technology to work. The only way out is using effective mechanisms of ensuring anonimity and privacy in the Net – and those must be trivial to use so that they are used universally (so that the mere fact of using encryption does not automatically tip off the government agencies that “this somebody has something to hide”). Anonimity, privacy and using strong cryptography must become the default, not optional! Two interesting examples of projects striving to go this way were called:

  • TAILS, or a Linux distribution crafted for anonymous use, by default removing all the logs and using as strong cryptography as possible in each given situation;
  • TORouter, or a physical device that just needs power and Internet connection to provide a properly configured TOR node.

Of course a question arises why the software vendors and service providers do not make the right decisions on user privacy, anonimity, offer strong encryption by default – and the answer, according to Jacob, is simple:

Do you know why vendors don’t make good privacy decisions for users? It’s because you are their product.

Jacob’s talk got an interesting emphasis after the conference, when en route to the USA he was detained on Keflaviku airport (that did not stop him from commenting the whole situation in his usual manner).

However, the biggest sensation of the conference (and that’s a general consensus) was Salma Said dismantling the popular myth of how peaceful and “Internet-fueled” Egyptian revolution was – and the myth of its success.

The revolution became peaceful once we burned 90% of police stations during the first 6 hours. Then we could act like hippies. (…) This revolution needs weapons; if we had weapons we would use them. (…) When the thugs came we didn’t defend Tahrir with twitter and facebook; we defended it wih our own bodies.

That does not mean that Internet wasn’t relevant to the Egyptian uprising; however, it was not – according to Salma – even close to being as important as the Western world was led to believe.

It was all the more interesting considering the fact that at the same time in the second room Slim Amamou praised the way Internet enabled and helped the Tunisian peaceful social and political change. The apparent contradiction was especially evident on the (unfortunately) twitter feed of the #net4change tag, where Salma’s remarks on how Internet was much less important than what is generally thought and Slim’s praises on its importance went head-to-head. A nice summary of that came spontaneously from Salma:

Internet is important in revolution, but it depends on where you are and what you can do.

Finally, Hanna Hellquist (State secretary, Swedish Ministry for Foreign Affairs) summarized the conference saying, among other things, that Sweden must send clear signals, unequivocal signals of support for human rights and personal freedoms towards foreign nations. It’s not always easy (it’s very difficult to do with China, for example), but it’s crucial.

The response was very mixed, as the talk sounded strange in the context of controversial events around The Pirate Bay.

I had the pleasure of asking Mrs Hellquist about that afterwards – she admitted that it’s a difficult topic, not only due to Internet censorship debate and actions against filesharing in Sweden. However, she cannot, for obvious reasons, be held accountable for the whole Swedish government and is just playing her part and doing her job.

Afterparty

…Or a joint beer excursion was one of the most interesting beer excursion I have ever had the pleasure of participating in. The sheer fact that I wa able to discuss with activists from around the globe, doing their parts in a multitude of different ways – direct actions in Egypt; getting the info out and finding sources; keeping the infrastructure up and running, and acquiring proof of government foul play – was fantastic.

The discussions themselves, obviously related to the topic of the conference, social change and Internet (and more!) where very stimulating and will have my mind going for a long time.

Thanks: I would like to thank Marcin de Kaminski for inviting me as a participant to the Net4Change conference; and Telecomix agent Lejonet for extending his hospitality towards me and offering a place to stay for the two nights in Stockholm.