Cafaro's Ramblings

They’ve done it again in Basketball, National Champions two years running, and simultaneous champions in Basketball and Football at the same time. Love my Gators!!

– @page { size: 8.5in 11in; margin: 0.79in } P { margin-bottom: 0.08in } –>

Ok, been a busy busy couple of months, two conferences down, two scheduled.

In February, I helped with the new LinuxWorld/OpenSolutions World Summit in NY. The show did pretty well, but the weather really messed it up (warning to others, don’t schedule a conference during a massive snow/ice storm, really messes things up LOL). I missed most of the first day when my 4 hour drive turned into around 8 hours, and I didn’t get to leave until 4 hours later than planned. The show’s presentation are are being pod casted here:

http://www.linuxworld.com/events/

Next on the list was the FOSE 2007 show where I helped organize the Tux.org non-profit booth. We handed out over 1,000 issues of Linux Journal with an intro to Linux flier, over 1000 CD/DVD Linux Distros, a couple dozen live FreeBSD CDs, and numerous other giveaways. We had some generally interested people talk to us and it’s nice to see more and more people actually know what Linux is and what OpenSource really means. Here’s some information on what we were doing:

http://www.cyberigor.com/fose/

Well, that takes care of what’s been happening, Now coming up this week is the ShmooCon conference:

www.shmoocon.org

I love this conference, has some great speakers, Bruce Potter and the rest of the Shmoo Group do an amazing job with it. Starts in about 3 hours, going to be a fun weekend!

Finally LinuxWorld/OpenSolutions World San Francisco 2007 is starting up. Hoping to get some real good speakers lined up for the Security track (which I’m track chair for). Anyways, not much to see, but here’s the site for that:

http://www.linuxworldexpo.com/live/12/events/12SFO07A

I recently worked on two grid management articles for IBM’s developers center that were just published:

Managing a Grid, Part 3: Monitoring and Scheduling

Managing a Grid, Part 4: Day-to-day tasks for a grid admin

I’m pretty happy with how both of them turned out. They were on a real quick schedule so wasn’t sure how well they would come out. After going back and reading them, I feel they are a decent job. Hope people find them useful.

Oh, and I ran across this:

Care and Feeding of your Grid

So at least one person liked it

Ok, just a quick post but GO GATORS!!!

My school has another National Championship!!!!

I was attending school at UF when they won the 1996 National Championship. It took 10 years, but it’s such a good feeling!!!

 

Well, once again, I seem to be sparse on the posts. Maybe it’s because I’ve been busy with LinuxWorld Summit NY, or trying to get a new software project at work finished, or maybe cause I’m devoting my free time to my new Nintendo Wii. Well truthfully it’s a little of all the above (and a lot of getting my new software project working), but I did run across this little interesting tidbit:

http://www.nintendoworldreport.com/newsArt.cfm?artid=12687

I hadn’t seen this published broadly, but it appears that the version of opera currently under beta testing to Wii users (any Wii owner can download and play with Opera 9 on their Wii for free) has a vulnerability that can at minimum cause the Wii to hard lock. Currently there is no reported exploit that can run code on the Wii, which would normally be a threat from this exploit, and not clear if it ever will given that Game Consoles are usually pretty strict in what code is or isn’t allowed to run.

Anyways, interesting to see how the age of the desktop vulnerability has come to the game consoles world, even Nintendo. Wonder how long it takes them to issue a fix?

Wow, it’s been a very long time since I last posted something. Well, I do have somewhat of an excuse, I’ve been busy and traveling.

On the busy side, I’ve been trying to get several projects at work moving or finished including: Updates to www.gridswatch.com, Developming some web-based database applications, Working on content and sessions for the upcoming LinuxWorld Summit in New York, and most recently co-authoring some articles on working with Grid computing networks (I’ll post something when they are published).

On the travel/vacation side, I took a long overdue and just plain long vacation. We left for Europe (Barcelona, Spain) late October, spent a day in Barcelona, then a couple of days in France, then a few days in Italy, then back to Barcelona where we spent a few more days before heading to Madrid and Toledo, Spain. Had some great food, met some nice people, and came back with a sword which I purchased at the blacksmith’s shop after spending an hour talking about swords with the man who made my sword. Needless to say I had a great time, and it had been 7 years since the wife and I took a real vacation together. We didn’t get back till mid Novemeber just to give you an idea of how long a vacation this was (we had just a few vacation hours saved up…).

Of course about a week after our return we then had an extended Thanksgiving day weekend (5 days for me), so Novemember has been a light month on work. This translates into me being behind in what I want to have done before the end of the year. I’m going to be busy.

I’ll have a few more updates in December (hopefully articles going live, and some info on the LinuxWorld Summit that is coming). Not to mention gripes about stupid security I’m sure I’ll see.

Ok, been meaning to write a little about this, just couldn’t find the time.

To ALL those in charge of taking private information via secure webforms (credit cards, SSN, etc..) PLEASE READ THIS.

Yes, you must use an SSL encrypted webpage, yes you must only give that information collected to those who are directly responsible for billing the transaction. But DO NOT EMAIL all the information to anyone, and certainly don’t include it in the confirmation email!

I say this because I recently registered for a workshop I plan on attending. I’m not going to name the institution that is running it, nor am I going to mention the name of the course (though I must admit if I was presenting at the workshop I would be very pissed to learn that this was how they were sending confirmation emails). My company is paying for the workshop so they used the company credit card and the administrative assistant took care of the registration for me. Shortly after they registered me, I received the confirmation email. What did I find in that email that they sent to me (and to one other email address that we didn’t recognize), my contact information, all the contact information for the person holding our company card, the full credit card number, the Expiration date, and the CCV Code!

They emailed out everything you could possibly need to use the credit card at any online vendor in a plain text email over the unencrypted PUBLIC INTERNET!!!!

The fact that they had a nice SSL encrypted website to take this information just made the situation worse. Through their actions they have violated the trust relation they setup by presenting what appeared to be a secure internet transaction. By emailing the information they collected back over the internet, they placed that information at even more risk than if it was not emailed, but didn’t use an SSL cert. Now our credit information is being cached unencrypted on at least 2 email servers (most likely 4 or more) for who knows how long. If those machines are compromised or someone was having fun watching that traffic, they could now be purchasing a couple of big screen HDTV’s maybe a laptop or 4, subscribing to every porn site they want, etc..

People have got to remember that your responsibility for the secure transaction on the web doesn’t end at the SSL encrypted webform. It continues for as long as you hold and maintain that private information. End-to-end, review your policies, before it comes back to bite you.

I’ve been nice and I’m trying to work with these people to make sure they get this corrected. So far they seem to be listening (though action is a little slower). Hopefully they will get it, time will tell. If I had been someone less friendly, this could have been a much bigger headache for them.

Well, I just got back from LinuxWorld and have to say I had a great time. This was a much better show than Boston was. Actually, after attending this show I realized how much the Boston show lacked for attendance and things happening. I still think part of what killed the Boston show was the move out of New York to Boston, but now that that the Boston show has been dropped and the LinuxWorld Summit in New York set as a replacement, hopefully it will get back on track.

Anyways, had a lot of fun at a couple of the booths, notable were the Fedora guys, who willingly let me hose the FC6 test 2 box in the name of experimentation, the USENIX booth for some good information, and the Trolltech booth with their cool developer phone coming out soon. Outside of the actual show, I had a good time hanging out with Joshua Abraham (pbnj developer) and Jon “maddog” Hall. Both of them were very cool, and introduced me to several other very cool people. Unfortunately, I’m terrible with names, and besides Pixel (aka “Bob”), can’t remember who I had the pleasure of having dinner and hanging out with Wednesday evening. Here is a rather bad picture taken with my Treo at dinner of some of the folks:

Ok, here is the actual interview that I had with Network World.  I really like how it came out, I think Phil Hochmuth did an excellent job taking what I had said and presenting it to the reader.  This is also the interview where they had taken the quote from for the previous article.   Well here it is if you are interested:

LinuxWorld experts: Securing Web-based application on Linux

A pretty good article about the upcoming LinuxWorld/OpenSolutions World Conference and expo came out in the online magazine Network World today. I was even quoted in it at the bottom of the second page. It was an interesting interview, and I believe I rambled on for way too long, but they managed to get my main point, that is, Security is about finding the right compromises, and there are good tools now and in the near future to help us get there.

Now there is one small issue, and I’m posting this as a correction. I am not currently working on development of SELinux technology. I am working on some policy stuff, but I am not active in the community development of the technology currently. I have worked on it in the recent past, and plan to continue in the near future (though I am thinking of helping out indirectly via SEDarwin). I just wanted to make that clear. I support SELinux, I’m trying to help promote and improve SELinux, but I’m not a core developer of the technology. There are others such as the NSA, Trusted Computer Solutions, IBM, Tresys Technology and several other groups and companies that are putting in the hard work to make this technology a reality in the production world.

Here is the article for those interested.