The BFC Computing Weblog: Category Hardware

Anti-Virus on Voting Machines

Bill McGonigle — Mon, 25 Aug 2008 21:10:00 -0400

There’s been much made of the revelation that Diebold voting machines run an install of McAfee Anti-Virus, and that it’s caused trouble with the voting software.

The arguments against it typically boil down to:

Your voting machines shouldn’t be use for anything else
Your voting machines should be secured against anybody installing software on it
You can’t verify the operation of MAV so it could possibly tamper with votes
You should be running an operating system which is not so easily infected

Those arguments all have merit, but skip the fundamentals - the software image on a voting machine should not be running on read/write media, that is hard drives. If that basic criteria isn’t met, AV software might actually be a good idea, but missing the fundamentals is no excuse for dirty hacks.

I build my first appliance computer that could run from a CD in a CD-ROM drive in 2002. It’s neither new nor a difficult concept. When you need things to be secure, in that case under HIPAA regs, in this case for votes, you mount your media device (hard drive, flash memory, etc) with the ‘noexec’ flag, and then no software installed on the read/write media can be run from that media. Since you can’t write to the CD, software can’t be run from there either. You provide a stripped down OS image to make doing any more than the minimum very difficult, certainly requiring physical access to the machine.

This isn’t to say your machine shouldn’t be kept secure - of course it should, and the BIOS needs to be correctly configured (many of you know the security problems with certain BIOS configurations) - but read-only media and a good Q/A process obviates the need for anti-virus software. Certainly some software selection choices can make this difficult, but any good architecture starts with the requirements and works towards software selection, not the other way around. Assuming good security is a requirement.

Ideal Time Machine Hard Drive

Bill McGonigle — Wed, 23 Jul 2008 18:47:23 -0400

After coming close to losing a few years' worth of the kids’ digital photos (I had a backup, thank you, rsnapshot, but when I only have one copy it’s close to being lost) I decided to find a good full-time backup hard drive for the wife’s computer. Hers is a Mac Mini running Leopard, and it has the Time Machine backup system (think exactly like rsnapshot, but with directory-level hard links as well). So, I wanted to find a drive that would be:

Small
Quiet
Easy
Big enough to handle backup of an 80GB drive
Reliable
Cost-effective

Now, there are several drives out there that have the capacity. Most are pretty big (physically), and many of them require an AC wall wart and have fans in them. That I didn’t want.

I usually just head over to Newegg and find a case and a drive and screw something together, but they didn’t have any that met the requirements. By this time I had decided that a Firewire bus-powered drive with a 2.5” 160GB drive would be perfect, and I finally found one at MacSales/OtherWorld Computing. These guys sponsor the open source project XPostFacto which lets you run OSX on hardware Apple has abandoned (so that you can connect to the Internet without being pwned). So, good guys, and they have the 160GB OWC Mercury On-The-Go Oxford911 FireWire 2.5” 5400RPM 8MB Cache Portable Storage Solution, which, while a mouthful, is just the right drive for Time Machine backups. I didn't think I'd buy another PATA drive, but the Oxford 911 chipset is really quite well-proven, a nice feature for a backup drive. The drive comes with a cable and a pleather case:

and a CD that contains some software for something I don't need (it would be a nice green move to be able to leave out pleather cases and CD's if they're just headed to the trash heap). I plugged the drive in, the Mac asked me if I wanted to use it for Time Machine, and a few clicks later the backups started running. Nicer interface than rsnapshot, for normal mortals anyway. Now after all that, there are two complaints. First, it's in a very nice lucite case. But the case doesn't have much in the way of markings on it. There's a 3-position switch on the back, and you have to refer to the user's manual pamphlet to figure out what it does. It's a switch for Bus Power/Off/AC Power. I made a label on my label maker so I could recycle the instructions. The second point isn't about the product but the marketing. The box exclaims, "Fits in your shirt pocket!". Here's how well that works:

This particular oxford (not 911) shirt of mine has bigger pockets than any others, and it just fits. When I hear a claim like that, I think of another 2.5" drive I have:

that can almost fit reasonably in a pocket. This isn't a shirt pocket drive - maybe cargo pants. Better to just call it a really nice drive.

Ideal Time Machine Hard Drive

Bill McGonigle — Wed, 23 Jul 2008 18:47:23 -0400

Small
Quiet
Easy
Big enough to handle backup of an 80GB drive
Reliable
Cost-effective

Now, there are several drives out there that have the capacity. Most are pretty big (physically), and many of them require an AC wall wart and have fans in them. That I didn’t want.

This particular oxford (not 911) shirt of mine has bigger pockets than any others, and it just fits. When I hear a claim like that, I think of another 2.5" drive I have:

that can almost fit reasonably in a pocket. This isn't a shirt pocket drive - maybe cargo pants. Better to just call it a really nice drive.

Ideal Time Machine Hard Drive

Bill McGonigle — Wed, 23 Jul 2008 18:47:23 -0400

Small
Quiet
Easy
Big enough to handle backup of an 80GB drive
Reliable
Cost-effective

Now, there are several drives out there that have the capacity. Most are pretty big (physically), and many of them require an AC wall wart and have fans in them. That I didn’t want.

This particular oxford (not 911) shirt of mine has bigger pockets than any others, and it just fits. When I hear a claim like that, I think of another 2.5" drive I have:

that can almost fit reasonably in a pocket. This isn't a shirt pocket drive - maybe cargo pants. Better to just call it a really nice drive.

Barracuda Moves Against Trend Micro Bogus Patent

Bill McGonigle — Tue, 24 Jun 2008 18:44:00 -0400

After reading about Barracuda moving to invalidate a bogus patent Trend Micro filed for on virus-scanning at an e-mail gateway (many of my clients depend on this technology) in January, I sent Barracuda the following note:

-----Original Message-----
From: Bill McGonigle [mailto:bill@bfccomputing.com] 
Sent: Tuesday, January 29, 2008 12:24 PM
To: legal@barracuda.com
Subject: possible SMTP prior art - TFS

From:

http://groups.google.com/group/comp.mail.sendmail/
browse_frm/thread/3cee3dc93ea81690/a8cd75d669fbd6b7?lnk=st&q=smtp+virus+scan#a8cd75d669fbd6b7

Its pretty functional - gateways between any/all MS/MAIL,
WP-OFFICE, CC:MAIL, SMTP, UUCP, MCI-MAIL. It does uuencode
and MIME attachments (configurable per address or domain
wildcard) and international characters. It can also virus
scan attachments on the way through the gateway, and access
can be controlled on a user by user basis!

(message dated July 25th, 1995).

It looks like it's still around in some form from foxT:
   http://www.tfstech.com/

Good luck,
-Bill

I never heard back more than a quick “thanks!” from Dean Drako, CEO of Barracuda, but today, I read they’ve moved ahead with this strategy and Goran Fransson, developer on TFS, is a new open source ally.

Dean writes of Goran, “We greatly appreciate the time that Goran Fransson took in coming forward to share this very important piece of prior art,” Drako says. “We believe that his testimony is instrumental in our case against what we believe is an unjust patent claim by Trend Micro against Barracuda Networks and the open source ClamAV project. In our view, Goran is an open source hero.”

Full disclosure: I’ve sold completely open solutions, based on postfix/MailScanner/clamav/sqlgrey against Barracuda’a blackbox appliances, but I’m glad they’re fighting against Trend Micro’s abuse of the system.

ZFS/Linux Summit Meeting

Bill McGonigle — Mon, 19 May 2008 20:19:00 -0400

Photos of Jeff Bonwick of ZFS fame and Linus Torvalds of Linux fame. Turns out that they’re neighbors and Jeff was just helping Linus hook up a new gas grill. (j/k)

ZFS is the ‘one filesystem to rule them all’ but it can’t be brought into the Linux kernel because of patents and licenses. ZFS is licensed under the CDDL, which gets it into FreeBSD and OSX, which are BSD and thus compatible with the CDDL, but not into the Linux kernel, which is GPLv2. If Linux were GPLv3, it would be possible for Sun to also license ZFS as GPLv3 and the twain could meet. However, Sun doesn’t really need to bother if Linux isn’t going to do it.

Note that a cleanroom implementation of ZFS could be GPLv2-compatible, but since it’s not CDDL-based the code wouldn’t have patents grants. “Sun Sues Linux Kernel Developers, News at 11” helps nobody.

I wrote on the ZFS list that having ZFS as a de-facto standard would lift all boats, and help Sun sell Thumpers. Assuming Jonathan dispatched Jeff to broker a “I’ll show you mine if you’ll show me yours” with Linus, we can look forward to the day when digital cameras come with ZFS flash cards instead of FAT32. And that the current owner of the FAT32 patents would be further isolated is really a key point.

Missing Sync and the Garnet VM on Nokia n810

Bill McGonigle — Mon, 12 May 2008 17:23:00 -0400

In the long and continuing saga to have a decent mobile Internet solution that is friendly to Free Software, I’ve been working out a porting strategy to get rid of my Treo 650, which, while it’s been useful, is now beyond the end of its useful life. The replacement for the Treo is a Nokia n810, which is not a phone, but can use a phone over Bluetooth to get Internet access. It’s a great little linux box, with a Mozilla-based browser with Flash and wealth of 3rd party apps via .deb repositories. Wifi, bluetooth, GPS, etc. Meanwhile, I want a phone with good phone audio quality (pretty much rules out smartphones - bummer), EVDO, Bluetooth, and 4+ hours talk time (so I can run it all day without charging). A flip-phone is really what I want, to avoid accidental dialing in my pocket (DAMHINT), not just for the Captain Kirk factor.

I have a decent workflow established with the Treo 650 and Missing Sync on Mac OS X that works pretty well for me. Access, the company which owns Palm OS, released, a while back, a PalmOS 5 emulator for the Nokia n810 which runs all the basic Palm applications. I tried getting this working earlier but wasn’t successful.

Now that’s changed. One unexpected checkbox later and I have full HotSync between n810/Garnet and Missing Sync 5.1 on Mac OS X 10.4.11. Here’s how to do it:

First, in the Sharing Pane of System Preferences, make a new firewall exception like this, to allow in Network HotSync preferences:

Now, add a new handheld in Missing Sync, and change the Preferences, to include these:

And set the various standard conduits to overwrite data on handheld with desktop (once only).

Now, on the Garnet VM, put in the IP address of your Mac (dns didn’t work for me), and click the HotSync button. You should get a successful sync. Do it again to make sure it does nothing, quickly, indicating successful sync. Change some data on both ends and make sure it syncs. OK, you’ve got sync.

Now, go back and uncheck the allow-all-handhelds-to-network-sync box to protect your data. Make sure ‘Network’ is set in ‘Edit Handhelds’, and it’ll continue to work. I’m not sure what happens the first time, but there must be some handheld negotiation that’s required without permissions. Minor inconvenience, just needs to be documented.

All the iCal stuff should sync just fine, but MemoPad apparently doesn’t allow a way for sharing Memos between handhelds. So, to get this you also need to copy the Memo data file; copy:

~/Documents/Palm/Users/treo-profile/MemoPad.memopad

to:

~/Documents/Palm/Users/n810-profile/MemoPad.memopad

and sync again. You should have all your common Palm data on the n810 at this point.

Have fun. I ordered a new-in-box Motorola e815 radio from eBay for $90, which meets all my phone criteria. From here, I’d like to move to KDE PIM apps, and perhaps OpenSync. OpenSync to iSync is a non-starter, currently, but perhaps SyncML can bridge the gap.

Microsoft/Zune/NBC/Watermarking

Bill McGonigle — Thu, 08 May 2008 23:44:00 -0400

People are a tizzy about some ‘magical’ technology NBC got Microsoft to put into its Zune to prevent ‘unauthorized’ episodes from playing. Of course, a he-said, she-said spat ensued, and they’re probably both lying. Anyway, this magic isn’t, it’s just watermarking. It’s well-defined how to make this unnoticeable and non-trival to remove. NBC just adds watermarking to the shows before they air, the Zune detects the watermark, and refuses to play the file unless there’s also an authorization key.

The trick with this approach is that it’s 100% DRM; hardware player support is required, and any other player will not have a problem. Also of note, this does nothing to stop copying, it’s just a revenue-enforcement model and is anti Fair-Use.

Nah, neither GE nor Microsoft would do something like that… good on Apple for refusing to play Evil Ball.

Molex to Left-Angle SATA Power Cable

Bill McGonigle — Sun, 13 Apr 2008 04:05:00 -0400

My, these are hard to find. Scroll down to part# PWS17904. I need them to put SATA drives in a 1U case with Molex power connectors and very little clearance, on my quest to build a powerful, quiet, 1U server (no compromises!).

I have a couple on order. I’ll post back here if there are any problems.

Murphy Strikes

Bill McGonigle — Fri, 28 Mar 2008 12:17:00 -0400

Sure enough, after three years of trouble-free server operation, the day after we deactivate a RAID mirror to make room for drive expansion, the drive dies.

If you sent us important mail between 3/26 at 10:00EDT and 3/27 at 02:00EDT, please resend.

If there’s a silver lining here, we’ll be trying to build a replacement server that all of: [1U, powerful, quiet]. It used to be a pick-two situation, but around here we’re into “pick all three”. We think it can be done.