« Older posts
Newer posts »

WebVR – 15 Sep 2016 CloudCamp London Lightning Talk

16Sep16

A quick overview of WebVR based on Ada Rose Edwards’ awesome ‘getting started with WebVR‘ presentation that I saw at Nineworlds Geekfest

The demos that I showed off can be seen from Ada’s GitHub pages:

Sadly the odd colour basic demo and the T-Rex thing haven’t (yet) made it from the dev container on my laptop to anywhere in the outside world.

If you want to try developing this stuff yourself then it’s Dockerised:


sudo docker run -dp 4000:4000 --name webvr cpswan/webvr

The title page comment about no conspiracy is because I was the 3rd former Royal Navy person in a line up of 6 speakers at an event that has no leaning towards military/defence stuff – what are the chances of that?


Filed under: presentation, technology   |  Leave a Comment
Tags: , , ,

Racist, abusive or foul language

04Sep16

In my last post ‘The Surveillance Party‘ I wrote about how the UK Labour Party used their ersatz SIGINT operation to exclude me from their leadership election process. I was told ‘You posted inappropriate comments on social media on 5 July 2016’, so let’s take a look at my tweets and see what might have scored as ‘racist, abusive or foul language’.

Before proceeding it’s worth noting for any readers who don’t know me personally that I don’t use Facebook, which is why I’m just looking at Twitter.

Racist

I don’t think any of my tweets that day (or any other day) were racist or could be interpreted to be racist. I do however realise that as a reasonable well off, middle class, middle aged, white, CIS guy I get to play life on the easy settings, and may not notice the hidden bias in my language; so comments welcome on where I’ve transgressed so that I can correct my behaviour going forward.

Foul language

This one is perhaps a slam dunk:

IOS_TPlink_RT

I’ve RT’d an account with a naughty word in its name, which would have been an easy hit for an analysis system with a ‘foul language’ blacklist. It may not have mattered that it wasn’t me using that word – guilty by association.

Abusive

This is where we venture into the political correctness twilight zone, so I’ll tune for the most hysterical interpretations of what might cause offense and thus be interpreted as abuse…

Immigrants

Here’s a reply to Dick Morrell venting his anger about Brexit:

immigrants

In this tweet I imply that some of the Brexit voters don’t like immigrants. I think from the media coverage that it’s a fact that many Brexit voters voted that way because they don’t like immigrants, so I’ll take that as a fact; but I recognise that people can still take offense from statements of fact, especially when they’ve aligned themselves with a group associated with the fact (whether it’s a view they hold themselves or not).

Rail unions

Here’s a complaint about the atrocious state of the South Coast main line for the last few months:

train_jam

This could be taken as a jab to the Rail Maritime and Transport workers Union (RMT) and their ongoing industrial action, though that day it was just run of the mill signalling problems.

Disabled/old

Here’s an RT of a wonderful article showing how technology (in the shape of the Apple Watch) has helped a deaf/blind person. Based on the excellent CloudCamp London presentation by Chris Lewis I repeated his point that old age will make us all disabled to some degree:

disabled

Could this somehow be interpreted as abuse of disabled people and/or old people?

Blairites

This is definitely my most political tweet of the day, but it’s quite subtle in that it doesn’t directly mention Blair or Labour. My friend Justin Cormack had tweeted an FT article about a potential split in Labour along the lines of when the ‘gang of four’ split to create the Social Democratic Party (SDP). I replied:

heels

So this is a pretty clear statement of fact. The ‘gang of four’ weren’t any of those things; but by implication I’m pretty clearly accusing the potential ‘SDP mark 2’ splitters of being:

  • neoliberal (a label which no politician ever seems to have aligned themselves with – there are no self describing neoliberals).
  • war criminal aligned – because Blair and his cronies lied to the British public to engage in an illegal war in Iraq that’s had terrible consequences here in the UK, but even more terrible consequences for Iraqis. Frankie Boyle summed it up perfectly a few weeks earlier here, and let’s not forget that the entire purpose of the #chickencoup seemed to be to derail Corbyn ahead of the publication of the Chilcot enquiry. As Blair hasn’t been found guilty of anything (and I expect he never will – at least outside of the court of public opinion) I was perhaps missing an ‘alegedly’, but 140 characters!
  • heels – according to the Oxford dictionary ‘an inconsiderate or untrustworthy man’ (informal, dated). Potentially a term of abuse, but hardly a very strong one.
  • clutching for power at any cost – because they’d rather split from the party that got them voted in than face deselection for not toeing the line from the leader elected by their party.

It takes what I expect to me more than £22 worth of analysis to pick this one apart, and anybody thinking that they’re the target of my ‘abuse’ here is almost certainly a more genuine enemy of the party than I ever will be – because they’re the ones who would split away to satisfy their own political careers.

#ChilcotReport #ChickenCoup

This RT doesn’t show up in the advanced search I linked to above, but I did RT it on 5 Jul:

chickencoup

It’s clearly a political tweet, but does calling some MPs ‘chickens’ count as ‘abuse’?

Conclusion

Along the lines of ‘rather be hanged for a sheep than a lamb’ I’m hoping that my offending tweet was the ‘SDP mark 2’ one where I call potentially splitting Blairites ‘neoliberal war criminal aligned heels clutching for power at any cost’, but knowing how this type of sausage is made I’d bet that it was the naughty word in name RT :(


Filed under: politics   |  1 Comment
Tags: , , , , , , , , , , , , , , , ,

The Surveillance Party

04Sep16

TL;DR

The UK Labour Party has been running an ersatz signals intelligence (SIGINT) operation to identify and exclude members and supporters that they don’t want voting in their leadership election; people who under some sort of criteria are identified as enemies of the party. This should be terrifying, as the difference between enemy of the party and enemy of the state is an election away (and if that party gets its hands on the levers of state power then it levels up to a full capability SIGINT operation).

I don’t think it’s overstating things to say that this is the most significant post Snowden example of the impact of mass surveillance on democracy.

Background

A vote of no confidence in leader Jeremy Corbyn from the members of parliament (MPs) in the Labour Party has triggered a leadership election. I won’t go into the details here, as it’s covered in its own Wikipedia entry. The party has been crawling through social media to identify unwanted members and supporters and exclude them from the party or leadership election process. The Twitter hashtag for this process is #LabourPurge2.

I applied to be a ‘supporter’ of the Labour Party as I feel it’s important that the country has an effective political opposition and I wanted to have a say in the process. Here’s the letter I got:

LabourPurge2

I’ll use another post to pick apart my 5 Jul 2016 Tweets for what might be considered ‘racist, abusive or foul language’ (and whether any of that could be construed as being aimed at Labour Party members) as I don’t want to get sidetracked on this post.

The point here is that they went a few weeks back before finding something that matched the criteria to exclude me. The interesting questions I’ll spend the rest of the post on are: who are ‘they’, what are ‘the criteria’, and how is this all being done?

‘They’ are watching, in secret

Somewhere at the core of the Labour Party there’s a bunch of people who decided that this was necessary, and somewhere else there’s a bunch of people actually doing the spade work. I’m not going to waste time here speculating about the motivations of the former group. The interesting part is that even with open source collection (like public tweets or Facebook posts) and sophisticated analysis tools there needs to be some degree of human assessment. The humans doing that are (like in the case of grown up SIGINT operations) having to do their work in secret, because the reveal the details would be political dynamite. The last thing that the group directing this will want is their criteria being spilled out (like say the ATOS fit-to-work checks), so they can’t just outsource it to the lowest bidder – a high quality circle of trust needs to be established here.

This is where I necessarily stray into speculation (because the facts are hidden):

  1. I expect that the work is being done by a law firm, because they provide clerical/analytical skills for hire, and understand (and most importantly respect) non disclosure agreements. Another possibility would be a ‘big 4’ type consulting firm.
  2. The £25 paid by ‘supporters’ is being used to pay the professional services fees associated with this whole exercise.
  3. Somebody had already figured out the cost of this exercise hence the steep jump in the ‘supporter’ fee (it was £3 last time).

What are the criteria?

The precise criteria of what makes an ‘enemy of the party’ are secret, and that’s a big part of the problem, but we can get some feel for it by observing the responses to and reactions of those being excluded.

Isn’t this just about enforcing the rules?

I’ll take a brief diversion here on the topic of party rules and how they’re interpreted. One might argue that the criteria are publicly and transparently embodied in the party’s rules, and this whole exercise is simply about ensuring that the rules are properly enforced. It’s quite fair and proper that a party doesn’t want people who are racist, abusive or use foul language; but each of those things is open to some degree of interpretation, and it’s in that interpretation that the true criteria for this exercise lie. When I pick through my tweets for 5 Jul the only thing I can be sure of is that I didn’t press the racist button – the criteria are subtle enough that it’s not clear to me which tweet got me found out as an enemy of the party. What I am pretty sure of is that if it hadn’t been 5 Jul then there would have been something incriminating further back in my timeline.

It’s harder on members

I was only trying to be a ‘supporter’ before being found out as an enemy of the party and excluded. People who’ve switched allegiances from other parties to Labour have found themselves excluded for their past support of those previous parties. Here’s an example from Ben Crawford (picked from the top of the pile on #LabourPurge2):

LabourPurge2_Ben

Here lies the point about the dangers of using SIGINT like this – people are being found guilty for their sins of the past. It creates a world where nobody can engage in politics and change their mind (because they think something changed or they were presented with a better argument, reasoning or set of data). It means that only the purist ideologues can engage in the political process. It is exclusionary.

Conclusion

I’ve used the word ‘exclude’ a lot in this post, because that’s what this is about – exclusion. Rules against people who are racist, abusive or use foul language are there to create an inclusive environment, but they’ve been twisted into a set of SIGINT filters to identify ideological enemies and exclude them. We’re getting a front row seat here to what happens when modern SIGINT is used for political purposes, and I’m writing this because I don’t like its impact on democracy.


Filed under: politics   |  2 Comments
Tags: , , , , , , , , , , , ,

Self Encrypting Drives

09Aug16

TL;DR

Many SSDs are also Self Encrypting Drives (SEDs) they just need a few bits flipped to make them work. As the SSDs use encryption under the hood anyway there’s no performance overhead.

Background

This is something of an almanac post after a couple of days of prodding around the topic of PC device encryption. I wanted to make sure that the PCs I use for work stuff were properly protected, but I also wanted to minimise the impact on performance.

Bitlocker

As my laptop runs Windows 8.1 it seemed obvious to check out BitLocker, but a quick search revealed that software based BitLocker has some degree of performance overhead.

In the end I actually went with BitLocker on my laptop, as the SanDisk X300 SSD I have isn’t a SED (as it doesn’t support Opal or Microsoft eDrive), which is a shame as the article I found on the X300s gives a pretty good review of what’s out there.

Even if I did have an X300s rather than a plain old X300 the eDrive/BitLocker combination wouldn’t have been easy, as it requires doing a clean install of Windows rather than letting you keep your existing setup.

SEDs

SSDs use encryption internally anyway so that the blocks written to flash memory don’t have long runs of 1s or 0s, so it’s almost trivial for an SSD to also be a SED – all that’s needed is a means to manage the keys that are used to unlock that encryption. Out of the box SEDs are like safes with the door open and no combination set – they just need some tools to set the lock.

Class 0

With my desktop machine (a NUC) I’ve got a Samsung SSD that supports three different modes of encryption:

Magician_Security

  • Encrypted Drive is eDrive/BitLocker – too much trouble to configure
  • More on Trusted Computing Group (TCG) Opal below
  • Class 0 just uses a BIOS boot password. After reading this piece on Class 0 I decided it was probably worse than useless.

Opal and sedutil

The X300s article had run through the basics of Opal and use of the Wave Embassy app to enable it. Sadly as I have just a plain X300 I wasn’t getting a free license for that. There are a bunch of commercial offerings for Opal, from the usual suspects, and frankly they all look awful.

Open Source to the rescue… the Drive Trust Alliance offers sedutil for Windows and Linux. It’s a combination of a command line tool to configure Opal, and a Linux based pre boot application (PBA) to ask for the password that unlocks your drive.

After a bit of downloading and testing I confirmed that I was good to go, and following the encrypting your drive instructions worked perfectly.

The user experience

Most of the time the encryption is totally seamless in terms of performance and use experience. The only change is at boot (or resume from hibernation) when the PBA is launched first and asks for a password – the system then unlocks the SSD and reboots into the normal OS.

No Sleep

The one issue seems to be that the system will no longer make use of sleep mode, instead dropping into hibernate (to force a request for the password for resume). I can see why that’s more secure, but for my own use case I’d be happy to have sleep/wake without being asked for a drive password.

Conclusion

I wish the drive in my laptop was a SED. The BitLocker performance overhead isn’t too annoying, and it didn’t even take too long to encrypt the whole SSD, but it’s still sub optimal.

Using open source tools with the SED in my desktop was quick and easy. So if I’m even unlucky enough to be burgled I won’t have to worry about the data on that device.


Filed under: security   |  3 Comments
Tags: , , , , , ,

Surprisingly Slipshod for Amazon

18Jun16

I got an email proclaiming:

AmazonFresh – now in your area

If that wasn’t exciting enough in its own right (which would probably be the case) it went on to say:

Get a £20 Amazon.co.uk gift card when you spend £60 or more on an AmazonFresh order and have it delivered between 16 – 30 June, 2016

I’m a sucker for a deal, so I thought I’d give it a try (in place of my usual Waitrose Deliver order).

The first problem was when I clicked on the link in the email https://www.amazon.co.uk/b/?ie=UTF8&node=10407261031&bbn=6723205031

Amazon_Amp

Ah – the old & to & gag. A few backspaces later and I’m at this:

Fresh_Postcode

Alarm bells are starting to ring now. You know where I live Amazon. You know the postcode. Rule #1 of UX is don’t ask a human to answer a question where the computer already knows.

So then I enter my postcode:

Fresh_postcode2

And I look back at the email:

… The Offer is limited to selected London postcodes where AmazonFresh is available …

So AmazonFresh isn’t now in my area, because my area isn’t London, that’s not where I live (and Amazon knows that). So the whole thing is a ham-fisted waste of time.

I look forward to my London friends telling me how great Fresh is. If they can get past the old & gag.


Filed under: could_do_better   |  2 Comments
Tags: , , ,

Infosec Europe 2016 DevOps Connect presentation Deploying Security at Scale

09Jun16

Filed under: presentation, security   |  Leave a Comment
Tags: , , , , , , , ,

micro:bit Simon

15May16

The BBC micro:bit is a computerised project board that’s being given to every year 7 (11-12yr old) kid in the UK. It’s supposed to encourage experimentation and learning to program in the same way that the BBC Micro (and associated BBC programmes) did back in the 80s. I’ve been pretty excited about it since the announcement, though I feared that I’d have to wait until my daughter received hers before I got my hands on one. Luckily a friendly local teacher brought me one to play with, and with a long flight on my hands I decided to have a go at coding Simon (a perennial favourite of mine for trying out new platforms).

There are various different ways to program the micro:bit, but I went with Python (as it’s familiar) and the Mu editor (as plane WiFi isn’t a great way to use online code editors). I used the accelerometer for input, and simple arrows to show the game sequence (up, down, left, right).

Here’s the code, which is also on github (it should work fine in the online Python editor as well as Mu, and yes I know I should probably not be using global variables, but I haven’t refactored much from earlier BASIC and C implementations):

from microbit import *                  # standard Micro:Bit libraries
from array import *                     # to use an array
import random                           # generate random numbers

count = 0                               # initialise counter to 0
wait = 500                              # initialise wait to half a sec
sequence = array('B',[])                # array to hold sequence
display.show("-")                       # start out showing a dash

def squark(dir):                        # function to show arrows
    global wait
    if dir==0:                          # Right
        display.show(Image.ARROW_E)
    elif dir==1:                        # Left
        display.show(Image.ARROW_W)
    elif dir==2:                        # Down
        display.show(Image.ARROW_S)
    elif dir==3:                        # Up
        display.show(Image.ARROW_N)
    else:
        display.show("-")
    sleep(wait)
    display.show("-")
    sleep(wait)

def play_sequence():
    global count                        # use the count global variable
    global sequence                     # use the sequence global variable 
    global wait                         # use the wait global variable
    sequence.append(random.randint(0, 3))       # add a new value to sequence
    for i in range(0, count):           # loop for sequence length
      squark(sequence[i])               # display the arrow
    wait = 500 - (count * 15)           # vary delay to speed things up
    count = count+1                     # increment sequence length
    
def get_tilt():
    x = accelerometer.get_x()           # read left-right tilt
    y = accelerometer.get_y()           # read up-down tilt
    if x > 100:
        return 0                        # Right
    elif x < -100: return 1 # Left elif y > 100:
        return 2                        # Down
    elif y < -100:
        return 3                        # Up
    else:
        return 4                        # Flat
        
def reset_game(): 
   global count
   global sequence
   count=0
   sequence=[]    

def read_sequence():
    global count
    global sequence
    display.show("*")                   # Show that we're waiting
    for i in range(0, count-1):
        while get_tilt()==4:            # Wait for a tilt
            sleep(50)
        input=get_tilt()
        if input == sequence[i]:        # If it's right then show it
            squark(input)
            if i==9:                    # We have a winner
                display.show(Image.SMILE)
                sleep(1000)
                display.show("WINNER")
                reset_game()
        else:
            display.show("X")           # Wrong tilt - game over
            sleep(1000)
            display.show("TRY AGAIN")
            reset_game()
            break
        
while True:
    play_sequence()                     # play the sequence to be remembered
    read_sequence()                     # read the sequence from the player
    sleep(1000)                         # wait a sec

Filed under: code, micro:bit   |  2 Comments
Tags: , , ,

InfoQ – Docker Security Scanning

10May16

Docker Inc have announced general availability of Docker Security Scanning, which was previously known as Project Nautilus. The release comes alongside an update to the CIS Docker Security Benchmark to bring it in line with Docker 1.11.0, and an updated Docker Bench tool for checking that host and daemon configuration match security benchmark recommendations.

continue reading the full story at InfoQ

Docker_Security_Scanning


Filed under: Docker, InfoQ news   |  Leave a Comment
Tags: ,

Wireless doorbell extension

02May16

TL;DR

A relay board from eBay combined with a cheap wireless doorbell from Amazon allowed me to extend my existing wired doorbell.

Background

I got the loft of my house converted into a home office. I love it up there, but if I shut the door (to keep noise out) then I can’t hear the doorbell (or anybody shouting up the stairs for me).

Some research led me to wired to wireless doorbell extenders such as the Friedland D3202N, but they didn’t seem like an ideal choice due to:

  • Being hard to come by (obsolete?).
  • Lock in to a given (expensive) wireless bell system.
  • An extra box to mount near the existing bell (and wires to hide).

I also checked out the Honeywell DC915SCV system, but that had many of the same flaws/limitations.

What I really wanted was a setup where I could have a bell in my office, another in $son0’s room, integration with the existing doorbell, and a summoning button in the kitchen/living room.

The bells

I found the 1byone Easy Chime system on Amazon, which seemed to offer multiple bells and bell pushes that could work together. I bought one to see how hackable the bell push would be, and the answer was good enough – the button is a standard push button surface mounted onto the PCB (and thus very easy to remove/replace). I also found pads on the PCB marked SW2 that aren’t connected, which seem to change the send code.

bell_push

Having confirmed that the system would do what I wanted I ordered a second bell and push.

Relay board

Now I needed some way to take the 12V AC from the wired bell system and turn it into a button push. A solid state system would have been nice, but I couldn’t find anything off the shelf, and I wasn’t going to design something from scratch[1]. The ‘12v ac/dc Mini Handy little Relay board‘ I found on eBay seemed to be ideal.

Putting it all together

The doorbell has space for some batteries that isn’t used, so I was able to tuck the relay and wireless push in there.

I’d have liked to wire things up so that the relay was activated when somebody pushed the bell, and I probably could have done that if I’d dug into the system; but with the available connections the best I could do was to wire it across the wired switch, so the relay is spending most of its time on (with consequential power draw, heat, and expected lower component life… but it works).

bell_done

So the relay is wired across connections 1 and 3 of the wired bell, to the same places as the wired bell push. The wireless bell push is connected to the C (common) and NC (normally closed) connections on the relay board. When the doorbell is pushed the relay briefly powers down and opens, causing the wireless bells to be activated.

relay_wired

Conclusion

The entire system cost £26.23 and took no longer to put together than I expect it would have taken to install an off the shelf wired to wireless extender. The key parts fit inside the existing bell, so no new boxes and wires to worry about. I’m very happy with the outcome.

Note

[1] This is where one of my smart hardware hacking friends points out that I could have used a 555, a twig and a rusty nail.


Filed under: howto   |  2 Comments
Tags: , , , , ,
« Older posts
Newer posts »