Restaurant review: Rip's

Tuesday 31 July 2007 at 11:40 pm Rip's Casual Dining - 3809 North Crain Highway; Bowie, MD 20716; 301-805-5901

While in the field on assignment for work this week, I'm going to be stuck eating out a lot, so I may as well make the best of it, right?

Last night I went out to dinner with my cow-orkers and the other guys on my project team after the day's wrap-up meeting was over. We stopped back at our hotels to change and take showers after a long day of hiking around a huge business complex, wandering through server rooms the size of gymnasiums, and crawling around on all fours through ventilation ducts and beneath raised forced-air conditioning floors to figure out what's attached to what, where, and how. Seeing as how you can only eat so much commissary food without dying of a heart attack, we decided to broaden our horizons a bit for dinner and search out a neigh-mythical Italian grille "just down the beltway", or so the woman at the front desk told us.

Thanks to Mapquest, we failed miserably. We did, however, find Rip's Casual Dining, a homey looking family restaurant done up in weather-worn wood inside and out, with horseback riding tack on the walls and large family-sized dinner tables scattered amongst the tiny wooden dining booths that one would expect of a diner by the side of a rural road. The lot of us were showed to the back of the restaurant where the tables large enough for our party could be found.

For starters, it took our waitress fifteen minutes just to bring out water for us. It took another ten minutes (about what you'd expect for a reasonably busy restaurant) for her to get our orders. Now, here's where things really start to go south: While the tables around us were given their complimentary baskets of biscuits and muffins (which were excellent, by the way - corn muffins with what we think was almond extract or amaretto in them) we waited. And waited. And waited some more. In fact, in the forty-five minutes it took them to bring our entrees (about an hour in total), the tables around us were seated, served drinks, rolls, and muffins, served the appetizers they'd ordered, served dinner, ate everything, paid, and left while we sat there talking and wondering what in the hell was going on in the kitchen.

Such is most annoying when you feel like you've been re-enacting the search for the Xenomorph in Alien all day and you really want to have a decent meal.

At least the food was tasty.. I had the grilled chicken tortilla salad (with caesar dressing), which was very tasty. I don't recall what everyone else had, only that they were pleased with the fare, though annoyed with the horrid service.

Cost? About $12us per person for a full meal. Not bad at all.

My overall rating: 3.25 flareguns. I found myself wishing repeatedly that I'd had pyrotechnics of some sort to get the attention of the waitstaff. Maybe a cattle prod to drive the point home. Though I've only been here once, I cannot, in good conscience, recommend this restaurant unless you've got a lot of time to kill. Bring a book. Also, be sure to ask for the muffins and not the rolls.

Map to Kite Flying Day 2007.

Tuesday 31 July 2007 at 8:30 pm In preparation for LGBT Kite-Flying Day 2007 the organizers have worked up a map to direct people to the correct location this weekend, the afternoon of 4 August 2007. Click on the thumbnail to view the full-sized image.

Download the full-sized image: Here it is!

Funeral's over, and I'm back in DC.

Sunday 29 July 2007 at 11:37 pm I don't have a lot of time right now, so I'll give everyone the highlights:

Lyssa and I got back from Pennsylvania around 0000 EST5EDT this morning. Grandma Pat's funeral went smoothly, the wake was small (as wakes go) and reasonably uneventful. I wound up sleeping through most of it because I was still dead tired from driving all Friday night up to Pennsylvania after work, got up early to get ready and dressed, and attend the memorial service. We left around 1845 EST5EDT on Saturday night and, after driving through one of the nastiest rainstorms to hit the tri-state area this month, got home safe and sound. I slept for a good ten hours after getting home.

This evening, i had to drive elsewhere yet again - I'm in the field for work and staying in a hotel for the week.

Will write more when I get time, probably tomorrow night.

"Whattya suppose that make us?" "Big damn sysadmins, sir."

Friday 27 July 2007 at 2:43 pm "Ain't we just!"

Happy System Administrator Appreciation Day, everyone. Buy your sysadmin a beer after work tonight.

US DoJ says that highly-ranked White House personnel are exempt from subpoena.

Friday 27 July 2007 at 2:38 pm The Department of Justice snuck back home with its tail between its legs earlier this month after deciding that senior White House officials are exempt from subpoena and thus can freely ignore summons to testify. That's right... they don't have to show up in court if they don't want to, especially with regard to questioning about the possibly illegal firing of eight US prosecuting attorneys. The House Judiciary Committee has been trying to get to the bottom of this because, in the past couple of years a number of prosecutors that didn't toe the party line exactly lost their jobs, and to that end they've been trying to get people who were closest to the matter on the stand. Over and over again, those summoned are saying that they will not appear, that they will not testify, and that they've got the backing of George W. Bush telling them that they are immune from any such legal compulsion. Now the question is whether or not they can be brought up on charges of contempt of court for their actions, but if they can't even be commanded to show up in court there is a snowball's chance in a blast furnace of that ever happening. The few who have set foot before the committee, such as Sara Taylor (former unspecified White House official), gave only partial information, usually to save their own asses, and cited privileged protection as their justification for avoiding any other questions.

Technically, however, this is how privileged judicial protection is supposed to work: You have to appear in court and give at least some testimony, but you can refuse to answer certain questions, or at least that's how professor Stephen Gillers of NYU's law school put it.

I don't think that I'm going out on a limb by saying that nothing is ever going to come of this. The people in power in this country right now have a master plan and they're following it to the letter. They've also got the rest of the government that they could conceivably have to answer to for their actions set up in such a way that their hands are tied and what options they have are limited. In a month or so this whole thing will be forgotten about by the media, and the people around the same time.

NASA project for the International Space Station sabotaged.

Friday 27 July 2007 at 2:12 pm A couple of days ago it was discovered by NASA that someone had sabotaged a hardware upgrade destined for the International Space Station. Specifically, someone cut the wiring inside of a sensor package designed to monitor physical stress upon the ISS' superstructure and relay the data back to Mission Control. While being able to keep an eye on the overall status of the space station would be a good thing, it's unlikely that it would have directly placed the crew in harm's way, barring unforseen circumstances. The sabotage was first discovered in a test unit in the lab; a subsequent check of the module that was due to be loaded aboard the Space Shuttle Endeavour showed the same kind of damage. At this time, the identities of the culprits are unknown, and if they're not internal security is keeping them a closely guarded secret. NASA says that repairs will not take long, and the replacement monitoring system will be sent up on the shuttle as scheduled.

I like how they didn't invite the EFF or the ACLU to this conference.

Thursday 26 July 2007 at 1:59 pm It would appear that the US Senate is pushing to turn the Net into a nice, safe, sandboxed playground that are constantly monitored because they don't like what you can find on it. It should come as no surprise that they're invoking the protection of children to justify the installation of near-ubiquitous content monitoring and filtering so that They can decide what you should or should not be allowed to look at. They seem to like using children as an excuse, because no one in their right mind would not want to protect kids, right? Parents, they say, are utterly incapable of keeping tabs on what their kids do when they're using computers, which is utter bollocks. Parents need to be parents, which is to say that they need to take an interest in what their kids are up to, set rules of behavior, and most importantly enforce those rules to teach their kids that there are things that they shouldn't be getting into.

The question that now remains is this: Who gets to decide what is or is not filtered? Who determines what people should be protected from, as opposed to what people should make up their own minds about? At what topics will they stop? Alternative politics? Grassroots news? Alternative spirituality? Pictures of someone whacking a pinata?

Who gets to decide what 'protecting' means?

In the immortal words of Andrew Stuttaford, "Rule 1: When someone talks about 'the children' watch out for your wallet. Rule 2: When someone talks about 'the children' watch out for your freedoms. And now, it seems: Rule 3: When someone talks about 'the children' watch out for your democracy."

Clockwork automata on the micro-scale.

Wednesday 25 July 2007 at 11:50 am An article in the New Journal of Physics this month postulates a novel use for the not-yet-extant technology of nanotechnology: Building clockwork computers on a microscopic scale. The idea is that electronic circuitry isn't suitable for some environments but difference engines constructed on a microscopic scale might be because they would be far more precisely engineered and constructed with more durable materials. Sure, they'd be slower than conventional integrated circuits, but for some applications (like monitoring engine timings) you don't need a processor that can play Doom 3.

I hate to break it to them, but this isn't a new idea at all - Charles Stross beat them to it by a couple of years in the novel Accelerando. In the book, the IRS used nanoscale difference engines for security purposes because electromagnetic eavesdropping had advanced to the point where anti-TEMPEST technology was no longer effective. Still, I have to hand it to them - it's a technology that hasn't been explored in a serious manner in decades, and sometimes great advances can be made by re-implementing old developments. Also, if anything could spur development of practical nanotech (wet or dry), it's the prospect of new and interesting number crunching apparatus.

Lynch's Law #4.

Wednesday 25 July 2007 at 08:03 am No anonymity network is fully operational until the following three things have been successfully made available:

1. A copy of the Protocols of the Elders of Zion.


2. The King James Bible.


3. Porn.

Cellular PDAs with RATs in the datawalls.

Tuesday 24 July 2007 at 2:27 pm RATs meaning remote access tools, that is. Malware that conceals itself in a system and lets someone on the outside with the right application and credentials connect and manipulate the system remotely. The classic such utility is Back Orifice by the Cult of the Dead Cow, and was probably the first of its kind which let you do such things as mess with the mouse cursor and typed text, flip the display upside down, access the webcam, and open or close the CD-ROM.

It seems that combination cellphone/PDA's are now advanced enough to be targeted. Nowadays many cellphones have digital cameras built into them, as well as general purpose RAM and storage, microphones for speakerphones, and at least one form of networking capability (sometimes more - Bluetooth and Wi-Fi are increasingly common on lower-end phones these days). Also, a great deal of information is actually stored locally, so the contents of a phone falling into the wrong hands could be disasterous (remember what happened to Paris Hilton back in 2005?) because everything from stored passwords (you do encrypt, right?) to contact information to cached text messages and e-mails are stored in the unit. As if that weren't enough, GPS units are now being built into phones; incidentally, I use the one built into my own along with a portable version of Google Maps to navigate, so the technology is certainly feasible. Feasible enough to abuse, I should think.

Word's been going around for a couple of months now that there are people being stalked through their cellphones. They're getting text messages from Someone Out There with near-realtime images captured from the cameras. Text messages are being sent from their phones without their knowledge. Audio recordings were played back of not only their voicemail but things that went on around them because someone silently turned on the speakerphone to use it as a bug. It would be possible for an attacker to go through the datastore of the phone to see who called whom in which direction and pull stored contact information, too, because that's kept in the phone as well as with the cellular provider.0

The hell of it is, there are applications on the market that already do a few of these things. If you added them together, they could theoretically replicate all of these unusual happenings. However, all it would really take is a small number of people (one person, really) with a development kit for a particular phone or embedded operating system used in cellphones to write a single application to do all of these things, and potentially more. The trick then is actually infecting a phone - either someone would have to get hold of your phone to install a new application on the sly, or the user of a phone would have to be tricked into downloading and installing malware. It would be far easier, however, to get cellphone users to browse a malicious website or open a text message that exploits a bug in the phone's software.

It's not so far-fetched - the Apple iPhone very well might have such a bug.

As always everyone, forewarned is unflatlined. Be careful out there.

We lost Grandma Pat yesterday.

Tuesday 24 July 2007 at 1:00 pm "A feast for fire and a feast for water; a feast for life and a greater feast for death!"
--Liber Al vel Legis, II:41
Lyssa's Grandma Pat died yesterday.

She's already been cremated, and a memorial service will be held this weekend.

This doesn't bode well.

Tuesday 24 July 2007 at 08:29 am Passed along by Vlad_II:

Does anybody know what's up with the HOPE conference?

Backing up PalmOS devices using open-source software.

Tuesday 24 July 2007 at 08:21 am When using the Pilot Link toolset with an open source operating system to back up a PalmOS device such as the Palm Treo 700p, remember two things: One, when you connect the phone to your system using the USB cable, it will create two devices in the /dev directory, /dev/ttyUSB0 and /dev/ttyUSB1 (assuming that there is only one Treo plugged in at a time). You'll want to reference the second device file, /dev/ttyUSB1. Secondly, press the hotsync button on the cable or activate the hotsync function on the device before running the pilot-link utility. This is the command that I use: pilot-xfer -p /dev/ttyUSB1 -s ~/treo

A long week, a late night, and so much to write...

Monday 23 July 2007 at 11:48 pm Well, let me see... it's been interesting times the past couple of days, which has left me precious little time to write about what's actually been going on with my day to day life lately.

First off, early last week Alphonse Elric, Lyssa's primary machine and workstation at home packed it in. One moment he was cunching merrily away, the next utterly locked up. No amount of rebooting or jiggling was able to bring him back online, though we did notice that the components inside of his silver chassis (as well as the exhaust fans and chassis itself) were horribly dirty, and caked with dirt the likes of which I don't think anyone has seen outside of a flood cleanup. Working on the theory that the graphics card had died a horrible heat-related death, I swapped in a spare the next day, and managed to boot Alphonse for a couple of seconds. Just a couple of seconds - we got to drive detection, and then nothing.

In the end, Lyssa and I determined that Alphonse's mainboard had died, which is a simple enough fix given enough time. We headed down to the local Micro Center outlet to buy a new three-pack of canned air, a new mainboard, and while I was at it a 1 GB memory upgrade for Windbringer. It took us the better part of three hours to dismantle Alphonse, clean absolutely everything we could with isopropyl alcohol and non-static wipes, and replace the mainboard. Before setting out to tackle this task, I hooked the primary drive up to Leandra with a nifty USB-to-IDE converter and began copying everything that I possibly could off to her storage array for safe keeping.

That night I got to watch something first-hand that I'd only heard about because of the circles I tend to run in: Tech sexism. The phenomenon in which females in a computer store are all but ignored if there is a male with them, on the incorrect assumption that they're the clueless girlfriend along for the ride when in fact they're the ones that're doing the purchasing. They kept deferring to me when I was present, and ignoring Lyssa when I wasn't, but more's the point they kept trying to force upon her gear that she didn't much need, and probably was more expensive than she really needed. Case in point: While looking for an LCD flatpanel to replace the 22" CRT on her desk, they gave her the wrong display without even asking her. The display which, we came to find later, was the cause of her eyestrain and headaches.

Let this be a lesson to everyone out there: Back up your data fully and often. Lyssa was lucky; she didn't lose anything. You might lose all of the data you have.

Alphonse Elric came back up without any trouble. He's still short a drive that I'm duplicating at this time, but that will be fixed soon once it's finished. Lyssa's planning a full reformat and reinstallation of everything in the near future to blow out some of the cruft, and I've suggested using the Unison file synchronizer to maintain backups of everything on Leandra. Now I just need to get two more drives to add to the drive array...

The next day I installed the memory upgrade in Windbringer, who is extremely happy with the new arrangement. Now I can get some use out of machine virtualization software without using up all of the swap space in one go.
More under the cut...

"What I did on my summer vacation..."

Sunday 22 July 2007 at 9:14 pm ...I went to the local Harry Potter release party as the other wizard named Harry.

I'll write up the night tomorrow when I get time at work.

Cleaning the screens of laptops.

Thursday 19 July 2007 at 08:58 am The premoistened towelettes that you can buy to clean the screen of your laptop computer (or at least the ones made by 3M, anyway) are basically lint-free disposable sheets soaked in a little water and isopropyl alcohol. Save your money and use a lint-free cloth and a little rubbing alcohol to clean your screen.

The cleaning pads you can buy, however, have the advantage of being sealed and thus portable while abroad.

Rubbing alcohol is also good for cleaning the chassis of computers, as well as the keyboards and heat sinks.

Cryptographic history hit-and-run.

Thursday 19 July 2007 at 08:26 am Someone in Italy has a real German Enigma machine from World War II up for auction on eBay. The Enigma machines were the mechanism used to implement the famous cryptosystem that protected German radio communications up until Allied cryptographers were able to figure out how it worked. With today's technology (in particular, programming languages) it isn't too difficult to implement one yourself once you know the principle, but if this is legit, it's a real piece of World War II and crypto history. Not many Enigma machines survived after the war was over; the few that are left are in museums around the world. However, when last I checked, the bidding was up to $13.5kus after 11 bids, with eight days and four hours remaining in the auction.

I wish that I had the kind of petty cash laying around to buy such a thing, this is a real find. Alack and alas, I'll have to make do with this hardcopy implementation of the Enigma cypher once I print it out.

For those of you Out There who are good with your hands and fans of codes and cyphers, there is also a kit you can buy that implements the Enigma machine.

Hmmm.... I might just get one of those kits and build it myself. It'd look good on my desk at work.

Microsoft patents the end-all-be-all of spyware; open source community gears up in response.

Wednesday 18 July 2007 at 3:57 pm A couple of days ago it came to light that Microsoft, everyone's favorite software powerhouse took out a patent on what very well could be the spyware to end all spyware - a system which scans information stored on a workstation and sends it Someplace Else for analysis... to generate advertising specifically geared for the person logged into the box. The patent describes a system integrated not only into the operating system and user interface, but all of the applications linked against this functionality that would look at every document on the machine, every e-mail sent or recieved, multimedia files' metadata (such as keywords or genre), and even internal status messages (such as remaining disk space or printer status) and send it off for processing. APIs would be included in the system libraries that would then make it possible to show advertisements along with whatever you happen to be doing. For example, the background of the disk management utility could show ads from Western Digital for bigger hard drives if you're running low on disk space, or popups that can't be easily banished could accompany every web page you look at.

Now, just because there's an active patent doesn't mean that it's actually going to happen, right? Or at least, that's what one hopes. MS software already phones home and reports on what the system's been up to, but this is a whole 'nother smoke. At a minimum, such a thing would be a horrible invasion of privacy; not everyone would like their personal data being scanned for keywords, be it a spreadsheet of finances or the novel they're writing. Web browsing history is another hot-button - when you get right down to it, it's nobody's business what you're looking at or searching, and there are ways and means that can and really should be taken to keep that data out of the hands of a central authority. Third... could someone who's built such a system really keep the information protected? I strongly doubt that such a thing would be possible. Hell, somebody hit the US Department of Transportation with a heavily targeted attack of forged e-mails and viral payloads that netted them an unspecified quantity of sensitive information over the past year or so. On top of all of this, who is to say that such a technology won't accidentally leak sensitive information in the course of looking for keywords to send you advertisements for?

I can only hope that nobody is crazy enough to actually do this.

Dammit. I lost the update for this weekend again.

Tuesday 17 July 2007 at 4:34 pm Okay. Let's try this one more time.

Lyssa and I changed our plans last weekend because a) there weren't nearly as many RSVP's for the Starcraft LAN party we were organizing, and b) because there were some things that we had to take care of because we'd been putting them off for too long. That morning we sent out word of the cancellation, had a quick breakfast, and then set out for Maryland to take care of things.

There. Nice and fast, so that nothing else has a chance to crash on me.

Neither Lyssa nor I had gotten a haircut or had our hair styled in some time; in my case, it was nearly two years (since just before I started at Sunrocket, actually), and I'd been having difficulty for months running even a broad-toothed comb through my hair due to all of the split and damaged ends. Also, I might be flown elsewhere in a couple of weeks on assignment for work, so I thought it a good idea to make the effort to look presentable and professional, just in case. As it turned out, I had a wait of about an hour, so I roamed around for a while, got a cup of coffee, and read for a while until it was my turn. The haircut itself took less than twenty minutes, and took about five inches off of my hair. Its' a lot shorter than it had been but it look a lot better, I think, and it certainly feels better. Lyssa had her hair colored again, which took longer, so I ran a few more errands around the mall. After meeting back up, we set course for northern Virginia once more.
More under the cut...

Regarding the "Virginia Remedial Fees" bill that snuck through a few weeks ago.

Monday 16 July 2007 at 3:58 pm Late last month, a bill snuck through the Virginia general assembly that adds considerable fees onto even trivial traffic violation tickets. If you are convicted of a driving misdemeanor (say, driving ten miles over the speed limit, which if you don't do in northern Virginia you run the risk of being rear-ended by a bored commuter) the bill can add up to one thousand dollars onto the fee. If you get nailed for something really egregious, such as driving while intoxicated, you may as well sell your car because the civil remediation fees alone will be over $2kus, never mind losing your license, jail time, and other fines. A guy named Dan Wilson has broken things down, and it's kind of scary. I'd discount it if I didn't know people in my neighborhood who've gotten hit with the "driving with a tail light out" fine already.

(One thing that doesn't even amuse me about that is the fact that to get your tail light fixed, you have to drive with your tail light out. Try explaining that to a traffic cop.)

The fines have to be paid within twenty-six (26) months of assessment: One third up front, the rest before fourteen and twenty-six months, respectively. Not quite so bad, but still a real kick between wind and water.

If you're a Virginia resident, I urge that you add your signature to this petition as soon as possible.

Another wiki appears on the Tor darknet.

Monday 16 July 2007 at 3:42 pm Someone Out There has set up a new wiki on the Tor network for exchanging and cataloging links. It's admittedly a little thin right now on content, but the more that word gets out, the bigger it'll hopefully get. You can check it out here: http://mihfrbaf562yakt2.onion/wiki/

EDIT: Hyperlink fixed. My bad.

Anonymous prankster leaves envelopes of money in bathrooms around Japan.

Friday 13 July 2007 at 2:13 pm No, I'm absolutely serious: Somebody in Japan has been going into men's rooms of government office buildings in Japan and is leaving envelopes of 10,000 yen bills in the stalls for people to find since April of 2007. Nobody knows who's doing it (because the bathrooms there are the only rooms that don't have securicams) or why they're doing it, but the bundles of notes are left neatly wrapped in paper with the houshuu ('remuneration') written on each of them, along with a carefully handwritten letter stating that whomever is leaving the packets of money will find the cash "useful for your persuit of knowledge."

Handwriting analysts have noted that the handwriting is getting worse and worse as more packets are left, which has lead to speculation that the individual in question is either terminally ill or elderly. Interestingly, the packets of money have been handed over to the police, who will give the packets back to the finders if no one claims them within six months.

The quote from the letter makes me wonder if this isn't an expensive reality hack: The people of Japan are said to be fascinated by this mystery, so much so that the national election has been put on the back burner. It could be said that the "persuit of knowledge" mentioned refers to trying to figure out who the anonymous, eccentric benefactor or benefactors are. It also might be that whole thing is a reality hack to get people to question what's going on around them and the money's a tool to get the attention of the people. That's what I'd do if I was going to set up a prank, anyway.

Hail Eris.

This is why discounting the usefulness of SIGINT is a bad idea.

Friday 13 July 2007 at 1:06 pm At some point in the past year or two, twenty-five undercover CIA operatives traveled to Italy to abduct one Abu Omar, an Islamic cleric suspected of involvement in an act of terrorism in Milan back in 2003. However, they didn't follow secure communications procedures (or those same procedures need to be updated badly), and they were rumbled by Italian law enforcement, who are now trying the agents in absentia for kidnapping. Like many people these days, the operatives used cellular telephones to keep in touch with one another through the course of the op. Unfortunately, the prosecutor was able to get the records from the local cellular companies and piece together which phones were involved, where they were and where they went, when they were there and for how long, and exactly whom they were in touch with. If a phone doesn't go anywhere for seven or eight hours, you can infer that the owner of the phone was staying at location foo. The prosecutor was also able to match up names with op-aliases and break the cover of a least a few of the agents. The operatives phoned home to HQ in NOVA (hi, guys) a couple of times, the commanding officer of a US Air Force base in Aviano, each other (which you can figure out by looking at the patterns in the logs as a whole), and the US consulate in Milan.

The moral of the story? If you're up to anything shady at all, no matter which side of the fence you're on (or think that you're on), don't trust the cellular network. Phones can be uniquely identified, and the computers that drive each cellular repeater can be queried to determine when the phones were last associated with them. Routes of travel can also be reconstructed by searching the records of all cellular repeaters and backtracking in time. Even if you use *67 (or the local equivelent) to block caller ID, that only blocks the display of the call's recipient: Telephony switches and billing computers always have the called and calling numbers in their logs. Just because the associates of a target don't have access to that information, that doesn't mean that local law enforcement won't take a dim view of what you're up to and act accordingly. Also remember that phone calls can be tapped, and not necessarily with a small transmitter and a pair of gator clips attached to a hard line: Telephony switches can be instructed to copy both sides of a conversation to a maintenance port for recording, and everyone concerned won't be any the wiser. Also, to get a cellular phone of any kind, you have to fork over ID of some kind to a phone company to get a service plan opened - if someone can match an alias to a face, they can hunt you down and possibly figure out your other aliases if they're sufficiently motivated to do so.

Contractors do the dumbest things sometimes.

Thursday 12 July 2007 at 4:22 pm Like putting classified material online where anyone can stumble across it it.

It has come to the attention of the news media that documents that really shouldn't be getting out (like blueprints of high-security military installations) are being stashed on publically accessible web and FTP servers around the net, sometimes on the networks of the subcontractors themselves where anybody with the time and patience to go digging has a chance at finding it. During research for this article, reporters working for the Associated Press found dozens of sensitive documents that weren't even protected with a basic password. Moreover, sometimes you could anonymously FTP into the same web servers and go poking around behind the scenes to look at the source code for dynamic content and find older things that were once hyperlinked (incidentally, this is how web developers get their work onto the servers in the first place; the standard FTP daemon is often a necessary evil, but there are still countermeasures that can be put into place). Even though the data is no longer online, nobody knows exactly what's still floating around out there, or what's likely to be accidentally posted in the future. I wonder how the security auditing teams that the US government hires to survey their systems missed this stuff..

More and more, it seems like the book Google Hacking for Penetration Testers (second edition) is required reading if you're going to be doing anything useful on the Net these days, if only so that you know what is possible and can plan to not do dumb things. I'd also recommend that all security auditors and penetration testers read it so that you can add some new tricks to the contents of your sleeves - just because it's not a Cisco router running the telnet daemon with a username and password of 'cisco' doesn't mean that it isn't important.

US government mines even more personal information than previously suspected.

Thursday 12 July 2007 at 2:38 pm Ever since 9/11, the US government has been an informational vacuum cleaner that sucks up information on just about everyone in this country, or who happens to enter or leave the country (as some people with laptops have discovered). What they do with it and where they put it all is a matter of some speculation; suffice it to say that the network attached storage system companies are making a killing selling RAID systems to them... at any rate, it's come to light that they're mining more than just terrorism-related information to generate profiles on people. In fact, there are five other databases than the STAR (System To Assess Risk) database announced in 2005 that is used to try to predict someone's ties to terrorist groups. These other systems include a database that helps to map reports of identity theft across the country to determine if and where identity theft rings are operating (which has been in operation since 2003), and a system that correlates data from the National Insurance Crime Bureau's database against unspecified other information to locate major insurance fraud scams (though no date of activation is given for this system). Fantastic amounts of data are being poured into these systems; it's anyone's guess if anyone or anything is querying some subset of these databases and making cross-system connections.

There is also speculation that They are buying information from major data brokers, such as Choicepoint. Like the credit agencies' records, there's no guarantee that the information is correct, and if there's a mechanism in place that allows for the correction of bad data points, nobody's saying anything.

Random note: Transhumanists might wish to ponder the possibility that a system such as this will spontaneously become self-aware at some point in the future.

Some people will do anything to pack just one more bookcase into a room...

Thursday 12 July 2007 at 12:57 pm I love books. Chances are, you love books, too. The problem with that is that there is never enough room for all of the books you've read, and never enough for all the ones that you want to get around to reading because physical space is at a premium, and pesky structures like doors get in the way of building bookcases. That is, unless you do what this guy did and build a classic-style "door hidden behind a hinged bookcase". Rather than buy bookcase kits from a furniture store, kenbob@instructables designed his own bookcases and figured out how to mount one of them (they can each hold between 500 and 1000 pounds each, the weight of your average cache of books) to the wall without ripping everything down, or using stabilizing casters on the bottom (which ruins the effect). There's nothing particularly odd behind the hidden door, just the house's crawlspace and a dead storage area, but if you're going to do it, you may as well do it right. The framework constructed is entirely made of steel, so it's much stronger than plain old wooden bookshelves. There are even wooden trim pieces to hide the parts where the bookcase doesn't quite meet the wall.

Total cost? About $350us.

There are images and videos built into this article, so be sure to give everything a close look - he did a very good job, I have to say.

The things people come up with these days...

Wednesday 11 July 2007 at 7:03 pm If you've been on the Net for a while, you've probably seen buttons or tags for Digg, which is a community-based news management and relay website. The idea is that news articles are submitted by users, and everyone else on the site votes on how interesting, relevant, or helpful the articles are. Articles deemed popular through this method rise to the top (theoretically) while unhelpful articles sink to the bottom and are lost (again, theoretically).

Somebody developed a Tetris-like game seeded from Digg's RSS feed. For every article submitted, a game piece enters play. It moves pretty fast, and is very responsive for a Flash game, so check it out when you've got a chance.

Former US Surgeon General has a few choice comments about American politics.

Wednesday 11 July 2007 at 3:07 pm Dr. Richard Carmona, who served as Surgeon General of the United States of America between 2002 and 2006 has gone public with some of the problems he had after his appointment by the Bush administration, and it looks like censorship, control, and politicking were the driving force behind a lot of policies and not medical research and science. Dr. Carmona went before a committee in the House of Representatives yesterday, and went on the record in stating that he was censored in many ways by the current regime, including the editing of his speeches by aides who were idealogically closer to Bush's point of view and being prevented from attending certain speaking functions outright. He also stated that he was flat-out overruled on policy positions regarding AIDS and stem cell research, regardless of the future benefits of both.

Weirdness on the roads of DC last night.

Wednesday 11 July 2007 at 2:31 pm After work last night, the roads of DC were harrowing, to say the least. Lyssa remarked that there would be a goodly amount of asshattery afoot, but I had no idea of just how right she was.. first of all, while driving Lyssa to dance class last night we came upon an unusual sight for northern Virginia: A white Pontiac at perpendicular angles to the rest of the road. The driver had somehow managed to get the front end of his car stuck in the ditch running alongside the road (they're a bit more common than you might expect for a reasonably affluent part of Virginia), with the rest completely blocking the oncoming lane of traffic. The windscreen had shattered, airbags were deployed, and the driver was half-in, half-out of the car and looking like he'd had one of the worst days of his life. As traffic was backed up, I got a pretty good look at the guy, and he appeared to be stunned though not injured too badly because he'd gotten the driver's side door open and there were signs that he'd walked around a bit before sitting back down. I don't know if he'd gotten broad-sided on the right-hand side or not because that would have meant stopping in traffic to look backward. I didn't see any police or the rescue squad (that's really what they call it down here) at the time.

I didn't grab any pictures, though I seriously thought about it.

Then, after dropping Lyssa off I'd doubled back to go to the local coffee shop to kill time until class was over and read a little, and was startled as I turned into the parking lot by a police car suddenly accelerating to cruising speed and nearly clipping the tail end of my car.

Then, no sooner had I parked and turned the engine off, an older gentleman (probably early 70's) in his car got smacked broadside by a middle-aged Chinese woman, bounced off of a parked delivery van, and then slammed into the front end of a late model station wagon with three kids in the back seat. I ran over to see what the situation was, and found that the driver's side door of his car was mangled beyond hope of opening it without a Milwaukee saws-all; the station wagon was in remarkably good shape, as was the front end of the delivery van. The interior of his car was in bad shape, though: The airbags went off, which tore most of the dashboard off and shattered the windscreen, and later on he complained that his legs and forearm were bothering him. I didn't get a good look at the car that went out of control because she'd manged to limp into a nearby parking lot, got out, and ran over.

I won't quote the invectives that he greeted the women with because they're better left to the imagination. Suffice it to say that he didn't think it was possible that she didn't see him, and expressed his point of view in some detail.

It was around this point that I realized that there wasn't much I could do, aside from call the police (along with everyone else) and generally stay out of the way. It took about ten minutes for the police, the rescue squad, and an ambulance to arrive at the scene. I'm fairly certain that the police car that arrived was the same one that nearly clipped me on the way in. Call it a hunch.

Thankfully, the rest of the night was relatively quiet and uneventful.

The RIAA demands a cut from cover bands and coffee shops.

Tuesday 10 July 2007 at 4:32 pm With stuff like this going on, you have to wonder if the mainstream music industry has pretentions to replacing the Mafia in its business practices. It seems that the major music licensing bodies (ASCAP, BMI, and SESAC, among others) have been shaking down restaurants, coffee shops, and other places where people can gather to listen to music, either over the radio or played live. Some of the songs played at these places were covers of other songs, which it used to be legal to do so long as you didn't turn a profit off of it, but no longer. Specifically, they've been approaching the owners of these places demanding licensing fees for their work. More's the point, once a coffee shop makes a payment to one licensing body (say, ASCAP), word gets out and all of a sudden they all start pounding on the front door demanding a cut - even the ones that don't actually have anything to do with the music being played. The bills aren't one-time only, either - the proprietors of these places are getting billed yearly just for having a radio playing, too. Apparently, it's legal to do this even if you have no evidence whatsoever of wrongdoing or even fair use?

What's next, having to pay a fee to listen to music in the car? What about the collection of CDs in my home or yours? Will we have to pay extra on top of what we already bought the disks for? Will we have to listen to music with our doors and windows closed some day soon, lest someone who hasn't paid a listener's fee overhear a couple of carefully licensed notes?

Ye flipping gods, this is reminding me a bit too much of Tales of the Afternow.. listener's licenses, and all that.

Situation report: DC

Tuesday 10 July 2007 at 2:06 pm Jean and Chandler went home early yesterday morning, something that's taking Lyssa and I a while to get used to. They're almost like family to us, and it feels weird to come home after work and not have anyone there. We're now able to take Lucy out of the office and let her spend the evenings in the living room because Chandler isn't here anymore. He's a good dog, to be sure, but he's also never seen small rodents before and we couldn't take a chance.

Lucy, to her credit, wasn't unduly shaken up by Chandler's presence. She knows that she's safe in her cage, so as long as he didn't do anything crazy like try to knock the cage over she could go about her business unmolested. We bought for her a larger cage with two elevated levels last weekend, and she seems very pleased to live in it. If nothing else, she's much more active than she was before. I greased her treadwheel with a little olive oil. so not only does it rotate more freely but it no longer keeps up awake at night. I think that we miscalculated when selecting the cage, though, because she is very careful on the mesh floors of the upper levels - I think they're a bit too widely spaced for her to feel secure. We made do with a few blocks of gnawable wood on the platforms but I'm not sure that they're enough.

Also, the interior of the cage can't be rearranged, so neither Lyssa nor myself can reach down into the bottom of the cage to move things around or pick up the ceramic food dish on the lowest level. This presents a problem. A larger problem lies in getting Lucy out of the cage so that we can clean it because we can't reach into the cage ourselves. Either she'll have to come to the top so we can boost her out on top of the lid of her hamster ball (which we did with her last cage) or we'll have to put it in the bathtub and take the mesh top off to get at her. I don't know how well that's going to work, though.

On Saturday, Jean, Laurelinde, Lyssa, and I went out to lunch at Tiffin's to raid the buffet, and then we headed into University Park to pay Curious Tattoos (website unavailable - anybody got a link?) a visit because Lyssa decided that she wanted to get a second pair of earrings. We spent about 45 minutes waiting in the anteroom of the tattoo and piercing parlour killing time by looking at the tattoo flash all over the walls and in the books piled on the counter.. personally, I was more interested in the photographs of the tattoos and piercings that they've done over the years because they show actual work and not just freehand art that the folks who work there have done. Lyssa got her second tattoo there when she was in grad school, which is why she wanted to go back. Personally, I've been sharking for a good tattoo parlour for a while now, and I think that I've found the one that I want to go to.
More under the cut...

I need a life.

Monday 09 July 2007 at 9:28 pm Last night, I watched Nightwatch again with Jean and Lyssa, and this came to me:
More under the cut...

What the hell. Baa! Baa, I say!

Saturday 07 July 2007 at 02:21 am
Find out which Transformer you are at LiquidGeneration!

Huh.. I thought I'd get Soundwave.

Review: Transformers

Saturday 07 July 2007 at 02:14 am Earlier tonight, Lyssa, Jean, Jason, and myself stood in line at the local movie theatre in NOVA to see Transformers on the silver screen.

Before the spoilers start, I can only say that It Was Good. I've got a geekbone so big, that I don't think that I have to tell you what I'm pressing the spacebar with.

Go. See. This. Movie.
More under the cut...

MPAA sets up fake file sharing sites!

Thursday 05 July 2007 at 4:22 pm It seems that the Motion Picture Association of America is adding some new tricks to its arsenal to use in its war against movie piracy: They've started to set up phony file-sharing sites to sucker people. The idea is that you sign up for the site (giving them both e-mail and IP address) and go about your business while the web server records everything that you do. Eventually, they'll have enough evidence to come after you in court for movie piracy.

The site mentioned in the article has gone down since the story broke, but the question is now, "How many other sites out there will they create to catch people?"

Forewarned is unflatlined, everyone.

I was wondering how long it would take them..

Thursday 05 July 2007 at 4:17 pm Even though the Cruxshadows are still on tour, they've been hatching plans while on the road to release another single from their latest album, Dreamcypher. Specifically, they'll be releasing a couple of remixes of the song Birthday along with some new (and some live-only) material on 4 September 2007 through Isotank Records - you can preorder it from here. Frankly, part of me isn't surprised that they announced it yesterday, which just happened to be the birthday of their frontman Rogue. In a weird, strange, "Am I doing enough in this lifetime?" kind of way, it works.

Faraday shielding film for windows.

Tuesday 03 July 2007 at 2:21 pm It's not quite as good as a Faraday cage (or better yet, not putting up wireless access points at all) but it'll definitely be on the radar of IT and infosec professionals in the near future thanks to some very high profile network intrusions that used wireless networks as their beachheads: A thin, transparent film that is not only impact resistant, but filters RF emissions, so that signals from outside can't get in, and more importantly, signals inside can't get out. Supposedly, this stuff's been in use on the government side of things for a while now, and it's just been declassified. The article makes it sound like you're going to be able to walk down to CompUSA in a couple of years and pick this stuff up to protect your house, when that's not what it was designed for, and in fact it's not aimed at consumers' home offices at all. This RF shielding material was designed for high security facilities, such as government data centers and big corporations that have lots of valuable data to protect (not naming any credit card companies - you know who you are); places where you don't want anyone with a wireless card or cellphone transmitting data without anyone being the wiser.

The article also has a comment from Bruce Schneier about properly securing your wireless infrastructure being more cost-effective than coating the windows with this stuff, and he's got a point: This Faraday shielding film was horrendously expensive when it was still classified, and it'll take a few years before it comes down enough in price to really be affordable. 802.11b access points only implement WEP, which is at best a stumbling block these days for intruders and not even much of a deterrent. 802.11g is worth the time and money to upgrade to, not just because it's faster, but because WPA is much harder for an intruder to crack; moreso if it's deployed in a corporate environment and is backed with (say) cryptographic certificates.

Political commentary brain kickstart go!

Tuesday 03 July 2007 at 1:07 pm I haven't been following the Scooter Libby case for a couple of weeks because everything else has been keeping me busy, but I did find out in passing that he was found guilty of perjury and sentenced to two and one-half years in federal prison and a fine of one-quarter of a million US dollars because he lied on the stand about the outing of Valerie Plame as a CIA operative. Then something interesting happened: George W. Bush commuted the imprisonment portion of Libby's sentence, leaving him only with the fine to deal with. Given his position inside the beltway he can probably handle it with a little work but it's probably going to haunt him for... well, not until he dies, like the article suggests, but definitely for a year or so. The way things like this tend to happen, he'll probably drop out of sight for a while, write a book, and then become a consultant.

The article makes an interesting point, though: It sends a message to everybody who's up to no good in the nation's capital: If you're playing for the right team and know the right people, you just might get off with a slap on the wrist depending on how much good your shenanagins did for someone else. Perjury is nothing to sneeze at; lying to a jury in any capacity can get you dry cleaned by the judicial system, no two ways about it, because you're wasting the time and money of the taxpayers who are covering the court proceedings. Libby got away with his skin and freedom intact, just a little short in the pocketbook, which is a hell of a lot more than Joe or Jane Average would have left if it was discovered that they were lying on the stand.

On top of this, there's something interesting that the news media isn't mentioning: We still don't know who actually leaked Plame's identity to the press. Chances are, we'll probably never find out because everybody and their backup was paying attention to Libby's indictment, trial, and sentencing. This would have been a perfect opportunity for the culprit or culprits to finish covering their tracks and sneak away.