Feeds:
Posts
Comments

One would think that the so-called Patriot Act, or the secret wiretapping leaves things to wish for in the US. In any case – given this and similar concepts around the world – Sweden seems to have felt left out (what do I know), so Ingvar Åkesson helped to write a law for giving FRA – where he is now director-general – quite arrogant powers.

Who benefits?

Isn’t it great that a government agency (a civilian one, but controlled by the Ministry of Defence) in effect can write its own laws? Not that they will necessarily follow them, but it will help them to get what they want.

The issue of wiretapping has been brewing for some time, though it seems most of the attention only came about shortly before the vote, and the proposal was accepted by the Swedish Riksdag (parliament) in June this year by a narrow margin. It is likely that it would have been rejected, but in a tactical swoop a number of last-minute amendments were made based on previously discarded comments from several critics.

It has become quite a political circus (there have also been some other – rejected – surveillance proposals lately, not related to FRA). If unchallenged, it will take effect Jan 1, 2009.

The proposal will certainly have an impact on how Internet and other electronic communication is structured in the area, and some operators are already suggesting to re-route traffic to exclude Swedish territory. This, however, is not the primary focus of the debate – Swedish residents will be directly affected as well.

Two votes short of rejection

Originally the Social Democrats, who have been in power for a long time in various constellations, were pushing for the idea some years ago. Now with the Moderate Party pretty much in charge it got voted through. This time, the Social Democrats opposed it (easy way to win political points, I would say).

There seems to have been intense activity within all parties, but in the end only two people from one of the ruling parties dared to go against the government’s line. Two more and the proposal would have been dead.

Deny everything

As of now the government seems to be doing its best at denying that there is any problem with the new law – despite harsh criticism, including that from several powerful Swedish government agencies and other organisations. The Prime Minister (Fredrik Reinfeldt) has even gone so far as to say that critics “do not understand” the law, while key people of the government seem to be quite good at confusing things themselves even concerning quite basic matters.

Part of the debate is about what the law actually says; it may be written in Swedish but it seems that FRA added some sort of legalese encryption if you will. However, many bloggers have helped to establish what it is really about, and what the technical implications are. The facts are becoming clearer every day, but the government is still trying to avoid facing them.

As of today FRA – among other tasks – listens to radio traffic etc. looking for foreign threats. The argument goes that the interesting data is now mostly on cables used for telecom, and that FRA should be able to listen to that as well.

It has been claimed that Swedes would not be affected as domestic traffic would be filtered out – and even so, that “keywords” would be used to avoid too broad surveillance (except proponents are trying even to avoid the term surveillance, instead referring to more politically correct constructions like “signals intelligence” or “anti-terror”).

Well, many of these arguments have been debunked and proven to be deceptive or even outright falsities. If the truth about this proposal was acknowledged, I don’t think it would survive long. As for the government, they should expect significant repercussions either way.

Hope?

However, it’s not over yet. There is a lot of activity going on: demonstrations, political meetings, hearings, etc. etc. Several movements have been created against the law.

Yesterday for instance, by initiative of a member of the Liberal Party, the public was invited to a local political meeting. It was announced on a blog, and guess what – about 20 people showed up (excluding 10 or so regulars) with less than a day’s notice to listen and discuss FRA. We had a great time, and I look forward to more actions like this. Quite frankly, today’s politics may not survive without it.

Birgitta Ohlsson – member of the Riksdag – was there, as was a top government official (Håkan Jonsson, representing himself at the meeting). The official did not convince me, but he clarified some things and his presence allowed for a dialogue on the matter which was appreciated. Sadly, such things seem rare in the government circles right now.

Maybe they hope to win this battle, but they may very well lose the next election over it if they remain steadfast. (That said, I’m sure it will also raise many questions if the government finally backs down on the issue.)

What’s wrong with the reverse gear?

Among other things, I learned at the meeting that the inner workings of the Riksdag is somewhat more complicated than one would think. For instance, it does not seem to be possible to revert the decision without writing a – similarly extensive – new law to override the first one, which will require significant juridical manpower.

As it’s quite late in the process, and the government is not cooperating, the parties may have to look to their own resources to resolve this. (The government itself can certainly do the legwork, but it seems they will only do so if they have no other choice, meaning someone else may have to do the legwork first…)

So, guess which may be the only party with these capabilities? The Social Democrats. I guess we’ll find out soon enough if they are truly interested in tearing up this proposal, but it worries me that they seem to have a monopoly here, and who knows what kind of deals will be made.

The clock is ticking

As of today, several members of the Riksdag from the governing parties have took a stand against the law, so it seems likely that it will be hard to keep it as-is, if a motion to drop the legislation can be formed in time. But how much change is necessary to please the dissenters? Some argue there is no longer a sane way to achieve a reasonable compromise given the time constraints, so will there be enough pressure to drop the legislation altogether?

There were some other possibilities mentioned, such as delaying the enforcement of the legislation subject to a parliamentary inquiry, which seems possible but still may require great efforts to get enough parties and members of the Riksdag together in a common motion. Currently there are a number of efforts to divert attention, so the trickery is far from over. Time is running out, and it seems the battle may well end in September (any motions must be available early in October).

Note, however, that the Social Democrats do not want the issue to be pending too long, in case the next election favours them and they have to sit through it again. Who knows what they will do in the end, or if all parties will manage to cooperate well enough.

All in all, there is still hope, but we can expect a rather messy development during the coming months. Book writers, rejoice!

References

(Rather limited, sorry. Hint: Google Translate supports Swedish texts; most things should be readable.)

Ubuntu wallpaper

Here’s the classical Ubuntu logo in 3D (interestingly provided by the alias ilovewindows 8) – click on the link for more of his artwork).

Some political standards processes can be curiously slow. ODF 1.0, going through a fast-track procedure (rubberstamp, if you will), spent about a year in ISO, from submission to publication – and that with a strong consensus backing it, as well as (as far as I can tell) a truly open and thorough process preceding it in OASIS; public mailing lists and all. This is about as good as it gets in that context, but don’t let me spend too much time on that glorification.

Enter the submission of OOXML (ECMA-376) shortly after the publication of ODF (see the timeline provided by Rob Weir at IBM), and it’s closer to a two year period, beginning with formal protests (contradictions) that were set aside, followed by a vote to disapprove, followed by a contested fiasco of a BRM.

Out of more than 1,000 known errors of varying complexity presented there, only about 200 were resolved in any way (this took a week, even after legally questionable procedures were applied). Following this, there was a sort-of-vote1 for approval, followed by appeals, and recently a week-long silence from ISO on whether the appeals will be considered or not.

The bumps should not be surprising considering the relative (lack of) justification for, and quality of, the proposed standard, the closed process in Ecma and the hijacking of ISO to approve that outcome. So, one keeps wondering how a fast-track process is deemed to be appropriate for a 6,000 page proposal, developed behind closed doors and in practice being pushed by a single entity.

Looking at it from another direction, does it make any sense to call it “fast-track” after all this time? One of the most interesting aspects here is that the breaks, where there are any, seem to be rather poor – so far they have only managed to slow things down, but not to stop them. I would suggest a maintenance check, or somebody is going to get hurt.

In this moment, it seems quite likely that ISO has already rejected the appeals. The odd thing is that it seems they should have been available to the ISO TMB on Aug 4, and we have yet to see any official response. Is ISO lagging behind, working on PR measures? Maybe they are still using typewriters over there?

ISO, in case you are reading this: don’t sit up all night pondering how to best articulate all nuances of “these appeals have no ground, and we are not aware of any procedural problems…”; try something more concise, such as: “black is white, so we can’t see anything”. To the point, don’t you think?

Well, they would surely need some breathing room in any case; regardless of the decision, it is sure to raise many uncomfortable questions for ISO.

So, what will happen to OOXML? Will ISO publish it as a standard? If not, when will it end?

More importantly, what will happen to ISO? Without serious reform and actual transparency, can it be taken seriously by the community in this light?

Update 15 August: ISO took only 11 days to publish their decision to reject the appeals and proceed towards publication of OOXML. Congratulations for the speedy response! Let’s see where this goes…

Footnotes:

1 Earlier votes would count unless new ones were submitted. This certainly had effects on how the game was played.

It seems I am a little back(b)logged here. (Sorry.)

Anyway, here are some of many interesting recent events:

  • I went to Japan! I was there for 10 days with fellow Computer Science students; mostly in Tokyo, but my trip also included a short stop in Kyoto. If I should include any random thoughts about the journey, I would mention the Firefox ad in the metro, featuring a fox in a boxing ring. Very curious… 🙂
  • When talking about Japan, I simply have to include a ninja reference, no? Well, here you go: watch Ask a Ninja, net neutrality.
  • The DNS bug. It can have many interesting security implications, as this Flash movie suggests. (Thanks to Xavier for pointing to this site.)
  • The patent establishment makes fools of themselves again: our beloved European Patent Office says that software is an “ambiguous” term. (I do not know about original references yet, sorry, maybe this is only available in printed form so far. Link.) Apparently some software is more equal than other software, and deserves Patents to cover it. Here is a Digital Majority post about this.

Enjoy!

Update 2 Aug 2010 09:26: replaced two Wikipedia links.

… and how to avoid a pitfall on some Dell PowerConnect equipment. On that note, I haven’t yet managed to get this working in VMWare (Server 1.0.5, and Workstation 6.5 Beta, I believe) on Linux, using some host-only interfaces. It seems the switching mechanism gets things mixed up a bit.

So: in order to add redundancy to (say) firewalls, one could use such a protocol as VRRP. Unfortunately, Cisco has claimed patents on it, leading the OpenBSD developers to implement a similar system, called CARP.

The basics are relatively simple: instead of a primary and a secondary firewall to use their own MAC addresses for routing, we create virtual interfaces on each firewall, with corresponding MAC addresses that are used on both firewalls.

In the simple setup, only one firewall would be active at any time, meaning that you could bring down a firewall, upgrade it, and bring it back up, all without anyone noticing. Done right, the traffic is transparently routed through any of the two firewalls, and downtime is measured in seconds at the most.

Imagine a small example, where we want to replace one firewall with two network cards, with a redundant set of two similar ones; let’s say we have an external network (the Internet), and our internal network. We reserve some IP addresses for the new redundant set:

External addresses: (physical card: em0)


100.0.0.1 = Routing (CARP)
100.0.0.2 = Firewall 1 (master)
100.0.0.3 = Firewall 2 (backup)

Internal addresses: (physical card: em1)


200.0.0.1 = Routing (CARP)
200.0.0.2 = Firewall 1 (master)
200.0.0.3 = Firewall 2 (backup)

(In practice you may not need individual addresses on all interfaces with CARP, but let’s work with this for now.)

Addresses for pfsync: (assuming a crossover cable here, so basically any unique addresses can be used)


10.0.1.2 = Firewall 1
10.0.1.3 = Firewall 2

Note: pfsync does not keep track of the rules in pf.conf, only the actual user sessions registered on the firewalls.

We’ll need to edit numerous files in /etc on each firewall:

pf.conf – add:


pass quick on { em2 } proto pfsync keep state (no-sync)
pass on { em0 em1 } proto carp keep state

sysctl.conf – uncomment:

net.inet.carp.preempt=1

This ensures that if even one interface on a firewall fails, the second firewall (if intact) will take over.

hostname.em0 – add:

inet 100.0.0.2 255.255.255.0

to the first firewall, and:

inet 100.0.0.3 255.255.255.0

to the second; similarly for hostname.em1 use 200.0.0.2 and 200.0.0.3.

hostname.em2 – add:

inet 10.0.1.2 255.255.255.0

to the first firewall, and:

inet 10.0.1.3 255.255.255.0

to the second.

hostname.carp0 – add:

inet 100.0.0.1 255.255.255.0 vhid 1

to the first firewall, and:

inet 100.0.0.1 255.255.255.0 vhid 1 advskew 100

to the second; similarly for hostname.carp1 on both machines, but with 200.0.0.1 and vhid 2 instead. It is interesting to note that we don’t have to say that carp0 corresponds to em0, and carp1 to em1; OpenBSD can figure this out from the IP addresses and netmasks.

hostname.pfsync0 – add:

up syncif em2

on both machines. We can also get this running live without rebooting. Let’s kick in the backup node first: (it is assumed here that pf is already enabled and has rules loaded into memory, and also packet forwarding is in use on both firewalls)


firewall-2 # sysctl -w net.inet.carp.preempt=1
firewall-2 # sh /etc/netstart
firewall-2 # ifconfig carp

You should see that all CARP interfaces display MASTER, since firewall-1 isn’t up yet.


firewall-1 # sysctl -w net.inet.carp.preempt=1
firewall-1 # sh /etc/netstart
firewall-1 # ifconfig carp

Again, you should see that all CARP interfaces display MASTER (and, obviously, BACKUP on firewall-2), since it’s advskew is lower (0) than on the backup node (100). Note: setting the advskew to higher values than 240 will probably not work. You’ll see what I mean. 😎

Fun thing to try on another machine, when failing over from one firewall to another:


watch traceroute 100.0.0.1

There are some other things I could go into, but let me just make a note on Dell equipment:

As I mentioned, fail-over from one firewall to another is supposed to take seconds as the most (depending on advbase (default: 1) and advskew), even if you disconnect cables randomly from one firewall, cut the power to the machine, or attack it with a raygun. As soon as one firewall stops talking to the other on one of the interfaces, the second one will prepare to act in its stead.

Why, then, doesn’t it work on some Dell PowerConnect equipment, for instance? Well, it seems the RSTP mechanism gets confused by the shared MAC address, resulting in having (say) two master nodes, and the situation may take as much as 30 seconds to stabilize, if not more (or if at all).

The answer is that you should be able to turn it off for the ports where the firewalls are connected. Considering a case where both firewalls are connected to the same switch (using a different VLAN for each interface, for instance), it should be safe to do so.

Happy fail-overs!

Microsoft FUD?

Is Microsoft admitting to using Fear, Uncertainty and Doubt? Either their Live.com engine is a bit weird, or there’s some curious honesty here. Judge for yourself… 😉

Live.com

(Source: http://www.microsoft.com/en/us/default.aspx – search for “fud”. Tip from comm2k.)

Silly geek joke

Some files were walking about in peace, when suddenly they started screaming:

– Watch out, watch out! /bin/dd is coming!

One of the files then said:

– I’m not afraid, I’m /dev/null !

The file stood alone as /bin/dd came closer. Finally, the program stood inode to inode with its enemy:

– You’re doomed!

– Don’t you know who I am? You can’t touch me!

There was a long silence, and then /bin/dd said with a dark voice:

– dd if=/dev/zero of=/dev/sda

(This is based on the ex theme from circles of mathematics – don’t say I didn’t warn you. (Apparently this is before the era of udev. On an additional note, no binaries were harmed in this excercise as they were located on a different drive.))

UserFriendly nails it again.

American Civil Liberties Union has filed a brief about free speech issues of an application for an abstract patent. FFII says hi; it’s great to see a major civil rights organization to bring this up in the patents sphere. With enough exposure, hopefully the insanity of business and software patents may come to an end some day…

OOXML use cases

ISO has now rendered a decision, and the fight over OOXML could be over soon. Specifically, while there have been no reported irregularities, countries have available another two months to raise concerns. Apparently e.g. Norway has already done so, but I’m sure that misunderstanding will be cleared out shortly.

In any case, there are many good things about OOXML that I don’t know where to start. (I need to double-check the exact meaning of “open” and “XML”, but at least the “Office” part seems clear to me, which suggests a high quality work here.) Indeed, one of my favourite aspects of this standard is its simplicity. For instance, one can safely focus on its two major use cases, namely when:

  • you own Microsoft, or
  • Microsoft owns you.

Actually, this is a rather strong statement, since it has yet to be proven that anyone is currently using or implementing any version of OOXML – especially Microsoft themselves, who apparently are a bit slow on that. No worries though – it’s a standard now, so surely it’s not that important.

I wish ISO and Microsoft best of luck with all the upcoming, exciting standards projects. Clearly, we can expect even better processes that provide for a modernized approach with honest and high fidelity works. We can all thank ourselves for being part of this proud and happy family. 🙂