Some Disassembly Required

Nexus 4 for the Traveler - Staying Contract-Free

noreply@blogger.com (Anonymous) — Sat, 28 Sep 2013 23:55:00 +0000

Going contract-free means I can drop my plan down to $5-10 a month while abroad, reserving my phone number for cheap. It also means having an unlocked phone, which I can use abroad by purchasing local pre-paid SIM cards.

While in the states, I've set up my Nexus 4 to use Consumer Cellular's data connection. 2GB of data (enough for me) is only $30 a month so my bill is considerably cheaper than it ever was with a Verizon contract.

Here's how I set it up:

Buy unlocked Nexus 4 on sale.
Call CC and give them the IMEI number from the phone
Configure a new APN with the following settings:

Name: cci
APN: att.mvno
Proxy: 66.209.11.32
Port: 80
username/password/server: not set
mmsc: http://mmsc.cingular.com
MMS proxy: 66.209.11.32
MMS port: 80
MCC: 310
MNC: 410
Authentication type: PAP
APN type: default,supl,mms,agps,fota
APN protocol: IPv4
APN roaming protocol: IPv4
Bearer: unspecified

Nexus 4 for the Traveler - CyanogenMod

noreply@blogger.com (Anonymous) — Wed, 25 Sep 2013 08:04:00 +0000

I'm giving up my trusty Nokia quad-band flip-phone and WebOS smartphones for a Google Nexus. I'll keep the Nokia around for traveling light but I'm sad to say it's time to retire the collection of Palm Pres. I've run out of spare parts and the time has come to move on. It was a good run.

Why the Nexus 4? Google had them on sale, probably to clear out inventory before the next phone in the lineup is available. It comes with a clean copy of Android 4.3 (no lame carrier apps / spyware). It's moddable, unlocked and supports a variety of GSM frequencies for travel.

It doesn't run WebOS or have a hardware keyboard, but it'll have to do.

My ultimate smartphone would have little cloud integration, easy side-loading of apps, a vibrant open source software community, no spyware, easy tethering, very granular security/privacy controls and full-disk encryption. I'm not sure yet how much of this I'll accomplish but I'll document the process as I go along.

The first thing I did, before connecting to any network, was disable the location settings and wi-fi backups, because governments seem to be stealing that stuff.

The next step is to install CyanogenMod. This should give me access to some of the features I want; things that could be handy should my device get lifted while traveling.

Download the Android SDK. I unzipped it to c:\bin\ and then updated the system path.
Run the Android SDK manager and make sure the Android Tools and Google USB drivers are installed.
Enable Developer Settings and USB Debugging on the Nexus 4.
Plug the phone in. In my case, the drivers did not automatically install, so I did it manually.
Unlocked the boot loader using adb and fastboot. I had to authorize my laptop from the Nexus screen before adb would recognize the device.
Flashed the ClockworkMod recovery image. Note that I couldn't use fastboot to boot the recovery image. I just selected it from the menu by holding volume down and power to boot the phone.
Downloaded and installed CyanogenMod using ClockworkMod. I installed CM from the zip file. Following the directions to use adb push to put the file on /sdcard/ actually put the file in /sdcard/0.

Time Lapse Video Processing Part 2 – From Video

noreply@blogger.com (Anonymous) — Mon, 18 Mar 2013 00:55:00 +0000

2013-03-17

Gonzaga Bay to Bahía de los Angeles (after editing in Windows Movie Maker) Vimeo.

In the previous post, I described my setup as well as the process for creating time-lapse videos from still images.

In this post, I'll describe the process for doing the same by skipping frames in video files, resulting in a much smoother timelapse video – especially for driving scenes.

Assembling Time Lapses from Video

Using x264vfw (http://sourceforge.net/projects/x264vfw/), VirtualDub and Windows Movie Maker.

Video Source Files:

29.97fps 720p H.264 MP4 video (VGA and HD)
29.97fps 720p H.264 MOV video (HD)

Load In VirtualDub

I am using VirtualDub to "decimate" the video files and reassemble them at the original framerate, resulting in an accelerated or time-lapsed video.

To start, choose FILE->OPEN VIDEO FILE and select the source video. Don't forget to install the ffmeg input driver for VirtualDub if your source files are .MP4 (or mpeg in another container, such as .MOV).

Frame Rate

Both the Roam and the NEX-5 are configured to capture video at 29.97fps (standard NTSC framerate). To create a time-lapse, I accelerate the video by skipping frames ("decimating" in VirtualDub terminology) when I re-encode the files (back to 29.97fps).

To do this in VirtualDub, first decide how much you want to accelerate the video – 2x, 3x, 10x, etc. For highway driving, I typically use 10x. For driving on trails or street scenes, I use 6x.

To set the frame rate in VirtualDub, choose Video->Frame Rate. Set the Source Frame Rate Adjustment to the source video framerate (29.97fps in my case) multiplied by the acceleration factor (10x for this example). This changes the source frame rate to 299.7fps (10x29.97fps=299.7fps).

Second, select the Decimate By option and enter the same acceleration factor (10 for this example). This will select every 10^th frame and skip the rest, reducing the ultimate framerate back to 29.97fps for playback.

Why does this work?

A 30-second source video will contain 899.1 frames (29.97fps * 30s=899.1 frames). If I want to accelerate the video by 10x, I take 1/10th of the frames (89.91), resulting in a 3s video that appears to play back at 10x the recorded speed (89.91 frames / 29.97fps = 3s).

To play back at 2x the speed, I take half the frames (449.55), resulting in a 15s video that appears to play back at 2x the recorded speed (449.55 frames / 29.97fps=15s).

Compression

From experimentation, I find that for 720 video, an average bit-rate of 7kbps with H.264 works well. I have not attempted to fine-tune the options further.

Video->Compression and choose x264 for Windows. I then set Rate Control to Single Pass ABR and set the bitrate to 7000.

I then save the videos (FILE->SAVE AS AVI) or batch them up to process overnight.

Final Editing

Once complete, I have the original files cut down to time-lapsed H.264-encoded AVIs. At this point, they are ready for editing with a non-linear editor, such as Windows Movie Maker (or better – Premiere or Final Cut Pro), to add transitions and soundtracks.

Time Lapse Video Processing Part 1 – From Stills

noreply@blogger.com (Anonymous) — Mon, 18 Mar 2013 00:39:00 +0000

2013-03-17

San Felipe to Gonzaga Bay (after editing in Windows Movie Maker) on Vimeo.

I'm not a videographer, nor do I really aspire to be. I am, however, a gear-o-phile, and am enthralled by buttons and shiny things. One of those buttons captures video, leaving me with gigabytes of video, mostly driving, and diminishing free space on my drives and memory cards.

After collecting video clips for months, I decided to do somethingwith them, but what?
I don't really have a concept or a project in mind. I am also constrained both by software (I don't have a decent editor) and hardware (a tiny laptop with an AMD E350 1.6GHz CPU).

For now, I've decided to solve my disk space problems by editing the video clips from my roadtrip down to 6-10x time-lapses. Chances are good that whatever I do with these clips, it won't involve a lot of real-time driving scenes, so the 10x time-lapses should be useful and take up significantly less storage.

Video Source Files:

JPEG stills taken in sequence
H.264 MP4 video (VGA and HD)
H.264 MOV video (HD)

Software:

ImageMagik – useful for batch processing still images
ffmpeg – the video swiss army knife. Useful for converting containers, formats and encoding.
VirtualDub – assembles time-lapses and applies filters. It may be possible to perform all processing in ffmpeg, omitting VirtualDub, but I haven't investigated this yet.
Windows Movie Maker – a basic (though the basics are done well) video editor that comes with some editions of Windows

I have some experience with VirtualDub, which is why I chose to use it to assemble the time lapses. However, VirtualDub natively only works with AVI and JPEG files. To process MP4 and MOV data files, you can either convert them to AVI using ffmpeg before processing in VirtualDub, or you can install the ffmpeg input drivers, allowing VirtualDub to open the files without prior conversion. I chose the latter.

Assembling Time Lapses from Stills

Using ImageMagick, Google Picasa, x264vfw (http://sourceforge.net/projects/x264vfw/), ReNamer (http://www.den4b.com/wiki/ReNamer), VirtualDub and Windows Movie Maker.

Resize Source Images

I start by resampling all of the images down to 1440x1080 resolution using ImageMagick. Mainly, I do this for disk-space – going from 1.5Mb to 200Kb makes a difference when I'm traveling with a small laptop with limited storage. While I haven't done a comparison to see if there are any overall performance gains, pre-processing and down-sampling the JPGs does make the VirtualDub step proceed faster.

The mogrify command, using this syntax, down-samples the images as they are loaded (theoretically the fastest method) and automatically adjusts contrast using auto-level.

mogrify "*.jpg[x1080]" -auto-level -quality 85

Once mogrified, I quickly skim through the stills and remove any I don't want included. This process is quicker on the down-sampled images than the originals, at least on this AMD E-350-powered laptop.

Finally, I rename all the images in sequential order. On Windows, this can be easily done using Google Picasa or ReNamer.

Load In VirtualDub

I assemble the stills into a 720 H.264-encoded AVI video using VirtualDub. From the VirtualDub main window, choose FILE->OPEN VIDEO FILE and select the first image in the sequence. Provided they are numbered sequentially, VirtualDub will open all of the images automatically.

Frame Rate

Frame Rate is a complicated subject depending on capture rates, focal lengths and movement in the scene.

The Contour Roam can capture stills but the built-in intervalometer only has one setting – 1 shot per second. For scenes that don't feature a lot of change from one shot to the next, such as people walking, this is ok. It may not seem obvious – but highway driving scenes also work well; the ribbon of highway doesn't move much from one frame to the next. Driving slowly, however, such as in town or on a 4x4 trail, and there is too much movement, resulting in a video that is either too herky-jerky or frenetic to watch.

The other downside to the Contour in this mode is that it is fully automatic. Some scenes may auto-expose or select white balance inconsistently as conditions change (such as when a cloud passes overhead). The shutter speed will likely be very fast. This eliminates motion blur so the resulting video will never be exceptionally smooth. A good rule of thumb for the shutter speed is to use the reciprocal of the playback framerate – 1/30th of a second exposures for 30fps playback. In bright sun, the Contour is shooting at 1/1000th or 1/2000th of a second.

The NEX-5 is fully programmable and produces much better results, though it does NOT have an intervalometer. It does have a continuous shutter mode and I have an add-on mechanical intervalometer for shooting night scenes.

For highway scenes captured at 1fps with the wide-angle Contour Roam, I assemble the stills at 15-30fps. For trails and other low-speed driving captured at 1fps, I assemble them at 6fps, though the resulting video isn't very smooth. I also use 6fps to assemble stills captured of subjects at portrait-distance with a 50-80mm lens using continuous shutter on the NEX-5. To get the files up to 30fps, I can interpolate the video files when edited later.

To set the frame rate in VirtualDub, choose Video->Frame Rate and set the Source Frame Rate Adjustment to your desired frame rate.

Resize

I have 1080 stills but I'm only creating 720 videos for now, so I down-sample them using the VirtualDub Resize filter.

Video->Filters->Addand select Resize. I am resizing only, no cropping or letterboxing is required as I am keeping the aspect ratio the same as the original.

Compression

From experimentation, I find that for 720 video, an average bit-rate of 7kbps with H.264 works well. I have not attempted to fine-tune the options further.

Video->Compressionand choose x264 for Windows. I then set Rate Control to Single Pass ABR and set the bitrate to 7000.

I then save the videos (FILE->SAVE AS AVI) or batch them up to process overnight.

Final Editing

Once complete, I have the original files cut down to time-lapsed H.264-encoded AVIs. At this point, they are ready for editing with a non-linear editor, such as Windows Movie Maker (or better – AV Linux, Premiere or Final Cut Pro), to add transitions and soundtracks.

The Greatest Coffee Drink Ever

noreply@blogger.com (Mordy) — Thu, 22 Nov 2012 20:06:00 +0000

I have broken my prohibition on guest posts to allow some thoughts from the intrepid Mordecai Ulrich Grant, who amuses me some. The following is his first.

I believe that in all my wanderings, I have never experienced something so delicious on my brim as a finely ground filtered coffee with rum, honey and lemon.

Veracruzano Chile Salsa

noreply@blogger.com (Anonymous) — Wed, 31 Oct 2012 03:35:00 +0000

The salsa at the Coco Loco on the Costa Esmeralda was particularly good, and at least to my somewhat seasoned palate, a bit unusual - sweet, spicy, smoky and dark.

Eventually my curiosity overcame my reticence for cooking and I asked Alberta what she does to make this stuff. It seems, at least superficially, to be delightfully simple.

Salsa Veracruzano

Incredients:

garlic cloves
dried chile peppers (ancho or other more spicy varieties)
water

Instructions:

finely chop garlic
add garlic, peppers and water to a pan
sauté for a while
blend (or mash with mortar & pestle)

Veracruz Shark Recipes

noreply@blogger.com (Anonymous) — Tue, 30 Oct 2012 06:52:00 +0000

In Misantla, I took notes on how to make stuff with sharks. I am a terrible cook but I do know what I like.

Shark Ceviche

Sharks should be somewhat frozen to make handling easier. Some people think it's really important to flash freeze any fish eaten raw. I don't know if that's a common practice in Veracruz.

Ingredients

~6 2' sharks
1 large white onion
3 jalapeño peppers
8-12 limes

Instructions:

chop of shark heads. Remove filets from body, separating from spine. slice meat away from skin.
discard heads, spines, skin
cube shark meat
finely chop onions and peppers (including seeds)
place incredients in bowl
juice 8-12 limes (enough to cover the shark/onion/pepper mixture)
let stand ~20 minutes

Optional:

Add catsup, maynaise and orange soda. It sounds gross but it's not entirely terrible. I prefer it "natural" however.

Shark Minilla

This is a typical dish from Veracruz. It's basically shredded shark with a tomato/pepper sauce. People from the mountains won't eat it when made from shark because shark's eat people and I guess that's just too close to cannibalism for their comfort.

Ingredients:

~6 2' whole juvenile sharks
2-3 whole tomatoes
several dried ancho chiles
several large dried chiles of some other variety
3 cloves of garlic
clove sprigs
salt
some other misc spices
manteca (pork lard)
1/2 stick butter

Instructions:

Take frozen sharks (not frozen hard, just enough to make cutting & handling easier) and cut into thirds. If sharks are not frozen, adjust cooking time accordingly.
Boil in water ~15 minutes
Remove sharks from water and set aside to cool
Boil the tomatoes and dried chiles in the shark water
Once cool enough to handle, gently pull the skin away with a fork and shred the shark meet. Discard skin, heads and spines.
Put a hunk of manteca into a large ceramic/stoneware pot (I imagine cast iron would work as well) and melt. Add shredded shark and chopped garlic
Discard most of the shark water. Put the rest along with tomatoes, peppers and spices in a blender. Add fresh water and blend.
Put contents of blender, 1/2 stick of butter in the pot with shark meat.
Cook for a bit, stirring well.

Locating a Toyota Birfield in Mexico

noreply@blogger.com (Anonymous) — Thu, 06 Sep 2012 21:55:00 +0000

A year ago I decided to drive my HJ60 Land Cruiser to México and start my great Latin Roadtrip. I spent the last year working out my plans, upgrading and modifying the vehicle and doing maintenance.

I considered upgrading the axles but decided against it. It just didn't seem necessary for my style of driving. In hindsight, after experiencing my first broken birfield, I realize that was a mistake.

This is my story and my advice. Don't do what I did, unless you really like fish tacos and beer.

Don't Ship the Parts

The first piece of advice I can offer is - upgrade before you leave. It's pretty easy to break a stock Toyota birfield joint, especially if reversing in 4WD with the wheels turned and obstacles in your way. Unless you're the sort of person who enjoys breaking things on the trail for the challenge of fixing them, upgrade before you leave.

If you are the sort of person who enjoys breaking and fixing things in remote locations, then you already have a spare birf in your kit and you've swapped out birfs at trail-side a few times before.

I neglected to upgrade and didn't carry a spare so I had two choices at thas point - find one locally or order one from the states. Finding the part locally is entirely possible but I had trouble locating one searching by make & model. The 60 series was never sold in México so there are very few of them around. My initial search turned up one wrecked 60 in a yonke (salvage yard) but they would only sell the complete front-end.

At this point I decided to order parts from the states. That led me to my next decision - ship to México or make a border run? I chose the former. That was a poor decision.

While waiting for shipping, I talked to some knowledgeable Land Cruiser folks in the states and learned that the outer axle on a 60 series is the same as you find on '81-85 Toyota mini trucks (before they moved to independent front suspension in '86). This vehicle was sold in México and parts are plentiful. I gave this information to my local mechanic, along with the part number (43405-60015), and he quickly located a new unit which he could get within a day. Since the parts from the states were already on their way, I called this Plan B.

Importing Parts from the States

If you've opted to get your parts from abroad and you can get yourself to the border, the best thing to do is to import them yourself and not rely on the post office or private shipping. In my case, I could have gone from Ensenada to Tijuana, walked across the border, picked up the parts from a friend willing to hold them for me and returned to Ensenada in a day. Walking across the border you're unlikely to have your belongings inspected by customs and even if you are, it's unlikely that any duty would be imposed.

In Baja, there are many people traveling back and forth from San Diego. I turned down several offers from people willing to bring the parts down here to me, which would have saved me from even having to take the bus trip.

My parts were shipped via USPS Priority Mail with delivery confirmation. When I first heard this I figured I would never see that package. I talked to many folks in Baja, both locals and expats, and no one had any confidence that the package would arrive, or if it would, when it would be here. The consensus is that USPS Priority is hit or miss, Express is more reliable and DHL/UPS is the best way to go.

On the 2nd business day, the package was in San Francisco. On the 3rd, the confirmation number showed the package had been handed over to México. I assumed it was in Tijuana and had only to make the short trip to Ensenada. The 4th, 5th and 6th days showed the package in Mexico to clear customs. I didn't realize it at the time but the package was sent first to Mexico City. The status didn't update again until the end of the 8th business day. Earlier that day I had given up and ordered the local part. The final update showed that delivery had already been attempted on the 7th business day.

Priority Mail International Parcels Attempted Delivery Abroad MEXICO

No further updates appeared on the USPS site and there was no sign of the package at the hotel where it was destined. I took this as validation of my decision to order the local part. On the 11th business day, on a whim, I tried plugging the USPS confirmation number into the SepoMex web site.

AP Ensenada, B.C. Puesta en ventanilla

While I speak conversational Spanish, I also rely on pitiful looks and wild gestures to get my point across. That wasn't working on the phone so I turned to the hotel receptionist for help. After several phone calls she gave me directions to the Mex Correo office on Adolfo López Mateos (i.e. 1st Street) and Florestra, only a few blocks away.

It seems I had been lounging around Ensenada waiting for a box that was in fact waiting for me just down the road.

Outside the office an old man sat on a chair with a typewriter, taking dictation from people who wanted to send letters but couldn't write themselves. Inside, they located my package and after showing an ID, signing a bunch of forms, and handing over 800 pesos in import duties, I finally had the box - two weeks after I'd ordered it, one week after it arrived in Ensenada and the day after I'd already installed the local part.

The package made it to Ensenada remarkably quickly. I can't say whether or not the expected $60 USD in import duties helped it along but I don't imagine it hurt.

Recompressing Large Images with ImageMagick and PowerShell

noreply@blogger.com (Anonymous) — Wed, 22 Aug 2012 05:56:00 +0000

ImageMagick, it seems, is picky about the order of it's parameters. For example, when calling mogrify to compress files, you have to put the -quality paramter before the filename, not after.

In one of my previous scripts I batch-converted some images to JPGs but inadvertently set the JPEG quality to 100% after getting caught up in parameter order issues. This left me with a lot of very large (15MB+) files that are taking up valuable space on my laptop.

This is a quick and dirty script that finds the large files and calls mogrify to recompress with the JPEG compression level set to 85. For my images (mostly scanned 35mm film) this gives me files closer to 5MB.

$Path="C:\Users\WaW\Pictures\Test\"
$Quality=85     #desired JPEG compression level
$SizeFilter=10  #size in megabytes of files you want to target

if (Test-Path -path $Path)
{
    Write-Host "Info: Found Path $Path"

    $Items = Get-ChildItem -path $Path -recurse | where  { ($_.Length /1MB) -gt $SizeFilter }

    #Loop through and act on each file individually. We're only going to touch the big files so we'll mogrify them individually, efficiency be damned

    ForEach ($Item in $Items)
    {

    #$ItemFullName = $Item.Fullname

    $MagickParams = @("-quality", $Quality, $Item.Fullname)
    $MagickCmd = "mogrify"

    Write-Host "Calling $MagickCmd $MagickParams"

    & $MagickCmd $MagickParams

    }

}
else
{
    write-Host "Path $Path Not Found. Abending."
}

Information Security For Travelers - TrueCrypt with Honeypot

noreply@blogger.com (Anonymous) — Fri, 22 Jun 2012 09:46:00 +0000

In the first iteration, I simply used TrueCrypt on my existing Windows 7 system drive. This was great from a data protection perspective. The machine couldn't even be booted without a password and the entire drive was encrypted.

I then took the leap to running Ubuntu Linux as my primary OS. I used Linux Volume Manager & dm-crypt to encrypt the Ubuntu partitions on disk. I also set up an unencrypted Windows installation to act as a honeypot. This way my data was still protected and I had a chance at recovering the stolen hardware if the thieves used the honeypot.

Ubuntu works well on my desktop but I had issues with the laptop. I've decided to revert back to Windows, this time incorporating the honeypot concept using TrueCrypt and the Windows boot loader. I can still perform my Linux tasks using virtual machines.

This will be a doozy if you've never messed with the boot process before. I found it to be a fun and exciting refresher course in the facinating world of boot strapping operating systems.

Prerequisites

Two Windows 7 licenses
Windows 7 Install media (DVD or USB)
Linux install / Live media (I used Ubuntu 12.04 on USB)
TrueCrypt 7.1a installer for Windows
A laptop with at least a 64GB hdd or ssd. This drive will be erased so backup your data if you care about it.

Overview

The high-level approach is simple. I used two separate partitions to isolate Windows installations for dual-booting.

Install Windows 7 honeypot.
Install Windows 7 again (to be protected via TrueCrypt).
Encrypt the second partition and enable pre-boot authentication (PBA).
Set up Boot Loader / Manager / Menu.
Install & configure Prey on the honeypot.
Protect system BIOS with a password.

The details, however, are a bit more hairy. The Windows 7 & TrueCrypt boot loader work ok for a vanilla install but we'll need a more configurable loader, which means manipulating the Windows & Truecrypt loaders.

Step 1 - Install Windows 7 Honeypot

I booted from the USB stick where I put the Windows 7 Home Premium installer and chose Custom (advanced) from the What Type of Installation Do You Want? screen.

I then created a 32GB partition, which is about the practical minimum for Windows 7, and installed the OS as normal.

I reused my OEM license key (from the sticker on my laptop) but I did NOT use the OEM system discs to do the installation. Instead, I used an actual Microsoft Windows ISO to avoid bloatware & OEM recovery partitions.

To enable autologin to the honeypot, I used the control panel to create a standard user account with no password. To set that account to logon automatically I launched netplwiz from the Start Menu, selected my dummy user and unchecked users must enter a username and password to use this computer.

Step 2 - Install Protected Windows 7

Once the previous install was complete, I booted from another USB stick where I had imaged the Windows 7 Ultimate installer. Again, I chose Custom (advanced) from the What Type of Installation Do You Want? screen.

This time, I selected the remaining unused space on the drive and installed to that location. I used a retail Windows 7 Ultimate license key because I had one available from a previous project. You can use whichever edition you prefer.

Windows Boot Loader Configuration

Once the second installation was complete, I had a boot menu containing two items, both labeled Windows 7. By default, the boot manager was on the 100MB NTFS System Reserved partition.

Next, I isolated the Windows 7 installations by giving them each their own boot manager. While booted into the honeypot OS, I started a command-prompt with admin privileges and created a backup of the Windows Boot Configuration Data (BCD).

bcdedit /export c:\bcdback

I then started the Windows 7 Disk Manager and marked the partition containing volume C as Active (formerly the System Reserved partition was active).

Next I restarted, booting from a Windows 7 install USB stick, hit SHIFT-F10 to open a command prompt and set up the boot manager on the newly Active partition. Before I started I double-checked my drive letters and partitions with diskpart.

bcdboot c:\windows /s c:

bootrec /FixBoot

bootrec /RebuildBCD

The RebuildBCD command may be unnecessary but I didn't get a chance to try without it. Upon rebooting, the machine automatically started Windows 7 from the honeypot partition.

I then repeated the process for the other protected OS partition, starting by making it Active via the Windows 7 Disk Manager. I then restarted, booting from the Windows 7 install USB stick, launched a command prompt, double-checked my drive letters with diskpart and finally set up the boot manager on drive c: (c: is assigned to whichever partition is Active).

bcdboot c:\windows /s c: 

bootrec /FixBoot

bootrec /RebuildBCD

Upon restart, the machine successfully booted Windows 7 from the protected partition.

At this point the machine would boot from whichever of the three partitions was made active:

100MB "System Reserved" with the original dual-boot BCD and boot menu
31GB Windows 7 install (honeypot) w/o menu
192GB Windows 7 install (protected) w/o menu

I left the protected partition Active while I proceeded with encryption.

Step 3 - Encryption

I booted the Windows 7 (protected) OS, launched the TrueCrypt client and started the system encryption wizard. Here are the answers I gave:

Area to Encrypt: Encrypt the Windows system partition.
Number of Operating Systems: Single-Boot
Encryption Options: Defaults
Password: Follow TrueCrypt's instructions and use a longish pass phrase.
Collecting Random Data: follow TrueCrypt's instructions
The software needs the movement of your mouse to generate random numbers for key generation. It's not as goofy as it seems.

Wipe Mode: None
This drive is new and has never had any sensitive information stored on it. Wiping isn't necessary.

I passed the boot test since Partition 3 (the large protected Windows 7 install) was active and was booting independently of the honeypot install. TrueCrypt remained ignorant of the honeypot and configured it's boot process independently as well.

Once the system encryption completed, I used the System menu to edit Settings, disabling PBA bypass with the ESC key and disabling text display during PBA. You might want to put a convincing error message here (bootmgr missing, etc).

Step 4 - Grub4DOS Boot Loader

At this point the machine would start and boot using the TrueCrypt bootloader, enforce pre-boot authentication and successfully start the protected Windows 7 installation. To re-enable booting the honeypot installation, I chose Grub4DOS, a third-party boot manager.

Rationale

The TrueCrypt boot loader can only chainload the Windows boot loader, which it expects to find on the Active partition. It is not configurable. The Windows boot loader is not suitable for our honeypot setup because of how it handles resuming from hibernation. In a dual-boot scenario, the boot loader is on the shared System Reserved partition and somehow monitors the shutdown status of each Windows installation. If I hibernate the protected installation and the machine is stolen, it will come out of hibernation to my protected login screen rather than to the unprotected honeypot Windows 7 desktop.

Grub2 is a modern configurable boot loader but it doesn't work well with TrueCrypt because it overwrites part of TrueCrypt's code, even when extracting the TrueCrypt boot loader from the mbr and loading it from a file instead.

Grub would work but it's multi-stage architecture is cumbersome and it would require it's own /boot partition on ext2/3.

Grub4DOS, like Grub, won't overwrite TrueCrypt's boot code when it is loaded into the MBR but it also has the added advantage of supporting NTFS for the rest of it's boot code & menu configuration. I'm reusing my 100MB NTFS "System Reserved" partition for this task so Grub4DOS is a good fit.

Extract Sectors from Boot Disk

To handle the disk manipulation (extracting/writing boot loaders), I could either boot to a Linux Live CD and use dd and related tools or set it up from Windows using Grub4DOS Toolbox, which provides analogues to the Linux tools and automates many of the tasks so they can be performed from Windows. One of the components, bootlace.com, can't run on a 64-bit OS so I'm used Cloud Bootlacer for that component.

The first thing I did was launch the Grub4DOS toolkit and extract the original TrueCrypt MBR and related volume headers, keys, etc.

Backup TrueCrypt MBR to file

Backup First 63 sectors (TrueCrypt MBR, volume header, keys, etc)

I then uploaded the file containing the first 63 sectors of the drive to Cloud Bootlacer, taking only the default options (i.e. none). They returned a new file containing the first 63 sectors, but this time with the TrueCrypt MBR replaced with the Grub4DOS MBR. Hopefully Cloud Bootlacer isn't operated by nefarious data thieves, agents of a corrupt authoritarian regime or executives from Facebook.

At this point I had the following files set aside:

truecrypt.mbr, containing the first sector of my drive with the TrueCrypt boot loader
truecrypt_orig.bin, containing the first 63 sectors of my drive, with the TrueCrypt loader, volume header, encryption keys, etc
bootlaced_grub4dos.bin, containing the first 63 sectors that I have yet to put on my drive, with the Grub4DOS bootloader, TrueCrypt volume header, encryption keys, etc
bootlaced_truecrypt.bin, which should be a duplicate copy of the file truecrypt_orig.bin. Cloud Bootlacer generated it and I will probably throw it away.
gldr, the remaining boot code for Grub4DOS, part of the grub4dos package
menu.lst, the stock menu configuration file that came with Grub4DOS

I placed the gldr, menu.lst and truecrypt.mbr (one might choose to rename this one for obscurity) files in the root of the 100MB NTFS "System Reserved" partition.

Write Modified Sectors to Boot Disk

Finally, I did the scary thing. From the Grub4DOS Toolbox, I wrote the bootlaced_grub4dos.bin file to the first 63 sectors of my drive.

Alarmingly, it threw an error, "Error writing to target! 80". There were no messages in the log and no indications on the 'net, so I gave up Windows and booted from an Ubuntu USB stick. No damage was done by the failure, so I confirmed that my SSD was indeed /dev/sda and then I used dd to write the grub4dos bootloader to the MBR:

$ sudo dd if=/tmp/g4d.bin of=/dev/sda bs=512 count=63

63+0 records in

63+0 records out

32256 bytes (32 kB) copied, 0.00359019 s, 9.0 MB/s

Configure Grub4DOS

After writing the new MBR, I rebooted and was presented with the default Grub4DOS menu, as defined in menu.lst. The default menu was able to find and boot the honeypot OS but not the protected OS.

I replaced the contents of menu.lst with the following:

# load the first entry after a few seconds

default 0
timeout 10
# set graphics mode (1366x768) and menu colors
color light-grey/black black/light-grey dark-gray/black white/black
color border=0x222222
graphicsmode -1 1366 768 32
# hide the System Reserved & TrueCrypt Partitions, activate the honeypot partition
# and chainload the boot manager on hd0,1
title Windows 7
hide (hd0,0)
hide (hd0,2)
unhide (hd0,1)
rootnoverify (hd0,1)
makeactive
chainloader /bootmgr
# hide the System Reserved and honeypot partitions, activate the truecrypt partition
# and chainload the truecrypt bootloader previously stashed on hd0,0
title TrueCrypt
hide (hd0,0)
hide (hd0,1)
unhide (hd0,2)
rootnoverify (hd0,2)
makeactive
chainloader (hd0,0)/truecrypt.mbr

It would be a good idea to obscure any references to TrueCrypt (though if true plausible deniability is your goal you'll probably have to go much further than this).

I saved the file, restarted and verified that I could now select and boot either the honeypot or the TrueCrypt protected operating systems.

Step 5 - Prey

I downloaded and installed the latest Prey from the Prey Project. Unlike most users who selectively enable Prey when the laptop has been stolen, I want Prey to activate whenever someone reaches into the honeypot. To make things simple, I've configured Prey to run standalone and send me a usage report every 20 minutes by email.

Documentation for Prey is sparse. Most users have PreyProject accounts and use the control panel to manage and configure the service. I'm going old school for now. To configure Prey, launch:

C:\Prey\platform\windows\prey-config.exe

A GUI will appear.

Choose the first option to configure standalone vs control panel mode

Standalone & SMTP Settings

Check URL: Despite the on-screen text, a value must be set. I chose the URL of a non-existent page on this blog that will always return an HTTP 404 error.
SMTP Settings: I chose the credentials for a gmail account which I consider to be somewhat "throwaway". The password is weakly protected on the hard drive. This alone may be enough to convince me to switch to control panel mode in the future.

In this configuration, Prey stores the password to my SMTP server as a simple base64-encoded entry in a config file. One should not use this password for anything important.

To further protect Prey's configuration, I edited the permissions of c:\prey:

removed inheritance
removed permissions for Authenticated Users
removed permissions for Users

This left SYSTEM and Administrators with full access.

A few minutes later I received my first report.

It included a screenshot, a failed capture from my web cam, my IP address, latitude/longitude, uptime and Windows username.

Step 6 - Protecting System BIOS

Should the laptop be stolen, I want to encourage the thief to use the machine as-is, so that they can be tracked via Prey.

With physical control of the machine, we can't prevent a determined thief from reinstalling the operating system to bypass our security controls but we can make it harder.

My last step was to disable booting from USB devices and to password protect the settings. These are among the few options that HP permits the end-user to modify in the Insyde BIOS.

Remaining Issues

The TrueCrypt Boot Loader screen options are not respected

"do not display any text" cannot be enabled
"allow pre-boot authentication to be bypassed with ESC" cannot be disabled allowing USB boot (facilitating a wipe & reinstall by a clever thief)

Prey reports contain "turn on your webcam" error rather than webcam captures

Information Security For Travelers - Re-Thinking Drive Encryption

noreply@blogger.com (Anonymous) — Sun, 17 Jun 2012 17:00:00 +0000

I'm installing a slightly larger drive in my netbook to accomodate digital photos and other files during my travels. At the same time, I've been trying out Ubuntu 12.04 on my desktop. Most of the software I use is open-source so this experiment has gone quite well.

I live-booted Ubuntu on my laptop and found that everything but the right-mouse button is compatible with the available drivers. This is enough encouragement for me so I'm making the switch and rebuilding my encrypted laptop to run Linux.

Since TrueCrypt doesn't support whole-disk encryption for Linux, I'm turning to dm-crypt. Linux and dm-crypt provide a lot of flexibility for partitioning and booting, so I'm going to get creative and add a Windows 7 honeypot.

Should my laptop be stolen, my data will still be safely protected by the encrypted Linux volumes, just as it was in my previous setup. The Windows 7 partition will have no password (to encourage use) along with Prey (to track my gear down).

This gives me a new capability - physical recovery from theft.

Drive Layout

Windows Install

I could have used the recovery discs from HP but I'm looking for a very stripped down installation. I used a Home Premium disc, imaged to a USB stick, along with the OEM license key stuck to the bottom of my netbook.

I manually created a 32GB primary partition at install time. This should be just enough space for Windows 7 64-bit along with some storage for Prey data.

Windows Configuration

After the installation, I followed these tips to disable system restore and trim down the page file and these instructions to uninstall the Windows Search service along with a few other Windows features.

My 32GB partition now has 22.2GB of free space with Windows 7 installed. I could have made it smaller but this is safer. The last thing I want is for the thief to format & reinstall because Windows is acting up or for Prey to run out of storage.

The last steps will be to install & configure Prey and to set Windows to autologon to a standard user account.

Ubuntu Install

For Ubuntu I'm using the Logical Volume Manager with an encrypted physical volume. I've avoided setting up LVM in the past because my simple setup didn't justify it. Now I have the perfect excuse.

I modeled my LVM layout after this excellent article on LinuxBSDos. I won't include screenshots here as they are mostly the same in Ubuntu 12.04 as what you see in that article. I chose to keep /home on the root partition, however. I sized my partitions and volumes according to this table.

Grub Configuration

I want Grub to default to Windows 7, auto-booting after a few seconds. I also want the Ubuntu options to be obscured with different labels.

I started off going through the Grub 2 1.99 manual and following myriad posts and HOW-TO docs with mixed results. In the end I installed the Grub 2 Customizer from the software center and justed used that.

Grub 2 boot screen with custom background image,
Windows honeypot set to default and Linux entries renamed.

Betsy's New Metal

noreply@blogger.com (Anonymous) — Sat, 16 Jun 2012 05:12:00 +0000

Since #AlternatorGeddon was resolved, lots of you have been rightfully pointing out the fact that I haven't left (again) yet (again).

There is a reason for that, however.

Traction & Recovery

I've been following the blogs of many other Latin American roadtrippers and I've come to accept that I won't be able to avoid the really nasty roads this time of year. My odds of getting stuck in the mud, as-is, are higher than I'd like.

I decided I really need some rock sliders, so I picked up a kit after talking to the folks over at Inchworm Gear. I got some extra parts as well to build some corner guards.

Since I have an open front and a factory LSD rear diff I'm at risk of getting stuck if one wheel loses all traction in the mud. Enter the Spartan auto-locker.

If my LSD clutches are worn out, I may put one in the rear too. That would be beastly on dry pavement and squirrelly on ice but fantastic on dirt and sand and mud. It's strong enough since I'm not a wheeler. Valley Hybrids in Stockton will do the install.

Realistically I'll probably rely on other vehicles for recovery if I get stuck on a muddy road somewhere. I'd like to be a bit more self-sufficient than that, however. My hi-lift & chains are not going to cut it.

I'm going to put an entry-level Warn winch in the front along with some recovery points (the stock hook is missing). Amazon will deliver a Warn VR series electric winch for free if I can't find one in one of the local shops. The local wheeling community has been incredibly helpful so I'm happy to shop local as much as possible.

Fixing Previous Screwups

With the added weight of two additional jerry cans and the bigger mud terrain spare, my bumper is stressing out - literally. The corner where the spindle mounts is weakly supported and flexing as I drive. The Franken-bumper is about to be converted to dual-swingouts. The corners will also be tied to the frame via the corner guards. The parts for this will come from Bill's scrap pile and Luke's shop, 4x4 Labs, where I just saw him setting up his cool new plasma table.

I wish I had one of his bumpers but there is a long wait (and a justifiably hefty price tag).

I've also given up on TruckPuter. I wish I had transplanted the OpenFi system from the Miata into Betsy. That was 100GB of bliss, controlled by a physical jog wheel. I naively assumed that a better solution had arisen in the last few years. Laptop, custom x86 mini-itx PC, Android tablet - they all suck. I've decided to just use my stockpile of old Palm Pre's as MP3 players and just plug them into the head unit.

Maintenance

Finally, I'm going to replace the clutch (probably - it has 100k on it) and fix the leaking rear main seal at the same time.

Many thanks to George @ Valley Hybrids, Bill with the cool G wagon, Josh @ Inchworm and Luke @ 4x4 Labs for helping me pull this all together.

Vignetting from Filters at Ultra Wide-Angles

noreply@blogger.com (Anonymous) — Mon, 14 May 2012 15:56:00 +0000

I recently picked up an old FD Canon 17mm/f4 lens for ultra wide-angle shots. Since I knew that vignetting was sometimes a challenge with my Cokin A filters on a 24mm lens I upgraded to larger 85mm / P filters.

In order to find my new limits before vignetting, I shot a test roll. The following were shot at f8 on a roll of Fuji 200 film. I paid no attention to composition and minimal attention to exposure.

72-77mm step-up ring, B&W 77mm polarizer

72-77mm step-up ring, B&W 77mm polarizer and 81 stacked

Cokin P Polarizer

Cokin P Polarizer and 81 stacked

Cokin P Polarizer and ND4 stacked

Cokin P Polarizer, ND4 and ND8 stacked

Cokin P ND1024
(excessive flare is an issue for this Hitech ND
when shooting without a hood)

Cokin P Polarizer
(wide-angle holder)

Cokin P Polarizer (wide-angle holder)
and ND4 (hand-held)

85mm ND8 gel (hand-held)

This tells me that vignetting will be an issue even though I'm using a step-up ring for the screw-on filters and I modified a Cokin P holder for super-wide use. The only way to avoid vignetting is to hand-hold an 85mm (Cokin P size) gel.

For comparison, I also shot a second series with a 24mm/f2.8 lens. In that case, vignetting was only a problem when stacking two gels with the Cokin polarizer.

I don't yet have a good solution for filtration of 17mm lenses on a full-frame (35mm film in my case) camera. Larger gels get expensive quickly and are bulky. Given the amount of vignetting I saw with a 72-77mm step-up ring, I'm not sure how much larger I'd have to go to avoid the problem.

Neutral Density Filter Tests

noreply@blogger.com (Anonymous) — Mon, 16 Apr 2012 10:50:00 +0000

Hitech 10-stop neutral density filter in action

I recently added some neutral density filters to my set of gels.

I picked up a used set of Cokin P graduals, a Hitech 0.6 (ND4), 0.9 (ND8) and a 10-stop Hitech 3.0 (ND1024). These are all the standard (not pro) series filters from Hitech.

Many complain about color casts being introduced by the standard 3.0 filter. This inspired me to do a few tests digitally before I commit any film to these new filters.

My experience was quite interesting. So far I've run into three challenges.

Heavy magenta color casts when the 3.0 filter is stacked with either the 0.6 or 0.9 filters. No stacking the 10-stop.
Light flare coming from the back corners of the Cokin P holder
Vertical bars of tonal difference when the 3.0 filter with others

My first attempt was disastrous, never mind the boring subject.

Hitech ND1024 and ND4

I then made a hood out of duct tape to shade the Cokin holder and reduce the flare.

The following were all shot at f8 using a Canon 50mm/f1.4 lens on a Sony NEX-5 with an FD adapter. I used ImageMagick to resize the JPGs produced by the camera. I have raw files but didn't process them as I am only interested in the relative differences between images.

Hitech ND4, 1/160s

Hitech ND8, 1/100s

Hitech ND8 and ND4 stacked, 1/25s

Hitech ND1024, 1s

The ND4 and ND8 don't have a very strong color cast, even when stacked. The ND8 seems to increase color saturation slightly. The 10-stop filter is significantly cooler, with a blue-green cast but that should be easily correctable. This is not the magenta cast that people complain about.

This rest are quite interesting. I can't quite explain what I'm seeing yet.

Here you'll see what happens when the 10-stop filter is mixed with other Hitech NDs.


Hitech ND1024 and ND4, 2.5s

Hitech ND1024, ND8 and ND4, 6s

Notice the increasingly severe magenta color cast and the mysterious bar down the left side. The sun was over my left shoulder at the time. The color cast alone is enough to keep my from trying to stack these.

Next I tried stacking the NDs with the Cokin linear polarizer.


Cokin polarizer and Hitech ND1024, 4s

Cokin polarizer, Hitech ND1024 and ND8, 10s

With just the polarizer stacked with the Hitech ND1024, the color is correctable but the vertical bar is back.

Stacking the ND1024 with the ND8 gives the now-predictable magenta cast.

The last test shot incorporates a Cokin gradual ND.

Cokin linear polarizer, gradual ND and Hitech 1024, 5s

The blue sky was significantly muddied by the addition of the gradual ND. Aside from the vertical bar issue, I think I'd want to edit this one from RAW before I make a practice of stacking a gradual with the Hitech 3.0.

Warming Polarizer Tests

noreply@blogger.com (Anonymous) — Mon, 16 Apr 2012 10:01:00 +0000

I recently decided to move to larger filters for my Canon FD lenses. This is partially to avoid vignetting and partially to accommodate a couple of lenses that use 72mm filter rings.

As always, I'm looking for good value on my equipment so I can spend more money on beer and traveling to find beer. Thankfully the used market for Canon FD gear is pretty good.

I know from previous experience that many polarizers tend to pass cooler light so this time around I added some warming filters to the mix.

I picked up the following:

Cokin P160 linear polarizer
Cokin P026 81A warming filter
B&W screw-on polarizer
Tiffen screw-on 81a warming filter
Tiffen screw-on warming polarizer

I tested them recently to check for color casts and to see the warming effect. My test methodology is pretty simple as I was just looking for relative differences between the filters.

I used a Sony NEX-5 with an FD mount adapter, a Canon 50mm/f1.4 lens and a tripod. I took the in-camera JPG files and resized them with ImageMagick. No changes were made to levels.

No filters

Cokin linear polarizer

B&W polarizer

The image taken with the Cokin polarizer appears considerably cooler than the original image. The B&W polarizer is less so.

Next, the warming filters.

Tiffen warming polarizer

B&W polarizer with Tiffen 81a warming filter

Cokin linear polarizer and Cokin 81a warming filter

The Tiffen warming polarizer and the stacked glass filters both look similar, although the stacked filters seemed to yield more blue in the sky. The warming effect is very pronounced on the brown river.

The Cokin filter set was cooler than the other combinations but on first examination, I think this will yield the most pleasant skies.

Information Security For Travelers - Drive Encryption Part 2

noreply@blogger.com (Anonymous) — Mon, 02 Apr 2012 05:59:00 +0000

Now that I've identified my threats and vulnerabilities and encrypted my netbook hard drive, it's time to look at storage on my other devices.

Nokia Quad-Band "Dumb" Phone

I have my contacts and call history here. Unfortunately, I am not aware of any encryption or strong access control available for a device like this. I'll disable the SMS history but otherwise I'll leave it as is and accept the risk.

Android Tablet (aka TruckPuter v3)

I'm using an inexpensive Archos tablet as my car stereo. There may be encryption options for Android 4 but I don't intend to use this device for anything but playing music.

It's a good idea to keep your security controls proportional to the sensitivity of the data at risk. In that light, I'm not going to spend any time on logical security controls for the tablet. I'll just keep it physically locked up when not in use.

If you're traveling to a place where your choice in audio books, podcasts or music could cause you trouble it would behoove you to find and employ a suitable option.

Portable USB Flash Drive

Sometimes a wi-fi network won't be available or my netbook won't be handy and I'll be using someone else's computer. Perhaps the netbook has been stolen and I need access to a scanned jpeg of my passport.

I'll use a portable USB flash drive to hold copies of my sensitive data (passport, driver's license, vehicle registration, contact list). It will also have a portable app suite but I'll get into that later.

Because of the sensitive data, I definitely want this device to be encrypted. I could encrypt it myself with TrueCrypt but TrueCrypt requires administrative rights in Windows. I can't guarantee I'll have admin privileges so I'm going to use an off-the-shelf IronKey USB stick that I have from a previous project.

The IronKey will work in any Windows machine with USB ports. It has two partitions - an unencrypted one with a Windows executable with the IronKey utility and a second one that can only be accessed by entering a password into the aforementioned utility. That password unlocks a key which decrypts the partition.

IronKeys aren't perfect but since I have one on hand it will do.

Password File

Typing a password into an untrusted machine is a risky activity. There are all sorts of malware that can capture the keystrokes between your fingers and your web browser, evading most of the security controls employed by web applications.

One way to mitigate this risk is to store your passwords in a vault or protected file. With the right software, the password vault can enter the password into a login form for you, thereby evading malware that monitors keystrokes. It also has the advantage of not requiring you to memorize all your passwords.

I prefer to use KeePass 2. It is available for Windows and Linux.

KeePass is a GUI front-end to an encrypted password file. It is easy to install. Filling it with usernames and passwords can be a bit tedious but the payoff is worth it.

I keep the "master" password file on my netbook. If I add a new password, I put a copy of the password file on my IronKey drive as well as on a plain unencrypted SD card.

The file itself is strongly encrypted provided you use a good password, so it can be safely stored on an unencrypted drive. I can use this copy if my IronKey is unavailable or it doesn't work in a particular internet cafe's computers.

This concludes my precautions for data protection in storage. In the next posts, I'll talk about confidentiality of my personal data when it is in use and when it is in transit.

Information Security For Travelers - Drive Encryption Part 1

noreply@blogger.com (Anonymous) — Sun, 01 Apr 2012 23:50:00 +0000

I've analyzed my threats and vulnerabilities. Now it's time to look at drive encryption as a security measure to mitigate the risk of someone exploiting those vulnerabilities. Drive encryption is now cheap and easy for everyone. If your drives aren't encrypted, why not?

Drive encryption addresses two of my threats:

identity thieves with access to my (presumably stolen) hardware
overzealous search & seizure, which may happen at the hands of legitimate or illegitimate authorities

I'm going to focus on these areas:

Whole drive encryption
Storage encryption for other gizmos
Portable USB encryption
Password file Encryption

Whole Drive Encryption

Because my netbook doesn't have a Trusted Computing Module (TPM) and I want cross-platform compatibility between Windows and Linux, I'm using TrueCrypt. Dm-crypt for Linux or Bitlocker for Windows are also good choices. I don't do Apple so I can't help you there.

Most people will simply use TrueCrypt to encrypt the entire disk where Windows is installed. A password is required at boot time in this configuration.

In addition, you might optionally choose to add a hidden encrypted volume to your drive. To do this, you'll need an empty partition available on your drive. You won't be able to resize any partitions once the drive is encrypted so it's best to sort this out now. I don't need such a partition so I won't detail that here.

To get started, download and installed TrueCrypt. Once it is installed, proceed by selecting Encrypt System Volume from the System Menu.

This will kick off a wizard that will walk you through the process. Part-way through you'll be prompted to reboot the computer so TrueCrypt can complete a pretest.

Here are the answers I gave:

Area to Encrypt: Encrypt the whole drive

If your drive is used only for a single operating system (Windows) then the safest option is to encrypt the whole drive. Since I'm starting from a new fresh drive and I don't plan to use it for anything but my Windows install, I've encrypted the whole drive.

Encryption of Host Protected Area: No

Since I'm using a fresh drive, I know the HPA is available to be encrypted. This might not be the case for some factory-built machines that store drivers or recovery tools there.

Number of Operating Systems: Single-boot

I'm only planning to boot Windows on this netbook.

Encryption Options: Defaults

I simply chose the default encryption and hashing algorithms.

Password

This is the password you'll use to boot the computer. Of course it is essential that you choose something that you can remember.

TrueCrypt stores the decryption key for your hard drive on the drive itself. It is protected by this password, so you should also choose something long and not easily guessable.

A weak password will be vulnerable to brute force attacks (i.e. automated password guessing) should someone steal your hard drive and really want the contents. Of course, if they really wanted the contents, they'd just beat you or lock you away until you gave up the password.

Collecting Random Data

Just wiggle your mouse around for a bit. The software needs the movement of your mouse to generate random numbers for key generation. It's not as goofy as it seems.

Wipe Mode: None

This drive is new and has never had any sensitive information stored on it. Wiping isn't necessary.

You will also be prompted to create a recovery disc. This is how you recover your hard drive in case the decryption key is damage or corrupted. Since I don't have a CD-burner, I chose to save the recovery disc as an ISO file which I will write to a USB stick for safekeeping.

Once you've finished the wizard, TrueCrypt goes to work in the background encrypting your drive. From this point on you can ignore TrueCrypt - it will run silently.

Information Security For Travelers

noreply@blogger.com (Anonymous) — Fri, 30 Mar 2012 22:06:00 +0000

While I'm not opposed to technology, I usually use travel as an opportunity to unplug. In the past I've used internet cafes and VOIP but didn't carry any electronics more sophisticated than a AA-powered MP3 player.

This time around, I'm traveling with a laptop and a phone. I'll be getting internet access from a variety of sources. I'll be away long enough that I have to manage my finances online. Since I'm driving, I'll use the laptop for route planning.

While I still think it's possible to travel without electronics, it's harder than it used to be. Time will tell if I stick to this approach.

In the meantime, I need a broader approach to protecting my data.

Threats

To start with, I have to identify my threats. Personally, my concerns are:

Internet cafe malware (keyloggers)
Wi-Fi hotspot eavesdropping (session hijacking, credential theft)
Identity thieves (stealing personal data from stolen hardware)
Over-zealous customs and immigration officials (no one should have the authority to search my data unless I have committed a crime)
Data-mining firms (gathering personal and behavioral information, usually for marketing purposes)

Vulnerabilities

Now that I have identified my threats, I have to look at my vulnerabilities to those threats.

High-Risk Vulnerabilities

Internet cafe malware

I have no control over the hardware or the software that the internet cafe is using. The machines are exposed to a constant flow of public users with poor security habits. The machine could be infected with keyloggers or other forms of malware, all passively collecting information.

Anything connected to or accessed from a cafe machine is highly vulnerable if no steps are taken.

Identity thieves

In addition to my physical wallet and passport, I have personal information on my laptop, phone and flash storage devices. If someone steals my laptop it would be trivial to gain access to it along with the data stored on the hard drive, including a photocopy of the contents of my wallet and passport.

Medium-Risk Vulnerabilities

Wi-Fi hot-spot eavesdropping

Public wi-fi networks can be quite risky. Other users may be capturing unencrypted transmissions, which can include session tokens or personal data. Some sites do a good job of encrypting transmissions but some do not.

For example, a malicious user on a poorly secured wi-fi network could easily capture the session I used to log into my email or social networking account.

Low-Risk Vulnerabilities

Over-zealous customs and immigration

It is an unfortunate trend, recently, for customs and immigrations officials to temporarily seize and search electronic storage devices when crossing borders. This is ostensibly done to prevent criminals from doing criminal things but people have been targeted for political reasons as well.

This is mainly a problem with the US and Canada but a destabilized government in Latin America could very well turn to such tactics. The hardware and software to crack the traditional security measures on a phone or laptop are easily available to governments.

While I don't have anything to hide, I don't have anything to share either. There is nothing for me to gain by participating in such a search.

Data-Mining Marketers

Many companies use cookies and other persistent identifiers to track your activity on the internet. This is generally for marketing purposes but these firms have a poor record on data protection and their presence is annoying at best on most web sites.

Now that I've identified the threats and my vulnerabilities to those threats, I can devise the security measures I'll employ to protect myself and my data. In the coming posts I'll look at how to balance security and usability with various encryption technologies to mitigate the threats described above.

Black Rock City Shade Structure

noreply@blogger.com (Anonymous) — Mon, 23 Jan 2012 08:22:00 +0000

Shade Thing made of aluminet &
plastic tarp. In retrospect it would have
been better to use all-aluminet covering.

Black Rock City Shade Structure

I already have my truck set up so I can sleep comfortably on a bed I've built into the back of the vehicle.

When making camp, I usually I park in the shade and don't sleep in it during the day. Obviously this wouldn't work in shade-less Black Rock City, so I decided to erect an aluminet shade structure over the top.

It's shaped like a monkey hut morphed into a partial dome.

Parts (quantities will vary by vehicle size):

10-14 10' pieces of 3/4" PVC (enough to make ribs & flagpole).
I am fairly confident you could also use 1/2" provided you make straight cuts and use good supports & reinforcements.
4 1"-3/4" reducers
If integrating into vehicle load-bars. My Yakima bars have an OD of ~1".
10-14 straight couplers
For re-connecting pieces cut down in size for easier transport. 10' PVC pipe is unwieldy.
6-10 4-way couplers
For connecting all ribs to top frame.
4-6 3-way couplers
Branches off side ribs and connects to elbows for light posts.
4-6 30-45 degree elbows
For light posts. Depending on the bend in your side-ribs you may want different angles to get your light posts as vertical as possible.
10-14 18" straight steel spikes
Found near re-bar at the big box hardware stores.
18-30' of 14-21' wide 70% aluminet.
I should have used a total width of 26x21'. Pricey but it really is much better than a standard tarp and it will last forever.
Gromets

The shape is fairly simple as you can see in the diagram below. I simply took a tape measure to the vehicle, estimated how much PVC I'd need and made a couple trips back and forth to the hardware store as I assembled it one afternoon.

Here are a few assembly notes.

Cut all PVC as straight as possible. Use clamps to hold the pipe steady. This is crucial to getting sturdy connections wherever you use a coupler.
Hammer the steel spikes no more than half-way into the ground. You need to have at least 8" or so for the PVC to securely slip over the top.
Lash ropes to the 4-way couplers and steak them straight-down vertically. While aluminet does pass some air, limiting it's tendency to go airborne, in a good storm you might get enough lift to pull free of your steel spikes.
I used 2 strips of aluminet, each 26' long and 7' wide and 1 strip of green tarp. I should have used all aluminet. Each ran along the length of the vehicle - one on each side and one along the hood, roof and rear. Consider making the center piece a bit longer to help block the sun when it is low on the horizon. I left the aluminet about 3' off the ground on the sides.
I put cheap solar lights from the hardware store ($3-5 each) on four light-posts around the vehicle. I also put a fancy color-changing LED solar light up on a 15' flagpole. This really helps to find your way around at night.

See it in action at Wide-Angle Wandering.

TruckPuter v2

noreply@blogger.com (Anonymous) — Sun, 06 Nov 2011 06:03:00 +0000

TruckPuter v1 was based on an HP DM1Z 12" netbook with a remote power switch. I scrapped that for a number of reasons:

Windows 7 is a mediocre touchscreen OS. Task switching is a hassle.
The netbook bluescreened often
MS Streets & Trips is mediocre nav software
The DM1Z has a hidden reed switch that deactivated my remote power switch

XBMC Live (Ubuntu 10.04) Installation

TruckPuter v2 is based on a Mini-Box m350 case & M3-ATX ignition-sensing power supply, an Asus AT5ION-I motherboard & Atom D525 CPU with 4GB of RAM, a 120GB SSD for storage and a 32GB class 4 SD card for booting. I'll delegate navigation to a Garmin Nuvi with custom maps.

I just did a test-boot using XBMC Live on an SSD and everything looks good so far.

Thanks to mini-itx.com for tips: http://www.mini-itx.com/projects/xbmc-ion

Laptop Remote Power Switch

noreply@blogger.com (Dillon) — Tue, 19 Jul 2011 10:12:00 +0000

Inspired by this thread on mp3car.com and using this service manual from HP I just finished soldering a remote power switch to my laptop.

The switch & soldering iron came from Radio Shack. The wire leads were taken from an ethernet cable.

The laptop will be used as a car computer. Now I can boot it without having to pull it out of its hiding spot or deal with opening the lid.

Edit: there is a reed switch somewhere that prevents the laptop from booting when the lid is closed (or within ~30 degrees of being closed). I haven't been able to find it yet ...

VirtualBox VMs - autostarting on a headless Linux host

noreply@blogger.com (Dillon) — Mon, 14 Mar 2011 06:28:00 +0000

With some help from this and other blog posts I now have the Windows VM from my previous post set to auto-start.

Despite all the CLI and the manually edited scripts and config files, I'm finding this much easier (and more successful) than using KVM.

To start, I created a config file that will be used by the init.d scripts:


sudo nano /etc/default/virtualbox

Which contains the following entries (note - my VMs run as a user called vbox):

SHUTDOWN_USERS="vbox" # space-delimited list of users who might have runnings vms
SHUTDOWN=savestate # if any are found, suspend them to disk

I then created the script, which required a few modifications to refer to my local system:


#! /bin/sh
### BEGIN INIT INFO
# Provides:          virtualbox-subsonic-win
# Required-Start:    $local_fs $remote_fs vboxdrv vboxnet
# Required-Stop:     $local_fs $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: subsonic-win virtual machine
# Description:       subsonic-win virtual machine hosted by VirtualBox
### END INIT INFO

# Author: Brendan Kidwell 
#
# Based on /etc/init.d/skeleton from Ubuntu 8.04. Updated for Ubuntu 9.10.
# If you are using Ubuntu <9.10, you might need to change "Default-Stop"
# above to "S 0 1 6".

# Do NOT "set -e"

# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/usr/sbin:/usr/bin:/sbin:/bin
DESC="subsonic-win virtual machine"
NAME=virtualbox-subsonic-win
SCRIPTNAME=/etc/init.d/$NAME

MANAGE_CMD=VBoxManage
VM_OWNER=vbox
VM_NAME="subsonic-win" #This has to be the name exactly as it appears in your VirtualBox GUI control panel.

# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME

# Load the VERBOSE setting and other rcS variables
[ -f /etc/default/rcS ] && . /etc/default/rcS

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.0-6) to ensure that this file is present.
. /lib/lsb/init-functions

#
# Function that starts the daemon/service
#
do_start()
{
        # Return
        #   0 if daemon has been started
        #   1 if daemon was already running
        #   2 if daemon could not be started

        sudo -H -u $VM_OWNER $MANAGE_CMD showvminfo "$VM_NAME"|grep "^State:\s*running" >/dev/null && {
            echo "$VM_NAME" is already running.
            return 1
        }

        sudo -H -u $VM_OWNER $MANAGE_CMD startvm "$VM_NAME" --type=headless >/dev/null || {
            echo Failed to start "$VM_NAME".
            return 2
        }

        echo "$VM_NAME" started or resumed.
        return 0
}

#
# Function that stops the daemon/service
#
do_stop()
{
        # Return
        #   0 if daemon has been stopped
        #   1 if daemon was already stopped
        #   2 if daemon could not be stopped
        #   other if a failure occurred

        sudo -H -u $VM_OWNER $MANAGE_CMD showvminfo "$VM_NAME"|grep "^State:\s*running" >/dev/null || {
            echo "$VM_NAME" is already stopped.
            return 1
        }

        sudo -H -u $VM_OWNER $MANAGE_CMD controlvm "$VM_NAME" savestate || {
            echo Failed to stop "$VM_NAME".
            return 2
        }

        echo "$VM_NAME" suspended.
        return 0
}

#
# Display "State" field from showinfo action
#
do_status()
{
        sudo -H -u $VM_OWNER $MANAGE_CMD showvminfo "$VM_NAME"|grep "^State:\s*.*$"
}

case "$1" in
  start)
        [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
        do_start
        case "$?" in
                0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
                2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
        esac
        ;;
  stop)
        [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
        do_stop
        case "$?" in
                0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
                2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
        esac
        ;;
  restart|force-reload)
        #
        # If the "reload" option is implemented then remove the
        # 'force-reload' alias
        #
        log_daemon_msg "Restarting $DESC" "$NAME"
        do_stop
        case "$?" in
          0|1)
                do_start
                case "$?" in
                        0) log_end_msg 0 ;;
                        1) log_end_msg 1 ;; # Old process is still running
                        *) log_end_msg 1 ;; # Failed to start
                esac
                ;;
          *)
                # Failed to stop
                log_end_msg 1
                ;;
        esac
        ;;
  status)
        do_status
        ;;
  *)
        #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
        echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload|status}" >&2
        exit 3
        ;;
esac

I used the following commands to test the script:


/etc/init.d/virtualbox-subsonic-win status # Is the VM running?
/etc/init.d/virtualbox-subsonic-win start  # Start the VM
/etc/inid.d/virtualbox-subsonic-win stop   # Stop the VM

Once satisfied, I added set it to run whenever I enter or leave multi-user mode:

sudo update-rc.d virtualbox-subsonic-win defaults

From HyperV to KVM to VirtualBox

noreply@blogger.com (Dillon) — Mon, 14 Mar 2011 03:48:00 +0000

HyperV had miserable support for non-Windows guest operating systems, I couldn't get my DVD backup software working when mapped to the hypervisor's physical DVD drive, and the storage I/O was pretty miserable.

I then set out to run everything on KVM, using Ubuntu 10.10 for the base OS.

That worked ok for basic things, but KVM has even worse support for pass-through to physical devices. I couldn't even boot a KVM guest unless I had media in the optical drive, and I couldn't attach/detach the drive after the guest was booted. Useless.

I thought about upgrading to the latest qemu & KVM (Ubuntu 10.10 ships with old versions) but I decided to scrap it all and go with VirtualBox. VirtualBox has served me well in the past, so now I'm going to give it a go.

I present to you ... VirtualBox 4 on Ubuntu 10.10. Headless.

Special thanks to this article on HowtoForge.

First, I stopped KVM:

sudo service qemu-kvm stop

Then I blacklisted the KVM modules so they don't come back at the next startup:

sudo vi /etc/modprobe.d/blacklist.conf

Then add the following lines:

 blacklist kvm
 blacklist kvm-intel
 install kvm /bin/true
 install kvm-intel /bin/true

To install VirtualBox, I first added VirtualBox's repository to APT.

sudo vi /etc/apt/sources.list

I then added the following line for Ubuntu Maverick (10.10):

deb http://download.virtualbox.org/virtualbox/debian maverick contrib

To finish the APT setup, I added VirtualBox.org's key:

wget -q http://download.virtualbox.org/virtualbox/debian/oracle_vbox.asc -O- | sudo apt-key add -

APT is now ready to install VirtualBox:

sudo apt-get install linux-headers-$(uname -r) build-essential virtualbox-4.0 dkms

For VirtualBox's Remote Desktop (RDP) server, you need the "extension pack". I guess this one doesn't come from the repository, so I downloaded it with wget.


cd /tmp

wget http://download.virtualbox.org/virtualbox/4.0.4/Oracle_VM_VirtualBox_Extension_Pack-4.0.4-70112.vbox-extpack

With sudo, I ran the installer:

sudo VBoxManage extpack install Oracle_VM_VirtualBox_Extension_Pack-4.0.4-70112.vbox-extpack

I'm running my VM's under a dedicated user named vbox.

sudo adduser vbox
sudo adduser vbox vboxusers

Since I don't want my virtual machine's in the vbox user's home directory, I'm going to put them in /opt.


mkdir /opt/virtualbox/
sudo chown vbox:vbox /opt/virtualbox/
sudo chmod 770 /opt/virtualbox/

Ok, now it's time to create some VMs. First up - I need a Windows 2008 server to run Subsonic (media streaming) and PS3 Media Server.

Now I'm logged in as vbox.


vbox@myserver:/opt/virtualbox/$ VBoxManage createvm --name "subsonic-win" --ostype Windows2008_64 --register --basefolder /opt/virtualbox/

It will give you some handy output, including the UUID of the new VMs. I'm using the UUID in the following commands.

First I'm adding memory & mapping the virtual NIC to eth0 (I don't have the bonds working yet), and telling it to put a listener on TCP/4389 for Remote Desktop to the console.

VBoxManage modifyvm 53294d05-2c07-4dae-af6e-6e53ee06aa85 --memory 1024 --acpi on --boot1 dvd --nic1 bridged --bridgeadapter1 eth0  --vrde on --vrdeproperty TCP/Ports=4389

Next up - creating the virtual disk image.

VBoxManage createhd --filename /opt/virtualbox/subsonic-win/subsonic-win-0.vdi --size 10000

Next I added a SATA controller.

VBoxManage storagectl 53294d05-2c07-4dae-af6e-6e53ee06aa85 --name "SATA Controller" --add sata

And then attached my new disk.

VBoxManage storageattach 53294d05-2c07-4dae-af6e-6e53ee06aa85 --storagectl "SATA Controller" --port 0 --device 0 --type hdd --medium /opt/virtualbox/subsonic-win/subsonic-win-0.vdi

And then the W2K8 install ISO:

VBoxManage storageattach 53294d05-2c07-4dae-af6e-6e53ee06aa85 --storagectl "SATA Controller" --port 1 --device 0 --type dvddrive --medium "/media/software/Windows/Microsoft/Windows Server 2008/en_windows_server_2008_r2_standard_enterprise_datacenter_web_x64_dvd_x15-50365.iso"

And finally - startup!

VBoxHeadless --startvm 53294d05-2c07-4dae-af6e-6e53ee06aa85 --vrde on --vrdeproperty TCP/Ports=4389

At this point, I was able to connect using RDP on port 4389 and watch the console as the VM booted. Nice and easy.

Once I finished installing Windows, I used this command from the host to attach the Guest Additions ISO to the new guest.

VBoxManage storageattach 53294d05-2c07-4dae-af6e-6e53ee06aa85 --storagectl "SATA Controller" --port 1 --device 0 --type dvddrive --medium "/usr/share/virtualbox/VBoxGuestAdditions.iso"

PS3 Media Server Headless on Ubuntu Server 10.10

noreply@blogger.com (Dillon) — Sun, 20 Feb 2011 09:29:00 +0000

I'm rebuilding my guests on KVM. PS3 Media Server is moving to a headless Ubuntu Magestic Meerkat guest.

Here are the steps I followed to set it up:


http://ps3mediaserver.org/forum/viewtopic.php?f=3&t=3437

sudo -s
sudo apt-get install subversion build-essential git-core checkinstall yasm libgpac-dev
sudo apt-get install build-essential checkinstall gpac libgpac-dev git-core yasm

apt-get install gawk gettext html2text intltool-debian ladspa-sdk libaa1-dev libasound2-dev libatk1.0-dev libaudio-dev libaudio2 libaudiofile-dev libavahi-client-dev libavahi-common-dev libcaca-dev libcairo2-dev libcdparanoia0-dev libcucul-dev libdbus-1-dev libdbus-glib-1-dev libdirectfb-dev libdirectfb-extra libdts-dev libdv4-dev libenca-dev libenca0 libesd0-dev libexpat1-dev libfaac-dev libfaac0 libfontconfig1-dev libfreebob0 libfreetype6-dev libfribidi-dev libggi-target-x libggi2 libggi2-dev libggimisc2 libggimisc2-dev libgif-dev libgii1 libgii1-dev libgii1-target-x libgl1-mesa-dev libglib2.0-dev libglide3 libglu1-mesa-dev libglu1-xorg-dev libgtk2.0-dev libice-dev libjack-dev libjack0 libjpeg62-dev  liblzo2-2 liblzo2-dev libmad0 libmad0-dev libmail-sendmail-perl libmp3lame-dev libmp3lame0 libmpcdec-dev libncurses5-dev libogg-dev libopenal-dev libopenal1 libpango1.0-dev libpixman-1-dev libpng12-dev libpopt-dev libpthread-stubs0 libpthread-stubs0-dev libpulse-dev libpulse-mainloop-glib0 libsdl1.2-dev libslang2-dev libsm-dev libsmbclient-dev libspeex-dev libsvga1 libsvga1-dev libsys-hostname-long-perl libsysfs-dev libtheora-dev libtwolame-dev libtwolame0 libvorbis-dev libx11-dev libxau-dev libxcb-render-util0-dev libxcb-render0-dev libxcb1-dev libxcomposite-dev libxcursor-dev libxdamage-dev libxdmcp-dev libxext-dev libxfixes-dev libxft-dev libxi-dev libxinerama-dev libxrandr-dev libxrender-dev libxt-dev libxv-dev libxvidcore4 libxvidcore-dev libxvmc-dev libxvmc1 libxxf86dga-dev libxxf86vm-dev mesa-common-dev po-debconf sharutils x11proto-composite-dev x11proto-core-dev x11proto-damage-dev x11proto-fixes-dev x11proto-input-dev x11proto-kb-dev x11proto-randr-dev x11proto-render-dev x11proto-video-dev x11proto-xext-dev x11proto-xf86dga-dev x11proto-xf86vidmode-dev x11proto-xinerama-dev xtrans-dev zlib1g-dev libschroedinger-dev libstdc++5 libfaad-dev libgsm1-dev libdc1394-22-dev libfaad-dev libsdl1.2-dev libxvidcore-dev

cd
git clone git://git.videolan.org/x264.git
cd x264
./configure --prefix=/usr --enable-shared
make
sudo checkinstall --fstrans=no --install=yes --pakdir "$HOME/Desktop" --maintainer "$USER" --pkgname=x264 --pkgversion "1:0.svn`date +%Y%m%d`-0.0ubuntu1" --backup=no --deldoc=yes --deldesc=yes --delspec=yes --gzman --default
make distclean

cd
wget http://www.live555.com/liveMedia/public/live555-latest.tar.gz
tar xvf live555-latest.tar.gz
cd live
./genMakefiles linux
make
sudo cp -r $HOME/live /usr/lib

wget http://transact.dl.sourceforge.net/project/opencore-amr/opencore-amr/0.1.2/opencore-amr-0.1.2.tar.gz
tar xvf opencore-amr-0.1.2.tar.gz
cd opencore-amr-0.1.2/
./configure --prefix=/usr
make
sudo checkinstall --fstrans=no --install=yes --pakdir "$HOME/Desktop" --maintainer "$USER" --pkgname="libopencore-amr" --pkgversion="0.1.2" --backup=no --deldoc=yes --deldesc=yes --delspec=yes --gzman --default
make distclean

git clone git://gitorious.org/ffmpeg/ffmpeg-mt.git
cd ffmpeg-mt/
git clone git://git.ffmpeg.org/libswscale/
./configure –-enable-pthreads
make 
sudo make install


svn checkout svn://svn.mplayerhq.hu/mplayer/trunk mplayer
cd $HOME/mplayer/
cp -rf ../ffmpeg-mt/libavcodec libavcodec
cp -rf ../ffmpeg-mt/libavformat libavformat
cp -rf ../ffmpeg-mt/libavutil libavutil
sudo ./configure --confdir=/etc/mplayer
sudo make
sudo checkinstall -D --install=yes --fstrans=no --pakdir "$HOME/Desktop" --pkgname mplayer --backup=no --deldoc=yes --deldesc=yes --delspec=yes --default --pkgversion "3:1.0~svn-`grep "#define VERSION" version.h | cut -d"-" -f2`"
make distclean
export LD_LIBRARY_PATH=/usr/local/lib/

sudo apt-get install ant ant-gcj ant-optional ant-optional-gcj ca-certificates-java default-jdk default-jre default-jre-headless java-common libaccess-bridge-java libgcj-bc libgcj-common libjaxp1.3-java libjaxp1.3-java-gcj libxerces2-java libxerces2-java-gcj openjdk-6-jdk openjdk-6-jre openjdk-6-jre-headless openjdk-6-jre-lib rhino ttf-bengali-fonts ttf-kannada-fonts ttf-oriya-fonts ttf-telugu-fonts ttf-wqy-zenhei tzdata-java gcj-4.5-base libgcj11-dev

cd /usr/src/
svn checkout http://ps3mediaserver.googlecode.com/svn/trunk/ ps3mediaserver-read-only

cd ps3mediaserver-read-only/ps3mediaserver
sudo ant

JAVA_HOME=/usr/lib/jvm/java-6-openjdk/jre

sudo nano /etc/init.d/PS3MediaServer

sudo chmod a+x /etc/init.d/PS3MediaServer

sudo update-rc.d PS3MediaServer defaults 90

New Storage Architecture

noreply@blogger.com (Dillon) — Fri, 21 Jan 2011 08:22:00 +0000

My previous build is ok, but the performance has been awful. I can't get more than ~10MB/s write speed over the network on a 2gb/s link.

I decided then to separate the hypervisor function from the storage function. The hypervisor will probably move to KVM, on the existing hardware. For storage, I decided to buy rather than build. I could have built a FreeNAS storage server, but by buying the Synology DS1511+, I am getting great RAID management software and a compact hot-swappable chassis.

On the new setup I should be able to write >150MB/s. Sweet.