Sam's place

Routing for multiple uplinks/providers

2006-01-25T17:02:00.000-08:00

I've been researching the topic in the subject line for a little while now. My plan is to use my old desktop box to route for my home LAN. I have DSL and Cable at home (large house, lots of roommates), so I will be (finally) hammering out a way to use a single box to provide DHCP and other LAN services as well as provide outbound routing for BOTH ISP's.

This should be fun!

Anyways, I have here a couple links that address this:
Routing for multiple uplinks/providers
Multiple Connections to the Internet

They seem a bit stale, but I will try to post back with my progress.

I've already tried out pfSense, but found it to dislike my hardware as well as having a very sluggish web interface. The multi-WAN features of pfSense also turned out to be very unpolished and a bit confusing. So I figured that if I was going to be confused anyways, I may as well teach myself something useful.

I will probably begin by using gentoo, since it is what I have on my laptop, though I may go back to a more streamlined distro once I have things "figgered". Gentoo is also appealing as some of the baselayout changes in the latest version are designed to help out multi-homed hosts (particularly laptops, but I figure I can take advantage for my own goals).

A few extra goals I have beyond simply load-balacing/aggregating over both ISP connections will be to make it fairly easy to direct specific traffic across one ISP or the other (provided that ISP is up, of course). I also want my DHCP server to provide DNS servers from BOTH ISP connections (which are both DHCP... *g*). So a little bit of scripting beyond just setting up a multipath route.

I guess an alternative DNS approach would be to get a DNS server running on my router box itself, and provide special DNS routing rules that would prevent lookups from going out on the wrong interface.

I'll try to keep things updated -- my intended starting time for this project is this weekend. Any additional information that might be of use is, of course, appreciated.

Opinion: New Linux study suggests fundamental Microsoft creditability problems

2005-11-17T23:17:00.000-08:00

Wait, this isn't news, is it???

http://www.linux-watch.com/news/NS6557933549.html

[edit]

I've gone and read some of the study in question now. Not too impressive.

First is all the commentary about "Out of support" packages on SLES 8, while SLES 9 is available (and with those packages that are out of support in SLES 8!!!). Hmm! Maybe the applications that required those out of support packages were written towards distributions of SLES 9's vintage. Rather than upgrade 1-2 packages "out of support", I would expect a competent administrator to upgrade to SLES 9 or find an application compatible with SLES 8.

Rather, 3rd party extensions/products were chosen that operated both on Linux and Windows. Though of course, the specific application isn't disclosed, nor were the versions of those 3rd party products discussed.

Second, again with the "Out of support" packages. The report indicates that two of three of the SLES (*ahem*) administrators completely broke their servers while trying to upgrade glibc. I have to question the competence of the admins they selected. No backups? No knowledge of how to deal with this type of issue at all? Why were "third party extensions" to their "custom" ecommerce platform selected that weren't compatible with the existing platform?

The footnote at the bottom of page 3 is telling in this regard. Tallying non-version-specific "Windows" experience vs. non-version-specific "Linux" experience and having some version-specific requirements as well doesn't quite add up. What would the Windows administrators be getting experience in if not Windows 2000 or 2003?

Third, there is a mention of one of the Microsoft admins calling "Third party product support". Didn't the SLES administrators have similar options available?

Fourth, the number of patches installed, and the conveniently "monthly" patch cycle. Convenient, as Microsoft has a monthly patch release cycle. And the "number" of patches is questionable, as every patch not rated "optional" was installed. This entirely ignores whether the patch was to a component actually in use. SLES has all services disabled by default, and needn't automatically launch GUI software either.

SLES's patches included upgrades and patches to things like Acrobat Reader, which, given the methodology, would not have been patched on MS's enterprise solutions. The number of patches was higher for SLES because the vendor supports virtually all of the software on the machine.

Given the way modern linux distributions handle patch management, this isn't much of a burden. Requiring that _all_ patches be applied, presumably even to packages that were only installed to need patching, isn't a sensible approach. If it isn't needed, don't install it. If it isn't installed, don't patch it.

Some interesting charts, from Secunia:

SLES 8:
http://secunia.com/product/1171/
SLES 9:
http://secunia.com/product/4118/

Windows 2000:
http://secunia.com/product/20/
Windows 2003:
http://secunia.com/product/1174/

Pffft.

Sony's DRM rootkit

2005-11-01T08:57:00.000-08:00

If you use some of Sony's new copy-protected CD's on your computer, you get a nice present. You get some "stealth" processes and services, putatively designed to implement DRM. This doesn't sound like fun.

Mark's Sysinternals Blog: Sony, Rootkits and Digital Rights Management Gone Too Far

Microsoft's "monkeys" find first zero-day exploit

2005-08-14T11:08:00.000-07:00

Microsoft's "monkeys" find first zero-day exploit
Robert Lemos, SecurityFocus 2005-08-08

Microsoft 's experimental Honeymonkey project has found almost 750 Web pages that attempt to load malicious code onto visitors' computers and detected an attack using a vulnerability that had not been publicly disclosed, the software giant said in a paper released this month.

More:
Microsoft's "monkeys" find first zero-day exploit

Google Translator: The Universal Language

2005-05-26T17:26:00.000-07:00

Here is some really interesting machine learning. Google took all of the UN's translated documents and fed it to a statistical engine of some sort. Now that engine can translate between all of the UN languages with fairly high accuracy.

Google Translator: The Universal Language

I am curious about how this would handle colloquial use of language. My guess is not terribly well, without enough input data to chew on. I can imagine this type of database being grown organically though, with people translating the occasional document or snippet in their spare time, or as needed. What sort of statistical strength piecemeal (and potentially low-quality) translations would have is debatable, though. It may be that a rigorous and repeated approach such as what the UN needs to take with all of their documents would be needed.

ransom-ware

2005-05-25T08:52:00.000-07:00

Proof that people will find a way to abuse any technology given half a chance.

Computer users anxious about viruses and identity theft have a new reason to worry: hackers have found a way to lock up the electronic documents on your computer and then demand a ransom for their return.

Hacker holds computer files hostage

It always helps if the damn thing is plugged in.

2005-05-24T05:49:00.000-07:00

Yeah. It might seem obvious, but time and again, I find myself banging my head because I didn't think to check that first.

Never too young for a copyright lesson

2005-05-23T23:04:00.000-07:00

Good fun. 6th graders getting lectured about file-sharing.

Never too young for a copyright lesson | CNET News.com

'Geek speak' confuses net users

2005-04-07T06:15:00.000-07:00

BBC NEWS | Technology | 'Geek speak' confuses net users

SANS - Internet Storm Center - March 2005 DNS Poisoning Summary

2005-04-05T18:02:00.000-07:00

This is really interesting. DNS cache poisoning is and has been leveraged to redirect surfers to malicious websites that attempt to install malware.

This has been going around a bit in security mailing lists, but SANS has thoroughly written it up. At least as thoroughly as possible, as not everything is resolved and/or mitigated yet.

SANS - Internet Storm Center - March 2005 DNS Poisoning Summary

The future of blogging | CNET News.com

2005-04-05T15:14:00.000-07:00

The future of blogging | CNET News.com

Trackbacks courtesy of haloscan

2005-03-22T08:33:00.000-08:00

Trackbacks are now possible on blogger.com, using haloscan.com's trackback service.

A tiny bit of tinkering was required to enable haloscan's trackback and not their comment service, and unfortunately I couldn't find any haloscan icons that didn't say "Comments by". So no icon.

A bit of code to paste to enable auto-discovery, but nothing too hard.

Anyways, here's hoping I get some fun trackbacks!

Metalicensing

2005-03-19T04:40:00.000-08:00

An interesting take on the 'problem' of the proliferation of OSS licenses. It isn't terribly groundbreaking as things like the Mozilla Public License already includes text in it's template a block allowing alternate licenses to be given as an option.

But the idea of heirarchical meta-licenses seems intriguing.

NewsForge | Metalicensing

POPFile wins Jolt Productivity Award

2005-03-16T21:21:00.000-08:00

So here I am, sitting in the coffee bar at the Westin Santa Clara, sipping a mocha, listening to the live music at the "VIP pass only" St. Patrick's Eve SD West party. I got in anyways, and they seem to have stopped checking passes too.

Anyways, POPFile won a Jolt "Productivity Award" -- so I guess we are all award winning developers now. Cool. It's not the big award of the night, as there were 3 productivity awards in each category, but I am still thrilled. We were in the security category, so it's not surprising that at a software development conference we (a peripheral utility, perhaps part of the IS infrastructure) would loose out to a source-code analysis platform.

What little I saw of the conference was fun. I enjoyed talking to a lady at the sourceforge booth, and briefly discussed some of POPFile's problems with the service. Apparently some big changes are coming. Sourceforge will also be under a new director soon, as Pat is leaving (Bye Pat! I'll miss your emails). I also briefly chatted with a guy at the intel booth, but what they were doing didn't seem too thrilling.

I recorded the entire Jolt ceremony on my webcam, so I will be putting together a montage at least. For now, all I have is a shot of the award.

Woops, I got distracted for a couple hours there by some guys from Schwan's. Cool guys. We talked software and politics for a couple hours. They seemed fairly interested in open source.

Anyways, here's a picture of the award.

POPFile is a Jolt award finalist

2005-03-16T05:17:00.000-08:00

So I'm off to Santa Clara/San Jose for the award ceremony later today. A big thanks goes to John Graham-Cumming (who couldn't attend) and all who have donated to POPFile for making it possible for me to fly down there.

We're competing against mostly closed source commercial software, including Microsoft's ISA Server 2004. May the best software win, I guess.

I'm fairly ready to feel completely out of place, however.

I'll be wandering around at SD West for a few hours before the award ceremony, and then apparently there will be an after-party. I'll try to make some notes, and maybe get my webcam running to record the ceremony.

Good luck to us!

Schneier on Security: SHA-1 Broken

2005-02-17T17:20:00.000-08:00

Schneier on Security: SHA-1 Broken

Yikes. It'll be a short while before the paper is publicly available, but it doesn't look good. Are there any hash functions out there still unbroken?

Visiting SFU tonight

2005-02-11T01:52:00.000-08:00

So I'm up at SFU tonight. Wow, memories. I used to spend professional days up here with my dad, mostly doing stupid things to computers that an 8-13 year-old shouldn't be doing, meeting his co-workers (some of whom still remember me, at least according to them at the dinner many of us shared while my dad was in town) and eating lunch in the staff room at the cafeteria.

Sarah, a friend of my roommate's who seems to tolerate my existence ( ;-) ) is editor for the arts section at SFU's student paper. Sarah is up here all night and needs to fill her section, so Natasha and I are up here hanging out with her. We brought bubble tea and a buritto.

The one idea we (ie, they) had for filling space that involved me was a critique of a movie Natasha and I saw recently. That sounded too much like a book report, so I am doing my usual geeky stuff. My offer to write something geeky wasn't enthusiastically received. They, not being as uncontrollably geeky are doing arts editor stuff, and writing some other stuff.

Hooray for stuff.

And boo to politics and drama impeding good things.

Challenge/response filtering systems DO get false negatives

2005-02-06T06:50:00.000-08:00

This is what you get if you use challenge/response that flails about and
hits a non-existent account on one of the domains I administer. As a side note, it seems wrong for an anti-spam vendor to function using affiliate advertising. These guys don't have a good reputation, anyways. So... Enjoy your spam, "Mark". Please don't ask me to "filter" it for you again.

Thank you for verifying your email address with Spam Arrest!

Your email has been forwarded to Mark's inbox. All of your
future emails to Mark will also be delivered directly into
their inbox.

You can protect your own email account using Spam Arrest.

Please visit our website to learn more, and signup for a
completely free account!

http://spamarrest.com/affl?foo/

Spam Arrest - Take control of your inbox!

------------------------------------------------------------

Webmasters help stop spam and make 50%.
http://spamarrest.com/affl?foo/affiliates/index.jsp

------------------------------------------------------------

2005-02-06T05:35:00.000-08:00

This is a test post for "gaim-blogger". Blogging via IM (or close, anyways!) Interesting.

Hair? What hair?

2005-02-06T05:27:00.000-08:00

Yep, shaved my head. No more mop for a little while. Damn, but shaving your head goes through the razor blades.

I'll see how I like the bald look. Mixed reports so far, but I think there's only really one opinion that counts.

bleeeeeeeaaaaaaaaaaaaaahhh

2005-01-31T04:51:00.000-08:00

I feel unclean. So much loathing.

Geeking out, 802.11b SDIO card, mongolian grill, oh my.

2005-01-11T22:55:00.000-08:00

Today I slept in till 9 (!!!), then caught up with my Dad at the office. He was busy geeking out on his project, so I popped on my headphones and finished setting up my laptop to be useful for POPFile development. Mostly I was solving issues with having aborted the initial Linux install part way through, such as not having perl-devel and a bunch of other things installed. I also caught a bit of a nap in the office, since I was up far too late last night.

Long story short I now have email working using my training database from my desktop. I considered and discarded the possibility of forwarding email for classification via SSH to my desktop POPFile's XMLRPC interface. Running it locally makes more sense. I can copy the database back over when I get home.

After all that fun at the office we went for a drive up to the CompUSA in the next town over as the local one didn't have my Dad's coveted 802.11b SDIO card for his palm in stock. When we got home we checked his email on the hotel's wireless via IMAP. How neat!

On the way home we stopped at a very yummy mongolian grill and had a nice long chat with our waitress. Good fun.

Tomorrow... CVS commits should be happening. I feel content.

I'm in Michigan, and I have a laptop!

2005-01-10T22:22:00.000-08:00

My dad's visit to Vancouver was a precursor to a two-week long business trip to Ann Arbot, in Michigan, to do some close collaboration with the developers of the software used in my Dad's current project. Apparently 'the project' is hitting a bit of trouble which may be fatal, and my Dad is 'the man' to troubleshoot it.

At any rate, my Dad is largely confined to a wheelchair or a walker, due to the effects of mid-stage MS. In order for him to be able to get this vital trouble-shooting done, arrangements were supposed to be made for him to have access to on-call nursing care. Unfortunately, after he arrived in Vancouver, the arrangements that were supposed to be in place fell apart.

In order for things to proceed my Dad still needed someone to tend to him in the case of any non-emergency complications. So here I am.

Right now I'm in bed in our room blogging with my brand new laptop onto which I have shoehorned Mandrake. How cool is that.

I hope to use the rest of the next week and a half here to get some solid work done on POPFile. I seem to have ironed enough of the kinks in my new linux install to be able to focus on some improvements. I've also arranged to have SSH access to my home desktop so nothing I need there is inaccessible.

More later, of course.

my dad is in town!

2005-01-05T13:04:00.000-08:00

Yay. My dad is visiting from Australia for a week, and then we're both of to Michigan for two weeks. We're super busy visiting with all of his local friends until then, but are finding plenty of time to do all kinds of geeky things.

We tried using my linux desktop as a PPP gateway for his bluetooth PDA (close, but not quite), tried booting several computers from a linux distro on my USB flash-drive watch (yes, a watch!). We've also slurped all of my telephone contacts out of my cell-phone, which I didn't know could be done via IRda. Cool!

More later.

Most Hated Advertising Techniques

2004-12-06T14:00:00.000-08:00

Jakob Nielsen, of the Neilsen Norman Group, a group that specializes in helping companies design more usable product interfaces, recently wrote about a presentation at Neilsen Norman's "User Experience 2004" conference.

Two researchers, John Boyd from Yahoo! and Christian Rohrer from eBay presented information about negative user experience attributed to advertisements. About time.

Most Hated Advertising Techniques (Jakob Nielsen's Alertbox)

I wasn't able to find a free link to a paper by the researchers, though the ACM does seem to have something related by the same authors, which I wasn't able to access for free.

The rise of intrusive online advertising and the response of user experience research at Yahoo! (subscription download)

I also found a cached introduction to the 'tutorial' at the conference. I'm not sure how long that will work for. The uncached URL now redirects to The alertbox article linked above.

If spam is looked at from a user experience point of view, many companies would think twice about engaging in practices that encourage spamming on their behalf.