Introduction to Full Disk Encryption by Saqib Ali on 2007-01-20 20:16:09 from: c-24-6-168-127.hsd1.ca.comcast.net
< t i t l e > Introduction to Full Disk Encryption < / t i t l e >
So what is this Full Disk Encryption (FDE) you ask?
In short, it is a security solution that fully encrypts your entire Hard Disk Drive (HDD), including the Operating System etc. It is one of the "most transparent" encryption products you can get for your computer. Once installed you just have to authenticate once before the boot time, and if successful the HDD is unlocked and behaves like any other HDD. You don't have to worry about what files to encrypt and what not to encrypt. With FDE everything is encrypted. It is for the same reason that the US Government is currently conducting a competition of various FDE solutions to select and implement the best one.
You can find more info about the Government competition at
http://www.fbo.gov/spg/USAF/AFMC/ESC/FA8771-07-R-0001/Attachments.html
and
http://www.fbo.gov/spg/USAF/AFMC/ESC/FA8771%2D07%2DR%2D0001/listing.html
So what are the benefits of Full Disk Encryption?
Full disk encryption has several benefits compared to regular file or folder encryption, or encrypted vaults. The following are some benefits of full disk encryption:
- Everything including the swap space and the temporary files are encrypted. Encrypting these files is important, as they can reveal important confidential data.
- With full disk encryption, the decision of which files to encrypt is not left up to users.
- Support for pre-boot authentication.
I heard using encryption slows down a computer. It is true for FDE as well?
Yes and No. There is many hardware based FDE solutions (e.g. Seagate Momemtus FDE.2) that have NO impact on the computer's performance. On the other, hand software based FDE create a processing overhead, and slow down the computer - especially if you are working with large (more than 2 GB) files. But who works 2+ GB files on a daily basis anyways?
You ask: So where do I get this FDE thingy, and how much does it cost?
Good questions. FDE solutions come in many flavors. Most importantly they can cost anywhere from $0.00 (Free (e.g. Compusec)) to $200 (e.g. Pointsec) depending on the features and encryption algorithm being used. See below for comparison chart of the popular FDE solutions currently in the market, their feature set, and their cost.
How would I recover my data if I lose my pre-boot authentication password?
Another fine question. Lot of people ask this. Many of the FDE solutions in the chart above provide for easy but "secure" password recovery. Some support Challenge/Response sequence to recover password, while others can create password protected encryption key files that can be copied to CD and stored in a safe. Many of them provide both. Which method will work best for you, depends on your situation. If you installing the FDE solution on your personal laptop for home use, creation of the password protected encryption key is the best option. However if you are deploying the FDE solution in a large enterprise with IT Help Desk, Challenge/Response sequence may be the best option. If a remote user calls in to the Help Desk about a forgotten password, the Help Desk first authenticates the user, and then performs Challenge/Response sequence to recover the password. With the Challenge/Response password recovery mechanism the IT doesn't have to maintain a huge database of encryption key files, which can be a nightmare to manage.
So where can I find more info about this FDE thingy?
There are several Mailing Lists and Discussion Forum where you can get your questions answered:
http://www.full-disk-encryption.net - A Mailing List and Discussion dedicated to the FDE solutions, where all the major players contribute to answer user's questions:
http://tech.groups.yahoo.com/group/CompuSec/ - A Mailing List dedicated to discussion of the CompuSec FDE Solution, which a excellent "FREE" FDE product.
http://forums.pgpsupport.com/viewforum.php?f=54 - A Discussion Forum for PGP's FDE solutions.
View
NIST releases a security guide for managers by on 2006-11-26 13:25:27 from: ool-4573b59b.dyn.optonline.net
< t i t l e > NIST releases a security guide for managers < / t i t l e >
http://csrc.nist.gov/publications/nistpubs/800-100/sp800-100.pdf
This guide is specifically written for top level security/info management (CSOs, CIOs etc). It addresses the requirements of various security policies and laws, such as Clinger-Cohen Act (CCA) and Federal Information Security Management Act Implementation Project (FISMA). It covers NIST IA Framework from a upper management perspective.
It is essentially a condensation (Cliff's Notes version) of all the other NIST governance special publications to date. So if you been following the NIST publications all along, you will not find anything new.
View
Platform Authentication - The answer to cyber attacks launched using stolen passwords? by on 2006-11-26 13:24:34 from: ool-4355243e.dyn.optonline.net
< t i t l e > Platform Authentication - The answer to cyber attacks launched using stolen passwords? < / t i t l e >
Phoenix Technologies recently released a self-serving study of cyber attacks entitled "Network Attacks: Analysis of Department of Justice Prosecutions 1999 - 2006"
The key findings in the study (EVIDENCE ABOUND):
• Individual attacks caused as much as $10M in damages to individual organizations
• Organizations suffered the greatest financial loss and damage, more than $1.5M per occurrence, when attackers used stolen IDs and passwords
• Most crimes, 84 percent, could have been prevented if the identity of the computers connecting were checked in addition to user IDs and passwords
• Losses from stolen IDs and passwords far exceeded damages from worms, viruses, and other attack methods not utilizing logon accounts
• Vast majority of attackers, 78 percent, committed crimes from their home computers; most often using unsanctioned computers with no relationship to the penetrated organization
• 88 percent, of those crimes were committed from a home PC using stolen IDs and passwords and following normal logon procedures.
• Network attacks could have been prevented in 84 percent of all cases if the organization had implemented device identification and authentication in addition to user ID and password protections.
One Possible Solution
Armed with these findings Phoenix Technologies is pitching the use of Machine Authentication as a mean to prevent cyber attack lauched using stolen password. Trusted Platform Module is a hardware chip embedded on the motherboard that can be used to authenticate a hardware device. Since each TPM chip is unique to a particular device, it is capable of performing platform authentication. It can be used to verify that the system seeking the access is the expected system.
TPM does NOT replace a USB cryptographic key device / token. They compliement each other. A USB token/smart card authenticates the user whereas a TPM authenticates a machine.
So what is the problem with using TPM?
TPM can solve the problem of Machine Authentication, and most laptops are already shipping with the chip. So what is the problem? PROBLEM: TPM can also be used for DRM protect all digital content. This is something the EFF and ACLU members don't like (to say the least). It somehow errodes their civil liberties.
"They would rather have their banks emptied out then lose their right to copy digital content." (Hey don't bogart my credentials!)
1) Some comments on TPM from anti-DRM crowd; and
2) Mike Fratto's (Editor of Secure Enterprise) response to these concerns.
What are the alternatives?
1) Be a sitting duck. Passwords WILL be stolen and WILL be USED to cause financial damage;
2) Use software based device authentication. e.g. Passmark as used by Bank of America
3) Create a world-wide PKI, issue SSL certificates to machines as well as users, and then perform client side authentication from the server.
4) Use IP addresses to perform machine authentication.
Related link
TPM FAQs
Trusted Platform Modules Strengthen User and Platform Authenticity - Report by Trusted Computing Group
Trusted Computing and Financial Services - whitepaper by WaveSys
Network Attacks: Analysis of Department of Justice Prosecutions 1999 - 2006
View
CISSP Core Principles by Saqib Ali on 2006-10-20 11:18:41 from: ATHENA.MIT.EDU
< t i t l e > CISSP Core Principles < / t i t l e >
Confidentiality deals with Disclosure
Integirty deals with Modification, Alteration
Availability deals with Destruction
Core Prinicples of Security
1) Principle of Least Privelege
2) Know thy system
3) Prevention is Ideal, Detection is must
4) Defense in depth.
Principle of Least Privelege ==> Seperation of Duty ==> Job Rotation
Steps for Incident Reposnse
1) Preparation
2) Identification
3) Containment
4) Eradication
5) Recovery
6) Lessons Learned
Process for Information Labeling:
1) Identify the Admininstrator / Custodian;
2) Specify criteria
3) Define classification by the owner, and review by supervisor;
4) Define exceptions;
5) Define controls;
6) Define Declassification steps
7) Awareness
Kerberos
Click for detailed description of Kerberos
Diffie-Hellman
Click for detailed description of Diffie-Hellman
SLC (System Life Cycle)
1) Establish Requirements
2) Determine what the solution should do
3) Define
4) Build
5) Test (Certification)
6) Field (Accredition)
7) Maintain
8) Retire
Certification is part of Testing phase.
Accredition is part of Fielding phase.
IDS Events Defined
True Positive : Attack Traffic
True Negative : Normal Traffic
False Positive : Normal Traffic
False Negative : Attack Traffic
Therefore:
True Positive + False Negative = 100% Attack Traffic
True Negative + False Positive = 100% Normal Traffic
IDS Methods of Operation
Pattern Matching: Signature based [Default Allow, less secure]
Anomaly Detection: Learning based [Default Deny, more secure]
Protocol Behaviour: Determines normal traffic based on RFC.
BCP/DRP
BCP deals with the restoration or continued operations of the business processes.
DRP deals with the restoration of critical information systems (e.g. Data Center) that support the business processes.
BCP is long term focued, while DRP is short term focused.
Deliverables for BCP:
1) Scope of the plan
2) Plan for Recovery Steps
3) Plan for Testing.
4) Plan for Training for new skills
5) Plan for keeping BCP up to date.
Steps for BCP/DRP
1) Risk Analysis
2) BIA (Business Impact Analysis
3) Build the plan
4) Test the plan
5) Update / Modify the plan
6) Approve and Implement.
Validity Testing is also known as Structured walk-through testing
Consistency Testing is also known as Checklist testing.
Quick recovery allows up to 4 hours of downtime.
ISO/IEC 17700 is a holistic internal standard that addresses Security policies and guidelines, as well as security controls for networks and computers.
OSI Protocol Stack
Packets are part of Internet Protocol (IP) which works at Network layer.
Frames are part of Ethernet which works at Data Link Layer.
Router define Broadcast domain
Bridges define Collision domain
| Type | NETWORKS | HOSTS |
| | # of bits | # of networks | # of bits | # of hosts |
| A | 8 | 28-2=254 | 24 | 224-2 = >1 million |
| B | 16 | 216-2=65,534 | 16 | 216-2 = 65,534 |
| C | 24 | 224-2= >1 million | 8 | 28-2 = 254 |
TCP/IP
In the
IP header byte #9 is the protocol field. The following are some of the possible values:
1 : 0x1 : ICMP
2 : 0x2 : IGMP
6 : 0x6 : TCP
17 : 0x11 : UDP
Trusted Computing Base
Security Kernel implements Reference Monitor rules. Security Kernel comprises of the hardware, software, and firmware
Reference Monitor check all access. Reference Monitor holds all
TCSEC was developed by DoD
ITSEC was developed by Europe
Control Types
- Policies, standards, guidelines, personnel screening, and security awareness training are
Directive Controls
- Firewall, encryptio, identification, and authentication are
Preventive Controls
- Log review, auditing, and integrity checkers are
Detective Controls
- Instruction Manuals and audit trails are
Corrective Controls
Patents
Requirements for Patent:
1) Usefulness
2) Non-obvious
3) Novelty
Contractual Agreement for Patent:
1) Reduced to practice
2) Best way to do it
Law and Ethics
HIPAA : Regulatory Law : Deals with Medical : aka Kennedy-Kassebaum Act
GLBA : Regulatory Law : Deals with Finance : aka Financial Modernization Act
FOIA : Freedom of Information Act makes federal information readily available to public.
DMCA : Digital Millennium Copyright Act brings US into complaince with Article 20 of Berne Convention
CFAA Computer Fraud and Abuse Act is the "root" law - criminalizes an attack on any computer connected to the internet.
U.S. National Information Infrstructure Protection Act of 1996 is an ammendment to U.S. Computer Fraud and Privacy Act of 1986 and addresses CIA.
Business Records are exception to Hearsay Rule.
Sensitive information, if compromised, could adversely affect the national interest or the conduct of federal initiatives.
Evidence Life Cycle comprises of the following:
1) Collection and identification.
2) Storage, preservation, and transporation
3) Presentation in the court
4) Return to victim or owner.
Trade Secret is the most appropriate protection level granted to proprietary source code.
Copyright is used to protect expression of ideas.
Civil Law aka Tort Law requires preponderance of evidence.
The Foreign Corrupt Practices Act voilations are investigated by
SEC
The Economic Espionage and Protection of Proprietary Economic Information Act of 1996 voilations are investigated by
FBI
If you have questions/comments about this page, please email docbook.xml@gmail.com
Review of CISSP Training Material
View
The Scream of Nature OR The stolen cell-phone that screamed for help by on 2006-09-21 13:41:51 from: ATHENA.MIT.EDU
< t i t l e > The Scream of Nature OR The stolen cell-phone that screamed for help < / t i t l e >
"I was walking along a path with two friends—the sun was setting—suddenly the sky turned blood red—I paused, feeling exhausted, and leaned on the fence—there was blood and tongues of fire above the blue-black fjord and the city—my friends walked on, and I stood there trembling with anxiety—and I sensed an infinite scream passing through nature." —Edvard Munch
Hold on, that was my stolen cell-phone screaming for help.
Synchronica is now offering a new "screaming" service that can remotely lock and wipe data from mobile phones as soon as their owners report the loss. If the phone has been stolen, companies can also turn on the Synchronica Scream Feature, causing an annoying and embarrassing high pitched wail to be emitted from the stolen device.
Download the Synchronica Mobile Manager Scream as MP3
View
Internals of Full Disc Encryption Technology by Saqib Ali on 2006-09-06 08:48:29 from: ATHENA.MIT.EDU
< t i t l e > Internals of Full Disc Encryption Technology < / t i t l e >
Seagate Technology is about to release a HDD with hardware based encryption. These Full Disc Encryption (FDE) drives use 3DES algorithm in EDE (encrypt-decrypt-encrypt) mode using 3 different 64 bit keys. The effective key-length is 112 bit.
Before the operating system boots, the user will be prompted to enter a password that will unlock the drive. You can always use 2-factor authentication instead of static password. Seagate's FDE drives can use biometric, RSA token, or smartcards. This was demo at CeBIT using TiDoCoMi from Secude.
The FDE drives have a built-in Application Specific Integrated Circuit (ASIC) that performs the bulk encryption and decryption of the data on the drive platters. This frees the CPU from the performing these tasks. The ASIC also has the symmetric bulk encryption key. This encryption key is wrapped and sealed using the Storage Root Key (SRK) of the Trusted Platform Module on the motherboard. Keys wrapped and sealed using the TPM can only be decrypted by the TPM that wrapped and sealed them in the first place. This prevents disclosure of the key, and ties it to particular computer, thus preventing the FDE drive to be decrypted if installed on a different computer.
During the decryption process the ASICS sends the wrapped and sealed symmetric encryption key to the TPM. The TPM only unseals the key when the platform measurements have the same values that they had when the key was created. The ASIC then uses the key to encrypt and decrypt the bulk data on the disc drive as needed.
Wave System's EMBASSY Trust Suite can be used in conjunction with Seagate's FDE drives to provide key management and recovery. This provides the capability for key escrow and data recovery incase of accidental damage to the TPM. The Suite also provides multi-factor authentication capabilities.
Latest news and articles about the FDE drives (Updated daily)
A Discussion on University Security Operation Mailing List regarding FDE drives
View
Will Cell Phones replace Ipods and other media players?h?? by on 2006-08-18 09:26:06 from: ATHENA.MIT.EDU
< t i t l e > Will Cell Phones replace Ipods and other media players?h?? < / t i t l e >
Looks like it....
Samsungs's i1310 phone comes with support for internal Hard Disk Drive. Combine that with Seagate's 120GB 1.8 inch drive and what you have is a iPod killer. It is a iPod killer with lot more storage space then the iPod itself.
"The i310 comes with the latest version of Windows Mobile 5.0 for Smartphone which allows users to view files and easily carry their music library with them. This Windows Mobile 5.0 enables users to sync the playlists, songs, and videos from their personal PCs so that the experience with the i310 is identical to the users' personal computer. It also offers USB 2.0 and Plug & Play feature which allows the phone to be utilized as a removable hard disk. Businessmen and students can easily store and transfer files to/from their computers in any format conveniently."
Samsung i310 Specifications
Standard: GSM / GPRS (900/1800/1900MHz) + EDGE
OS: Windows Mobile 5.0 for Smartphone
Camera: 2 Megapixel Camera with Flash
Display: 2.0” 240x320 65K Color TFT
Features: Hard Disk Drive; Video Recording & Messaging (MPEG4 / H.263); MP3 / AAC / ACC+ / ACC+(e) / WMA / WAV / OGG; Dual Speaker / Digital Power Amp / External Music Key / BT Stereo; Bluetooth® Technology / USB 2.0 / Voice Recognition; Document Viewer / TV-out / BT Printing;
Memory: Support for 1.8inch Hard Disk Drive, External memory (microSD)
Dimensions: 111.9 x 48.5 x 19.8 mm
Weight: 120 g
Related links:
Samsung's Press Release
MAcWorld's coverage of the 120 GB HDD
Seagate Technology
View
University of Washington Crypto Course by on 2006-08-03 14:24:10 from: ATHENA.MIT.EDU
< t i t l e > University of Washington Crypto Course < / t i t l e >
Who wants to pay for Stanfords Crypto Course, when University of Washington has made the whole Cryptography Course available online for free. Yes, all the presentations, videos (mp3, WMV), homework, quizes etc. are available online. The material seems pretty decent, and is intended for advance audience.
> Click here for the course page with Course intro, and Homework assignments
> Click here for Course presentations (PDF, PPT), videos, and homework solutions.
To be fair (and since I work for MIT), I should note that MIT also has their Crypto online:
http://ocw.mit.edu/OcwWeb/Electrical-Engineering-and-Computer-Science/6-897Spring-2004/CourseHome/index.htm
http://ocw.mit.edu/OcwWeb/Electrical-Engineering-and-Computer-Science/6-876JSpring-2003/CourseHome/index.htm
http://ocw.mit.edu/OcwWeb/Electrical-Engineering-and-Computer-Science/6-875Spring-2005/CourseHome/index.htm
Next Topic: Full Disc Encryption Explained
View
Do you Code Sign ??? by on 2006-06-19 08:25:50 from: ATHENA.MIT.EDU
< t i t l e > Do you Code Sign ??? < / t i t l e >
"I am a regular reader of Bruce Schneier's Blog, Articles, and Books, and I really like what he writes. However I recently read his book titled 'Secret and Lies' and I think he has done some in-justice to the security provided by the 'Code Signing.' On page 163 of his books, he (Bruce Schneier) basically states that: 'Code signing, as it is currently done, sucks.' Even though I think that Code Signing has its flaws, it does provide a fairly good mechanism for increasing security in an organization." What are your thoughts on the current methods of code signing in existence, today? If you feel like Bruce Schneier, how would you fix it? If you feel like Saqib Ali, what have you signed and how well has it worked?
"The following are the reasons that he (Bruce Schneier) gives:
Bruce's Argument #1) Users have no idea how to decide if a particular signer is trusted or not.
My comments: True. However in an organization it is the job of the IT/security dept to make that determination. It shouldn't be left up to users. The IT dept should know not to trust "Snake Oil Corp.", however anything from "Citrix Corp" should be fairly safe. Moreover Windows XP SP2 provides provides a mechanism to create a Whitelist of certain trusted signers, and reject everything else. This is a very powerful security mechanism, and greatly increase the security in a corporate environment, if the workstations are properly configured. Having said that, this feature may not be that useful for home user, who can not
tell the difference between Snake Oil and Citrix Corp.
Bruce's Argument #2) Just because a component is signed doesn't mean that it is safe.
My Comments: I fully agree with this. However Code Signing was never intended for this purpose. Code signing was design to prove the authenticity and integrity of the code. It was never designed to certify that the piece is also securely written.
Bruce's Argument #3) Just because two component are individually signed does not mean that using them together is safe; lots of accidental harmful interactions can be exploited.
My comment: Again Code Signing was was never designed to accomplish this.
Bruce's Argument #4) "safe" is not all-or-nothing thing; there are degrees of safety.
My comment: I agree with this statement.
Bruce's Argument #5) The fact that the evidence of attack (the signature on the code) is stored on the computer under attack is mostly useless: The attack could delete or modify the signature during the attack, or simple reformat the drive where the signature is stored.
My comments: I am not sure what this statement means. I think this type of attack is outside the realm of Code Signing. 'It is like saying host based IDs or anti-virus are useless, because if you can compromise the system you can turn them off.'
I would really appreciate any comments / thoughts / feedback on the above mentioned Bruce's arguments and my commentary. I am planning to give a short talk about benefits of code signing, so any feedback will really help me."
View
Strong Earthquake hits Indonesia by on 2006-05-29 11:55:04 from: ATHENA.MIT.EDU
< t i t l e > Strong Earthquake hits Indonesia < / t i t l e >
Santa Clara, California, USA, May 27, 2006 – A deadly earthquake struck Indonesia this morning claiming more than 5,100 lives and leaving thousands more seriously injured. There is a massive disruption in the region as many buildings were flattened by the tremor, and countless people are trapped in the rubble. Additionally the nearby Mount Merapi volcano has become active, escalating the already enormous problem at hand.
Hidaya Foundation immediately released $100,000 for relief efforts and is requesting for more donations to help the victims of this catastrophe.
Hidaya Foundation is currently in contact with partner organizations on the ground, which include the Indonesian Red Crescent, and other NGO’s; Hidaya Foundation has been working with these organizations since the Tsunami of 2004.
Hidaya Foundation is appealing every one to come forward and donate generously to help reduce the pain and sufferings of the victims of this natural disaster.
Please Click here to Donate
View
Suggesting cryptographically strong passwords to users by Saqib Ali on 2006-03-02 15:14:19 from: ATHENA.MIT.EDU
< t i t l e > Suggesting cryptographically strong passwords to users < / t i t l e >
The following is an interesting discussion on suggesting cryptographically strong passwords to users:
http://www.securityfocus.com/archive/107/396530/2005-04-19/2005-04-25/1
The original poster suggested displaying a list of randomly generated password for the user to choose from. This will ensure that usage of cryptographically strong passwords.
Some issues that were pointed with this concept:
i) Shoulder surfing, since the password will have to displayed on the screen for the user to select one.
ii) Randomly generated password are hard to remember, and users will just write them down, and stick on their monitors. Very Unsecure!!!. Use pronounceable randomly generated passwords instead, as they will be easier to remember.
Automated Password Generator: Defines an algorithm for generating random but pronounceable passwords. Three problems with this algorithm.
a) does not preclude dictionary words from being used as passwords.
b) the generated passwords are alpha-only. cryptographically passwords should contain numbers and non-alpabatical characters.
c) we still have a problem of transmitting these randomly generated password to the user. email is unsecure for transmitting passwords. passwords can NOT be displayed to the user on the screen, due to the problem of shoulder surfing.
Password Safe is a tool that allows you to have a different password for all the different programs and websites that you deal with, without actually having to remember all those usernames and passwords.
Protocom's Single Sign On product can also alleviate the need for the user to remember multiple complex passwords.
Dept of Defense Password Management Guide
Some other notes:
"Remembering long passwords can be difficult, but there are some basic
techniques users can employ to lessen the pain. First, choose a phrase that
you will remember. As an example, we will use the phrase "The pearl in the
river." You can then take a number that you are familiar with, such as a
birthday. For this example we will use 7/4/01. Next, you can take the first
letter of your phrase and interlace it with the chosen date to make
something similar to t7p4i0t1r. This method creates a password that won't be
found in any dictionary and is unique to the person who created it.
It is important to remember though, that any password can be guessed if
given enough time. Therefore, it is important to change your password within
the amount of time it would take an attacker to guess it. For example, with
the previous password it may take an attacker 60 days on a very fast
computer to guess what it is. In order to ensure your systems safety then, a
user must change their password before those 60 days come to an end."
And Bruce Schneier says in his blog
"Passwords just don't work anymore. As computers have gotten faster, password guessing has gotten easier. Ever-more-complicated passwords are required to evade password-guessing software. At the same time, there's an upper limit to how complex a password users can be expected to remember. About five years ago, these two lines crossed: It is no longer reasonable to expect users to have passwords that can't be guessed. For anything that requires reasonable security, the era of passwords is over."
View
Death be not proud, though some have called thee by John Donne on 2006-02-27 17:56:14 from: ATHENA.MIT.EDU
< t i t l e > Death be not proud, though some have called thee < / t i t l e >
DEATH be not proud, though some have called thee
Mighty and dreadfull, for, thou art not so,
For, those, whom thou think'st, thou dost overthrow,
Die not, poore death, nor yet canst thou kill me.
From rest and sleepe, which but thy pictures bee,
Much pleasure, then from thee, much more must flow,
And soonest our best men with thee doe goe,
Rest of their bones, and soules deliverie.
Thou art slave to Fate, Chance, kings, and desperate men,
And dost with poyson, warre, and sicknesse dwell,
And poppie, or charmes can make us sleepe as well,
And better then thy stroake; why swell'st thou then;
One short sleepe past, wee wake eternally,
And death shall be no more; death, thou shalt die.
"Save your servant who trusts in you, My God. Let him find in you, My Lord, a fortified tower in the face of the enemy."
View
Best Practices for Designing Group Policies by on 2006-02-24 18:41:20 from: ATHENA.MIT.EDU
< t i t l e > Best Practices for Designing Group Policies < / t i t l e >
- Write the policy as high as possible. (at Domain or OU level)
- Work with e-Security to define policy. Security policies defined at highest level.
- Define Generic Policies as high as possible.
- The policies do not affect default administrator accounts
- Block inheritance at OU if needed. Can be Enforced at parent level. Enforced policies can not be blocked.
- Higher Policy in list takes precedence. (order in the list is important)
- Deny Apply Group Policy at Group level for IT Management Team
- Staging environment for Group Policies. Good Idea!
- You can NOT write policy at:
- Built in
- Computers
- Users
- Groups
- You CAN write policies at:
- Create an OU Design that requires least GPOs.
- Site Level GPOs requires enterprise administrations permissions.
- Domain Level GPOs requires domain administrations permissions.
- OU Level GPOs requires appropriate permissions. Delegation of Administration.
- GPOs take effect in the following order:
- Local Machine
- Sites
- Domain
- OU
- Machine Based Policy take effect on Reboot
- User Based Policy take effect on Logon
View
Firefox Image Load Block List by on 2006-02-17 19:59:04 from: ATHENA.MIT.EDU
< t i t l e > Firefox Image Load Block List < / t i t l e >
*.falkag.net
*.doubleclick.net
*.specificclick.net
*.peel.com
*.budsinc.com
*.maxserving.com
*.mediaplex.com
*.atdmt.com
*.advertising.com
*.casalemedia.com
*.tribalfusion.com
*.fastclick.net
*.specificmedia.com
*.qnsr.com
*.ru4.com
*.2mdn.net
*.ecrush.com
View
Code signing systems by Saqib Ali on 2006-02-01 17:05:43 from: ATHENA.MIT.EDU
< t i t l e > Code signing systems < / t i t l e >
How to manage digital certificates, Software Publishing Certificates and private keys for code signing
By Saqib Ali
This article looks at the management of the private key for the Software Publishing Certificate (SPC). SPCs are used to digitally sign binaries that are produced by software development vendors. Digitally signing executables proves the identity of the software vendor and guarantees that the code has not been altered or corrupted since it was created and signed. Signing the code requires access to the SPC and the Private Key (PVK) associated with the SPC.
Background
In cryptography, key management includes secure generation, distribution, and storage of keys. Appropriate and successful key management is critical to the secure use of every crypto-system without exception. Secure methods of key management are extremely important. Once a key is randomly generated, it must remain secret to avoid misuse (such as impersonation). It is, in actual practice, the most difficult aspect of cryptography, for it involves system policy, user training, organizational and departmental interactions in many cases, and coordination between end users, etc. Most attacks on public-key systems will probably be aimed at the key management level, rather than at the cryptographic algorithm itself.
Windows XP SP2 will produce this warning message for unsigned binaries. The user can NOT verify the authenticity of the code
Many of these concerns are not limited to cryptographic engineering and are outside a strictly cryptographic domain. The responsibility of the proper key management falls on the upper management in an organization of any size.
Users must be able to store their private keys securely, so no intruder can obtain them, yet the keys must be readily accessible for legitimate use.
There are many solutions available for proper key management of private keys owned by single individuals. Verisign, Entrust, RSA, and Microsofts Active Directory all provide a good mechanism for managing keys owned by individuals.
However, the management of private keys owned by groups or organizations is an issue that lacks proper tools and guidelines. Examples of these types of private keys include:
- The private key for the SSL certificates owned by groups or organizations
- The private key for SPC owned by a software development vendor
- The private key for the root CA (certification authority)
This article looks at the management of the private key for the SPC.
For signed binaries the source (vendor name) is displayed. The user knows that the code is authentic, and has not been tampered with during the transmission
A digital signature informs the user:
- Of the true identity of the publisher.
- Of a place to find out more about the binaries.
Code signing digital certificates can be purchased from
Verisign
So whats the problem?
In any software development firm more than one person needs to be able to sign the latest build, and release for download. However, allowing multiple developer access to the private key kills the security of the key. Every time a secret key is shared, the confidentiality provided by that key gets halved. Some questions that come to mind:
- What are the best practices for managing Code Signing Digital IDs and private keys?
- What can be done to secure the private key for code signing?
- Who should have the possession of the private key? Multiple people or just the project manager?
- What key escrow (recovery) techniques can be used, if the private key holder is not available?
- Who should be allowed to digitally sign the build?
If one person is responsible for signing all binaries, that person becomes the single point-of-failure. So it is recommended to give several people the ability to sign builds. However, this needs to be done in a way that several developers DO NOT end up with the private key for the SPC.
Code signing system: option one
One option is to use a code signing system (lets call it CSS1), which uses a shared secret scheme (Shamir, Blakeley or Trivial).
A secret sharing scheme allows you to distribute a secret (such as a private key) over some number of people such that a specified number of people (the threshold) must work together to recover the secret. For more information on secret sharing, have a look at this
Wikipedia entry. In its simplest form, this option would involve giving out parts of keys to each developer, and the CSS1 would have the knowledge on how to reconstruct the private key. If at least three developers are able to provide parts of the whole key, the CSS1 would go ahead reconstruct the key and sign the binary. The developers will never get to see the whole private key. This way, you can avoid a single person being able to sign, while at the same time making sure that no single person is critical for the signing. To further secure the system Shamirs or Blakeleys scheme can be used.
Secret sharing is a good start, but it doesnt get you all the way there. Suppose its time to sign a new build: then some parties reconstruct the secret key, and
poof all of a sudden CSS1 knows the secret key, and you are back to a single point (or even multiple points) of (security) failure. Now you are dependent on the security implemented in the CSS1 to safe guard the privacy of the key. An attacker might be able to make use of the window in time between the key being reconstructed and the key being destroyed, to retrieve the key from the CSS1.
Code signing system: option two
Another low-tech option is to use an isolated computer dedicated for code signing. Lets call this system CSS2. CSS2 should have no hard drive or network connection of any type. The operating system and the code signing tools, including the PVK and SPC, should reside on a read-only DVD. The following are security considerations:
- The operating system contained on the DVD should be very minimal. It should restrict any file copying or displaying functionality. It should also restrict any access to the console. This way an attacker cannot copy the PVK and the SPC from the DVD.
- The DVD should be encrypted, and the decryption key should be embedded into CSS2. This way any copies of the DVD will be useless, outside CSS2.
- The DVD should be placed in a safe box, which requires three more or keys to open it.
At the time of signing, at least 3 developers must get together to perform the code signing. They must use their keys to open the safe box, retrieve the DVD, boot the computer using the DVD, sign their code, and place the DVD back into the safe.
This system will prevent any attacker from gaining access to the PVK file. Even if an attacker gets hold of a copy of the DVD, it will be useless since it is encrypted. Also, since there is no file copy or display mechanism on CSS2, the PVK file can not copied.
Inevitably, there is still the potential for collusion, i.e. three or more developers with malicious intent can work together to create and sign malicious software.
Conclusion
Code signing can provide a very good security tool for verifying the authenticity of a released binary, and also guarantee that the code was not tampered with during transmission. However, management of the certificate and private key for code signing is very critical. If these private keys and certificates are misused, both the customer and software vendor can be adversely affected. The customer might end up with malicious software on their computer, while the vendor may lose money and reputation. If proper key management techniques are utilized, any misuse can be avoided.
View
Review of CISSP Training Material by Saqib Ali on 2006-01-28 15:31:31 from: ATHENA.MIT.EDU
< t i t l e > Review of CISSP Training Material < / t i t l e >
Boson has Audio training CDs for CISSP. The media and content was actually produced by AudioWhiz. AudioWhiz's Bruce Gaetke (CEO) claims that the training CD is intended for intermediate audience. However after listening to 5 CDs, I think this particular training is aimed toward the beginners. The content is very basic, and only good for people who are starting in the e-Security field. People who have worked in the security field for at least 3 yrs (which is a requirement for CISSP) will find this audio training to be ineffective.
The question/answer format of the training is great. Each answer is explained. The five CDs contain 12 sections on each CD, and are easy to navigate. However I would only purchase this training media, if you have NO experience in e-Security field.
Boson offers Computer based Practice test for CISSP. These are great for testing your skills. The simulation interface that Boson provides is a lot better than what PrepLogic provides. Boson offers 3 Practice Test for CISSP. I would highly recommend that you buy all three. Practice Test I contains 400+ questions, and Practice II & III contain 200+ questions each.
Boson test are great, but the best CISSP practice exams are produced by Transcender. Transcender offers SecurityCert: CISSP Exam for hefty price tag of $249. But I think it is worth every cent. You get about 500 very realistic questions on the media. The test engine is very good as well. Best of all it comes with a pass guarantee. i.e. Transcender will return your money if you don't pass the CISSP exam. So you can't go wrong. However if you are not interested in the Pass Guarantee, and just want the practice questions, Self Test Software offers the same questions and the test engine for $169. But you don't get the Pass Guarantee with $169.
If you don't want to pay $$$ for practice test, try CISSP and SSCP Open Study GROUP Online Quizzer. It is a free online Quiz, that includes question submitted by various people. The questions are of good quality, but the user interface is not that great. I prefer to see one question per page. I also like the explanations provided with answers to each question. Since the questions are usuallly submitted by people, I sometimes doubt the validity of the questions. Some of questions in the online quiz would never appear in an actual CISSP exam.
Logical Security offers a Computer Based Training for CISSP by Shon Harris. This is an EXCELLENT alternative to live or instructor-led training. I didn't want to shove out $3000+ for instructor-led training offered by many vendors, so went ahead and bought Shon Harris' CBT. And it was money well spent. One problem with instructor-led is that, what you get out of the training mainly depends on the instructor you get. If you get an instructor like Shon Harris you are lucky. Not many people are lucky enough, and I have heard many horror stories about the instructors. With Shon Harris' CBT you CAN NOT go wrong. It is a self-paced learning environment, and you can repeat as many times as you want. This 24-hour course is the same class Shon Harris teaches around the world for large corporations and organizations including RSA, BMC Software, NSA, Depts. of Energy and Defense, Microsoft and Bank of America. Shon provides real-world scenarios, examples and explanations so that you can truly grasp even the most complicated concepts. The course includes 3-D animations that conceptually walk you through critical topics. Text highlights, illustrations and question and answer sessions ensure full comprehension. However a workbook along with the CBT would have been nice. It seems like Logical Security will be offering a companion workbook in the near future. So that will complete the package.
CCCURE.com sells this CBT for $499. It is the cheapest price that you can find anywhere on the net. Most resellers are selling it for hundreds of dollars more. This is the same package that Amazon.com sells for $900 dollars. See details at: http://www.cccure.org/modules.php?name=News&file=article&sid=527
CISSP Core Principles (must read)
View
Kerberos by Saqib Ali on 2006-01-22 20:41:03 from: ATHENA.MIT.EDU
< t i t l e > Kerberos < / t i t l e >
Step 1) Authentication Server to Client
Ticket Granting Ticket : [client, address, validity, Key(client, TGS)]Key(TGS)
[Key(client, TGS)]Key(client)
Step 2) Client to Ticket Granting Server
Ticket Granting Ticket : service, [client, client address, validity, Key(client, TGS)]Key(TGS)
Authenticator : [client, timestamp]Key(client, TGS)
Step 3) Ticket Granting Server to Client
Ticket (client, service) : service, [client, client address, validity, Key(client, service)]Key(service)
[Key(client, service)]Key(client, TGS)
Step 4) Client to Service
Ticket (client, service) : service, [client, client address, validity, Key(client, service)]Key(service)
Authenticator : [client, timestamp]Key(client, service)
What follows is a simplified description of the protocol. The following shortcuts will be used: AS = Authentication Server, TGS = Ticket Granting Server, SS = Service Server.
In one sentence: the client authenticates itself to AS, then demonstrates to the TGS that it's authorized to receive a ticket for a service (and receives it), then demonstrates to the SS that it has been approved to receive the service.
In more detail:
1. A user enters a username and password on the client.
2. The client performs a one-way hash on the entered password, and this becomes the secret key of the client.
3. The client sends a clear-text message to the AS requesting services on behalf of the user. Sample Message: "User XYZ would like to request services". Note: Neither the secret key nor the password is sent to the AS.
4. The AS checks to see if the client is in its database. If it is, the AS sends back the following two messages to the client:
* Message A: Client/TGS session key encrypted using the secret key of the user.
* Message B: Ticket-Granting Ticket (which includes the client ID, client network address, ticket validity period, and the client/TGS session key) encrypted using the secret key of the TGS.
5. Once the client receives messages A and B, it decrypts message A to obtain the client/TGS session key. This session key is used for further communications with TGS. (Note: The client cannot decrypt the Message B, as it is encrypted using TGS's secret key.) At this point, the client has enough information to authenticate itself to the TGS.
6. When requesting services, the client sends the following two messages to the TGS:
* Message C: Composed of the Ticket-Granting Ticket from message B and the ID of the requested service.
* Message D: Authenticator (which is composed of the client ID and the timestamp), encrypted using the client/TGS session key.
7. Upon receiving messages C and D, the TGS decrypts message D (Authenticator) using the client/TGS session key and sends the following two messages to the client:
* Message E: Client-to-server ticket (which includes the client ID, client network address, validity period) encrypted using the service's secret key.
* Message F: Client/server session key encrypted with the client/TGS session key.
8. Upon receiving messages E and F from TGS, the client has enough information to authenticate itself to the SS. The client connects to the SS and sends the following two messages:
* Message G: the client-to-server ticket, encrypted using service's secret key.
* Message H: a new Authenticator, which includes the client ID, timestamp and is encrypted using client/server session key.
9. The server decrypts the ticket using its own secret key and sends the following message to the client to confirm its true identity and willingness to serve the client:
* Message I: the timestamp found in client's recent Authenticator plus 1, encrypted using the client/server session key.
10. The client decrypts the confirmation using its shared key with the server and checks whether the timestamp is correctly updated. If so, then the client can trust the server and can start issuing service requests to the server.
11. The server provides the requested services to the client.
View
Quotes on Law by on 2005-12-24 06:07:09 from: ATHENA.MIT.EDU
< t i t l e > Quotes on Law < / t i t l e >
"Wrong must not win by technicalities" Aeschylus
"Men are not hanged for stealing horses, but that horses may not be stolen"
"Law cannot persuade, where is cannot punish". Thomas Fuller
View
Quotes on Justice by on 2005-12-23 14:20:00 from: ATHENA.MIT.EDU
< t i t l e > Quotes on Justice < / t i t l e >
"One of the uses of our system of justice is to warn others... We are reforming, not the hanged individual, but everyone else." Michel de Montaigne
"It is justice, not charity, that is wanting in the world." Mary Wollstonecraft
"The art of policing is, in order not to punish often, to punish severely" Napoleon
View
Security Quotes by on 2005-09-21 23:05:37 from: ATHENA.MIT.EDU
< t i t l e > Security Quotes < / t i t l e >
"When it comes to simplicity improving security think of the application as a house. The bigger it is, the more windows and doors it will have."
There exist two types of systems:
1) those which are so simple that they are obviously correct, and
2) those which are so complex that it is not obvious even when they are incorrect.
Simplicity is the ultimate sophistication.
*"There are two ways of constructing a software program:
one way is to make it so simple that there are obviously no deficiencies;
the other is to make it so complicated that there are no obvious deficiencies"
C.A.R. Hoare
"I repeat: complexity is the worst enemy of security. Secure systems should be cut to the bone and made as simple as possible. There is no substitute for simplicity. Unfortunately, simplicity goes against everything our digital future stands for. " Bruce Schneier
"A more complex system is less secure on all fronts. It contains more weaknesses to start with, its modularity exacerbates those weaknesses, it's harder to test, it's harder to understand, and it's harder to analyze." Bruce Schneier
View
RBAC for WebApps using LDAP by Saqib Ali on 2005-09-10 19:12:28 from: ATHENA.MIT.EDU
< t i t l e > RBAC for WebApps using LDAP < / t i t l e >
LDAP directories have the capability to define Roles. Roles becomes a topLevel OU, similar to OU=People or OU=Groups.
Once logged in, a web application can check to see if the user has the proper Role assignment to perform a given a action.
Java, PHP, ColdFusion provide methods like isUserInRole("{RoleName}") to check logged-in user's Role assignments. Based on the Return Value of this function, the web application can determine whether to display content or restrict it from the logged-in user.
# sample LDIF to add Roles OU to LDAP:
dn: ou=Roles,o=xml-dev.com,o=CORP
ou: Roles
objectClass: top
objectClass: organizationalUnit
# Define a Role
dn: cn=ReportView,ou=Roles,o=xml-dev.com,o=CORP
objectClass: top
objectClass: groupOfUniqueNames
cn: ReportView
uniqueMember: uid=123456,ou=People,o=xml-dev.com,o=CORP
View
Do you Code Sign ??? by Saqib Ali on 2005-09-10 19:11:54 from: ATHENA.MIT.EDU
< t i t l e > Do you Code Sign ??? < / t i t l e >
I am a regular reader of Bruce Schneier's Blog, Articles, and Books, and I really like what he writes. However I recently read his book titled "Secret and Lies" and I think he has done some in-justice to the security provided by the "Code Signing".
On page 163 of his books, he (Bruce Schneier) basically states that:
"Code signing, as it is currently done, sucks".
Even though I think that Code Signing has its flaws, it does provide a fairly good mechanism for increasing security in an organization.
The following are the reasons that he (Bruce Schneier) gives:
Bruce's Argument #1) Users have no idea how to decide if a particular signer is trusted or not.
My comments: True. However in an organization is the job of the IT/security dept to make that determination. It shouldn't be left up to users. The IT dept should know not to trust "Snake Oil Corp.", however anything from "Citrix Corp" should be fairly safe. Moreover Windows XP SP2 provides provides a mechanism to create a Whitelist of certain trusted signers, and reject everything else. This is a very powerful security mechanism, and greatly increase the security in a corporate environment, if the workstations are properly configured. Having said that, this feature may not be that useful for home user, who can not tell the difference between Snake Oil and Citrix Corp. Bruce's Argument #2) Just because a component is signed doesn't mean that it is safe.
My Comments: I fully agree with this. However Code Signing was never intended for this purpose. Code signing was design to prove the authenticity and integrity of the code. It was never designed to certify that the piece is also securely written.
Bruce's Argument #3) Just because two component are individually signed does not mean that using them together is safe; lots of accidental harmful interactions can be exploited.
My comment: Again Code Signing was was never designed to accomplish this.
Bruce's Argument #4) "safe" is not all-or-nothing thing; there are degrees of safety.
My comment: I agree with this statement.
Bruce's Argument #5) The fact that the evidence of attack (the signature on the code) is stored on the computer under attack is mostly useless: The attack could delete or modify the signature during the attack, or simple reformat the drive where the signature is stored.
My comments: I am not sure what this statement mean. I think this type of attack is outside the realm of Code Signing. if you can compromise the system, you can do much more harm then just modify the executable.
"It is like saying host based IDs or anti-virus are useless, becuase if you can compromise the system you can turn them off."
Click here for the full discussion on Slashdot
View
RSS: beyond news sites and weblogs by Saqib Ali on 2005-06-06 00:00:11 from: ATHENA.MIT.EDU
< t i t l e > RSS: beyond news sites and weblogs < / t i t l e >
RSS: beyond news sites and weblogs (Full Article)
RSS (Really Simple Syndication) is an XML based web content syndication format. RSS has become the defacto feature on weblogs and many news sites. Almost all major news sites and weblogs provide an RSS feed for their audience. An RSS-aware program (aka RSS reader) can check these RSS feeds for changes and display the updates in a human readable format.
RSS has become the de facto feature on weblogs and many news sites
Almost every computer geek visits Slashdot.org once a day. But UberGeeks, like me, prefer to be always up to date with the latest articles on Slashdot.org. So instead of visiting Slashdot.org every 5 minutes, I have subscribed to the Slashdot RSS feed. As soon as there is a new article on Slashdot, my RSS reader notifies me of it. This allows me to logon and make the First Post (reply) to the Slashdot.org article. I have to attribute many of my Slashdot First Posts to the power of RSS. This power of RSS has been utilized on other news sites as well. NPR, CNN, and Wired all provide RSS feeds.
URLs to RSS feeds from some popular weblogs and news sites:
* Slashdot
* National Public Radio
However there are other areas where the power of RSS has not been fully realized. Wikis, Usenet and web based discussion groups come to mind. But this is changing fast. In this article I would like to go over some of the free software that allows web-content distribution and republication in the areas of Wikis, Usenet and discussion groups. Ill also go over a powerful RSS Reader that is freely available.
Firefox: a powerful RSS reader
An RSS Reader is an application that polls RSS feeds and displays them in a human-readable format. The reader allows you to browse the newly available items in the RSS feed. RSS readers come in many flavors.
As soon as there is a new article on Slashdot, my RSS reader notifies me of it
One powerful RSS reader, that often goes unused by many, comes built-in with Mozilla Firefox browser. It is called the Live Bookmark. Live Bookmarks is a new technology in Firefox that lets you view RSS news and weblog headlines in the bookmarks toolbar or bookmarks menu. It enables you to quickly see the latest headlines from your favorite sites. Clicking on any of the live bookmark will take you directly to the page referenced by that RSS item.
Firefoxs Live Bookmark lets you see the latest headlines from your favorite sites. Clicking on any Live Bookmark opens up the full article in the browser window
Firefoxs Live Bookmark lets you see the latest headlines from your favorite sites. Clicking on any Live Bookmark opens up the full article in the browser window
You can download Firefox from the Mozilla web site. Some other Freely available RSS readers:
* RSS OWL (Java based)
* FeedReader (Windows)
* DSSBandit (windows, written in C#)
* LifeArea (GTK/GNOME)
* Straw (Python/GNOME)
* Syndigator (Perl/GTK)
* Blam (Mono: C# and Gtk#)
* Snownews (Console based, ncurses)
Chronological web sites?
Wiki is a web site that allows users to add, edit or modify web site content, by merely using a web browser. Wiki provides a fast and easy way to collaborate and collaboratively create documentation on the web. Not surprisingly, Wiki comes from the Hawaiian term for quick or super-fast. A Wiki engine also serves well as a Departmental or a Taskforce web site, which the team members can use to share ideas and publish content, without messing around with HTML editors. PHPWiki, as the name suggest, is a PHP based Wiki, while Twiki is PERL based. Both of these Wiki engines, with their aim to foster information flow among the users, provide RSS feeds of the latest content and updates in chronological order. The RSS feeds from these Wiki engines provide an easy way for the users to keep up to date on the latest updates to the content of the web site. This is especially useful when the Wiki is being used to track bugs or features in a product. The subscriber of the RSS feed will be notified as soon as an update is made to the list of bugs or the feature.
All of the changes made to the content on the Wiki are shown as RSS items in the order they were made (chronological)
All of the changes made to the content on the Wiki are shown as RSS items in the order they were made (chronological)
Clicking on any Wiki Page Title (RSS item), will take you directly to the modified page. Only the pages that changed/edited show up as RSS items
Clicking on any Wiki Page Title (RSS item), will take you directly to the modified page. Only the pages that changed/edited show up as RSS items
* Twiki (requires Apache and Perl)
* PmWiki (requires Apache and PHP
* MediaWiki (requires Apache, PHP and mySQL)
* MoinMoin (requires Apache and Python)
* usemod (requires Apache and PERL)
* PHPwiki (requires Apache, PHP and mySQL)
* ChiqChaq (requires Apache and PERL)
Die hard usenet fan?
If you are die-hard fan of Usenet, like me, you can never stop pressing the refreshing key to retrieve the latest newsgroup postings. Refresh button (F5), on my keyboard, has worn out due to overuse. Worry not, Google + RSS has come to our rescue. A few years back Google acquired Deja News, the largest collection of web accessible Usenets.
All of the latest postings to a Usenet newsgroup are shown as RSS items in the order they were made (chronological)
All of the latest postings to a Usenet newsgroup are shown as RSS items in the order they were made (chronological)
PHPWiki and Twiki are two popular Wiki engines that are freely available under the GNU Public License. Both of these Wiki engines, in their aim to foster information flow among the users, provide RSS feeds of the latest content and updates in chronological order
After the acquisition, Google made some very cool enhancements to the Deja News Network. But that wasnt good enough, Google went on to develop a whole web based collaboration platform based on the NNTP protocol. A powerful feature of this collaboration platform is ability to generate RSS feed of the latest newsgroup postings in a chronological order. This allows an avid Usenet fan to keep up to date with the newest post on the groups of interest. As soon as a new Usenet posting is made, the RSS reader on my desktop notifies me of it.
You can subscribe to the RSS feed of a Usenet newsgroup by simply adding the following URL to your favorite RSS reader: http://groups-beta.google.com/group/{name.of.newsgroup}/feed/msgs.xml. Replace {name.of.newsgroup} with newsgroup of your choice. Some examples:
* http://groups-beta.google.com/group/comp.text.xml/feed/msgs.xml
* http://groups-beta.google.com/group/microsoft.public.visio/feed/msgs.xml
Do you Yahoo?
Ok, so you are not an old timer like me. Instead, you are from the new generation and instead use Yahoo Group to communicate with your peers. Worry not, Yahoo Group also provides a RSS for the groups.
You can use the following URL syntax to subscribe to an RSS feed of the Yahoo Group: http://groups.yahoo.com/group/{group_name}/rss. Replace {group_name} with the Yahoo Group of your choice. Some examples:
* http://rss.groups.yahoo.com/group/apache-user-group/rss
* http://rss.groups.yahoo.com/group/citrix/rss
* http://rss.groups.yahoo.com/group/ssl-talk/rss
* http://rss.groups.yahoo.com/group/xml-doc/rss
Conclusion
RSS is a fast and powerful way to get news out to an audience. RSS readers inform their users of any new postings on news sites, newsgroups and weblogs. If you need to keep up to date on the latest news articles, or you need to track the postings on Wiki or your favorite weblog, then you really need to use an RSS reader.
View
CSS to display XML in Web Browsers by Saqib Ali on 2004-09-05 13:39:45 from: ATHENA.MIT.EDU
< t i t l e > CSS to display XML in Web Browsers < / t i t l e >
The Cascading Stylesheets provide a way to directly view a styled XML document in software that supports XML styled with CSS2 (e.g. a recent Mozilla)
The following is a list of interesting CSS for displaying XML content in browsers:
1) CSS for DocBook XML document: http://www.badgers-in-foil.co.uk/projects/docbook-css/
If you have CSS for displaying XML documents, please feel free to add them to this list.
View
My new book by Saqib Ali on 2004-05-03 05:59:55 from: ATHENA.MIT.EDU
< t i t l e > My new book < / t i t l e >
My Inner demons would like to meet you, outside in the parking lot! . This is the title of my new upcomming book
View
An Unquiet Mind by Saqib Ali on 2003-12-06 19:30:59 from: ATHENA.MIT.EDU
< t i t l e > An Unquiet Mind < / t i t l e >
From Dr. Kay Redfield Jamison's book titled "An Unquiet Mind"
- "We all move uneasily within our restraints."
- "but of course they had no idea how I felt, although they were certain that they did."
- "The morbidity of my mind was astonishing: Death and its kin were constant companions."
-"Within psychiatric circles, if you kill yourself, you earn the right be considered a "successful" suicide.....
- There is an assumption, in attaching Puritan concepts such as "successful" and "unsuccessful" to the awful, final act of suicide, that those who "fail" at killing themselves not only are weak, but incompetent, incapable even of getting their dying quite right.
The book is available at Amazon. Definitely a must read.
Try some, Chocolate Bone Marrow instead.
View
Open letter to Darl McBride -- please grow up. by Linus Torvalds on 2003-09-23 20:01:38 from: ATHENA.MIT.EDU
< t i t l e > Open letter to Darl McBride -- please grow up. < / t i t l e >
Sept. 9, 2003
Open letter to Darl McBride -- please grow up.
Dear Darl,
Thank you so much for your letter.
We are happy that you agree that customers need to know that Open Source is legal and stable, and we heartily agree with that sentence of your letter. The others don't seem to make as much sense, but we find the dialogue refreshing.
However, we have to sadly decline taking business model advice from a company that seems to have squandered all its money (that it made off a Linux IPO, I might add, since there's a nice bit of irony there), and now seems to play the US legal system as a lottery. We in the Open Source group continue to believe in technology as a way of driving customer interest and demand.
Also, we find your references to a negotiating table somewhat confusing, since there doesn't seem to be anything to negotiate about. SCO has yet to show any infringing IP in the Open Source domain, but we wait with bated breath for when you will actually care to inform us about what you are blathering about.
All of our source code is out in the open, and we welcome you point to any particular piece you might disagree with.
Until then, please accept our gratitude for your submission,
Yours truly,
Linus Torvalds
View
SCO smear campaign cant defeat GNU community by Richard Stallman on 2003-09-23 19:46:37 from: ATHENA.MIT.EDU
< t i t l e > SCO smear campaign cant defeat GNU community < / t i t l e >
SCO smear campaign can't defeat GNU community
By Richard Stallman, Tech Update
June 23, 2003 12:08 PM PT
SCO's contract dispute with IBM has been accompanied by a smear campaign against the whole GNU/Linux system. But SCO made an obvious mistake when it erroneously quoted me as saying that "Linux is a copy of Unix." Many readers immediately smelled a rat--not only because I did not say that, and not only because the person who said it was talking about published ideas (which are uncopyrightable) rather than code, but because they know I would never compare Linux with Unix.
Unix is a complete operating system, but Linux is just part of one. SCO is using the popular confusion between Linux and the GNU/Linux system to magnify the fear that it can spread. GNU/Linux is the GNU operating system running with Linux as the kernel. The kernel is the part of the system that allocates the machine's resources to the other programs you run. That part is Linux.
We developed GNU starting in 1984 as a campaign for freedom, whose aim was to eliminate non-free software from our lives. GNU is free software, meaning that users are free to run it, study it and change it (or pay programmers to do this for them), redistribute it (gratis or for a fee), and publish modified versions. (See
http://www.gnu.org/gnu/the-gnu-project.html.)
In 1991, GNU was mostly finished, lacking only a kernel. In 1992, Linus Torvalds made his kernel, Linux, free software. Others combined GNU and Linux to produce the first complete free operating system, GNU/Linux. (See http://www.gnu.org/gnu/gnu-linux-faq.html.)
GNU/Linux is also free software, and SCO made use of this freedom by selling their version of it. Today, GNU runs with various kernels including Linux, the GNU Hurd (our kernel), and the NetBSD kernel. It is basically the same system, whichever kernel you use.
Those who combined Linux with GNU didn't recognize that's what they were doing, and they spoke of the combination as "Linux." The confusion spread; many users and journalists call the whole system "Linux." Since they also properly call the kernel "Linux," the result is even more confusion: when a statement says "Linux," you can only guess what software it refers to. SCO's irresponsible statements are shot through with ambiguous references to "Linux." It is impossible to attribute any coherent meaning to them overall, but they appear to accuse the entire GNU/Linux system of being copied from Unix.
The name GNU stands for "GNU's Not Unix." The whole point of developing the GNU system is that it is not Unix. Unix is and always was non-free software, meaning that it denies its users the freedom to cooperate and to control their computers. To use computers in freedom as a community, we needed a free software operating system. We did not have the money to buy and liberate an existing system, but we did have the skill to write a new one. Writing GNU was a monumental job. We did it for our freedom, and your freedom.
To copy Unix source code would not be ethically wrong, but it is illegal; our work would fail to give users lawful freedom to cooperate if it were not done lawfully. To make sure we would not copy Unix source code or write anything similar, we told GNU contributors not even to look at Unix source code while developing code for GNU. We also suggested design approaches that differ from typical Unix design approaches, to ensure our code would not resemble Unix code. We did our best to avoid ever copying Unix code, despite our basic premise that to prohibit copying of software is morally wrong.
Another SCO tool of obfuscation is the term "intellectual property." This fashionable but foolish term carries an evident bias: that the right way to treat works, ideas, and names is as a kind of property. Less evident is the harm it does by inciting simplistic thinking: it lumps together diverse laws--copyright law, patent law, trademark law and others--which really have little in common. This leads people to suppose those laws are one single issue, the "intellectual property issue," and think about "it"--which means, to think at such a broad abstract level that the specific social issues raised by these various laws are not even visible. Any "opinion about intellectual property" is thus bound to be foolish. (See
http://www.gnu.org/philosophy/words-to-avoid.html.)
In the hands of a propagandist for increased copyright or patent powers, the term is a way to prevent clear thinking. In the hands of someone making threats, the term is a tool for obfuscation: "We claim we can sue you over something, but we won't say what it is."
In an actual lawsuit, such ambiguity would make their case fail, or even prevent it from getting off the ground. If, however, SCO's aim is to shake the tree and see if any money falls down, or simply to spread fear, they may regard vagueness and mystery as advantageous.
I cannot prognosticate about the SCO vs IBM lawsuit itself: I don't know what was in their contract, I don't know what IBM did, and I am not a lawyer. The Free Software Foundation's lawyer, Professor Moglen, believes that SCO gave permission for the community's use of the code that they distributed under the GNU GPL and other
IBM's first 5 MB HDD (RAMAC) with 50 platters (cost $35,000.00)
Seagate's 750 GB HDD with 2 platters (cost $365.00)
