I bought an Asus U56E from Fry’s, which has an Intel i5-2410M CPU. The laptop has been very good, having excellent battery life and good performance. I replaced the internal optical drive with a drive caddy so that I could replace the internal drive with an SSD, but have an additional spinning drive in order to have a larger amount of space. My SSD has built-in encryption, however the spinning drive does not. I use Truecrypt. I wanted the i5 because I was under the mistaken impression that they all supported AES-NI. I later discovered that Intel has issued a microcode update for this CPU which enables the feature, but the BIOS manufacturer needed to enable it in the system BIOS. Asus has now enabled this feature in version 213 of the BIOS. Truecrypt’s benchmark performance has increased 5x since the update.
January 10, 2012
December 4, 2011
Curious Key Corruption
I used the easy-rsa script to generate some new server certs recently, and found that my strongswan install on OpenWRT could not load the RSA key. This despite the fact that the same key works fine in OpenVPN on the same server. The interesting thing is that when I use the build-key-pkcs12 script instead of the build-key-server script, and then use openssl on the router to extract the cert and key, the key works. it is also a different size. The key kept coming up as 1704 bytes when using the server script, but 1669 bytes with the pkcs12 script. Since the pkcs12 script works, I suggest using it always. It generates the key and crt files any way, even though the extracted key file was a different size than the generated one with the same set of files. There must be a bug somewhere.
May 23, 2011
Strongswan 4.5.1 now in the OpenWRT Trunk
My issues with Strongswan in the OpenWRT trunk are now resolved. Strongswan 4.5.1-1 is available.
April 5, 2011
StrongSwan on OpenWRT
I recently purchased a Buffalo WZR-HP-G300NH router and installed OpenWRT on it. I used the trunk version, but found that StrongSwan4 did not allow me to pass traffic, despite an identical configuration to my working Trendnet router. I can successfully connect, but my log files show an error “unable to add SAD entry.” My client indicated no proposal. Though I have not discovered the full nature of the issue, I did notice that the current OpenWRT trunk does not include the kmod-mod-imq module. Since the networking component has changed, I wondered if that might be related. When I installed the 10.03.1-rc4 version of OpenWRT instead, things worked again.
February 22, 2011
November 6, 2010
Noscript And Zimbra Problem
I log into a Zimbra server for email. I may be logged in on the local network, from outside, over the Internet, or across a VPN. The hostname is always the same. I found that I would have to actually quit Firefox in order to log back into Zimbra if I initiated a session over the Internet, and later made a VPN connection. I would see a white screen with a link in the upper left corner which said [Sign Out]. Clicking it did nothing. I actually had to restart Firefox. I discovered that this happened because of Noscript’s ABE protection. I did not wish to disable this, as it is a useful security feature. The solution is to go into the NoScript options, under ABE, and edit the SYSTEM settings. It normally says
# Prevent Internet sites from requesting LAN resources.
Site LOCAL
Accept from LOCAL
Deny
I added this line after the Accept lin:
Accept ALL from *.<mydomainname>
That fixed the issue. It might be advisable for people who use Noscript in a corporate environment with VPN access to add this to their ABE settings in order to prevent web application failures.
October 13, 2010
Sexuality, the State, and the Death of Black Manhood
Recently, my college friends and myself were discussing a recent article in Vibe magazine on the experiences of a flamboyantly gay man at Morehouse College, and the response of the school’s president. I shared the two articles with family and friends, and the inevitable question “what has happened to black men?” came up. It seems clear to me that the main things which have happened are the reasons I despise Lyndon B. Johnson and Ronald Reagan. The war on poverty brought us welfare, which pushed a lot of black men from homes in the name of easy (or easier) money. That was Johnson. Reagan escalated the war on drugs, which further devastated the black family, especially the black males. Can anyone really claim that it is better for a black guy to be locked up for smoking or selling weed, rather than going to a community college and getting himself a job some day? Is controlling what someone does with his own body so very important? Is promoting the creation of drug gangs, then promoting the increase in the intrusiveness and violence of policing something we can really describe as “good?”
Because of these two factors, black men have fewer male role models. Many men emulate their mothers, unsurprising, as so many men are reared without fathers. Some of those mothers are educated, so that is fine as far as education goes. These men will pursue education. But they do not act like men. This is true even of many heterosexual men. Among any sufficiently large population, a number of gay people is to be expected. I do not find it surprising that a segment of the gay population would take emulating their mothers to an extreme that the straight men would not.
I predicted years ago that black higher education would become increasingly gay, and specifically, effeminately so. The war on drugs has devastated the ranks of black men in black communities to such an extent that female role models are, all too often, the best role models for success that black boys have. The testosterone has been depleted from the segments of black society most in need of it. This is one of the many tragedies brought to neighborhoods across the nation by the desire to force moral choices on others “for their own good.” And, while I targeted those two presidents for specific criticism, we can hardly “blame whitey” for this one. There are lots of people who are black drug warriors. Pretty much every black politician, including Obama, is a drug warrior. Eric Holder, his pick for Attorney General, is an especially fervent drug warrior. As far as I am concerned, we should treat blacks who support the war on drugs the same as we would treat a black guy doing a minstrel show in full blackface at an NAACP meeting. They deserve nothing but derision for being essentially black slave overseers. They profit from promoting oppression.
(Crossposted at The Libertarian Standard)
October 12, 2010
Twitter’s Pro-Freedom Terms of Service
Over at the online photography magazine, Photofocus, Scott Bourne warns photographers of the terms of service they may unwittingly agree to by posting a picture on Twitter. From the article:
Ask a real lawyer (not some guy named Larry who plays one on your local camera club forum) what this means. I did. My lawyer says it means that Twitter can do pretty much anything it wants with my photos (other than claim actual Copyright to them) and there’s nothing I can do about that. Is that an issue for you personally? Maybe not. It’s unlikely it will impact you if you aren’t trying to sell your photos. But if you are, read on.
As a professional photographer, I can’t sell “exclusive” rights to any image I decide to publish on Twitter. The reason is that once it is published on Twitter, there is no exclusivity left. That could be expensive. As professionals, we need to decide whether the exposure we get via Twitter is worth that trade off. For some of us the answer is yes – for others the answer is no. The purpose of this post is to get you to understand that you will have to make some hard choices. I am hoping they are informed choices, no matter what you decide.
In the case of the Twitter TOS, it seems that the terms Twitter stipulates are exactly the pro-freedom position: you can do whatever you want with the stuff you own (stuff, not ideas) unless you have contracted some other arrangement. Twitter owns the servers. You own the photo, sure, but you still have the photo after you uploaded it. What the uploader is actually doing is using Twitter’s stuff to create a copy on Twitter’s servers. For the photographer to then claim that he has the right to determine what Twitter does with it is like going to someone’s house and using a dollar bill left on a counter to make origami, then demanding the right to determine what happens to it as a result of your pattern rearrangement. It is nonsense from the start.
July 19, 2010
Automounting Truecrypt in Linux
I have a dual boot system with Windows 7 and Ubuntu 10.04. In order to secure the system, I have system encryption with Truecrypt and encrypted LVM in Ubuntu. I need to access my Windows files from within Ubuntu. After a bit of searching around the Internet, I pieced together this command line, which I put in /etc/rc.local. Since my system is fully encrypted and used by only me, I’m not concerned about the password being in /etc/rc.local. I installed the Truecrypt console version.
I added the following line to /etc/rc.local:
echo “MyTruecryptPassPhrase” | /usr/local/bin/truecrypt -t -m system -k “” -p ”” –protect-hidden=no –fs-options=rw,noatime,umask=000 –filesystem=ntfs-3g /dev/<windows partition> /<local mount point>
By echoing the passphrase and piping it to the Truecrypt command, we avoid having it show up in the ‘ps -ef’ command. The filesystem will be mounted with 0777 permissions.
I have found that it is even possible to mount outer partitions (with hidden partitions inside) using this method, and protecting the hidden partition. The command is as follows:
echo “HiddenPartitionPassphrase\n\nOuterPartitionPassphrase” | /usr/bin/truecrypt -t -k “” -p “” –protect-hidden=yes –fs-options=rw,noatime,umask=000 /dev/sda2 /windows
By using the hidden OS feature in Truecrypt, it is possible to triple boot your computer, with all data on the drive except for the /boot partition in Linux being encrypted. Since no secret information is stored in /boot, this is not a problem.
April 22, 2010
Ubuntu thumb drive
I recently installed Ubuntu 10.04 beta 2 (Lucid Lynx) on an Imation 4GB thumb drive. Ubuntu has a feature to install the live CD onto a thumb drive, but I have always found that solution a bit unsatisfying. I wanted an installation which could be updated and modified as I see fit. So, I wanted to use the thumb drive like a hard drive. Most of what I do allows me to forgo persistent local storage, but I did want that option, so I encrypted my home directory, which is an install option. One of the potential problems with that plan is the fact that flash storage, especially cheap flash storage, like the kind in a thumb drive, has a limited number of writes before it fails.
installing Ubuntu onto a thumb drive, using it like a hard drive, is simple. Just run the normal install, clicking on the “Advanced” tab on the screen prior to the beginning of the actual install. The subsequent screen allows you to choose the location for the boot sector. Simply change the boot sector to the thumb device, and you are done there. For further details, go here.
After the install, you can update your Ubuntu install as normal. Now, the next step is to do things which will extend the life of your thumb drive. Obviously, you do not want to have a swap file. I formatted the swap partition which Ubuntu automatically created and mounted that partition as /home. I also made use of tmpfs to mount some of the more heavily written areas in RAM, discarding them on each reboot. Here is what I did in /etc/fstab:
tmpfs /var/tmp tmpfs noatime,rw,mode=1777 0 0
tmpfs /tmp tmpfs noatime,rw,mode=1777 0 0
tmpfs /var/cache/apt tmpfs noatime,rw 0 0
tmpfs /var/log tmpfs noatime,rw 0 0
Additionally, I added this to /etc/rc.local:
mkdir -p /var/cache/apt/archives/partial
mkdir /var/log/apt
This means that the heavily written stuff, like logs, and the update cache for software, are written to RAM and discarded. The /etc/rc.local line is needed because apt-get requires both the archives and archives/partial directories to function correctly.
Once I had the system up and running, I found Firefox performance to be bad. Using the ever-trusty lsof, I found that Firefox uses multiple sqlite databases to hold stuff like preferences. The solution I decided on was to move my home directory onto a ramdisk. Since I had a small /home partition, I added the following things to my /etc/fstab:
UUID=f39t7wj8-v872-4dc9-ik47-nve73hv923nbsw1 /home2 ext4 rw,noatime 0 2
tmpfs /home tmpfs noatime,rw 0 0
Your uuid will differ, but the idea is to mount your original /home partition on /home2 instead, and mount /home as a ramdisk. I also added the following to /etc/rc.local:
rsync -a /home2/ /home/
This syncs the contents of /home2 (which is on the flash) with /home (which is in ram, and discarded at every boot). If I make an important change to my home directory, I log out of my GUI session, open another virtual terminal (by pressing ctrl-alt-F1), log in as root (you will need to set your root password to allow this), and run:
rsync -a /home/ /home2/
This will sync the changes you made back to the flash card. You should only rarely have to do this. One useful way to save files is to use the free Ubuntu One service which is included with Lucid. That makes it easy to save small files and sync them to the cloud, which ends the worry associated with having your home directory in RAM. Save any files you want to the Ubuntu One directory, and they will be saved offsite.
If you have any issues with doing any of this, feel free to contact me at robwicks@gmail.com. Also, I would greatly appreciate corrections and suggestions. I may experiment with AUFS in the future. That may be a good alternative to tmpfs alone on some of the filesystems.
