Honeypot.net

The Omaha World-Herald published a story about a Lincoln public high school who wrote “Remember the Reason for the Season” on their electronic bulletin board in front of the building. The ACLU contacted the school’s principal to request that the message be removed, and the school complied.

I can understand why some parents might not want that sign above the school. While I don’t personally have a problem with it, I’d feel uncomfortable if my kids’ school ran a similar sign that appeared to endorse Islam, Hinduism, or other religions. And as it turns out, the high school in question does have Jewish and Muslim students whose parents probably weren’t thrilled with the message.

Buried in the article, though, was an interesting nugget:

The ACLU was alerted to the sign by a World-Herald reporter who called to ask if anybody had complained about it. The marquee is along a well-traveled city street near the school.

Although many travelers had seen the sign in their daily commute, there were no complaints or any other evidence of offense until OWH’s own reporter triggered the investigation and created the story. I think the school did the right thing in not choosing one religion over another, but I think the newspaper was completely wrong to spark a controversy where none apparently existed.

I was reading a story about a hacked password database and saw this comment where the poster wanted to make a little program to generate non-random passwords for every site he visits:

I was thinking of something simpler such as “echo MyPassword69! slashdot.org|md5sum” and then “aaa53a64cbb02f01d79e6aa05f0027ba” using that as my password since many sites will take 32-character long passwords or they will truncate for you. More generalized than PasswordMaker and easier to access but no alpha-num+symbol translation and only (32) 0-9af characters but that should be random enough, or you can do sha1sum instead for a little longer hash string.

I posted a reply but I wanted to repeat it here for the sake of my friends who don’t read Slashdot. If you’ve ever cooked up your own scheme for coming up with passwords or if you’ve used the PasswordMaker system (or ones like it), you need to read this:

DO NOT DO THIS. I don’t mean this disrespectfully, but you don’t know what you’re doing. That’s OK! People not named Bruce generally suck at secure algorithms. Crypto is hard and has unexpected implications until you’re much more knowledgeable on the subject than you (or I) currently are. For example, suppose that hypothetical site helpfully truncates your password to 8 chars. By storing only 8 hex digits, you’ve reduced your password’s keyspace to just 32 bits. If you used an algorithm with base64 encoding instead, you’d get the same complexity in only 5.3 chars.

Despite what you claim, you’re really much better off using a secure storage app that creates truly random passwords for you and stores them in a securely encrypted file. In another post here I mention that I use 1Password, but really any reputable app will get you the same protections. Your algorithm is a “security by obscurity” system; if someone knows your algorithm, gaining your master password gives them full access to every account you have. Contrast with a password locker where you can change your master password before the attacker gets access to the secret store (which they may never be able to do if you’ve kept it secure!), and in the worst case scenario provides you with a list of accounts you need to change.

I haven’t used PasswordMaker but I’d apply the same criticisms to them. If an attacker knows that you use PasswordMaker, they can narrow down the search space based on the very few things you can vary:

• URL (the attacker will have this)
• character set (dropdown gives you 6 choices)
• which of nine hash algorithms was used (actually 13 — the FAQ is outdated)
• modifier (algorithmically, part of your password)
• username (attacker will have this or can likely guess it easily)
• password length (let’s say, likely to be between 8 and 20 chars, so 13 options)
• password prefix (stupid idea that reduces your password’s complexity)
• password suffix (stupid idea that reduces your password’s complexity)
• which of nine l33t-speak levels was used
• when l33t-speak was applied (total of 28 options: 9 levels each at three different “Use l33t” times, plus “not at all”)

My comments about the modifier being part of your password? Basically you’re concatenating those strings together to create a longer password in some manner. There’s not really a difference, and that’s assuming you actually use the modifier.

So, back to our attack scenario where a hacker has your master password, username, and a URL they want to visit: disregarding the prefix and suffix options, they have 6 * 13 * 13 * 28 = 28,392 possible output passwords to test. That should keep them busy for at least a minute or two. And once they’ve guessed your combination, they can probably use the same settings on every other website you visit. Oh, and when you’ve found out that your password is compromised? Hope you remember every website you’ve ever used PasswordMaker on!

Finally, if you’ve ever used the online version of PasswordMaker, even once, then you have to assume that your password is compromised. If their site has ever been compromised — and it’s hosted on a content delivery network with a lot of other websites — the attacker could easily have placed a script on the page to submit everything you type into the password generation form to a server in a distant country. Security demands that you have to assume this has happened.

Seriously, please don’t do this stuff. I’d much rather see you using pwgen to create truly random passwords and then using something like GnuPG to store them all in a strongly-encrypted file.

The summary version is this: use a password manager like 1Password to use a different hard-to-guess password on every website you visit. Don’t use some invented system to come up with passwords on your own because there’s a very poor chance that we mere mortals will get it right.

This is the letter I just sent to my representative, urging him to vote against Hollywood’s E-PARASITE Act:

Congressman Fortenberry, please vote against the appropriately-named “E-PARASITE Act” being proposed by Rep. Smith, TX. It’s the counterpart of Senate Bill S.968, the “PROTECT IP Act”.

This flawed legislation seeks to criminalize civil offenses and reverse our Constitutional presumption of innocence for the benefit of a tiny — but very vocal — coalition of Hollywood special interest groups. The Internet has brought untold billions of dollars to our economy and democracy to distant shores. Let’s not discard these advances for the benefit of a few CEOs who haven’t figured out how to do business in the new economy. Given technology legislation that’s supported by the AFL-CIO and opposed by Google, I’ll side with Google every time.

Please stop these parasites from destroying the Internet we built just so they can make a few more dollars before their obsolete business plans finish them off.

Thank you for your time,
Kirk Strauser
Norfolk, NE

Please let your own representatives know that we don’t want this terrible legislation.

I needed to run a BIOS flash utility that was only available for DOS. To complicate matters, the server I needed to run it on doesn’t have a floppy or CD-ROM drive. I figured I’d hop on the Internet and download a bootable USB flash drive image. Right? Wrong.

I found a lot of instructions for how to make such an image if you already have a running Windows or Linux desktop, but they weren’t very helpful for me and my Mac. After some trial and error, I managed to create my own homemade bootable USB flash drive image. It’s available at http://www.mediafire.com/?aoa8u1k1fedf4yq" if you just want a premade ready-to-download file.

If you want a custom version, or you don’t trust the one I’ve made — and who’d blame you? I’m some random stranger on the Internet! — here’s how you can make your own bootable image under OS X:

Relax!

There are a lot of steps, but they’re easy! I wanted to err on the side of being more detailed than necessary, rather than skipping “obvious” steps that might not be quite so easy for people who haven’t done this before.

Download VirtualBox and install it

1. Download VirtualBox. I used version 4.1.4. The version available to you today might look different but should work mostly the same way.
2. Open the “VirtualBox-[some-long-number]-OSX.dmg” disk image.
3. Double-click the “VirtualBox.mpkg” icon to run the installer.
4. Click “Continue”.
5. Click “Continue”.
6. Click “Install”.
7. Enter your password and click “Install Software”.
8. When it’s finished copying files, etc., click “Close”.

Download FreeDOS and create a virtual machine for it

1. Download the FreeDOS “Base CD” called “fdbasecd.iso”. Note: the first mirror I tried to download from didn’t work. If that happens, look around on the other mirrors until you find one that does.
2. Open your “Applications” folder and run the “VirtualBox” program.
3. Click the “New” button to create a new virtual machine. This launches the “New Virtual Machine Wizard”. Click “Continue” to get past the introduction.
4. Name your new VM something reasonable. I used “FreeDOS”, and whatever name you enter here will appear throughout all the following steps so you probably should, too.
5. Set your “Operating System” to “Other”, and “Version” to “DOS”. (If you typed “FreeDOS” in the last step, this will already be done for you.) Continue.
6. Leave the “Base Memory Size” slider at 32MB and continue.
7. Make sure “Start-up Disk” is selected, choose “Create new hard disk”, and continue.
8. Select “File type” of “VDI (VirtualBox Disk Image)” and continue.
9. Select “Dynamically allocated” and continue.
10. Keep the default “Location” of “FreeDOS”.
11. Decision time: how big do you want to make your image? The full install of FreeDOS will take about 7MB, and you’ll want to leave a little room for your own files. On the other hand, the larger you make this image, the longer it’ll take to copy onto your USB flash drive. You certainly don’t want to make it so large that it won’t actually fit on your USB flash drive. An 8GB nearly-entirely-empty image will be worthless if you only have a 2GB drive. I splurged a little and made my image 32MB (by clicking in the “Size” textbox and typing “32MB”. I hate size sliders.). Click “Continue”.
12. Click “Create”.
13. Make sure your new “FreeDOS” virtual machine is highlighted on the left side of the VirtualBox window.
14. On the right-hand side, look for the section labeled “Storage” and click on the word “Storage” in that title bar.
15. Click the word “Empty” next to the CD-ROM icon.
16. Under “Attributes”, click the CD-ROM icon to open a file chooser, select “Choose a virtual CD/DVD disk file…”, and select the FreeDOS Base CD image you downloaded at the beginning. It’ll probably be in your “Downloads” folder. When you’ve selected it, click “Open”.
17. Back on the “FreeDOS — Storage” window, click “OK”.

Install FreeDOS

1. Back on the main VirtualBox window, near the top, click “Start” to launch the virtual machine you just made.
2. A note about VirtualBox: when you click the VM window or start typing, VirtualBox will “capture” your mouse cursor and keyboard so that all key presses will go straight to the VM and not your OS X desktop. To get them back, press the left [command] key on your keyboard.
3. At the FreeDOS boot screen, press “1” and [return] to boot from the CD-ROM image.
4. Hit [return] to “Install to harddisk”.
5. Hit [return] to select English, or the up and down keyboard arrow keys to choose another language and then [return].
6. Hit [return] to “Prepare the harddisk”.
7. Hit [return] in the “XFDisk Options” window.
8. Hit [return] to open the “Options” menu. “New Partition” will be selected. Hit [return] again. “Primary Partition” will be selected. Again, [return]. The maximum drive size should appear in the “Partition Size” box. If not, change that value to the largest number it will allow. Hit [return].
9. Do you want to initialize the Partition Area? Yes. Hit [return].
10. Do you want to initialize the whole Partition Area? Oh, sure. Press the left arrow key to select “YES”, then hit [return].
11. Hit [return] to open the “Options” menu again. Use the arrow keys to scroll down to “Install Bootmanager” and hit [return].
12. Press [F3] to leave XFDisk.
13. Do you want to write the Partition Table? Yep. Press the left arrow to select “YES” and hit [return]. A “Writing Changes” window will open and a progress bar will scroll across to 100%.
14. Hit [return] to reboot the virtual machine.
15. This doesn’t actually seem to reboot the virtual machine. That’s OK. Press the left [command] key to give the mouse and keyboard back to OS X, then click the red “close window” button on the “FreeDOS [running]” window to shut it down. Choose “Power off the machine” and click “OK”.
16. Back at the main VirtualBox window, click “Start” to re-launch the VM.
17. Press “1” and [return] to “Continue to boot FreeDOS from CD-ROM”, just like you did before.
18. Press [return] to select “Install to harddisk” again. This will take you to a different part of the installation process this time.
19. Select your language and hit [return].
20. Make sure “Yes” is selected, and hit [return] to let FreeDOS format your virtual disk image.
21. Proceed with format? Type “YES” and hit [return]. The format process will probably finish too quickly for you to actually watch it.
22. Now you should be at the “FreeDOS 1.0 Final Distribution” screen with “Continue with FreeDOS installation” already selected. Hit [return] to start the installer.
23. Make sure “1) Start installation of FreeDOS 1.0 Final” is selected and hit [return].
24. You’ll see the GNU General Public License, version 2 text. Follow that link and read it sometime; it’s pretty brilliant. Hit [return] to accept it.
25. Ready to install the FreeDOS software? You bet. Hit [return].
26. Hit [return] to accep the default installation location.
27. “YES”, the above directories are correct. Hit [return].
28. Hit [return] again to accept the selection of programs to install.
29. Proceed with installation? Yes. Hit [return].
30. Watch in amazement and how quickly the OS is copied over to your virtual disk image. Hit [return] to continue when it’s done.
31. The VM will reboot. At the boot screen, press “h” and [return] to boot your new disk image. In a few seconds, you’ll see an old familiar “C:" prompt.
32. Press the left [command] key to release your keyboard and mouse again, then click the red “close window” icon to shut down the VM. Make sure “Power off the machine” is selected and click “OK”.

Convert the VirtualBox disk image into a “raw” image

1. Open a Terminal.app window by clicking the Finder icon in your dock, then “Applications”, then opening the “Utilies” folder, then double-clicking “Terminal”.
2. Copy this command, paste it into the terminal window, then hit [return]:

/Applications/VirtualBox.app/Contents/Resources/VirtualBoxVM.app/Contents/MacOS/VBoxManage internalcommands converttoraw ~/"VirtualBox VMs/FreeDOS/FreeDOS.vdi" ~/Desktop/freedos.img

This will turn your VirtualBox disk image file into a “raw” image file on your desktop named “freedos.img”. It won’t alter your original disk image in any way, so if you accidentally delete or badly damage your “raw” image, you can re-run this command to get a fresh, new one.

Prepare your USB flash drive

1. Plug your USB flash drive into your Mac.
2. If your Mac can’t the drive, a new dialog window will open saying “The disk you inserted was not readable by this computer.” Follow these instructions:
   1. Click “Ignore”.
   2. Go back into your terminal window and run this command: diskutil list
   3. You’ll see a list of disk devices (like “/dev/disk2”), their contents, and their sizes. Look for the one you think is your USB flash drive. Run this command to make sure, after replacing “/dev/disk2” with the actual name of the device you picked in the last step: diskutil info /dev/disk2
3. Make sure the “Device / Media Name:” and “Total Size:” fields look right. If not, look at the output of diskutil list again to pick another likely candidate and repeat the step until you’re sure you’ve picked the correct drive to complete eradicate, erase, destroy, and otherwise render completely 100% unrecoverable. OS X will attempt to prevent you from overwriting the contents of drives that are currently in use — like, say, your main system disk — but don’t chance it. Remember the name of this drive!
4. If your Mac did read the drive, it will have automatically mounted it and you’ll see its desktop icon. Follow these instructions:
   1. Go back into your terminal window and run this command: diskutil list
   2. Look for the drive name in the output of that command. It will have the same name as the desktop icon.
   3. Look for the name of the disk device (like “/dev/disk2”) for that drive and remember it (with the same warnings as in the section above that you got to skip).
   4. Unmount the drive by running this command: diskutil unmount "/Volumes/[whatever the desktop icon is called]"
   5. This is not the same as dragging the drive into the trash, so don’t attempt to eject it that way.

Copy your drive image onto the USB flash drive

1. Go back to your terminal window.
2. Run these commands, but substitute “/dev/fakediskname” with the device name you discovered on the previous section: cd ~/Desktop; sudo dd if=freedos.img of=/dev/fakediskname bs=1m
3. After the last command finishes, OS X will automatically mount your USB flash drive and you’ll see a new “FREEDOS” drive icon on your desktop.

Add your own apps to the image

1. Drag your BIOS flasher utility, game, or other program onto the “FREEDOS” icon to copy it onto the USB flash drive.
2. When finished, drag the “FREEDOS” drive icon onto the trashcan to unmount it.

Done.

1. You’re finished. Use your USB flash drive to update your computer’s BIOS, play old DOS games, or do whatever else you had in mind.
2. Keep the “freedos.img” file around. If you ever need it again, start over from the “Prepare your USB flash drive” section which is entirely self-contained. That is, it doesn’t require any software that doesn’t come pre-installed on a Mac, so even if you’ve uninstalled VirtualBox you can still re-use your handy drive image.

I read a nice newspaper story a while ago about Abe’s Detailing in Norfolk, NE. When I wanted to have Jen’s minivan detailed as a present, I thought I’d give Abe’s a try and made an appointment for the $45.99 “express detail”. When we picked it up later, the van looked nice, but they wanted to charge us for the $159.99 “presidential detail” that they performed instead.

I told the employee that I’d ordered the cheaper package. He said I must have talked to his brother and that his brother wrote it down wrong, and still wanted me to pay the full price for the wrong job.

I will never darken the doorsteps of Abe’s Detailing in Norfolk again. If you choose to do so, I highly recommend you get a written estimate in advance.

It snowed!I went outside today and played! bet I would have stayed out there if it had snowed more and if my feet didn’t freeze, I would have stayed there longer!

I was at grandma’s house last weekend, and there was a power outage.Turns out, it was a squirrel chewing on the power lines, and got electrocuted.We found out when my Uncle Brian came in saying,“There’s a dead squirrel that was chewing on the power lines.“When I heard that I fell on the floor laughing!That squirrel is nuts!Or at least was nuts…

While waiting for Jen to return from a conference, I thought about calling her to get her estimated time of arrival, or her ETA. I realized she might be might be pretty far away still and thought I better ask for an estimate of the accuracy of the estimate, or meta-estimate: her META. Hey, neat! META can be a recursive acronym for “meta-ETA”, so it also references the nature of the acronym itself, sort of making META a meta-acronym, which truly makes it both meta and META.

Grandma and Grandpa got here yesterday!My camera is working again to!I took a picture of a mirror,and when I saw the picture I saw me and my camera flashing!Anyways,I am very exited!They’re staying 2 weeks!

As of mid-August, I can’t watch the local ABC affiliate TV channel over my satellite dish because they tried to jack up the rates they charge Dish Network for carrying their channel. Never mind that their advertisers pay them by the number of viewers, regardless of whether that’s by antenna, cable, or satellite. Dish Network could almost get away with asking KCAU to pay them for the task of handling all the transmission details. Anyway, here’s a letter I wrote to KCAU’s president:

As you mentioned on your website, I could watch your programming over-the-air for free. While your position regarding Dish Network makes sense on the surface, it falls apart quickly. They are redistributing your signal at no cost to you while you still collect money from advertisers. Frankly, they’re doing you a favor by handling your broadcasting. Imagine that you could still get the same advertising revenue without having to pay for transmitters and the associated electricity and personnel. Nice, huh?

Since you’re not directly paid by viewers regardless of whether they watch by rabbit ears or by satellite dish, you can hardly claim to be losing money with the latter. In the mean time, your viewership is lower by the number who can no longer receive your signal (and you’re crazy if you think I’d downgrade from a crystal-clear satellite signal and DVR to a snowy analog antenna). The other local network affiliates must be rubbing their hands together with glee as you throw away your audience.

Finally, consider that a five-minute Internet search returns downloadable versions of current programming. While I personally don’t (yet) consider that a viable option to local programming, as of today that would be the easiest course for a lot of your viewers who have been cut off.

Please allow Dish Network to resume broadcasting your signals at no charge to you so that I can go back to watching “Lost”. Thank you.

Sincerely, Kirk Strauser

I have no particular feelings for either company, but Dish Network’s position in this one case seems by far the most reasonable of the two.