Retroactive change?

One more reason to be extremely careful about what you do or say on the Internet, especially if you think you're hidden behind "anonymous": retroactive changes to privacy policies. MS surely isn't winning points this week, what with this policy change and announcing the per-hour Office subscription.

Grandstream GXP-200 BLF

I've added notes to the wiki for configuring the Busy Lamp Field (BLF) on the GXP-2000 so that it can "watch" phones via Asterisk.

More phones than I know what to do with...

There was definitely a VoIP theme this year for presents. I rec'd:

• 2 two-line phones
• 2 four-line phones
• a Phillips DECT 6.0 cordless with two handsets
• and a Linksys SPA-3102

I can now return the borrowed VoIP phone as I now have enough to experiment with whatever configuration (except for video calls).

Weather update

The original script for the weather wake-up calls was based on Swift. I've added the lines for Festival (see the wiki). Please note that the Swift-based output sounds much, much better than the Festival-based output. In either case, tweaking the speech parameters will improve the output.

Wake-up weather

The good news is that I've added my notes for generating wake-up calls with weather forecasts to the wiki. The bad news is that I managed to "lose" the web interface for it. I'll remedy this shortly.

Lesson learned: scheduled backups are fine when little happens in between. If you code heavily, backups should occur more often!

VoIPSupply

Well, VoIPSupply lost a $200 sale today. Between their checkout cart (web) being broken and their offices being closed (what retailer closes on the weekend before Christmas?!), I went elsewhere for my purchase. Don't think I'll ever use them again either.

On a related note: Sparks! Phones for your Greenville trip won't be an issue.

Liquidsoap daemon script

Savonet/LiquidSoap tends to be Ubuntu-specific (for now). Building it on other systems requires a bit of work. I've put a Fedora 10 startup script for LiquidSoap in the wiki.

Starbucks++

Amazing! Starbucks actually honored a gift card that I'd won in a drawing five years back, had subsequently misplaced, and discovered while moving my desk this past week. Let's see, after today, I still have 3 free Venti's coming to me... (heh)

Liq + Icecast error

(Mostly for my own records) If you receive the following error, try explicitly declaring the username on both ends (Icecast and the Liquidsoap script).

2008/12/06 09:50:33 [threads:1] thread "root" aborts with exception Shout.No_connect !
2008/12/06 09:50:33 [main:3] Shutdown started!
2008/12/06 09:50:33 [threads:3] thread "non-blocking queue #1" exited (1 remaining)
Thread 4 killed on uncaught exception Shout.No_connect

Adding res_mysql to F10 Asterisk

The Fedora 10 pre-packaged 64-bit version of Asterisk comes without res_mysql. To add it, you'll need to download asterisk-addons from the Asterisk web site and compile it yourself. One issue though: if you accept the default install paths, you're going to need to copy res_config_mysql.so from /usr/lib/asterisk/modules to /usr/lib64/asterisk/modules. Regular configuration requirements should work after that, including realtime meetme (which I'm working with now).

F10 Asterisk bug fix

If you've got the initial version of F10 and you've installed Asterisk from packages, you're probably noticing that Asterisk isn't working properly. It's caused by a bug in the startup script. $AST_CONFIG is defined in line 27 and redefined using itself in line 88

  27 AST_CONFIG=/etc/asterisk/asterisk.conf
  88 ASTARGS="$ASTARGS -C $AST_CONFIG/asterisk.conf"

The fix is to drop the "/asterisk.conf" from the end of line 88.

Fedora 10

If you didn't pick up from the previous post that I'm installing Fedora 10, I am. Not to jinx the install but, except for the video driver issue, it appears to be going smoothly. There's even a 64-bit version of IMAP voicemail storage for Asterisk (that is usually a real head-banger to get compiled and installed properly). MythTV also installed cleanly, though I need to get it configured. The good news is that I think the package is from the guy that wrote the "Hacking MythTV" book.

In any case, it appears to be going much smoother than previous Fedora installs. Sparks is doing a similar install across town. He has voiced similar opinions.

Fedora 10 and NVidia cards

If you're trying to install Fedora 10 on an HP box, you're probably having issues with not being able to see the cursor. While the repair is to add 'Option "HWCursor" "off"' to the [Monitor] section of xorg.conf, you're also probably noticing that xorg.conf doesn't exist.

The problem is that F10 has a chicken/egg issue involving installation. You need the NVidia driver to get the xorg.conf you need to modify to see the cursor and you need the cursor so that you can click on the link on the NVidia website.

The bad news is that you'll have to guess where the cursor is, on the screen, a number of times. The good news is that it isn't that difficult. I had mine working after about 5 minutes of frustration.

Improved Conference Manager

I'm working "wikifying" the notes for the improved conference call manager. The work in progress can be viewed here. The current feature set includes:

• Volume controls for talking and/or listening for individual callers
• Volume controls for talking and/or listening for the entire conference
• Hangup a specific caller
• Kick (hangup with message) a specific caller
• Mute/unmute a specific caller
• Mute/unmute all callers in conference
• Lock a conference (block anyone else from joining the call)
• Unlock a conference
• Record/stop recording the call
• Make a call from the conference room
• Create/edit/delete conference rooms on the fly

As it's a bit detailed and lengthy, it's going to take a few days to get it entered. Please bare with me.

When worlds collide

My project list for the weekend:

• generate wiki pages to show off the conference room manager
• solder together a serial-to-IR interface for MythTV and document it

My wife's project list:

• clean the entire house, top to bottom (company coming)

I wonder how much this will conflict with... What's that? Yes, dear...

Yawn!

Norfolk to Detroit to St. Louis to O'Fallon to St. Louis to O'Fallon to St. Louis to Chicago to Norfolk in 67 hours is exhausting. Fattening too, but that's a different story.

Back online

The system upgrades took much, much longer than expected. If no one else has commented on it, it appears that MP3 functionality has disappeared from just about all of the leading Linux distributions. Avoiding the reasons why this is happening, it creates a number of issues which must be worked around.

One loss is the ability to use LiquidSoap as a source for hold music in Asterisk (even though the capbility can be recovered, it doesn't yet "fit well" with Icecast or Asterisk inputs).

At first, I attempted to use 64-bit Linux, with the objective of using LiquidSoap for a number of features. I had so much difficulty in getting Liq to work that I abandoned the 64-bit effort. Little did I know that it wouldn't work in 32-bit either.

To make a long story short, time constraints have left me with a 32-bit box with a borked Liq (only plays OGGs) and a number of work-arounds to get a few functions (Asterisk, MythTV, etc.) working. I've even resorted to using SqueezeCenter as a hold music source in Asterisk. It's overkill, using way too many processing cycles to provide a single function, but it works.

Temp offline

I'll be offline for at least part of the weekend, updating OSs on a couple boxes (translation: recompiling a number of kernel modules and fighting packaged installs). Hopefully won't be for more than a day or so.

AOL

You've gotta love AOL. Ten plus years after the first infected email with a spoofed source address and their virus scanner still sends complaints back to the spoofed address (in this case: me!!), with instructions to contact my email administrator (again: me!).

If 1 in 200 messages is infected, I'd guess that 1 in 400 is a return message (I receive a lot of these). Although the mail was sent with good intentions, it demonstrates a lack of understanding of infection vectors and is basically a waste of resources. For AOL, the message size was 4K. Because it was an error message, it was sent to my account and root on my mail server, so I get to delete this twice. This also ate up 8K of bandwidth. For me, it's not that bad. For AOL, it has to be monstrous (i.e., they're wasting their own money).

If your anti-virus utility scans inbound email for viruses, please TURN OFF your auto-response feature. It actually compounds a number of problems (bandwidth, storage) rather than prompting the owner of an infected machine to fix his junk.

Scary item for the holidays

I've added notes for counting matches in multiple columns in Excel to the wiki.

There, that should scare the beans out of some of you (me, offering up a workable MS tip). Happy Halloween!

Wut?!

On Friday, I realized that hearing "Sweet Patootie" sung in a thick Southern accent, by a Larry the Cable Guy clone, is actually quite scary. I'm not so sure that I'm going back to that store...

Copying between wikis

Notes for copying pages between different version (or not) MediaWikis are in the wiki.

Solaris drive cloning

Notes for cloning hard drives on Solaris are in the wiki.

Numeric sort

Notes for sorting by numeric values in MySQL are in the wiki.

Busy

Offline (more or less) for a bit. Doing some heavy lifting on coding for a friend.

Myth and MVP

I think that I now have my MythTV/MVP configuration tweaked to the point where I can ditch the SageTV server. While SageTV still does have a couple bells and whistles that are nice-to-haves, I feel that SageTV has let their Linux side drop behind just a bit. Yes, they do have an HD interface, but I don't have a HD television yet. I may return to them at a later date.

The SageTV server hasn't been able to adjust recording times for those channels that start a minute earlier than expected. Yes, I know that this is more of a function of their scheduling service. The television schedule was part of the commercial package that I bought. It is much, much more inaccurate than the scheduling service (which I also paid much less for) for MythTV.

SageTV also loses to MythTV in the comparison of web interfaces for scheduling recordings of favorite shows. SageTV really doesn't have a "Favorites" feature unless you're willing to edit menu_items.js and then manually pick your shows. MythTV tracks your favorites, can automatically deconflict same-time recordings, and requires much fewer clicks to work around issues (if you need/want to take care of them manually).

SageTV has an interface to Squeezebox that will only play locally on the server. MythTV's interface (Slimp3) actually plays remotely, through the MVP box.

For remote access, you still need a client program for SageTV. For MythTV, the standard media players (Windows or Linux) will work via the web interface.

The extra features that SageTV does have (the ability to play directly off of GoogleVideo or YouTube, a handful of useful plugins, etc.), I can live without.

MythTV's shortcomings are minor. It isn't as hackable as SageTV (yes, the commercial product was easier to work with) and the community is a bit more friendly (I got a lot of abuse from the Myth developers for attempting to code something different from _their_ way. They actually were a bit proprietary about the code (they were angry that I was rewriting their code to do something they deemed useless)). You'd think that it'd be the other way around.

I stuck with SageTV for a very long time (through 2 versions), well past the point where MythTV was a better choice for me. I think this was caused by the manual configuration requirements needed for MythTV. (I could just never find the time to play with it.)

In any case, for those of you in the VPN (mostly those living in the house), the Sage interface is being taken down. The old rules of use for Sage now apply to Myth. For everybody else, notes in the wiki have been updated here and here.

Fixing sound files generated with Cepstral

If you generate a bunch of files with Cepstral, using default settings, you're probably going to be suprised when Asterisk doesn't play them. Even worse, sox will likely fail to recognize the file and refuse to transcode it.

The problem is that Asterisk is expecting an 8 kHz wav while Cepstral generates 16 kHz wavs (for most of its voices). You're faced with regenerating the files or transcoding them. Depending on the number of files, one method or the other will be preferable. I've put both methods in the wiki.

Cepstral and app_swift

Rec'd Cepstral for my birthday. Picked up the Allison, Damien, Shouty and Whispery voices. Had a bit of fun getting it to work. Works nicely though embedding SSML in the text is a bit wonky (i.e., some punctuation requires de-referencing). Notes are in the wiki.

ShmooCon 2009

With little or no fanfare (or I've been working way too hard to notice), ShmooCon 2009 has been scheduled for 6-8 Feb 2009. If things go as they have in the past, expect tickets to go on sale early in November.

Fat fingers

The more you work with *nix, the more you'll realize that it's the little things that will trip you up. Case in point: I tried installing OpenMeetings on my home system and continously get the "NetConnection.Call.Failed rtmpt://localhost:8088/openmeetings/hibernate" error. Hours of troubleshooting later, it turns out that I called the config file "hibernate.xml" vice the proper "hibernate.cfg.xml".

I've updated the wiki notes to show the proper method.

Tiddly Gushy

Got a thumb drive full of valuable stuff but can never find anything on it because you can never remember what the filenames mean? Have multiple work machines that you just wish would have a common address book? Ever wish you could run a private wiki at work but you're not allowed? Ever hear of TiddlyWiki?

A coworker showed me TW a couple days ago and I haven't put it down since. It's a tool that I've been needing for a very long time now.

For those that don't know, it's a wiki written in JavaScript, meant to run from the local file system (e.g., hard disk or thumb drive). It looks like it'd make a good index tool for CDs or DVDs full of miscellaneous kruft. It looks like it'd make a good container for various beginner's guides also. I'll keep you posted.

IAX?

There's discussion on the #savonet channel that an IAX interface for Liq is being developed. This could make things simpler. It's nothing that you can't already do by using Icecast as an intermediary service. However, I'm looking forward to experimenting with it.

Firefox locking up

Ended up having to troubleshoot an audio problem within Firefox tonight. The browser refused to play any audio and would lock up while visiting Flash-based sites. Fortunately, this was an easy fix. Notes are in the wiki.

Life expectancy?

Another thing that technology improves in our lives: the ability to pull new pranks. Tonight I ran across PhotoStamps from Stamps.com. Please note the statement that this is legitimate postage.

My wife has various pictures of her and her sibling's childhoods. [insert evil laugh here] I imagine that my in-laws will be forming a lynch mob sometime around Christmas.

Frustration

Why is it that finding info on streaming from a pipe to Ogg is easy, while the same info, involving MP3 streams, is a pain in the butt to track down?

Adding and deleting pages on Google

Here is my list of links which describe how to add, block, and remove various items from Google's search engine. For now, the links are mostly from GoogleTutor. I've added them to the wiki to make them easier to find (for me) and as a precaution against GoogleTutor's disappearance.

Stop yer whinging!

Got to eat dinner with the team captain for Skewl of Root. When asked (at the conference) how they did it, he replied, "Cooperation, Dedication, and Overwhelming Technical Superiority!".

Really want to know how they did it? Go back and take a look at their stats for the past 7 or 8 years. Notice how they almost always were in the top four finishers but most often had the suckiest "defense" stats? Care to guess what they fixed this year?

As for the other teams, they didn't place first but they definitely didn't place last. Those that actually played had to beat out nearly 400 other entrant teams (we're talking thousands of people here!). They all busted their humps to get there.

It is hilarious though, seeing team points graphed over time, with the Bossman narrating (similar to the effect of shifting into the next higher gear when the guy you're racing thinks you were at top end). Before you start buying torches and pitchforks, he was respectful of the other teams. Mebbe we can get him to digitize the commentary? (hint, hint!)

Adding and deleting pages on Google

Here is my list of links which describe how to add, block, and remove various items from Google's search engine. For now, the links are mostly from GoogleTutor. I've added them to the wiki to make them easier to find (for me) and as a precaution against GoogleTutor's disappearance.

He's so cheap that...

There's some advantage in being a tightwad. Your gadget money tends to go further. Friends know that I watch the local clearance bins like a hawk. I occasionally turn up some interesting stuff.

Example 1: The local Walmart dumped their shelf of Linksys PAP2's for ten bucks a pop. I donated them to Sploitcast and they were (mostly) given away at this year's Shmoocon.

Example 2: I just picked up an ATI HDTV video card for thirty bucks. I think the little OTA antenna may be missing but the price was low enough to be interesting.

Now my only problem is that I'm running out of slots.

Backdoor dialing

Hmmm... Gizmo's Backdoor Dialing feature looks interesting (i.e., free calls to land lines and mobile phones). I'm not in an area where this works but I'm willing to be some of my friends/family are.

MythTV and XMRadio

I added the MythTV hack to play XMRadio streams today. There's a couple things that the MythTV wiki doesn't tell you:

• you need to run xamp as the mythtv user at least once from the command line
• and you need to create the /home/mythtv/.xmonline folder (as the mythtv user) before you run it from the command line

Other than that, it's a pretty straight-forward install. My notes are here.

Ordering Pizza Without a Phone

I've added notes for making 1-800 calls from Asterisk without having to pay for a phone line or ITSP: 1-800 Calls via Google411.

Attack trees

A post over on Spark's Fedora blog about Anti-Virus, Anti-Spyware, and Rootkits in Linux prompted me to write a lengthy response. In doing so, I realized that I hadn't posted about basic security theory in a very long time.

Semi-related to Spark's topic is the following: attack trees. A good starting place is Wikipedia's article on attack trees and Bruce Schneier's 1999 paper on the topic is also a very good read.

Openfire notes

I've added notes for Openfire configuration to the wiki. Ben Perove has a 15-minute screencast on basick configuration. The one thing that he left out was that you have to enable management via /etc/asterisk/manager.conf.

I also learned (the hard way) that if you use the embedded database (vice an external one) for Openfire, you'll run into issues with configuring the Asterisk-IM plugin.

I'm having a bit of fun with Openfire (the server) and Spark (the IM client). The Asterisk-IM plugin announces inbound calls with pop-up windows using Spark. Openfire also has a gateway function for just about every IM available. This allows you to see when your friends are online (or chat with them), even in IRC, without having to start up a dedicated client for whatever individual service they might be using.

OpenMeetings update

Got the install-from-scratch version (vice the VM version) of OpenMeetings up and running. One tip for other people messing with it, running OpenMeetings on the same box as your web browser doesn't work well (if at all). Run the server on a different machine.

WiFiDog status

I've got the auth server built with all of the modules/features enabled. The older ipkg installed nicely on my ancient WRT54G. The gateway works nicely (though I did lose some spouse points during the install) and seems to respect the pre-existing port-forwards. I don't see much of the previous notes changing all that much. I'll start tweaking them this weekend.

One side project though, the documention. The current stuff is a bit sparse.

Ow! My eyes!

Dude! It's cool that you (you know who you are!) have a generally popular tech show on uStream. But don't forget to turn your rig off when you're done. We really don't wanna know that you wear too-small black speedo-like underwear and like to wander the house with a cereal bowl in the middle of the night!

Intrinsic.h errors

Note to self (and anyone else who's troubleshooting similar): The following error is caused by a lack of the XAW library.

    error: X11/Intrinsic.h: No such file or directory

The correction is to load the latest development version of libxaw.

WiFiDog update

I'll be updating the "setting up a captive portal" pages in the near future as a build another one from scratch (for the house). This weekend's project, from the looks of it, unless Sparks wants to mess with OpenVPN again. (Sparks?)

Basic OpenVPN

Wiki notes for a very basic OpenVPN configuration.

OpenVPN

Sparks and I have started working on getting OpenVPN up and running. The example for the simple point to point configuration is quite easy. However, that's where most of the howto's end. We're trying to get a point-to-multipoint configuration up and running but it's a bit more complicated. We should have it up and running shortly.

Abandonment

In the effort to make my digital life just a bit simpler, I'm considering abandoning yet another tool. This time it's SageTV.

I've enjoyed using it for the last three years. It has quite a few features that the other DVR software packages don't. Plus an active support community. Plus being user-extensible.

The problem is that the version that I've purchased is starting to have some serious issues, mostly by not playing well with various upgrades to my system. Having to maintain two versions of Java (the older one for SageTV) and a number of legacy libraries was a serious P.I.T.A. On top of that, the online sources never really worked all that well (which can be blamed mostly on the serious shortage of documentation for the Linux version).

In any case, I'm considering moving away from SageTV. I really don't want to purchase the newest version. MythTV appears to have most of the features that I want and I'm willing to invest a few hours to get it up and running. I'll keep you posted.

OpenMeetings Status

I've got OpenMeetings installed to the point where that it is able to provide a video feed, from an XP box, to anyone else that connects. I'm having issues with the webcam on the Linux box (its the same make/model as the one on the XP box) so I'm thinking that either the webcam shouldn't be run on the server or there's something hardcoded which requires that clients be Windows based.

I'm hoping that I find a howto or a troubleshooting page soon. That's the trouble with in-development code: documentation tends to be a bit sparse. Notes here.

Retreating

Amongst a certain crowd (*ahem*), it's a popular practice to go "on retreat" where the geek completely unplugs from all communications for the length of their vacation. This allows the geek to "retreat" from the stress of their connected work and social lives.

The problem is that stress conforms to many "laws" that physical objects do. In other words, the stress doesn't disappear just because you're not in it at the moment. Rather, the majority of it gets transferred to your coworkers and friends. In fact, it actually creates more stress from the inconvenience it creates on those friends and coworkers.

Translation: Sparks! Dammit! Answer your phone! You're not going to Denver on Monday!

OpenMeetings

For anyone with a subscription to the feeds from the wiki, please bear with me. The installation process for OpenMeetings is a bit intricate and recording the process adds a large amount of time to the process (i.e., you'll be seeing a lot of minor updates).

Feeds update

Hmm... down to 288 feeds, from 400+ earlier in the year. The hard part is saving the "to keep" stuff from the blogs that I no longer want to read (it is an election year after all...).

SqueezeCenter

I'm not sure when it happened but Slimserver has become SqueezeCenter. More or less the same features, a new skin for the interface. I've added notes to the wiki on reconfiguring SqueezeCenter to use your MySQL service (vice the extra one that comes with SqueezeCenter).

Misc.

A bit of catch up... I've added the following notes to the wiki:

• Generating SSL certificates for Dovecot
• A fix for Asterisk's music on hold starting and stopping on its own

.

Forcing an EPG update in SageTV

Here's an easy one for SageTV users: if you somehow mung up your EPG so badly that it thinks that your last update was somewhere in the future and your next one really IS in the future, you can force an update by going to "Setup -> Setup Video Sources" and clicking on your video source (hint: it'll start with a number). Click on your source and then "Channel Setup". Then scroll down and click on one of the channels with the green ball on the left. (Hint: the green ball should go away.) Click on it again, so that the green ball comes back.

Now go check your SageTV homepage (if you have the web interface installed). The datestamp for the "Last EPG Update" should be right about when you clicked on the channel button the second time. (Wiki notes here.)

For Sparks

Link for Sparks: HamSoft - Linux Software for the Hamradio Community (their spelling).

Video phones

Spent the evening wandering around on TalkShoe, messing with various video phones, and installing software on a development platform. It's becoming apparent that even though X-Ten, the SIPPhone on the N800, Ekiga, and the Grandstream GXV-3000 can all "do video", how well it's done varies greatly.

Case in point: a setup where the GXV-3000 calls an X-Ten softphone. The video from the GXV-3000 is quite nice, the X-Ten softphone displays it without any problems. It even scales well.

The X-Ten softphone, however, has issues with its own video stream. On an 800 MHz machine, it has a lag which noticebly grows over time, until the application is running so slow that the program's buttons are unuseable until you hang up from the other end. (The video from the GXV-3000 keeps up during all this.)

(Note: On a 1.2 Ghz dual core, it appears to keep up.)

A N800-to-GXV call is a bit different. The N800 is able to keep up. It's just that the resolution of the camera on the N800 is just so low that the picture on the receiving end is comprised of giant pixels and overdriven colors. It's just too dang ugly to look at!

My recommendation is to try and maintain end-point parity (use the same hardware or software on both ends). That way, it may be a bit ugly but you don't end up comparing mediocre (the soft phones) with the good (the hard phones).

Innocent bystanders?

Nothing gets my blood boiling quicker than someone forcing me to act on their own half-a$$ed research (yeah, I have one of those jobs). While my job has nothing to do with law enforcement or legal, IA and other people's work does play into it.

What gets my hair standing on end is that certain organizations are trying to get laws passed to criminalize file sharing (vice being a civil matter), yet they can't do their own dang research properly.

Be sure to click on the links for the authors. They have some other interesting projects going on.

Note: the Slashdot article pointed only to the UW research paper, this is the associated web site. Free Printer741 now!

Nothing

Nothing to see here. This post is just to claim this blog in a specific feed reader. Please ignore.

Web 2.0, The New Brain Sucker

If anyone's interested in grabbing a copy of my feed subscriptions from Bloglines, grab 'em quick. I've decided that RSS feeds are just as insidious as television, if not more. When I started this blog, there weren't that many out there and there were definitely only a handful of security blogs. I spent a lot of time writing about topics that interested me and tried to stay out ahead (or away) from the gathering crowds.

Nowadays, I don't write much and there aren't many topics not covered by a blog. Also, you don't have to travel too far to find any two security experts willing to contradict one another.

As such, I am attempting to crawl out of the RSS sinkhole and go back to researching the more cutting edge stuff. I may blog about it, I may not. To help do this, I'm pulling the plug (unsubscribing) from all of the feeds that I read (there's over 300 of them), except for those of a few close friends and one or two high signal-to-noise feeds.

For those of you that are totally immersed in RSS feeds or other forms of social network (yeah, you guys in the Twitter pool are included), the world is passing you by. Take a look around. The time that you used to spend coding or researching a topic has now disappeared into "reading time". You're probably spending the majority of your free time following the kruft growing in other peoples' lives or watching a couple security "experts" bicker.

If you're skeptical of my intent or even just of my possible success, you can call it a blogger's mid-life crisis. Me, I'll call it an escape attempt.

Product prejudice

"Product hate" tends to last longer that the reason for it. Case in point: I've asked a few Grandstream-related questions in some well-known forums and, instead of receiving legitimate answers (or even "don't know"), I've ended up on the receiving end of invective that is reminiscent of the old MS-v-Linux quasi-religious "purism".

The company may have had some crappy products in the past, but I've used a number of their products recently and I'm quite happy with them. Admittedly, the previous firmwares did cause a number of unbearable issues but the current versions work quite nicely. I'd recommend taking another look at the Grandstream stuff if you're needing some cheap equipment. Some of the newer models have a few bells/whistles that you might be interested in, too.

It's the little stuff

Just about everyone that's tried to cause Asterisk to play hold music that's streamed from elsewhere has run into the "Stopped music on hold on Local/202@default-b77d,2" issue. Googling for it is no help whatsoever. There are dozens, if not hundreds, of people asking about this error.

The answer is quite simple: if you're sucking off of a stream, comment out the line that starts with "directory". You only need the "mode" and "application" lines.

How do I know this? Well, let's just say that I spent a few hours today, tracing just that very problem.

Grandstream GVX-3000 video phones

Got the chance to play with some GVX-3000's last night. Once I recovered from the problems induced by my own typo's, we had them working nicely. Left the test setup running for a friend's enjoyment this morning. There are a few additional features that I want to play with.

Overkill

Many of us like to pop a bowl of popcorn, toss a DVD into a player, and watch a movie (esp. in an election year), say, like "National Treasure 2". Here's a hint to the Effin' marketing department: the previews shouldn't last longer than the d**n bowl of popcorn.

(To borrow from the real SJ) Oh! And one more thing... Converting a crappy stop-motion animation to "high def" doesn't mean that I'll consider buying it, especially when it's placed somewhere around minute seven in the previews of other movies that I'd never watch/buy, with the fast forward feature disabled. It's enough to make you barf your popcorn back up!

Yeah, I'm in a mood. What of it?

Please!

Arg! Why is it that online sites, that create audio files for use a podcasts, can't tag the MP3's properly, if at all? (*Ahem* TalkShoe) I've been tweaking my Savonet scripts, getting them to randomly play files if no one is using the jukebox function. Quite a few (not all) of the podcasts have no tags whatsoever and nothing shows up in the jukebox interface when they're played.

Anyone care to join me in pestering various sites about their tagging capabilities?

Using the Gizmo software with Asterisk

I've added notes to the wiki about using Gizmo Project as an Asterisk Client. Yell at me if you see any bugs.

Wrong! Wrong! Wrong!

Chris Soghoian's post, "IRS web site opens door to phishers" prompted me to visit the web site. In attempting to connect to the secure site, Firefox spit up the warning below. Note to any IRS webmaster: this is NOT how it's supposed to be done!

Numbers

I've started a list of numbers to call. If you have any interesting SIP or IAX numbers, drop me an email or ask for an account on the wiki.

Switching languages

I've switched languages for the conference manager. PHP proved to be just too brittle in dealing with self-referential recursive calls (it tended to pass a variable to the first call but would ignore the same value in the second and third calls). I'm now looking at switching to Perl or C based CGI scripts. So far, it appears to be going well. The Ajax piece is a bit more tolerant of the background code and the button functions implemented so far, work.

I'm able to adjust volumes now!

Gizmo, Grandstream, and Asterisk

This past week, I added a Gizmo interface to my Asterisk box. It's extremely simple to set up (notes here).

To add local inbound calls from POTS, I pointed my GrandCentral (GC) account at Gizmo. (They do that now.) This was the tricky and annoying part because the console showed that the call had been answered but the calling phone was still ringing.

When I stuck a conference room into the mix and dialed into that with a third phone, I realized that GC was using an IVR on the receiving end (i.e., "Press 1 to accept the call, Press 2 to send it to voicemail, etc.). In other words, it requires human intervention (i.e., you must press 1 to accept a call).

That's not to say that it can't be worked around. You can either have Asterisk push it immediately to a hard phone (if you expect to treat is as it was intended) or you can "trick" the IVR into delivering the call with the SendDTMF command (notes here). In either case, I now have a local inbound number for free!

VoIP Resources

In researching various VoIP services, came across the VoIP Resource Guide. It's a very large link page with a number of pointers to various VoIP related pages (includes hardware, software, politics, etc.).

Yeah! Wut?

Either Alec Saunders is completely ignorant about his former employer or he's playing at being a troll. His post entitled "Microsoft's Contribution Was TCP/IP" lacks a serious amount of "clue". Actually, the TCP/IP stack was "borrowed" and then implemented poorly.

I think that by using the phrase "by ensuring a relatively bug-free implementation of IP", it's a indication that Alec:

• wasn't there,
• was in marketing (and therefore ignored anything the programmers said), or
• is just a clueless journalist

A little research shows that he was actually a director of marketing, meaning that (at best) he knew the features but not the bugs.

Windows 95 had a secure TCP/IP stack?! Buahahahaha....[**gasp**].hahahaha....

For some reason, Alec has no memory of the horrendous amount of crap and pain we (as network operators) went through in the late 90's and early 00's. Could there have been that much separation between the various MS departments at the time?

Nested calls

I'm finding out the hard way that the statement that you don't need to prepend Perl routines with an ampersand only remains true if you don't repeatedly nest sub-routines. I wonder why this is....

New subscriptions

Blew most of Saturday night overhauling my subscriptions, mostly filtering out election year kruft (if you're blog is dedicated to bleeding-edge threats against the Nokia N800, it's really not the forum to carp about about what so-and-so politician did in his/her distant past)(start a separate blog d*mmit!) and picking up a number of new Asterisk-related subscriptions.

Although most won't hold up under continued review, I've picked up 18 new Asterisk-related subscriptions. You can grab a copy here.

Quote

"Be nice to nerds. Chances are you'll end up working for one." - Bill Gates (heh)

Here?

According to this and this, we have a Google data center right here in town. One more for my list of odd stuff about the area.

Simple hot-desking

I've added an Asterisk recipe for simple hot-desking to the wiki. This is valuable when the number of phones don't equal the number of users (i.e., 24x7 call centers) or your users tend to not have the same desk from day to day (temp workers or those on travel). What's in the wiki is quite basic (uses Asterisk's built-in database) but it can be easily adapted to facilitate some elegant click-to-call web interfaces for multiple teleworkers.

Going too far...

It's days like today that I'm highly susceptable to offers for alternate means of connecting to the Internet (Verizon: this is a hint!). Here's the scenario: I got up early this morning, poured myself a cup of coffee, pulled up my email client and started wading through the backlog from the last two days. Upon finding an email from Rob, concerning a pending field trip, I decided to forward the field trip information to my work account so that I'd have the contact info to call and register for the trip. In response to hitting send, I received the following:

Okay, I was a bit miffed. However, I read the details of the error message and visited the site. It said that I could have the block removed by sending a copy of the message to thisisnotspam@cox.net. I did so and received the following:

Okay, I'm now livid. The short version of the 5-minute screaming fit that I have in my head boils down to: Why are you filtering my outbound mail? Am I flagged as being a spammer because I send 5-10 messages per week?
Grrr...

Passing values back to the dial plan

More Asterisk scripting basics: I've added notes to the wiki for passing value(s) back to the dial plan.

Goolag redo

Okay, so I got the description of Goolag wrong. Mostly, it's my fault for not realizing that I'm supposed to download a binary executable from a known hacker site (yeah, that's a smart move). That from a page where the main focus is a search bar and the download link is formatted so that it appears as a "feature" on a page titled "Goolaq".

A little bit of design knowledge (instead of "adapting" formats) and visitors might not make the incorrect assumption. Mixing what is supposed to be a legitimate link for a download into what is supposed to be a parody leads to confusion such as this. It's like your pastor telling a dirty joke during a sermon. At best, it leaves people scratching their heads.

Again, my apologies for the confusion, especially to Corey Nachreiner.

To the guy calling himself "ass", I won't "moderate your comment up". You've yet to say anything constructive. I've posted this retraction instead. Please realize that I've never claimed to be a "l33t h4x0r" like you. In any case, from this humble n00b, thank you for your input!

Unrequested assistance

Note to self: If just before that pre-dinner nap, your spouse says, "I couldn't make out how my computer is hooked to your network," and later that evening your brand new IP phone consistently resets after two seconds of connect time, complaining about a lack of IP address, it should set off alarm bells in your head!

Note to everyone else: The Grandstream Budgetone 102 will do that if _SOMEONE_ (*ahem*) plugs the cable into the "PC" port vice the "LAN" port.

I refuse to ask how she thought that her computer was plugged into the phone (okay, maybe the _do_ both have blue cables) but I refuse to feel guilty that it took 15+ minutes to find that (yeah, I'm taking fire from that). I'll probably have to tell the story about taking her shopping for a laptop, and getting a red one, at the next social function, just to get even. (heh)

IMAP Voicemail

I've added notes for adding IMAP-based voicemail for Asterisk to the wiki.

MySQL password reset

Inherit a box where you don't know the root-level password for MySQL? Or just plain forgot it? I've added notes for resetting the root password to the wiki.

Putting a name to it

Ah! I finally have a name to one of my vices: cheesy wirefu. I blame the five years that I lived in Hawaii, watching what could only be described as a feudal Japanese soap opera (reading subtitles while following the action becomes second nature) and a number of really bad B movies from the clearance bin. (This was well before the Mystery Science Theater experiments.)

I learned the term "wirefu" from one of Zach Selwyn's vidcasts. Thanks guys!

Experimental Network Sessions - Episode 5

Notes for tonights conference call can be found here (in ODP format) and here (in PDF format). Wiki-fied notes are here.

It's a very easy technique so I don't expect the instruction part to last long. I'll hang out on the channel if anyone wants to chat.

Realtime default extensions

Finally got a little bit of time to test whether or not the default extension ("s") could be used in real time. From what I can tell it actually works, at least in 1.4.16.2. I'll test the other two ("t" and "i") later.

Repair: Realtime extensions with MySQL

Went back to try the install from scratch. Found a few bugs (extra quotes actually) in the MySQL script to create the extensions database. Fixed version here.

Home-grown conference manager repair

For anyone using my home-grown conference manager, otherwise known as a kludge, I've figured out what was causing the dial to drop to the default "s" extension: In the "callthis.php" script, in the line starting with "asterisk_command", change "Exten: Local/201" so that it reads "Exten: 201".

For some reason, the call manager only likes channel names in the Channel variable. It doesn't like them in the Extension variable when setting up calls.

In hindsight, it's kinda obvious, no?

Realtime extensions with MySQL

After a sucking up available free time after work for a few days, I finally have realtime extensions up and running on Asterisk and MySQL. My notes for realtime extensions are in the wiki. Now to play with it.

TWUUG swag?

One of the alternate uses for the Tidewater Unix Users Group is you can often find people to take your "treasures" off of your hands. Case in point: this week, the following appeared at the far end of the table...

It's a Meridian CDNET 914 SCSI-based CD library. Good for a couple dreams but you (or at least me) don't want to be caught by your spouse, sneaking this thing in the door. (Heh) That and there's something that's just down-right creepy about having a floppy drive in the back.
Note to self: test to see if the hardware moratorium has been lifted.

PSGw

PSGw is a Skype-to-SIP and SIP-to-Skype gateway. I spent a little time this morning, setting it up on a Linux box and getting it to talk to Asterisk. While the configuration is pretty straight-forward, I did have to guess at one thing (declaring context) that wasn't in the provided notes.

Overall, the calls to/from Skype are of marginal quality. They're intelligable but there's enough jitter in them to be highly annoying.

I've put my PSGw notes in the wiki if anyone else wants to try it out.

Goolag

Corey Nachreiner, over at WatchGuard, posted that the cDc has created Goolag as an aid to Google hacking (the term of using Google to find vulnerable devices or programs). Corey's declaration is a bit off of the mark in that Goolag is actually only a custom interface to search the cDc kruft space. In other words, you get to search all of the web for stuff that's related to (or at least mentionds) the cDc, not the all of Google's "discoveries", as evidenced by the following to screenshots.

Either one of those searches should have turned up hundreds, if not thousands of references to web cams. You can reproduce this "research" by going to Goolag and typing in "view" or "web cam" and then comparing it with a similar search via the normal Google interface (actually, Google will most likely block your search as an attempt at Google hacking, but it will report millions of hits).

VoIP Bandwidth Tester

Not that it's all that accurate but DSL Reports has a Voip Bandwidth Tester on their tools page. Interesting in any case (says I can support 18 simultaneous calls).

MPD on the NSLU2

I can't vouch for it operating properly as I have no idea how to configure it to stream to Icecast but MPD did compile on the NSLU2. Notes here. Anyone have a working mpd.conf which allows streaming to Icecast without an audio interface?

Update: Running Icecast and MPD on the same NSLU2 may not be the best idea, at least if you're going to use the stock config files. I'm seeing almost 100% load on the box and the output to another system is quite bursty (about 3 seconds of silence for every 3 seconds of music). It's probably a good idea to put the utils on different systems (2 NSLU2s or a NSLU2 and a full-size computer?)(works nicely if I use my Asterisk service as a source). As I've built this for someone else, I don't have the resources (okay, or motivation) to tweak these.

For anyone that cares to, I will offer an account on the wiki if you'll post your tweaks.

Icecast on the NSLU2

I've been wanting a better version of Icecast on the NSLU2 (other than the one that runs on OpenWRT) and have been meaning to build it. Various people have expressed interest, the latest of which was Brian M.

In short, I spent roughly four hours this morning installing various code on the NSLU2 and now have a working (I think) version of Icecast. Notes here.

If you're going to attempt the same build, it's probably a good idea to devote a Saturday to it cause it's not a simple process.

Now build MPD and write the start up scripts. I'll keep you posted.

Source Fource

Various thoughts on the Source Fource:

• Can't we just buy a Happy Meal instead?
• Just how old are those guys in the marketing department anyways?
• How long before they receive an trademark infringement letter from Source Forge? (Do they think people have forgotten Mike Rowe Soft already?)
• Why is it that four of the figures on the web page appear to be actual pictures while the other three are cheesy hand drawings (including the ones for Vista and Office)? Were there delays in production?

(heh) Couldn't resist.

Leverage

From the Obvious-but-not-stated-dept.: ... and thus, your entire infrastructure must be Cisco.

Zfone

I've added notes for installing ZFone in the wiki. The install is very basic, though I did have to chase down a library that I didn't have. Sparks and I will be testing this (hopefully) on Saturday. Let me know if anyone else wants to play.

Shmoocon 2008 - Day 3

A quick day (I was dog-tired). Attended:

• When Lawyers Attack! Dealing with the New Rules of Electronic Discovery (Benson)
• The Geek and the Gumshoe or Can Mathematics Solve Crimes? (Schearer, Thornton)
• PEAP: Pwned Extensible Authentication Protocol (Wright, Antoniewicz)

All three were worth seing, the first two were more entertaining that the last. All ran out of time (maybe we could get longer sessions on Sunday?).

I left early 'cause I started feeling under the weather, nauseous on top of being tired, so I bought copies of various talks and got out of there. Good timing, too. By the time that I got back to Virginia Beach, I was down to nausea, shakes, and sweats. Haven't felt that bad since the last bout of food poisoning. Mebbe it's the flu? (No, I didn't do any of _that_ at Shmoocon. I was good.) I'm feeling somewhat better today but am definitely considering staying in bed.

Finally met CyberEagle at the SploitCast table. I'm bigger than he thought, he's younger than I thought. (Walc: I'll keep an eye out for more give-away stuff for next year.) Ran into Bob from work (shouts!). Talked with the Army cadet again.

No major surprises this year. Cisco took a beating though, with various people poking holes in VoIP implementations, network equipment, and various of their proprietary protocols.

All in all, another good conference from Shmoocon. Looking forward to seeing what 757 and the Sploitcast groups come up with for next year (this year was a bit weak in the Arcade).

Shmoocon 2008 - Day 2

A pretty interesting day. Attended:

• Active 802.11 Fingerprinting: Gibberish and "Secret Handshakes" to Know Your AP (Sergey Bratus, Cory Cornelius, and Daniel Peebles)
• SIPing Your Network (Radu State, Humberto Abdelnur, and Oliver Festor)
• Passive Host Characterization (Matt Wollenweber)
• VoIP Penetration Testing: Lessons Learned (John Kindervag, John Ostrom)
• Advanced Protocol Fuzzing - What We Learned When Bringing Layer2 Logic to "SPIKE Land" (Enno Rey, Daniel Mende)

The 802.11 fingerprinting talk was based around the idea that devices can be indentified by looking at the responses to requestes with various header flags turned on, in a manner similar to how NMap does OS identification by messing with the IP and TCP header flags. The tool they were working on is called Baffle. It's not available yet but we should probably keep any eye on this one as there is still a lot of interesting work to be done on/with it. Larry Pesce managed to squeeze in a talk on Access Points For Pentesting, during the same hour.

The SIP talk could have been better. They couldn't get the video for their demo to work so they had to talk about the tool they're working on, KiF (not sure what that stands for), a state fuzzer for VoIP. In some architectures, KiF can "borrow" authentication from other phones to be able to make calls.

The Passive Host Characterization was a bit dry (but still interesting). Matt is a former Trickler programmer for those that know what it is. He's posted a demo for his tool, PHC.

The VoIP Pentesting talk cetnered around some of the common configurations and shortcomings in VoIP architectures. They showed how VoIPHopper can impersonate a phone so that it can access an organization's internal network, often through the firewall (based on assumptions made during rollout of the infrastructure).

The Advanced Protocol Fuzzing talk wasn't what I thought it was going to be (Layer 2 discussions usually mean wireless) but it was interesting regardless. The group is basically working on reverse engineering and testing various Layer 2 management protocols, such as Cisco's WLCCP, using a tool called Sulley.

Here's a short view of the news/gossip from day 2:

• Ethan's walking without a cane! (For those that don't know him, he's taken a lot of ribbing for managing to generate a compound break in his leg via a Segway.)
• Rob and I got to talk with Dave Aitel and, later, with an Army Academy student (Dude, take one of our first three choices for intership! You'll get more out of it and you'll get to meet/know "interesting" people.)
• Southern Vriginia is well represented at the conference this year, having 757 (HRGeeks), Sploitcast, and Hak5 present. I managed to donate a couple items for one of Walcy's giveaways.
• Shouts to Squidly1! Who knew your offer would generate sales at the local Best Buy? (heh)
• I think hotel management finally found a couple groups that didn't "mix" badly with the Shmoocon attendees. There were actually two smaller conferences: one for "business resource managers" (salesmen) and one for Anime fans. No one really wanted to mess with the guys wearing tuxedos (they also kept to themselves) and the Anime fans were considered a bit weird by most of the geeks (though a 19-year old girl in a Sailor Moon outfit can be quite distracting). But seriously, they were wearing their costumes into the same restaurants that we were in and were making our freaks/rebels (you know, body piercings, tatoos, etc.) look normal. Most of the anime attendess just wore bunny or cat ears but some had full blown costumes which somehow were a mix of faux ancient Japanese, faux American Indian, and New York City hooker. (heh)

In any case, day 2 was fun. Got to catch up with a lot of friends that I hadn't seen since last year. I triend to hang around and particpate in the Sploitcast podcast recording but I was too tired and too hungry to stick around (my hotel is in Bethesda, MD).

Shmoocon 2008 - Day 1

Day 1 of Shmoocon 2008 went pretty well. Got stuck in downtown DC traffic for hours but Karma balanced out by me ending up in the penthouse suite at my hotel. I attended:

• Intercepting Mobile Phone/GSM Traffic (H1kari)
• Forensic Image Analysis for Password Recovery (David Smith)
• Baked not Fired: Performing an Unauthorized Phishing Awareness Exercise (Syn Phishus)
• Web Portals: Gateway to Information or a Hole in our Perimeter Defenses (Deral Heiland))
• Hacking the Samuri Spirit (Isaac Mathis)

.We blew off "New Countermeasures to the Bump Key Attack" and the keynote because we were just too hungry and tired.

"Intercepting Mobile Phone/GSM Traffic" was interesting though I got the impression that H1kari had dumbed it down to make it more interesting to a wider group. It was interesting in any case.

I felt the audience was a bit unfair at the end of David Smith's talk on password recovery. He had stated up front that it was a work-in-progress and that he was looking for other ideas. Basically his works comprises building attack dictionaries by extracting strings from memory space, passing them through qualifying filters (must be a certain length, must be from a certain (type-able) character set, etc.), and using the resulting dictionary in a much smaller brute force attack. (Rob! Something to include in the forensics class?)

Deral Heiland's talk on web portals had similar audience issues as it too was a work in progress. I guess we're an unforgiving bunch. It did remind us to pay attention to details when evaluating web services.

Isaac Mathis's talk well done (funny). It reminded me a bit of Johnny Long's talks on just about any subject. With a bit more practice, I think Isaac might just reach the same quality.

Overall, the conference is off to a good start (I wonder if there were any shenanigans last night). No suprises so far, security-wise. I ran into a few friends that I hadn't seen in awhile. Noticed that others were missing (maybe Saturday?).

Shmoo!

There may be no blogging for the next few days. I'll be at Shmoocon and will be attempting to travel extremely light (i.e., I'll only have my N800 and my Razor on me). Then again, depending on how nimble my thumbs feel, I may be up to a few rounds of thumb typing into vi.

Shrinkage

...and so it starts. I've just deleted ten or so subscriptions from my blogline feeds. As it's only February, it's not a good sign that I'm already deleting subscriptions because of various blogs' "content drift", specifically that of the usual rabid anti-other-party election-year politics.

To paraphrase the television commercial: Sorry guys, I'm afraid I'm going to have to block you.

Note to self: start - 12 Feb - 392 subscriptions (now 383).

Shmoocon this week!

Okay, the number of days before the con is less than the fingers on one hand so I guess I should start packing. Problem is, I just finished unpacking from a last-minute trip to San Diego (I'm not gaining any spouse points here). I think I'm wearing my laptop out via the constant rebuilding, setting it up for a business environment (i.e., installing Windows), then setting it up for a known-hostile environment (i.e., a stripped down version of Linux), then rebuilding it post-conference (I like you hacker con guys, I just don't trust you as a whole).

In any case, I'm looking forward to going. The 757 bunch will be there in force (someone said 30 of us!!?), counting those that have moved away but have remained in contact. Was there anyone that was forced to take the goon route this year?

Xact and Yealink

I tried out the YeaPhone software, running on SlugOS/BE v4.8 on an NSLU2, to connect to a XACT XVP620 phone. Because the repository already had linphonec and yealink available, I avoided having to build them from scratch (I'm stating this as it may be a source of the following problem). Following the configuration guide on the YeaPhone site, I was able to cause linphonec to initiate calls and use the handset (hear/speak). However, there was a lot of annoying clicking in the call and the calls tended to fail after a couple minutes.

Below is a capture from dmesg on the NSLU2.

input: Yealink usb-p1k as /class/input/input1
usbcore: registered new interface driver yealink
drivers/usb/input/yealink.c: Yealink phone driver:yld-20051230
usbcore: registered new interface driver snd-usb-audio
drivers/usb/input/yealink.c: urb_irq_callback - urb status -2
drivers/usb/input/yealink.c: urb_ctl_callback - usb_submit_urb failed -1
drivers/usb/input/yealink.c: urb_ctl_callback - urb status -2
drivers/usb/input/yealink.c: urb_irq_callback - urb status -2
drivers/usb/input/yealink.c: urb_ctl_callback - usb_submit_urb failed -1
drivers/usb/input/yealink.c: urb_irq_callback - urb status -2
drivers/usb/input/yealink.c: urb_ctl_callback - usb_submit_urb failed -1
drivers/usb/input/yealink.c: urb_ctl_callback - urb status -2
drivers/usb/input/yealink.c: urb_irq_callback - urb status -2
drivers/usb/input/yealink.c: unexpected response 11
drivers/usb/input/yealink.c: urb_irq_callback - urb status -2
drivers/usb/input/yealink.c: unexpected response 2
drivers/usb/input/yealink.c: unexpected response 4
drivers/usb/input/yealink.c: urb_irq_callback - usb_submit_urb failed -22

Port forwarding and SIP

The overly cautious amongst us will refrain from port forwarding massive numbers of inbound ports, regardless of a stated need and especially if the box the ports are being forwarded to is not a single-purpose system. Port forwarding is a bad idea if more than two geek-level users live behind a single NAT box. The situation is much worse if the two are married. Where one wants his Asterisk server to run, the other wants to be able to listen to her radio stations or watch streaming videos. Port forwarding will allow the Asterisk box to accept inbound SIP calls but it also breaks the streaming media to the other system.

Ignoring SIP proxies and external routing of calls, the immediate compromise is often forwarding a smaller number of ports and this can cause other issues if you're not careful about your server configuration.

Hint: if you only forward UDP ports 10000 through 10100, make sure to edit /etc/asterisk/rtp.conf so that "rtpstart" and "rtpend" have the same values. Otherwise, you'll often end up not being able to hear any incoming audio on SIP calls.

Firefly marathon

Heads up! The SciFi Channel is running a Firefly marathon starting at 8:00 EST on Monday, Feb. 18th.

With apologies...

To Mr. C. form WTKR: I hereby apologize for being clueless myself and causing insult. However, what you plan to do is a bad idea in that it is a legal "gray" area in that it gives the impression that you've actually accessed the homeowner's network. It's why both Rob and I were uncomfortable each time it was mentioned. (Based on our training, it's considered unethical and can lead to a number of legal issues.)

A much better approach would be to ask Rob to set up a demonstration network to show what can be done (e.g., mirroring a user's web surfing, intercepting a VoIP call, etc.). The main point is that all parties must agree to the monitoring/interception. Otherwise, it's very likely to be illegal.

WTKR

Hey, one of my body parts is going to be on TV! Nah, it's not what you think. Rob and I did a little bit of wardriving for a local television news station. Being non-photo/audio-genic, I managed to stay off-mike/out of the lens for most of the interview. My right hand does show up in some of the filler shots so if you see a hand with a fresh scratch across the back (thanks to Rob's vicious Rotweiller), that's me! It was fun to do. The reporter was mostly clueless (he ends up wearing a wifi t-shirt) but the camera guy understood the jargon.

11 Deceptive Truths We Think We Agree To

Okay, I'm really annoyed by Rich Mogul's "11 Truths We Hate To Admit". Basically, it's a list of trolls that have popped up in the last few years. I'm surprised he didn't add "the IDS is dead" or "the firewall is dead". Following is my responses to his "truths":

"1. Signature based desktop antivirus is an addiction, not effective security." This is one of the more offensive trolls. It's right up there with "the IDS is dead" and "the firewall is dead". Statements like this make sweeping assumptions about what you're trying to protect and what tools you're using to protect those assets. Sadly, signature-based anti-virus actually has the best ROI.

"2. The bad guys beat us because they're agnostic and we're religious. Complete and utter BS. The bad guys are in the lead because they're doing the majority of the research. It's a bad analogy to start because if the good guys were to ever "win", every bad guy would be either dead or in jail. Mebbe it's better to call it the "game of life"?

"3. Antitrust concerns force Microsoft to weaken security." Hahahahahahahahahahahahahahahahahahahahahahahahahaha...!!! Yeah, keep believing that Microsoft would give something away for free if they hadn't been sued in the past. Troll!!

"4. Vendors are like politicians - they lie to use because we ask them to." Wow. Uh, can I sell you something? Troll!

"5. We're terrible at talking to, or understanding, those that fund us." Uh, speak for yourself. Obviously, a good chunk of us understand "business-eese". Otherwise, the "industry" would have died of atrophy years ago.

"6. Security researchers need to grow up." Obviously Mr. Mogull has never seen someone else's name tacked onto his work, had his work denigrated in mainstream press, or was ever under attack from an organization that refused to believe that their product was ever anything other than perfectly secure. Troll!

"7. Security companies make more money when there are more incidents." True somewhat. However, Mr. Mogull seems to have missed the mark by claiming that the fastest way to grow a security market is to have a product ready when a massive exploit hits. It's a fallacy. The actual fastest way is to have a good marketing plan ready for when the next big exploit hits. You can go a lot further with a superb marketing plan and a crappy product than you can with a superb product and a crappy marketing plan. The day the day-stopping painful exploit occurs is when the lawyers make the most money. Followed by vendors as companies abandon certain products for others, followed by insurance companies as companies attempt to transfer the risk (look it up in your CISSP books) of future exploits. The security companies are somwhere after that.

"8. Network security is the result of a mistake, not an industry worth perpetuating." Either a troll or a cry for help. Network security is a need arising out of the fact that your company has a competitor. Ideally, life would be serene and no one would feel the need to steal your secrets. In the real world, someone sees some sort of profit (financial, emotional, relational) in breaking into your systems and changing something. Mr. Mogull's argument only holds water if you believe that somewhere out there, utopie exists.

"9. Disclosure is dead." WTF?!! Given their druthers, companies don't disclose sh#t. This is a massive troll that suffers from the wide-ranging, yet slowly moving pendulum of "accepted practice". Hint: a number of recent laws now require "disclosure" yet there's been a number of law suits which have forced limited disclosure of vulnerabilities and exploits.

"10. Momentum will destroy us, until it doesn't." Uh, huh? Innovation is a marketing practice. Operationalization is a marketing term (okay, vague rationalization for an irrational decision). The entire paragraph is basically a gripe that neither our employers nor the bad guys have remained static. Whiney troll!

"11. We can't fail." Mebbe as a whole. However, individual security companies fail often. They sometimes "take their customers with them". Just as the bad guys will never "win the war" (face it, it isn't a "war" where people die from every port scan), neither will the good guys. A much better analogy is to view it as a competion, where your goal is to "keep up".

Borked EPG

Note to self (and other SageTV users): Mess with the Beta stuff on a different box. If you upgrade and then revert, you have to delete and re-add cable video sources. Otherwise wiz.bin is incorrect and your EPG service won't work (you'll notice "No Data" creeping into your schedule).

Asterisk and overhead paging

For anyone interested, I put a mini howto in the wiki for adding an overhead paging function to Asterisk, complete with bosun's whistle alert sound (think Star Trek). I've also shown how to convert wav files into gsm, alaw, and ulaw files. Enjoy!

Shmoocon speakers

The Shmoocon news site list of speakers for Shmoocon has been finalized. Expect to see them pasted up on the speaker schedule shortly.

A box of crap

I bought a box of crap at a yard sale this past weekend. It goes along with the recent "we moving" sale from which I obtained pallet-loads of junk from my emplyer. It's absolutely scary how many 5-10 year-old devices are out there that pone home once you plug them in. Even scarier is that the sites they're connecting to are still there.

Needless to say, I've "recovered" parts (power supplies, cables, mounting screws) from a number of VoIP devices for which the manufacturer is absolutely rabid about service payments (i.e., the devices are in the trash but I've a ready store of the usual these-break-first parts).

Now's all I need is the time to desolder a number of connectors. Where'd I put that solder sucker?

I also need to worry about the hardware moratorium. My wife has been quietly watching all of this movement and hasn't said a thing. Mebbe she's just wating to see how much actually "stays". (I also did promise to sort through my old stuff and toss out various bits.) I hope to have my workbench (my desk) cleared off by Easter.

Level 9

The EPG listings are broke (making them look like the same show played over and over) but the Sci Fi Channel is running a Level 9 marathon on Feb 1st (first 8 shows) and Feb 20th (second 8 shows).

See? The writers' strike does have some nice side effects...

I Want More Porn! (song)

Tom Willet song! (heh) More porn! More Spam!

Skype and VoIP interoperability, please!

I'm not able to say it as nicely as Dan York has, but please list me amongst the paying customers that would like to call a VoIP provider on a different network. Skype, are you listening to your customers?

Chanalyzer 3.0

Just received an email. The Beta 4 version of Chanalyzer (for the Wi-Spy) is out, which means the production version isn't too far away. Visit MetaGeek for the software.

It may also be worthwhile to note that they released Inssider 1.0.6 a couple weeks ago and the Linux tools ihave been tweaked, also (not by MetaGeek).

app_jack

Oh cool! Asterisk now has a app_jack application.

OLPC Mesh

(For Sparks) Here's a thought. Even though you weren't able to connect to RedHat's network, I bet we could have used one of the "olpc-mesh" connections as a hop. Something to play with next time we're somewhere where we can experiment with connections and talk to the owner(s) of an OLPC.

FUDCon 2008 notes

We're back from FUDConRaleigh2008. Admittedly, we were only there on Saturday. It's just taken this long to get around to doing the notes.

Both Sparks and I suffered from Bill Gates Syndrome in that I could not get F8 to recognize my CDROM drive and Sparks wireless wouldn't cooperate. His problem was surprising as it's both a recent system and a recent wireless card (which worked when we tested it in Virginia). My issue wasn't that surprising as the laptop a Sony that's over five years old. Getting a distro up and running on it, when it was brand new, was a headache and a half.

Luckily, I had the N800 with me. I was able to visit some of the sites that were talked about and I managed to grab a few photos (I'll post them when I have the change to sort through them). I think that, next time, we'll spend the weekend before building/testing systems, vice on-the-fly.

All in all, it was a good time. We sat in on a few of the talks. FedoraTV, open source GIS, and Asterisk were memorable. When we first got there, I fired up Kismet on the N800 to see what was available (RedHat provided a wireless connection). To our suprise, we detected 5 OLPC computers. We didn't see them at first but did get to touch one of three later in the day. (Hint: they show up as ad-hoc probes for "olpc-mesh".)

The one sour note of the evening (which irks me more and more as I think about it) was a particularly rude comment by Jared Smith, at the end of his talk. He'd given a copy of his book, "Asterisk: The Future of Telephone," to a young woman sitting in the row in front of me. She was actually quite happy to have received it. I suggested that she get Jared to autograph it, which she did. As I was leaving, I overheard him say something along the lines of "How would you like it signed? Best of luck to my favorite E-Bay bidder?"

Grr... What an ass ego ass!

(Note to Jared: Some people cherish their autographed books. I have a number of them, even some published by O'Reilly. Besides, you aren't worth that much.)

Regardless of one poorly thought out comment, I highly recommend FUDCon and BarCamp. Even if you only learn one or two new things while attending, you get to meet people from various circles and you'll probably pick up a few new ideas about some of the programs you've been using for years. Heck, you might even end up talking about one of your passions.

Changing the SageTV web port

I've updated the page for the SageTV web interface to include how to change the port that the service listens on (mine was conflicting with DansGuardian).

Too much detail

Was in the store today and noticed something really annoying on the 52-inch HD displays: the newer DVDs are programmed to take advantage of the ability to sense the size and resolution of the displays. The end result is that Hollywood can cram an insane amount of information (translation: even the studio garbage man gets a credit) into one screen.

The store had the latest Harry Potter DVD in the drive. It had cycled around to where it was waiting for someone to push "Play". No central graphic. Just three columns of credits and disclaimers, with the "Play" button in the border at the bottom of the screen.

Blech!

Your children are in danger!

[*sigh*] Are we so bored that we've allowed the security press to resort to printing the sort of yellow journalism crap where you should fear anything involving technology? It was a model. A number of assumptions were made (like one node's actual ability to infect another). Given the limitations of the standard access point and the technical requirements for one access point to "discover" others nearby, this isn't likely to happen. The study even stated such. However, the press managed to blow this up into "be afraid, be very afraid".

With this article, I'd much rather see people "be annoyed, be very annoyed!"

Blog claim

With apologies, I'm using this post to claim my blog in Technoratie. Please ignore the below. This post should disappear in the future.

Technorati Profile.

Installing CDR

With apologies to Juan Daza for taking so long to add them to the wiki, he has provided notes for installing Call Detail Records (CDR) functionality in Asterisk, using Postgres.

FUDCon 2008

Somehow, Eric has talked me into going to FUDCon 2008 in Raleigh. He almost had me talked into going a day early, to attend the TriLUG meeting. Unfortunately, the budget's a bit tight at the moment, what with my son starting another semester and Shmoocon being 4 weeks following.

In any case, it looks interesting (this will be my first un-con of this type). I'll keep you posted.

Cheap Trick

Here's something that's super easy and rarely done: adding a favicon to your Icecast web page: just copy your favorite favicon to /usr/share/icecast/web/favicon.ico and hit reload on your browser. (Example below.)

Conference call

Would there be any interest in my hosting a Talkshoe conference call where callers could collaborate in working on their [Apache|Asterisk|mail|Savonet|etc] setups. I won't claim expertise with any of these but I can see the value in having other people help configure and test when I'm working on stuff.

What do you think? Something like a couple unstructured hours on a Saturday afternoon/evening?