Linux User Group of Mauritius

  • IETF 93 Day 1


    First day

    As the plane landed in Prague, I decided to explore the surrounding region while in the Taxi. Prague is so beautiful with its old buildings that date back to pre-World War II. See for yourself below:

    ietf_1
    ietf_1
    ietf_3

    Next stop: Hotel

    I arrived in my Hotel exhausted, but determined to meet up with the various people that I had contacted: I met Michael Tuxen & Randal (Randy) Stewart who were there at the IETF hackathon. Michael Tuxen noticed that I was looking around for familiar people, and followed me when I left the room. He surprised me, and asked me If I was looking for him 🙂 That caught me by surprise 🙂 After exchanging a few words, he invited me to sit at the Hackathon table where other FreeBSD gurus were sitting. I started poking Randall Stewart who is one of the FreeBSD performance gurus when it comes to networking. Randal Stewart was a distinguished engineer at CISCO, and later moved to Netflix. Netflix served 1/3 of the North American Traffic during peak hours ! After the hackathon, I joined Michael and Randal, for dinner ! We spoke about FreeBSD, Netflix, Back to the future, and Star Wars ! I jokingly referred to Randall as “Doc Randall” in reference to the Back to the future Doc Emmett 🙂

    freebsd_gurus

    And the Beer ?

    With so many friends around, it was inevitable that I was going to taste the czech republic beer. After 2 bottles, I felt that I had enough, and decided to head to my Hotel room. While heading to my Hotel room, I met face to face with an IPv6 legend. More to come soon …

    –Logan

  • I’am officially a Google security supplier !


    google

    Security Services

    Last night, I got the confirmation that I am officially recognized as a Supplier of Security Services for Google, the Internet Search Giant 🙂

    google_supplier

    What does this mean for Internet Security

    I will be working more closely on Internet Security by focusing on key Open Source projects, and this effort will be sponsored by Google. Needless to say, I’m very excited ! I look forward to building a more secure Internet, that benefits not only the Google, but also Mauritius, as we are also heavy consumers of products that are heavily powered by Open Source Software: Android, gmail and quite a few others.

    Collaborative efforts

    By working together, as a team, we can strengthen the foundation of Today’s Internet, so that we avoid another Heartbleed. I look forward to not only work on code, but also with different people spread across the globe and who speak different languages. There’s something beautiful in Open Source: Despite our divergent opinions, we are able to work together. I believe that our strength comes from our ability to readjust ourselves to an increasingly hostile Internet.

    Google Security Supplier, am excited for this new adventure! 🙂


    –Logan

  • 23:59:60, the cyberisland and the leap second that we forgot



    The US is busy planning for the leap second transition


    Please see my previous blog post if you are not familiar with the leap second issue.


    The US has a document for “Best Practices” (URL: http://www.gps.gov/news/2015/05/leap-second/2015-best-practices-for-leap-second.pdf) which has been published by the Department of Homeland Security. I’m going to quote a few sections from it: Sponsored by the National Cybersecurity and Communications Integration Center in coordination with the United States Naval Observatory, National Institute of Standards and Technology, the USCG Navigation Center, and the Nation al Coordination Office for Space – Based Positioni ng, Navigation and Timing . This product is intended to assist federal, state, local, and private sector organizations with preparations for the 30 – June 2 015 Leap Second event.

    Below the introduction part of the document are a list of well detailed steps to prepare for the transition for the leap second that will occure on the 30th of June.

    Meanwhile in Mauritius

    I immediately went to look for the same information for Mauritius. My first choice is the Mauritius Standards Bureau. Looking at the relevant pages show nothing about Time (url: http://msb.intnet.mu/).

    My 2nd choice is thus CERT-MU, which is the Mauritian equivalent of CyberSecurity, expecting to find a document for “Best Practices” for the Leap Second. Result of the search on CERT-MU website : Zero.

    At this I start wondering what could be impacted by leap second in Mauritius. Websites crashes have been reported when previous leap seconds were added. Quote from a website: Sites such as Reddit, Gawker, LinkedIn, Foursquare and Yelp crashed after a “leap second” was added to the universal clock in order to keep up with the Earth’s rotation. So, A few critical websites might crash. This is important to everyday users.

    Other problems ?

    Wikipedia says that: Older versions of Motorola Oncore VP, UT, GT, and M12 GPS receivers had a software bug that would cause a single timestamp to be off by a day if no leap second was scheduled for 256 weeks. How many companies are relying on GPS for their operation: Car fleets, Car drivers, boats, and people with smartphones, and The Amadeus airline reservation system was disrupted for more than two hours which affects plane fights.

    Conclusion

    Important information such as leap second transition should have been available on CERT-MU website so that people and organizations can better prepare themselves, and avoid disruptive problems across the Mauritian Infrastructure.

  • Government of Mauritius website allows weak security



    govmu.org

    A few days ago, Sruti mentioned on the Mauritius Internet Users mailing list that she had problems resetting her password on the Mauritius Government website.

    Out of curiosity, I decided to check if the login works correctly. While working on this, I made an interesting observation: The connection offered on the website is weak, in terms of security !

    By observing the SSL connection on my smartphone I came across a weak encryption offered by m.govmu.org, which is mobile version of the government of Mauritius website. Stunned by this discovery, I also check the PC-version of the government website and noticed that It also offers the same weak encryption.

    SSL handshake has read 2749 bytes and written 362 bytes
    —
    New, TLSv1/SSLv3, Cipher is RC4-MD5
    …
    SSL-Session:
    Protocol : TLSv1
    Cipher : RC4-MD5

    The govmu.org website allows RC4-MD5 which is considered to be weak encryption, according to RFC7464 . The document, which is now a standard on the Internet, recommends removal of RC4 as an encryption mechanism, due to practical attacks demonstrated against it.

    Implications for Mauritian Citizens

    It is possible to intercept and decrypt sensitive Information that a user sends to the Mauritius Government website, as it is. It is possible to set-up a practical attack, under certain circumstances. This is more dangerous, as more and more people are using wifi which magnifies the problem.



    –Logan

  • 23:59:60, the cyberisland and the leap second that we forgot



    The US is busy planning for the leap second transition


    Please see my previous blog post if you are not familiar with the leap second issue.


    The US has a document for “Best Practices” (URL: http://www.gps.gov/news/2015/05/leap-second/2015-best-practices-for-leap-second.pdf) which has been published by the Department of Homeland Security. I’m going to quote a few sections from it: Sponsored by the National Cybersecurity and Communications Integration Center in coordination with the United States Naval Observatory, National Institute of Standards and Technology, the USCG Navigation Center, and the Nation al Coordination Office for Space – Based Positioni ng, Navigation and Timing . This product is intended to assist federal, state, local, and private sector organizations with preparations for the 30 – June 2 015 Leap Second event.

    Below the introduction part of the document are a list of well detailed steps to prepare for the transition for the leap second that will occure on the 30th of June.

    Meanwhile in Mauritius

    I immediately went to look for the same information for Mauritius. My first choice is the Mauritius Standards Bureau. Looking at the relevant pages show nothing about Time (url: http://msb.intnet.mu/).

    My 2nd choice is thus CERT-MU, which is the Mauritian equivalent of CyberSecurity, expecting to find a document for “Best Practices” for the Leap Second. Result of the search on CERT-MU website : Zero.

    At this I start wondering what could be impacted by leap second in Mauritius. Websites crashes have been reported when previous leap seconds were added. Quote from a website: Sites such as Reddit, Gawker, LinkedIn, Foursquare and Yelp crashed after a “leap second” was added to the universal clock in order to keep up with the Earth’s rotation. So, A few critical websites might crash. This is important to everyday users.

    Other problems ?

    Wikipedia says that: Older versions of Motorola Oncore VP, UT, GT, and M12 GPS receivers had a software bug that would cause a single timestamp to be off by a day if no leap second was scheduled for 256 weeks. How many companies are relying on GPS for their operation: Car fleets, Car drivers, boats, and people with smartphones, and The Amadeus airline reservation system was disrupted for more than two hours which affects plane fights.

    Conclusion

    Important information such as leap second transition should have been available on CERT-MU website so that people and organizations can better prepare themselves, and avoid disruptive problems across the Mauritian Infrastructure.

  • Havoc on the 30th of june

    Big news: The earth is not rotating uniformly !

    Planet earth does not rotate uniformly. They are some subtle changes that affect its rotation. Those subtle changes affect the reference clocks that are used to keep time accurate on your computer, your smartphone, and the servers at Google, Yahoo!,Facebook, and instagram. If you think that time is not important, Have a look at your facebook posts, and see the time-stamp attached to each facebook post. Time is used everywhere on the internet 🙂

    A Leap second

    To account for those subtle changes in rotation, a leap second was introduced. A second is introduced each time those subtle changes occur. However, that insertion can cause issues on systems such as GPS. Some systems might not be able to handle the additional second, and crash and/or overload. The next leap second will occur on the 30th of June at midnight.

    Keep your time in sync

    The solution consists of using an NTP client on your servers, and correctly sync with a reliable Time Source, such as pool.ntp.org. So, please make sure that your servers are properly configured with NTP 🙂



    –Logan

  • Top websites visited by Mauritius and the compromised cyberisland


    Alexa top 10 Websites visited by Mauritians

    alexa

    Alexa is a web statistic tool which is very useful. The problem in Mauritius, is that we do not have much statistics. I was expecting facebook, yahoo, and youtube. One site (ask.com) immediately drew my attention and I knew that something was very wrong in Mauritius !



    Ask.com or how a lot of computers are compromised in the Cyberisland


    The ask toolbar is generally found on computers that have been compromised, and installed surreptitiously. At the 10th place, we have ask.com, which is a malware that infects a lot of browsers. I saw it on a few laptops of my co-workers, and friends. However, I never imagined that it was so widespread in Mauritius! Widespread enough that it’s the 10th most visited website by the island ! ask.com is typically accessed via browser toolbar that generates bad search results, and is notorious to remove completely.

    Ask toolbar slows down the computers on which it is installed. It is very difficult to remove completely. The computers that have ask toolbar installed are very likely to contain other malware. Those computers tend to slow down entire corporate networks due to excessive traffic. Microsoft rates it as high, in terms of security severity: Microsoft Advisory. I went to check with CERT-MU which is the in its own terms “… Mauritian Computer Emergency Response Team (CERT-MU), a division of the National Computer Board (NCB), Mauritius, to educate and enhance the awareness of the general public on the technological and social issues facing internet users, particularly on the dangers of getting online.” and found nothing concerning ask toolbar.



  • Using Linux or BSD as your slave for repetitive editing

    Generating URI on blogsum

    Blogsum is a minimalist & secure CMS which I use. The only problem so far is generating the blog post URL. Generally, it’s a long string of text such as Using Linux or BSD as your slave . However, I cannot use this as a URL generator. One way would be to use javascript or any decent client-side language to do that. What output would I expect ? Something like “Using-Linux-or-BSD-as-your-slave” . That’s a pain to generate manually: I have to copy-paste it, and replace every space with a ‘-“. However there is another way if you’re using Linux or BSD.

    The power of sed

    Some people tend to jump on fully fledged programming languages like Perl, or Python. To me, it’s like using a car to travel 5 meters down the road. The same group of people would probably use google to look up thousand of ways to do the editing. There’s a way to do it on a single line of fairly readable code, using sed. Sed is a tiny piece of software available under all BSD and Linux systems. It stands for “Stream Editor”. Sed can be used to do a lot of complex tasks.

    sed has an easy to remember usage pattern for those kind of tasks that you can type on your terminal:

    echo "Using Linux or BSD as your slave for repetitive editing" | sed 's/ /-/g'

    The output is: Using-Linux-or-BSD-as-your-slave-for-repetitive-editing

    Analysing the command we just typed

    echo just prints whatever you want. echo “XXX”, would print XXX on a terminal. By using echo “XXX XXX” and adding a ‘|’ we take the “XXX”, and send it for further processing. In this case, we send it to sed.

    sed takes the input “XXX XXX”, and applies an operation. In this case the, s means substitute. Now, what do we want to substitute ? We want to substitute the space character, with “-“. we use the / and then the ” ” to tell that to sed. Now, what character do we want to use ? the “-“. We use ‘/’, and then ‘-‘, and another / to terminate the expression. What does the ‘g’ stand for ? By default it will replace only the first occurence of space with “-“. We need to do it for all instances of space. so we use g for “global” replacement. That’s it: we’re done. Linux or BSD just did the grunt work for you 🙂



    (Please don’t hesitate to leave your comments :))
    –Logan

  • Using Linux or BSD as your slave for repetitive editing

    Generating URI on blogsum

    Blogsum is a minimalist & secure CMS which I use. The only problem so far is generating the blog post URL. Generally, it’s a long string of text such as Using Linux or BSD as your slave . However, I cannot use this as a URL generator. One way would be to use javascript or any decent client-side language to do that. What output would I expect ? Something like “Using-Linux-or-BSD-as-your-slave” . That’s a pain to generate manually: I have to copy-paste it, and replace every space with a ‘-“. However there is another way if you’re using Linux or BSD.

    The power of sed

    Some people tend to jump on fully fledged programming languages like Perl, or Python. To me, it’s like using a car to travel 5 meters down the road. The same group of people would probably use google to look up thousand of ways to do the editing. There’s a way to do it on a single line of fairly readable code, using sed. Sed is a tiny piece of software available under all BSD and Linux systems. It stands for “Stream Editor”. Sed can be used to do a lot of complex tasks.

    sed has an easy to remember usage pattern for those kind of tasks that you can type on your terminal:

    echo "Using Linux or BSD as your slave for repetitive editing" | sed 's/ /-/g'

    The output is: Using-Linux-or-BSD-as-your-slave-for-repetitive-editing

    Analysing the command we just typed

    echo just prints whatever you want. echo “XXX”, would print XXX on a terminal. By using echo “XXX XXX” and adding a ‘|’ we take the “XXX”, and send it for further processing. In this case, we send it to sed.

    sed takes the input “XXX XXX”, and applies an operation. In this case the, s means substitute. Now, what do we want to substitute ? We want to substitute the space character, with “-“. we use the / and then the ” ” to tell that to sed. Now, what character do we want to use ? the “-“. We use ‘/’, and then ‘-‘, and another / to terminate the expression. What does the ‘g’ stand for ? By default it will replace only the first occurence of space with “-“. We need to do it for all instances of space. so we use g for “global” replacement. That’s it: we’re done. Linux or BSD just did the grunt work for you 🙂



    (Please don’t hesitate to leave your comments :))
    –Logan

  • Karbonn Sparkle V & Android One

    Android One

    Android One is a label that targets emerging markets. It specifies the minimum hardware requirements that a smartphone must have to be supported for 2 years by Google. This is one of the major opportunities for us in Mauritius. Some of you may think that it’s too good to be true, but it exists, as I got myself an Android One phone !

    Karbonn Sparkle V

    I bought an android-one certified phone from an Indian Manufacturer Karbonn. Mine is the Karbonn Sparkle V. When I got it, It was still on Android 4.4. As soon as I configured the wifi, It offered the possibility to be updated to Android 5.0 . Many high end phones are still shipping with Android 4.4 today without any updates to Android 5.0. sparkle


    • Display size: 4.5 inches
    • CPU: Quad-core 1.3 GHz Cortex-A7
    • Internal memory : 2GB
    • GPU: Mali-400MP2
    • RAM: 1GB
    • Camera (back): 5 MP, 2592 х 1944 pixels, autofocus, LED flash
    • Camera (front): 2MP
    • GSM: 2G, 3G, 4G



    User experience

    Yesterday night, I updated to Android 5.1.1. UX-wise, the phone is very responsive, and snappy. My only complaint would be the lack of internal storage space. I think that 4GB would have been better. Another version of the Sparkle is currently brewing. I hope that Google bumps the hardware specs for the next Android One label. The price is very competitive: Rs 5700-5900 depending on where you buy it. Overall, I’m very happy with my purchase, and I definitely plan to buy another Android One phone at the end of this year.


    Android One firmware

    firmware

    It is worth pointing out that Google offers 2 years of firmware update support. This is fantastic, as I get the equivalent of a Google Nexus phone, at a much more reasonable price. This is the major win for the Android One phones. Unlike manufacturers that tend to ignore firmware updates after 6 month, Google makes a smart move here.




    –Logan