text:
James Jaros' new novel Burn Down the Sky offers a disturbing take on the post-global-warming dystopian setting. Our civilization is no more, thanks to skyrocketing temperatures and a catstrophic water shortage — and then there's the deadly "Wicca" virus.
Check out the first chapter of Jaros' horrifying post-apocalyptic novel below.
Texas School Board Demands Equal Time for Climate Change Challenge
"Warming is only theory," board says — Associated Press
"Nonessential" Plane Travel Banned
Desperate measure to cut greenhouse gases
Critics call it "too little, too late" — Washington Post
Sweat dripped from the tip of Ananda's nose, darkening the dust. The girl raised a shovelful of dirt from the cracked bed of an empty reservoir and topped off a sandbag. Her mom tied a quick knot, heaved it aside, and snapped open another hand-sewn sack. Two men raised the wall behind them.
"Don't stop, hon. We're almost there."
Her mother had caught her staring at the steep sides of the basin-rising like cliffs, crumbling like chalk-before nudging the shovel with her foot. Ananda sank it back into the hard ground, the sun brutal on her back. Every story she'd ever heard about disasters called for gray skies, stormy skies, but there had never been a disaster like this one-that's what her dad said-and the sun rarely strayed. The evidence surrounded them in ring upon ring of shimmery, deadly heat. There was the reservoir on which she stood, a moat of parched earth and insects extending miles from the camp in every direction. Then high above her at the top of those clumpy cliffs lay the shoreline where huge summer homes had once peered down at unthinkably cool blue water before the flames claimed them, too. And beyond the circle of charred houses rested the silent forests, burned to oblivion by the same relentless force that had gutted those lavish homes-the savage orb that would not waver.
Ananda had never known the world beyond the fallen forests, but she imagined the fiery rings radiating all the way to the sun itself, sparking those death rays in the sky.
The wall now rose to her mother's eyes; only a few feet remained before the camp was enclosed. They'd been building it for seven days, but what could it keep out. What?
Her mother had been vague, her father less so. Before leaving to scout the perimeter this morning, he'd said it would keep out coyotes, wolves, panthers, bears, marauders.
He'd mentioned the marauders almost as an afterthought, but Ananda knew better: Another scout had spotted them moving south from Knoxville ten days ago. They'd always thought the camp was isolated, far from the plundering. Plans for the wall had begun immediately.
As she shoveled, she glanced through the narrow opening to the camp garden, shaded by a patchwork of old clothes, torn blankets, tattered tarps-anything that could defy the sun, even weakly. Sunlight in only the smallest doses, and each plant watered by hand, by drips. The greens-chard and kale and spinach-hung withered as the faces of the old men and women who looked after every leaf, picking off the constant bugs and crushing them with fingers turned the dun color of earth.
Ananda and her mother formed half of a work crew that included the men who raised the actual wall and plastered it with a mud mix more precious than the jewels of old. Her father's brother, Uncle Rye, tall and lean like him, thrust the final sandbag into place as the sun slipped behind the distant cliffs, briefly backlighting the ruins.
Always the tang of wood smoke in the air, sulfurous and sweet, even when the fires couldn't be seen, as if the flames had stalked the last breath of the land deep underground, burning the roots and rocks and worms until the world above collapsed into the world below. Making a hidden hell to match the one they'd left to the eye.
Even the cracks in the lake bed appeared to smolder, though they'd built the camp as far as possible from the combustibles that formed the reservoir's towering, blackened border. Nothing lived down here but what they tended-the garden, themselves. Grains of hope.
"Is Dad going to make it back tonight?" Ananda always worried when he was gone, saying good-bye to him at dawn with pleading in her eyes.
"Yes, he'll be back." Her mother's hand fell to her back, rubbing it briefly as they walked past the picked-over berry patch by the camp's lone spigot, its lip dry as crust at the end of the day. It was drawing the last of the groundwater, and even the littlest children knew this. It might last another year. It might dry up tomorrow. No one wanted to contemplate the next step because it would be a step, maybe a million of them, each more dangerous than the last as a new search began.
Ananda looked around. At least here, she thought, we have the wall, now. Water, now. Food, now. Out there-beyond the cliffs and rubble and burned trees, beyond the empty cities-were only rumors of the worst the world can offer.
"Reduced to rumors." Her father had once said that while staring at the sky, as if bewildered by the breathless weight of his own words, no more believing them than the absence of clouds or rain. He'd put his hand on her shoulder and said, "I'm sorry."
She and her mom sat outside their tent on a sheet of pink plastic salvaged from the long journey here, a story she first heard as a toddler. Everything they owned held a story, for nothing had come easily, so a piece of plastic, bleached by the blazing sky to the palest hint of color, had a history and an imagined past in a better time.
A centipede crawled toward her foot. Her mother crushed it so quickly that Ananda only glimpsed it moving.
Her mom didn't need to tell her about centipedes or snakes, or the prickly toxic plants that could sprout in the cracks of the lake bed. Her parents had been graduate students in wildlife biology before the final fall forced them south. They taught survival classes in the camp, though only days ago Ananda had heard the other adults argue for a gentler name. But her mother had said the children needed to know "the stakes."
Her mother's eyes were never easy, always searching, like they'd seen too much, and having seen too much were forced to look for even more.
Looking now for Bliss. On the same day Ananda had been assigned to wall building, her older sister was given cistern duty. Critical work. Her mother's eyes looked through the long dusk for Bliss to return.
The camp had four large cisterns buried in the lake bed, and a network of gutters to harvest the rare rain. Not a drop could be wasted. Everyone grabbed cups and bowls and sheets of plastic and ran around catching it, mad with relief and laughter, and drinking their fill while they could. Festive, like a holiday. Rain! Without its sparse offerings, they would have dried up the groundwater long ago and been driven to the Gulf, dead and heating still, dark with velvety oil slicks and derricks long abandoned.
They'd come to Alabama ten years ago, though the names of states meant nothing now. Droughts knew no borders. Neither did the gritty wind or the thunderheads that devoured the sky before battering the land with vicious bursts, flooding it, washing away the rich soil until every remaining ounce became a treasure greater than gold. Hating the waste of so much water, and hating the passing of those clouds, too, the remote promise of their angry anvil shapes vanishing like a moment's rage.
Bliss and her work crew had been hiding the openings to the cisterns, drawn down to a nine-day supply. Rationing had begun with the building of the wall, a struggle for Ananda, who perspired heavily. Her mother had shared her rations.
"If marauders come, we'll claim the drought like a friend," her father had said last night, "because having nothing might drive them on without a battle."
"They want more than water," her mother had replied. "They want-"
Before her father could speak, her mother silenced herself. But Ananda knew what she would have said: "They want girls." And she knew why her mother had stopped speaking: the fear of Wicca.
Her parents had told her about the virus a little more than a year ago. They'd sat her down in their tent after the evening communal meal and closed the flaps. Bliss had stood outside to make sure the littlest children didn't overhear what was about to be said. Her mother had told her to listen carefully, that they didn't want to dwell on what they had to tell her, "but you're older now, and you need to know." Her mom began by saying that Wicca had a scientific name: Immune Disintegration Disorder, or IDD, but that "Wicca" had come into far greater usage after enraged fundamentalists of all faiths started calling it the "devil's disease."
Ananda had sat still as the air in the tent as her mother said that the Wicca virus confined safe sex between men and women to the twelve months after menarche. "After that, sex will almost always kill you. So sex can't happen, Ananda," her mother had said in her gentlest voice. "Ever."
"But you have sex. You had me and Bliss."
"No, not anymore. Sex is too deadly now. And it's a horrible death, Ananda. It's so bad it makes people kill themselves. It's madness." Then her mom stared at her so intensely that it frightened her.
"Meaning?" Ananda whispered.
Her parents had glanced at each other. Ananda watched her father shake his head.
"Can you just accept that for now?" he asked her. "That it's the most horrible disease ever?"
Her parents never talked to her about Wicca again, but every day since then the disease had felt as real as the ravaged earth. Even Bliss wouldn't talk about it. "The more you know," her sister told her, "the less you'll wish you knew."
Now, Ananda watched everyone in the camp return to their tents, sitting as she and her mother were, by the front flaps. Fatigue quelling boredom, as it did every day. They numbered almost 140 people, about half of them children, and were joined not by a common religion, other than a shared understanding that religion had failed them as surely as other earthly institutions; or by a common hope beyond survival, because hope in its most magisterial realms-home and land alive with the abundant fruits of labor-had failed them, too.
But survival itself was a powerful unguent, soothing their everyday differences and holding them together like the mud they made from sand and clay and compost, which turned fifty-pound sandbags into a wall. Joined also by the weaponry they shared. Ananda, along with the other children ten or older, knew how to use their eclectic collection of revolvers, knives, swords, chains, semiautomatic pistols, shotguns, and three fully automatic rifles. Firepower looted from an armory, back when armories still stood brazen against the world.
Well-armed for a camp, but not like the marauders who had the richest redoubts showering them with food, fuel, weapons, and armor-plated vehicles-all they needed to hunt girls. That was the scariest rumor Ananda had ever heard: that gangs roamed the land "harvesting" girls like her for sex.
Her parents wouldn't say, and neither had Bliss. But Ananda sensed that everything the girls whispered about sex harvesting was true. She'd glimpsed it in the eyes of her sister, turning cold when one of the older boys in their own camp let his gaze linger on her chest, which had grown in the past year. Ananda had also noticed Bliss's small breasts, and above them, always alert, her icy blue eyes.
Her mother was still looking for her.
"What if Dad doesn't get back tonight?" The sky was darkening.
"I told you, he'll be back."
Empty words. One way or another they said empty words every day, until they could have filled the reservoir with their meaninglessness.
Ananda stood, jumping up to look over the wall to try to catch sight of her father first. Nothing but the vast plain of lake bed. Her father had stayed away at night only twice before, both times after he'd spied marauders and couldn't risk capture. The marauders had little interest in men, she'd overheard her mother telling Bliss, but rendered their bodies for their dogs.
Dusk, thankfully, was slow this time of year, one of the few clues to the season. "You study the angle of the sun to know winter from summer," her dad had told her. But it seemed a crime to have to measure angles to know the season.
"It is a crime," her father agreed.
"Then someone's got to pay," she said.
"In the best of worlds, someone would."
Still, she welcomed the angle because when she jumped again, the late light revealed dust rising above a distant hummock in the lake bed. A wisp, that's all, and it might be no more than a dust devil dancing teasingly. But it was her father.
"Dad!" she screamed. "He's running!" She raced to the wall, hurling herself up to the top. He was running with Hansel, their mastiff mix, by his side. Hansel looked behind them.
Ananda heard her mother yelling, "Open the gate. Open it," before ripping off the chains herself.
Her father was a half mile away. At least. She'd never seen him run so hard. His rifle was strapped across his back and his bandolier flapped against his bare chest. His hair, long and banded, bounced behind him.
He screamed at Hansel. Ananda couldn't hear him, saw only the hand gesture that came with the command "Home." The huge dog slowed, as if torn between his master and the order, then raced ahead.
Ananda sickened when she saw her father's command, even more when her mother screamed "No" as an armor-clad truck roared around the hummock, churning up a hurricane of dust.
Her mom pulled her down from the wall. "You are not to watch."
Ananda broke free and hoisted herself back up. She saw Hansel nearing the gate, her father still so far away.
Her mother pulled her back down again, shouting, "Go to the hiding place now."
"But Mom," she pleaded, "Dad's-"
Her mother pushed her into the arms of a woman who rushed her to the root cellar on the other side of the camp.
Ananda hurried down the steps and slipped into the darkness carved out of the earth behind a false wall, hiding with other girls-nine-, ten-, eleven-, and twelve-year-olds. Even a fifteen-year-old. But not Bliss. One year after menarche, Bliss had been freed from having to hide. She would be at the wall with a pistol. Everyone had trained for this.
Ananda heard the root cellar door close. Not locked. Too obvious. But the entrance to the false wall would yield only to force.
"Nanda," whispered Imagi.
Ananda drew the girl close. A nine-year-old, but younger than the three years that separated them. "Down syndrome," Ananda's father had told her. Imagi had a big round face, wide-open eyes.
"We have to be quiet," Ananda said.
Imagi giggled and shouted, "Quiet."
The other girls hushed her at once. Bella, another twelve-year-old, said "You've got to keep her under control, Ananda."
They waited. So few sounds reached the root cellar, then the crack of bullets.
Imagi stiffened. So did Ananda, but she put her hand over the girl's mouth.
"Remember the game?" she said to her.
Imagi nodded in the blackness.
"It's starting now."


text:
The United Nations Environment Program (UNEP), in partnership with TreeHugger, has launched the third World Environment Day (WED) blogging competition.
The winner will receive a free trip to Brazil - the host of this year's World Environment Day on 5 June 2012 - to write, blog and tweet about WED events in the country.
Bloggers are invited to enter the competition via online submissions of blog articles on the Green Economy. This ties in with the overall WED 2012 theme - Green Economy: Does It Include You? - which aims to highlight opportunities for moving towards low carbon, resource-efficient and socially inclusive sustainable development.
To enter, bloggers can post a link to Green Economy stories on the UNEP Facebook page http://facebook.unep.org with this comment, "I just entered to win a trip to Brazil for UNEP's World Environment Day 2012. Read my blog post and discover how the Green Economy includes you."
Entries must be made between 16 January and 12 February 2012.
To increase your chances of winning, post your story on Twitter with the hash tag #WED2012, and encourage friends to comment, 'like' the post on Facebook, and retweet your post across Facebook and Twitter.
The top ten bloggers, selected by a UNEP-TreeHugger jury, will be invited to a take part in a second round of blogging - a blogdown!
The winner of this blogging showdown will be determined by an online community via the World Environment Day website. Shortlisted bloggers will be awarded one vote for every 'like' that their entry receives online.
The blogger who accumulates the most votes by the end of April 2012 will win the competition and be invited to travel to Brazil to blog about World Environment Day.
The short-listed and winning posts will be published on TreeHugger and the World Environment Day websites.
What's included in the prize?
Flights, accommodation, visa costs, insurance, and travel within Brazil to WED events will be covered.
World Environment Day is on 5 June 2012. The competition winner will be flown to Brazil for three days, beginning June 3rd and ending June 6th 2012.
Entrants will be expected to ensure they are able to travel to Brazil during the period above and to cover any other costs (e.g. vaccinations).
For all terms and conditions, please visit: http://www.unep.org/wed/blog/
More information on the Green Economy can be found at: www.unep.org/greeneconomy
For a complete list of UN or partner competitions, click here.
The Brussels based United Nations Regional Information Centre for Western Europe - UNRIC provides information on UN activities to the countries of the region. It also provides liaison with institutions of the European Union in the field of information. Its outreach activities extend to all segments of society and joint campaigns, projects and events are organized with partners including the EU, governments, the media, NGOs, schools and local authorities.
United Nations Regional Information Centre for Western Europe (UNRIC Brussels)
Residence Palace, Rue de la Loi/Wetstraat 155, Block C2,7th and 8th floor, Brussels 1040, Belgium
Tel.: +32 2 788 8484 / Fax: 32 2 788 8485

subset: commoncrawl


text:
Setting off political debate abortion issues divide Portuguese government
Monday, 30-08-2004; Portuguese press reported today that the Portuguese Social Democratic Party (PSD) has divided opinions on the decision the Portuguese minister of defense Paulo Portas made representing the Portuguese government, namely forbidding Women on Waves' boat to enter Portuguese territorial waters.
The reasons given to prohibit the boat from coming to land did not convince some of the members, as the issues about abortion and about the boat divide the opinions within the coalition party. For example, the deputy Salvador Massano Cardoso, as a doctor, does not understand the argument given that states that the boat endangers public health. He does not understand this because the abortion pill administered upon the boat is the same pill used European countries without endangering public health there. In this same way, the vice president of parliament, Ana Manso, has already stated that she agrees with the arrival of the boat. This opinion is shared by the leader of Juventude Social Democrata (JSD, Youth Social Democrats), Jorge Nuno Sá, who also supports the debate on abortion that the Women on Waves initiative has as its objective.
The ex-president of PSD, Marcelo Rebelo de Sousa, has criticized the right wing party CDS-PP, to which the minister of defense Paulo Portas belongs, for taking the position it has in relation to the Women on Waves boat, even though they have already agreed to alter the laws concerning abortion during the next term in 2006. This promise is in conflict with the ruling that the government has made to block the boat. Blocking the boat is moreover also in conflict with United Nations marine conventions. This criticism was also expressed by Isabel Meireles, one of the best advisors in Portugal regarding international law, in the Portuguese daily newspaper Jornal de Notícias.
It is not only they divergence of opinions within the parties that is creating friction within the government, but also the fact that the decision was made exclusively by the ministry of Defense, while the issues involved are also relevant to the ministry of Foreign Affairs.
The government has however already announced that they will not restrict access to the Women on Waves boat while it is in international waters, and thus the vessel will adhere to the same law as the country where the boat comes from, in this case, to Dutch law.
The measures taken by the current government are critical for the oppositional parties. The three candidates for leadership of the Portuguese Socialist Party (PS), João Soares, José Sócrates and Manuel Alegre, have already protested against the decision made by the current PSD/CDS-PP government and the Portuguese Department of Socialistic Women has criticized the acting government as "arrogant, preposterous and incapable of representing the different opinions as expressed in a true democracy". The Socialistic Youth agrees that the attitude the acting government has taken goes against European Union conventions and have decided to hold a press conference next to the Women on Waves boat today.
The Portuguese Left Block announced that during the conference of the permanent part of the parliament, which will be next Thursday, they will ask the acting government to justify these measures they have taken.


text:
Logo of the Month: Chattanooga Lookouts
Affiliation: Los Angeles Dodgers
League: Southern League (AA)
Home Field: AT & T Field
Location: Chattanooga, Tennessee
Notable Alumni: Harmon Killebrew, Burliegh Grimes, Ferguson Jenkins, Trevor Hoffman, Adam Dunn, Pete Rose Jr.
Fun Facts: This franchise has been around since 1885 (that's 124 seasons of Lookout baseball). The team played an exhibition game against the Yankees in 1931. At one point during the game, 17 year-old female pitcher Jackie Mitchell struck out Lou Gerhig and Babe Ruth. Just days after the game, MLB commisioner Kenesaw Mountain Landis voided Mitchell's contract, stating the baseball was too strenuous for females. Mascot name is Looie. In 2009 the Lookouts won the Larry MacPhail trophy for best promotions by a Minor League Team.
6 Comments
Always loved this team name/logo combo. Pretty cool. Thanks for the history lesson on the she-pitcher too. Had no idea. Struck out the Babe AND Gehrig? Must've had some arm. I wonder what else she had…
I always liked the Lookouts logo, too. It's original yet simple. This is a team I would love to go see because of it's history. An episode of 'Baseball's Golden Age' was about Mitchell, and her striking out the Yanks. Really peeked my interest. This is one of the stories that makes baseball so great.
Love the logo and the history. Should have included it in my gigantic research paper last year.
My dad got me a Chattanooga hat after a trip to Tennessee. BEST HAT EVARH!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!


text:
Your shopping cart is empty.
engraved signs come with a standard Helvetica block font, however. You
can choose your desired font within the design feature we have available
when ordering. Sign borders are beveled edges to enhance the
appearance. Wall and desk holders available for professional finish.
• Material: 2 Ply Acrylic Plastic
• 10"x6"
• Thickness: 1/16"


text:
The sound of an F1 engine has changed so much over the years. While I like the high pitch whine of the current cars, it sounds more like a missile being fired than a race car. But I shouldn't complain as I'm sure one day they will be electric or something that doesn't make any noise. That'll really suck. Because I like the noise.
Frankly, I think the noise is as much a part of a Formula One car as the driver or the circuit. But the thing that is hard to believe is what they sound like only five feet away at full launch. I have been in the grandstands of a handful of F1 races but at five-to-ten feet...It's madness.
I was doing just fine till the Lotus Lamborghini pulled up and it didn't even launch hard. I have no idea why that engine hurts so much but after it went by I felt liquid run out of my ears, not blood but some weird liquid like it just drained my sinuses. I'm totally serious. I didn't have earplugs but figured how bad could it be? I could barely hold the camera still by the end it was so loud.
As for which car I would like to drive the most in the video? I'd trade a testicle to race in the 1968 Lotus Cosworth or the 1993 Williams Renault in period correct races. How about you?


text:
DOHA, Qatar (AP) — Qatar's prime minister says the Gulf nation will give Egypt another $3 billion to bolster its ailing economy and help rebuild key industries.
The pledge on Wednesday adds to Qatar's previous promises to invest up to $18 billion in Egypt over the next five years. It also highlights a critical economic lifeline for Egypt's governing Muslim Brotherhood, which has close ties with Qatar's rulers.
Qatar's prime minister, Hamad bin Jassim Al Thani, also said that the Gulf state will increase natural gas shipments to Egypt in the summer to help its overburdened energy networks.
The announcements followed talks with visiting Egyptian Prime Minister Hesham Qandil.
Egypt's economy has tumbled since the fall of Hosni Mubarak two years ago. Unrest has scared away foreign investors and crippled the vital tourism industry.


text:
Item description: Drawing, dated 27 April 1863, of the U.S.S. Monitor, drawn by Herbert E. Valentine, a private in Company F of the 23rd Massachusetts Volunteers, who served in the United States Army between 1861 and 1864 in eastern Virginia, North Carolina, and South Carolina.
Valentine enlisted in the United States Army on 5 October 1861, at Salem. On 18 October 1861, he was mustered into Company F, 23rd Regiment, Massachusetts Volunteers at Lynfield. Valentine served as a clerk and occasionally drew military maps. His artwork presumably was not produced for official purposes. In January 1864, Valentine was serving at Getty's Station near Portsmouth. In May 1864, Valentine's regiment sailed up the James River to City Point and took part in the siege of Petersburg.
Valentine did not re enlist at the expiration of his service and was discharged from the army on 16 October 1864. He married, had one son and one daughter, and spent the remainder of his life in West Somerville, Mass., occupation unknown, where he died on 17 June 1917. Valentine was active in veterans organizations, and in 1896 he published Story of Company F, 23d Massachusetts Volunteers in the War For The Union 1861-1865.
Item citation: From the Herbert E. Valentine Papers #4397, Southern Historical Collection, The Wilson Library, University of North Carolina at Chapel Hill.


text:
The biggest attention grabber at the Met's upcoming production of "Siegfried" won't be some Nordic diva. It's going to be the advanced 3D projections on a 45-ton set that will create an intricate forest scene. Better still: audiences own't have to dawn those geeky glasses:
For its visual sleight of hand, the 3-D technology being deployed at the Met will also interact with the movement of the set. The set uses a bank of projectors, motion-capture cameras and computers to fashion the images. The tilt on the stage allows for hundreds of different projections, changing in slivers of a second, at the different depths to help create, say, the colour, shading and contour of a rock, or at least to convince the eye.
The imagery is rendered in realistic detail using fractals: fractured geometric shapes that keep iterating reduced-size copies of themselves according to mathematical formulas. When the fractals are programmed into the computerized light system, the result is a dense symphony of geometric detail, giving the illusion of three dimensions.
Exciting that they can do this! Whether they should, though, depends on just how how big a headache those fake rocks give you by the second act. [NY Times]


text:
Wednesday, June 30, 2004
Review of Network Security Hacks Posted
"'Network Security Hacks' (NSH) has something for nearly everyone, although it focuses squarely on Linux, BSD, and Windows, in that order of preference. Administrators for commercial UNIX variants (Solaris, AIX, HP-UX, etc.) should be able to apply much of the book's advice to their environments, but they are not the target audience. NSH is written for admins needing quick-start guides for common security tools, and in this respect it delivers."
Sunday, June 27, 2004
Review of Secure Architectures with OpenBSD
"About a year ago I read and reviewed Michael Lucas' excellent "Absolute OpenBSD." That book covered OpenBSD 3.2 and the CURRENT of that time, pre-3.3. Palmer and Nazario's "Secure Architectures with OpenBSD" (SAWO) addresses OpenBSD 3.4, which at the time of writing is just behind the current release (3.5). Lucas' book is an excellent introduction to OpenBSD by a relative outsider; SAWO is a more detailed discussion by insiders. Each has its strengths and I highly recommend both."
Contribute Your dmesg Output
Thursday, June 24, 2004
Interesting Email from Stephen Northcutt... or not?
"From - Thu Jun 24 22:27:26 2004
X-UIDL: 40a19c3900000b29
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
X-ClientAddr: 18.104.22.168
Received: from 63-100-47-56.sans.org (63-100-47-56.sans.org [18.104.22.168])
Date: Fri, 25 Jun 2004 2:14:37 +0000
Message-Id: <email@example.com>
From: Stephen Northcutt
Subject: Stephen Northcutt needs your help
Precedence: bulk
To: Richard Bejtlich (SD599258)
This note is intended for U.S. citizens and is a personal note from Stephen Northcutt. For the past few weeks CERT and SEI, DoD government funded organizations, have been purchasing google adwords so that when people search for "SANS Training" they see an advertisement for CERT/SEI's network manager course.
I have a couple of concerns about this. The first is trademark or brand related, when you search for SANS training, you should get SANS training. Other competing commercial training companies have also engaged in this behavior and when I have written them and asked if this how they want to be remembered by the security community, they have discontinued this practice. I wrote firstname.lastname@example.com a couple weeks ago and they continue this practice.
My second concern is that the government offering the course violates the spirit and letter of OMB A 76. "Two of the key principles of Circular A-76 has always been that "in the process of governing, the Government should not compete with its citizens" and that "a commercial activity is not a governmental function."
The course:
The funding:
My third concern is the amount of tax we pay as citizens. The government is in the process of authorizing about 481 billion dollars for DoD spending. The Department of Defense clearly has too much money if they can afford to create training that mirrors material widely available from SANS, MISTI, CSI, Intense School and other training organizations. I believe the money spent on CERT, SEI and the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics should each be reduced by at least 10% immediately.
So I am asking for your help. If you agree with me please write your congress person and either use this note as a base or write your own. I would be honored if you would copy me, email@example.com. If you don't agree with me, or don't want to help me, that is fine, but before you send me a knee jerk email flame would you do three things. Look at your last paycheck stub and remind yourself how much tax you pay, second, consider the impact of the U.S. deficit (http://www.brillig.com/debt_clock/ ) and finally think about how you would feel if the government decided to compete in a disreputable manner with a course that took you months to write, SANS Security Leadership. After that, if you disagree with me, I would love to hear what you have to say. So please help me and write your congressman and tell them your home address, make sure they know you vote and you agree that the government has no business wasting taxpayer money competing with a course Stephen Northcutt does a better job of anyway.
To find your representative:
To find your congressional representative, the best link I could find is:
Thank you for taking the time to help! Needless to say, I write this note as a private citizen and the author of SANS Security Leadership and am certain this note does not reflect the collective views and opinions of The SANS Institute.
Stephen Northcutt
(808) 823-1375"
This sounds like a hoax to me... can anyone confirm it? "...make sure they know you vote and you agree that the government has no business wasting taxpayer money competing with a course Stephen Northcutt does a better job of anyway." If this is a true statement by Stephen, I'd be surprised.
Burning DVDs in FreeBSD
First I checked the media, which was Memorex 4X DVD-R 4.7GB (pictured at left, purchased at buy.com). I had already installed dvd+rw-tools, available in the ports tree as sysutils/dvd+rw-tools. Using the dvd+rw-mediainfo command, I checked the DVD in the burner:
# dvd+rw-mediainfo /dev/cd0
Mounted Media: 11h, DVD-R Sequential
Media ID: ProdiscS03
Current Write Speed: 4.0x1385=5540KB/s
Write Speed #0: 4.0x1385=5540KB/s
Write Speed #1: 2.0x1385=2770KB/s
Write Speed #2: 1.0x1385=1385KB/s
Write Performance: 4.0x1385=5540KB/s@[0 -> 2294911]
Speed Descriptor#0: 02/2298495 firstname.lastname@example.com=11080KB/s firstname.lastname@example.com=5540KB/s
Speed Descriptor#1: 02/2298495 firstname.lastname@example.com=11080KB/s email@example.com=2770KB/s
Speed Descriptor#2: 02/2298495 email@example.com=11080KB/s firstname.lastname@example.com=1385KB/s
READ DVD STRUCTURE[#10h]:
Media Book Type: 25h, DVD-R book [revision 5]
Legacy lead-out at: 2298496*2KB=4707319808
READ DVD STRUCTURE[#0h]:
Media Book Type: 25h, DVD-R book [revision 5]
Last border-out at: 0*2KB=0
Disc status: blank
Number of Sessions: 1
State of Last Session: empty
Number of Tracks: 1
Track State: invisible incremental
Track Start Address: 0*2KB
Next Writable Address: 0*2KB
Free Blocks: 2297888*2KB
Track Size: 2297888*2KB
Everything looked ready to go, so I proceeded according to the directions in the FreeBSD Handbook:
# growisofs -dvd-compat -Z /dev/cd0=FC2-i386-DVD.iso
Executing 'builtin_dd if=FC2-i386-DVD.iso of=/dev/pass0 obs=32k seek=0'
/dev/pass0: "Current Write Speed" is 4.1x1385KBps.
0/4370640896 ( 0.0%) @0x, remaining ??:??
0/4370640896 ( 0.0%) @0x, remaining ??:??
8421376/4370640896 ( 0.2%) @1.8x, remaining 103:35
27066368/4370640896 ( 0.6%) @3.9x, remaining 40:07
45744128/4370640896 ( 1.0%) @3.9x, remaining 29:56
4336517120/4370640896 (99.2%) @3.9x, remaining 0:06
4355194880/4370640896 (99.6%) @3.9x, remaining 0:02
builtin_dd: 2134112*2KB out @ average 3.9x1385KBps
/dev/pass0: flushing cache
/dev/pass0: updating RMA
/dev/pass0: closing disc
When I was done, I checked the media again:
# dvd+rw-mediainfo /dev/cd0
Mounted Media: 11h, DVD-R Sequential
Media ID: ProdiscS03
Current Write Speed: 4.0x1385=5540KB/s
Write Speed #0: 4.0x1385=5540KB/s
Write Speed #1: 2.0x1385=2770KB/s
Write Speed #2: 1.0x1385=1385KB/s
Write Performance: 4.0x1385=5540KB/s@[0 -> 2294911]
Speed Descriptor#0: 02/2298495 email@example.com=11080KB/s email@example.com=5540KB/s
Speed Descriptor#1: 02/2298495 email@example.com=11080KB/s firstname.lastname@example.com=2770KB/s
Speed Descriptor#2: 02/2298495 email@example.com=11080KB/s firstname.lastname@example.com=1385KB/s
READ DVD STRUCTURE[#10h]:
Media Book Type: 25h, DVD-R book [revision 5]
Legacy lead-out at: 2298496*2KB=4707319808
READ DVD STRUCTURE[#0h]:
Media Book Type: 25h, DVD-R book [revision 5]
Last border-out at: 2134112*2KB=4370661376
Disc status: complete
Number of Sessions: 1
State of Last Session: complete
Number of Tracks: 1
Track State: complete incremental
Track Start Address: 0*2KB
Free Blocks: 0*2KB
Track Size: 2134112*2KB
Last Recorded Address: 2134111*2KB
Track#1 : 14@0
Track#AA : 14@2134112
Multi-session Info: #1@0
I then mounted the DVD:
# mount -t cd9660 /dev/cd0 /cdrom
# ls /cdrom
.discinfo RPM-GPG-KEY-fedora
Fedora RPM-GPG-KEY-fedora-rawhide
GPL RPM-GPG-KEY-fedora-test
README-Accessibility RPM-GPG-KEY-rawhide
README-en SRPMS
README-en.html TRANS.TBL
RELEASE-NOTES-en autorun
RELEASE-NOTES-en.html eula.txt
RPM-GPG-KEY images
RPM-GPG-KEY-beta isolinux
It worked. I also mounted the DVD as /dev/acd0 on my ThinkPad, which appears to dmesg as the following:
acd0: DVDROM
at ata1-master UDMA33
I got this result by having 'hw.ata.atapi_dma=1' set in /boot/loader.conf. Without that setting, here is how the same drive appeared in dmesg:
acd0: DVDROM
at ata1-master PIO4
For reference, here is atacontrol output for the laptop:
$ sudo atacontrol list
ATA channel 0:
Master: ad0
ATA/ATAPI rev 5
Slave: no device present
ATA channel 1:
Master: acd0
ATA/ATAPI rev 0
Slave: no device present
Having ATAPI DMA enabled helps with performance, according to this thread by someone having trouble burning with the same device I have. I believe because that posted is using an internal Plextor connected via ATA, he is in a different situation. I use a FireWire adapter on my laptop and desktop to connect my external Plextor drive.
Wednesday, June 23, 2004
Duplicating Data CDs with FreeBSD
For testing purposes and to create my own media set, I duplicated the three CD-ROMs released as Fedora Core 2. To convert the CD-ROM into a .iso file for burning, I used this syntax:
dd if=/dev/cd0 of=/var/iso/fedora_core_disc3.iso bs=2048
Here's a few notes on this command. /dev/cd0 is how my Plextor drive appears to FreeBSD. My laptop's native CD/DVD reader is /dev/acd0. I could not get this command to work without including 'bs=2048'. I learned why after reading a FreeBSD Diary entry:
"Data on CDs is written in blocks of 2 kB. By default dd reads 512
bytes at a time, and the CD driver doesn't support this. It would
work if you use bs=2k."
When I tried dd without the bs=2048 argument, I got this error:
dd: /dev/acd0: Invalid argument
I also tried acquiring the .iso using my native CD/DVD reader. I got this error, although the .iso creation seemed to work ok:
acd0: FAILURE - READ_BIG status=51
sensekey=ILLEGAL REQUEST error=1
Others have reported this issue, and some suggested editing /boot/loader.conf accordingly:
This didn't fix the issue for me, so I acquired the .iso using the Plextor. It produced no visible errors.
When the process was done I wanted to check if the resulting .iso matched the CD from which it was derived. From Kris Kennaway I learned this command to get a MD5 hash of the original CD:
dd if=/dev/cd0 bs=2048 | md5
I then compared that output with the result of running md5 on this .iso. If they matched, the copy was good. This was the case. However, the MD5 hashes did not match the versions available at the Fedora site. As I trust the source of these CDs, I assume the difference is a result of taking an original Red Hat .iso, burning it to CD, and then deriving an image of that CD in .iso format. Perhaps the block sizes did not match up exactly?
To burn the new .iso to CD-R, I had to install cdrecord, found in sysutils/cdrecord. The first task was to ensure cdrecord could find my drive:
# cdrecord -scanbus
Cdrecord 2.00.3 (i386-unknown-freebsd5.2.1) Copyright (C) 1995-2002 Jorg Schilling
Using libscg version 'schily-0.7'
0,0,0 0) 'PLEXTOR ' 'DVDR PX-708A ' '1.06' Removable CD-ROM
0,1,0 1) *
0,2,0 2) *
0,3,0 3) *
0,4,0 4) *
0,5,0 5) *
0,6,0 6) *
0,7,0 7) *
Once I knew where to find the drive, I checked what options it supported:
# cdrecord -v dev=0,0,0 -checkdrive driveropts=help
Cdrecord 2.00.3 (i386-unknown-freebsd5.2.1) Copyright (C) 1995-2002 Jorg Schilling
TOC Type: 1 = CD-ROM
scsidev: '0,0,0'
scsibus: 0 target: 0 lun: 0
Using libscg version 'schily-0.7'
Driveropts: 'help'
atapi: 0
Device type : Removable CD-ROM
Version : 0
Response Format: 1
Vendor_info : 'PLEXTOR '
Identifikation : 'DVDR PX-708A '
Revision : '1.06'
Device seems to be: Generic mmc2 DVD-R/DVD-RW.
cdrecord: This version of cdrecord does not include DVD-R/DVD-RW support code.
cdrecord: If you need DVD-R/DVD-RW support, ask the Author for cdrecord-ProDVD.
Driver options:
burnfree Prepare writer to use BURN-Free technology
noburnfree Disable using BURN-Free technology
varirec=val Set VariRec Laserpower to -2, -1, 0, 1, 2
Only works for audio and if speed is set to 4
Now that I knew what options to use, I burned the .iso to the CD-R. You'll see I enabled 'burnfree,' defined in the man page as "Turn the support for Buffer Underrun Free writing on."
# cdrecord -v dev=0,0,0 speed=8 driveropts=burnfree -eject
-data /var/iso/fedora_core_2_disc3.iso
Cdrecord 2.00.3 (i386-unknown-freebsd5.2.1) Copyright (C) 1995-2002 Jorg Schilling
TOC Type: 1 = CD-ROM
scsidev: '0,0,0'
scsibus: 0 target: 0 lun: 0
Using libscg version 'schily-0.7'
Driveropts: 'burnfree'
atapi: 0
Device type : Removable CD-ROM
Version : 0
Response Format: 1
Vendor_info : 'PLEXTOR '
Identifikation : 'DVDR PX-708A '
Revision : '1.06'
Device seems to be: Generic mmc2 DVD-R/DVD-RW.
cdrecord: This version of cdrecord does not include DVD-R/DVD-RW support code.
cdrecord: If you need DVD-R/DVD-RW support, ask the Author for cdrecord-ProDVD.
Using generic SCSI-3/mmc CD-R driver (mmc_cdr).
Driver flags : MMC-3 SWABAUDIO BURNFREE VARIREC
Supported modes: TAO PACKET SAO SAO/R96P SAO/R96R RAW/R16 RAW/R96P RAW/R96R
Drive buf size : 1190112 = 1162 KB
FIFO size : 4194304 = 4096 KB
Track 01: data 637 MB
otal size: 732 MB (72:35.06) = 326630 sectors
Lout start: 732 MB (72:37/05) = 326630 sectors
Current Secsize: 2048
ATIP info from disk:
Indicated writing power: 5
Is not unrestricted
Is not erasable
Disk sub type: Medium Type A, high Beta category (A+) (3)
ATIP start of lead in: -11634 (97:26/66)
ATIP start of lead out: 359846 (79:59/71)
Disk type: Short strategy type (Phthalocyanine or similar)
Manuf. index: 3
Manufacturer: CMC Magnetics Corporation
Blocks total: 359846 Blocks current: 359846 Blocks remaining: 33216
Starting to write CD/DVD at speed 8 in real TAO mode for single session.
Last chance to quit, starting real write 0 seconds. Operation starts.
Waiting for reader process to fill input buffer ... input buffer ready.
BURN-Free is OFF.
Turning BURN-Free on
Performing OPC...
Starting new track at sector: 0
Track 01: 0 of 637 MB written.
Track 01: Total bytes read/written: 668934144/668934144 (326628 sectors).
Writing time: 552.030s
Average write speed 8.0x.
Min drive buffer fill was 99%
Fixating time: 32.601s
cdrecord: fifo had 10537 puts and 10537 gets.
cdrecord: fifo was 0 times empty and 10463 times full, min fill was 90%.
At some point in the future I'll use the drive to create DVDs, and report how that turned out as well.
The fact that I burned these CDs isn't rocket science, but I wanted to show the gear I used in case other people are looking to buy CD/DVD burners for FreeBSD.
I used a few other resources when learning how to burn CDs, including the FreeBSD Handbook and CD Burning from the Command Line.
Fedora Core 2-based Soekris System Operational
Here are a few notes on peculiarities of Fedora. I chose a "custom installation," and selected "no packages." That still deployed about 562 MB of packages as part of the base OS installation. Thankfully only the first CD was needed. When I finished the installation, I rebooted the laptop to edit key files to allow serial access. I made important changes to /etc/grub.conf, thanks to this Remote Serial Console HOWTO:
# grub.conf generated by anaconda
# Note that you do not have to rerun grub after making changes to this file
# NOTICE: You have a /boot partition. This means that
# all kernel and initrd paths are relative to /boot/, eg.
# root (hd0,0)
# kernel /vmlinuz-version ro root=/dev/hda2
# initrd /initrd-version.img
serial --unit=0 --speed=9600 --word=8 --parity=no --stop=1
terminal --timeout=10 serial console
title Fedora Core (2.6.5-1.358)
root (hd0,0)
kernel /vmlinuz-2.6.5-1.358 ro root=LABEL=/ console=tty0 console=ttyS0,9600n8
initrd /initrd-2.6.5-1.358.img
After editing /etc/grub.conf, I shut down the laptop and moved the HDD to the Soekris. When it booted, I didn't see the Grub menu as expected. I hit return a few times and then saw boot messages scroll by. Kudzu started, due to the hardware differences between my laptop and the Soekris. Although the screen wasn't as legible as I would have hoped, I could still make out the text and configuration options. I chose to deinstall the laptop hardware no longer present on the Soekris, like its NIC, sound card, and so on. Kudzu then asked to install the Soekris National Semiconductor DP83815 MacPhyter NICs and Compaq ZFMicro Chipset USB. Along the way it also asked if I approved of making changes top /etc/inittab and /etc/securetty. It appears to have made these changes:
co:2345:respawn:/sbin/agetty ttyS0 9600 vt100
The addition to /etc/inittab appears to enable the serial console. The addition to /etc/securetty allows root to log in over the serial console.
Unlike FreeBSD but like OpenBSD, it appears Fedora Core 2 does not recognize my Linksys USB200M 10/100 NIC. Here is the uname, netstat, and df outputs for reference. Note the filesystem layout is the result of "autopartition." I've never understood why Red Hat doesn't create separate partitions for /, /usr, /var, /tmp, and so on.
uname -a
Linux localhost.localdomain 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i586 i586 i386 GNU/Linux
netstat -natup
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:1024 0.0.0.0:* LISTEN 1652/rpc.statd
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1633/portmap
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1827/sendmail: acce
tcp 0 0 :::22 :::* LISTEN 1806/sshd
tcp 0 672 ::ffff:10.2.2.69:22 ::ffff:10.2.2:57811 ESTABLISHED 2160/0
udp 0 0 0.0.0.0:1024 0.0.0.0:* 1652/rpc.statd
udp 0 0 0.0.0.0:68 0.0.0.0:* 1179/dhclient
udp 0 0 0.0.0.0:980 0.0.0.0:* 1652/rpc.statd
udp 0 0 0.0.0.0:111 0.0.0.0:* 1633/portmap
df -h
Filesystem Size Used Avail Use% Mounted on
/dev/hda2 55G 548M 51G 2% /
/dev/hda1 99M 5.9M 88M 7% /boot
none 63M 0 63M 0% /dev/shm
Soekris-based FreeBSD System Operational
To send console messages to the serial line during the boot sequence, I followed the FreeBSD Handbook's advice:
echo -h > /boot.config
I tried to edit /etc/ttys to enable 19200 speed for ttyd0, but this did not work as I hoped. It seems the Soekris sends output to the serial line at 19200 prior to the FreeBSD boot sequence. Then, despite my attempted settings of 19200 in /etc/ttys, the FreeBSD boot sequence sends output at 9200. Accordingly, my /etc/ttys file has this entry to enable the serial console:
ttyd0 "/usr/libexec/getty std.9600" cons25 on secure
Notice the use of cons25. This lets me use vi properly, for example. I think the kernel must be recompiled to support speeds higher than 9600, as suggested by this section from the FreeBSD Handbook:
22.214.171.124 Setting a Faster Serial Port Speed
"By default, the serial port settings are: 9600 baud, 8 bits, no parity, and 1 stop bit. If you wish to change the speed, you need to recompile at least the boot blocks. Add the following line to /etc/make.conf and compile new boot blocks:
If the serial console is configured in some other way than by booting with -h, or if the serial console used by the kernel is different from the one used by the boot blocks, then you must also add the following option to the kernel configuration file and compile a new kernel:
options CONSPEED=19200
There is a sysctl variable, machdep.conspeed, which is set to 9600 by default. If changed to 19200 in /etc/sysctl.conf, the system will be available at 19200 once booted:
To set the speed by hand, issue this command:
sysctl machdep.conspeed=19200
FreeBSD sees the three NICs as sis devices, as does OpenBSD. Unlike OpenBSD, however, FreeBSD recognizes my Linksys USB200M 10/100 NIC, adding a fourth Ethernet interface if needed:
axe0: Linksys product 0x2226, rev 2.00/0.01, addr 2
axe0: Ethernet address: 00:10:60:25:a4:1a
on axe0
on miibus3
rlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
axe0: flags=8802
mtu 1500
ether 00:10:60:25:a4:1a
media: Ethernet autoselect (none)
status: no carrier
Multiple helpful pages discuss FreeBSD on the Soekris:
Tuesday, June 22, 2004
Red Cliff Consulting, a Trusted Professional Services Firm
Kevin is now running Red Cliff Consulting, a professional services firm headquartered in Alexandria, VA. He describes his group as "the experts that experts consult." I won't argue with that assessment. For example, Curtis Rose just joined Red Cliff, after working for years at Sytex. Curtis is one of the co-authors of the forthcoming book Real Digital Forensics, along with myself and Keith Jones.
Kevin will be speaking at Black Hat 2004 in Las Vegas in late July. He plans to discuss "the five things that are problematic in incident response." His public speaking engagements are always incredibly informative and entertaining. Before the Foundstone Christmas party in December 2002, the IR team discussed how funny it would be if Kevin described our team's work in Haiku form. Sure enough, our fearless leader delivered his entire talk in Haiku.
Kevin Mandia
Leading Foundstone's IR team
Puts bad guys in jail
In any case, if you need a group of trusted, experienced computer forensic consultants, check out Red Cliff's services.
Book Chapter on Sguil Available Online
My book will be on shelves in mid-July. If you'd like to attend live training on network security monitoring, sign up for my Network Security Monitoring with Open Source Tools class at USENIX Security '04 in San Diego. The class will be held on Monday 9 August 2004, and early conference registration ends 16 July. I will give away a limited number of free copies of the book and hope to debut a FreeBSD-based live CD with NSM tools.
Configuring RAID-0 with Vinum
I decided to use Greg Lehey's Vinum, and thanks to some helpful notes from Bamm Visscher and Dave Wheeler, got it set up in a RAID-0 configuration.
When I installed FreeBSD on the system, I created a 768 MB /nsm1 partition on the first drive ad0 and used the entire second drive (ad1) for /nsm2. Here is what df saw after installation. Notice I use the -m switch to show all values in MB.
bourque:/root# df -m
Filesystem 1M-blocks Used Avail Capacity Mounted on
/dev/ad0s1a 247 35 192 16% /
devfs 0 0 0 100% /dev
/dev/ad0s1e 739 0 679 0% /nsm1
/dev/ad1s1d 3977 0 3659 0% /nsm2
/dev/ad0s1g 263 0 242 0% /tmp
/dev/ad0s1d 1978 302 1517 17% /usr
/dev/ad0s1f 495 0 455 0% /var
Here is what bsdlabel saw for each drive:
bourque:/root# bsdlabel /dev/ad0s1
# /dev/ad0s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
a: 524288 0 4.2BSD 2048 16384 32776
b: 524288 524288 swap
c: 8421777 0 unused 0 0 # "raw" part, don't edit
d: 4194304 1048576 4.2BSD 2048 16384 28552
e: 1572864 5242880 4.2BSD 2048 16384 28552
f: 1048576 6815744 4.2BSD 2048 16384 8
g: 557457 7864320 4.2BSD 2048 16384 34848
bourque:/root# bsdlabel /dev/ad1s1
# /dev/ad1s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
c: 8418753 0 unused 0 0 # "raw" part, don't edit
d: 8418753 0 4.2BSD 2048 16384 28552
Before I could use vinum, I needed to edit the disk labels so /dev/ad0s1e and /dev/ad1s1d changed from fstype 4.2BSD to vinum.
After running 'bsdlabel -e /dev/ad0s1' and 'bsdlabel -e /dev/ad1s1' here is what the two disks looked like to bsdlabel:
bourque:/root# bsdlabel /dev/ad0s1
# /dev/ad0s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
a: 524288 0 4.2BSD 2048 16384 32776
b: 524288 524288 swap
c: 8421777 0 unused 0 0 # "raw" part, don't edit
d: 4194304 1048576 4.2BSD 2048 16384 28552
e: 1572864 5242880 vinum
f: 1048576 6815744 4.2BSD 2048 16384 8
g: 557457 7864320 4.2BSD 2048 16384 34848
bourque:/root# bsdlabel /dev/ad1s1
# /dev/ad1s1:
8 partitions:
# size offset fstype [fsize bsize bps/cpg]
c: 8418753 0 unused 0 0 # "raw" part, don't edit
d: 8418753 0 vinum
Next I created the following /etc/vinum.conf file. Notice for the drive sizes I used the values reported by 'df -m':
drive drive1 device /dev/ad0s1e
drive drive2 device /dev/ad1s1d
volume nsm
plex org concat
sd length 739m drive drive1
sd length 3977m drive drive2
After editing /etc/vinum.conf, I ran vinum to create the RAID-0 system:
bourque:/root# create /etc/vinum.conf
2 drives:
D drive1 State: up /dev/ad0s1e A: 28/768 MB (3%)
D drive2 State: up /dev/ad1s1d A: 133/4110 MB (3%)
1 volumes:
V nsm State: up Plexes: 1 Size: 4716 MB
1 plexes:
P nsm.p0 C State: up Subdisks: 2 Size: 4716 MB
2 subdisks:
S nsm.p0.s0 State: up D: drive1 Size: 739 MB
S nsm.p0.s1 State: up D: drive2 Size: 3977 MB
That step created new devices for the vinum drive, as seen next:
bourque:/root# ls /dev/vinum/*
/dev/vinum/control /dev/vinum/controld /dev/vinum/nsm
nsm.p0.s0 nsm.p0.s1
Now I needed to initialize the filesystem with newfs. The -U option enables soft updates:
bourque:/root# newfs -U /dev/vinum/nsm
/dev/vinum/nsm: 4716.0MB (9658368 sectors) block size 16384, fragment size 2048
using 26 cylinder groups of 183.77MB, 11761 blks, 23552 inodes.
with soft updates
super-block backups (for fsck -b #) at:
160, 376512, 752864, 1129216, 1505568, 1881920, 2258272, 2634624, 3010976,
3387328, 3763680, 4140032, 4516384, 4892736, 5269088, 5645440, 6021792,
6398144, 6774496, 7150848, 7527200, 7903552, 8279904, 8656256, 9032608,
When done I created a /nsm directory and mounted it:
bourque:/root# mkdir /nsm
bourque:/root# mount /dev/vinum/nsm
bourque:/root# df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ad0s1a 248M 36M 192M 16% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/ad0s1e 739M 4.0K 680M 0% /nsm1
/dev/ad1s1d 3.9G 4.0K 3.6G 0% /nsm2
/dev/ad0s1g 263M 6.0K 242M 0% /tmp
/dev/ad0s1d 1.9G 303M 1.5G 17% /usr
/dev/ad0s1f 496M 370K 456M 0% /var
/dev/vinum/nsm 4.5G 4.0K 4.1G 0% /nsm
To enable this automatically, I added this line to /etc/fstab:
/dev/vinum/nsm /nsm ufs rw 2 2
In /boot/loader.conf, I added these entries:
The older method of adding 'start_vinum="YES"' in /etc/rc.conf is still supported, but the new method is preferred.
Monday, June 21, 2004
2004 CSI/FBI Study Released
Participate in The Uptime Project
Saturday, June 19, 2004
Network Monitoring Products Reviewed by NWC
Two weeks earlier, NWC's Well-Connected Awards were published, complete with the most disgusting cover I've ever seen on a technical magazine. That earned the print edition a place in my circular bin, but the security awards were interesting. The "Network Behavior Anomaly Detection" award went to Q1 Labs, whose QVision tool seems to have been renamed QRadar. NWC liked this network behavior visualization product better than similar offerings from Arbor Networks and Lancope. Anyone interested in having me do a technical review of your product, please email blog at taosecurity dot com.
Soekris-based OpenBSD System Operational
$ df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/wd0a 125M 21.8M 97.8M 18% /
/dev/wd0f 156M 2.0K 148M 0% /tmp
/dev/wd0d 2.0G 169M 1.7G 9% /usr
/dev/wd0e 501M 6.9M 469M 1% /var
After reboot, I made these edits:
tty00 "/usr/libexec/getty std.19200" vt100 on secure
set tty com0
stty com0 19200
inet 172.27.20.13 255.255.255.0
After these edits I shut down the system and installed the 3250 MB HDD in the Soekris. I put my original HDD back into my laptop, and connected a serial cable and null modem from the laptop to the Soekris. Before powering on the Soekris I connected to the serial console:
# tip -19200 com1
When I plugged in the Soekris power, I saw these messages:
POST: 0123456789bcefghipajklnoq,,,tvwxy^[[2J
comBIOS ver. 1.24 20040312
Copyright (C) 2000-2004 Soekris Engineering.
CPU Geode 266 Mhz 0128 Mbyte Memory
Pri Mas IBM-DTCA-23240
LBA Xlt 788-128-63 3177 Mbyte
PXE-M00: BootManage UNDI, PXE-2.0 (build 082)
Slot Vend Dev ClassRev Cmd Stat CL LT HT Base1 Base2 Int
0:00:0 1078 0001 06000000 0107 0280 00 00 00 00000000 00000000 00
Seconds to automatic boot. Press Ctrl-P for entering Monitor.
Using drive 0, partition 3.
probing: pc0 com0 com1 pci mem[639K 127M a20=on]
disk: hd0+
> OpenBSD/i386 BOOT 2.06
switching console to com0
com0: changing speed to 19200 baud in 5 seconds, change your terminal to match
com0: 19200 baud
booting hd0a:/bsd:
entry point at 0x100120
[ using 404824 bytes of bsd ELF symbol table ]
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
Copyright (c) 1995-2004 OpenBSD. All rights reserved. http://www.OpenBSD.org
OpenBSD 3.5 (GENERIC) #34: Mon Mar 29 12:24:55 MST 2004
cpu0: Geode(TM) Integrated Processor by National Semi ("Geode by NSC" 586-class) 267 MHz
cpu0: FPU,TSC,MSR,CX8,CMOV,MMX
cpu0: TSC disabled
real mem = 133804032 (130668K)
avail mem = 117899264 (115136K)
using 1658 buffers containing 6791168 bytes (6632K) of memory
mainbus0 (root)
I now have a fully functional OpenBSD 3.5 system on the Soekris. That was fairly easy! Lots of sites describe how to install, augment, and use Soekris systems:
OpenBSD 3.5 on a Soekris Net4801
Netgate Soekris kits
Review of Security Sage's Guide to Hardening the Network Infrastructure Posted
"This is a tough review to write, since I worked with the lead authors and series editor at Foundstone, and I'm mentioned by name on p. 384. "Security Sage's Guide to Hardening the Network Infrastructure" (HTNI) is mainly a collection of advice given in other security books, packaged with brochure-like commercial product descriptions. Much of the technical defensive recommendations lack the command-level syntax to put that advice into practical use. I was excited by the table of contents, but disappointed once I finished the book. I can't recommend HTNI unless your library doesn't already address essential networking and security techniques."
Friday, June 18, 2004
More Useful Package Management Tools
Keep in mind that installing software via the FreeBSD ports tree results in the installation of a package, but not necessarily the creation of a package that can be moved among systems. That is why administrators can install software with the ports tree and then use the FreeBSD pkg_info, pkg_delete, and other pkg tools to manipulated deployed applications.
The first tool is gpkgdep, in the ports tree as sysutils/gpkgdep, by Jack Slater. This is an older tool but it works fine on my FreeBSD 5.2.1 REL system. Gpkgdep has good online documentation, but I'll quickly describe its use via a few screenshots.
This screen shot shows the "Required Packages" tab. It shows all installed packages, not all of the packages which could be installed. (This differs from a tool like sysutils/pib, a Tcl/Tk tool which presents information found in the ports index.) At the top of the screen shot we see "nmap-3.5.0", with "pcre-4.5" indented below. This means pcre is a dependency of nmap, i.e., nmap needs pcre to run. If we wanted to remove pcre, it would prevent us from running nmap. Further down the list we see "p0f-2.0.3_1", which has no arrow to the left of its name nor anything listed below. This means p0f has no dependencies.
The next screen shot shows the "Dependent Packages" tab. This lists packages followed by their dependencies. In this view, we're looking at "pcre-4.5" at the top. Indented below it we see "ethereal-0.10.3" and "nmap-3.50". This means both ethereal and nmap depend upon pcre.
The final screen shot displays the "Remove Package Simulation." Here we can select packages and see their dependencies selected automatically. Here we see "ethereal-0.10-3" selected, and gpkgdep has dynamically selected Ethereal's dependencies. They are show with slightly greyed-out boxes.
Turning to the command line environment we have sysutils/pkg_tree by Edwin Groothuis. This tool provides similar information in CLI form. To see Ethereal's dependencies, try this:
$ pkg_tree ethereal
|\__ jpeg-6b_2
|\__ libiconv-1.9.1_3
|\__ python-2.3.4
|\__ png-1.2.5_5
|\__ pkgconfig-0.15.0_1
|\__ perl-5.6.1_15
|\__ pcre-4.5
|\__ expat-1.95.7
|\__ net-snmp-5.1.1_4
|\__ gettext-0.13.1_1
|\__ libxml2-2.6.9
|\__ freetype2-2.1.7_3
|\__ tiff-3.6.1_1
|\__ imake-4.3.0_2
|\__ fontconfig-2.2.2,1
|\__ XFree86-libraries-4.3.0_7
|\__ XFree86-fontEncodings-4.3.0
|\__ glib-2.4.1_1
|\__ libXft-2.1.6
|\__ shared-mime-info-0.14_2
|\__ hicolor-icon-theme-0.5
|\__ atk-1.6.1
|\__ adns-1.0_1
|\__ XFree86-fontScalable-4.3.0
|\__ pango-1.4.0_1
\__ gtk-2.4.1
|\__ pkgconfig-0.15.0_1
\__ glib-1.2.10_11
This shows all of the packages needed by Ethereal and also Tethereal. Nmap is simpler:
$ pkg_tree nmap
\__ pcre-4.5
If you want to see all of the dependencies for the listed packages, use the -v option:
$ pkg_tree -v ethereal
|\__ jpeg-6b_2
|\__ libiconv-1.9.1_3
|\__ python-2.3.4
|\__ png-1.2.5_5
|\__ pkgconfig-0.15.0_1
|\__ perl-5.6.1_15
|\__ pcre-4.5
|\__ expat-1.95.7
|\__ net-snmp-5.1.1_4
| \__ perl-5.6.1_15
|\__ gettext-0.13.1_1
| |\__ libiconv-1.9.1_3
| \__ expat-1.95.7
|\__ libxml2-2.6.9
| |\__ python-2.3.4
| |\__ pkgconfig-0.15.0_1
| \__ libiconv-1.9.1_3
If you run this tool without any options, it queries the package database for every installed application.
Keep these tools in mind when you feel like doing some package house cleaning.
Adventures with FreeBSD CURRENT
SMP: AP CPU#1 launched!
Mounting root from ufs:/dev/md0
md0: Preloaded image 4423680 bytes at 0xc09e16d8
I tried a few simple fixes, like booting without ACPI enabled via the boot menu. I also tried a trick at the boot prompt noted in a newsgroup posting, namely:
unset acpi_load
set hint.apic.0.disabled=1
Note the first step disables ACPI, or "Advanced Configuration and Power Management support" (also at www.acpi.info). The second step disables APIC, the "Advanced Programmable Interface Controller." This site explains the relationship between ACPI and APIC.
None of these steps worked, so I decided to try installing the latest FreeBSD CURREENT snapshot. I burned the normal installation CD-ROM for 5-CURRENT and found it would boot on my Dell. I then installed it, and saw this as the result:
-bash-2.05b$ uname -a
FreeBSD janney.taosecurity.com 5.2-CURRENT-20040617-JPSNAP
FreeBSD 5.2-CURRENT-20040617-JPSNAP #0:
Thu Jun 17 01:58:11 GMT 2004 email@example.com:/usr/obj/usr/src/sys/GENERIC i386
Don't be worried about the "jp". This isn't some sort of Japanese distro. The "jp" is a reference to who built it -- the Japanese FreeBSD project.
Keep in mind that running CURRENT may bring problems, as it's not as stable as RELEASE. I also noticed this in dmesg output:
WARNING: WITNESS option enabled, expect reduced performance.
According to the man pages, witness "keeps track of the locks acquired and released by each thread." This is a troubleshooting mechanism. I can rebuild the kernel without it, as I see how it was built in GENERIC:
-bash-2.05b$ grep -i witness /usr/src/sys/i386/conf/GENERIC
options WITNESS # Enable checks to detect deadlocks and cycles
options WITNESS_SKIPSPIN # Don't run witness on spinlocks for speed
Anyway, I was happy to get the 5 tree running on this system.
Sunday, June 13, 2004
Cheap Domain Name Registration and Free Email Forwarding
GoDaddy offers domain name transfers for $7.95, which is excellent, but no free email forwarding. I decided to use ZoneEdit to host DNS records for the bejtlich.net, taosecurity.org, and taosecurity.net domains. ZoneEdit offers free email forwarding when you set up DNS records. Essentially, once I transfered or already had domains registered with GoDaddy, I changed the GoDaddy WHOIS records to list name servers owned by ZoneEdit. For example, here is my WHOIS record for taosecurity.net:
orr:/home/richard$ whois taosecurity.net
Richard Bejtlich
7799 Leesburg Pike Ste 1100S
Falls Church, Virginia 22043
United States
Registered through: GoDaddy.com
Domain Name: TAOSECURITY.NET
Created on: 07-May-04
Expires on: 07-May-05
Last Updated on: 11-Jun-04
Domain servers in listed order:
Using dig, we can see the DNS records for taosecurity.net:
orr:/home/richard$ dig @ns18.zoneedit.com taosecurity.net -t any
; <<>> DiG 8.3 <<>> @ns18.zoneedit.com taosecurity.net -t
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3126
;; flags: qr aa rd; QUERY: 1, ANSWER: 7, AUTHORITY: 2, ADDITIONAL: 0
;; taosecurity.net, type = ANY, class = IN
taosecurity.net. 2H IN A 22.214.171.124
taosecurity.net. 2H IN A 18.104.22.168
taosecurity.net. 2H IN MX 0 mail3.zoneedit.com.
taosecurity.net. 2H IN MX 0 mail4.zoneedit.com.
taosecurity.net. 2H IN NS ns18.zoneedit.com.
taosecurity.net. 2H IN NS ns8.zoneedit.com.
taosecurity.net. 2H IN SOA ns18.zoneedit.com. soacontact.zoneedit.com. (
1087014650 ; serial
4H ; refresh
2H ; retry
1w4d ; expiry
2H ) ; minimum
taosecurity.net. 2H IN NS ns18.zoneedit.com.
taosecurity.net. 2H IN NS ns8.zoneedit.com.
;; Total query time: 68 msec
;; FROM: orr.taosecurity.com to SERVER: 220.127.116.11
;; WHEN: Sun Jun 13 19:06:42 2004
;; MSG SIZE sent: 33 rcvd: 233
With mail3 and mail4.zoneedit.com handling email forwarding, I can send messages to firstname.lastname@example.com anywhere I like. If I relied on GoDaddy's extra email forwarding service, I'd have to pay an extra $10 or similar per domain.
If you're transferring an existing domain, I recommend taking these steps:
0. Disable any "zone transfer denial" preferences at your registrar. This caught me and delayed the transfer process until I told DomainDiscover to allow transfers.
1. Create zone records at ZoneEdit.
2. Change the DNS server entries at the existing registrar to point to the ZoneEdit DNS servers.
3. Change the contact information at the existing registrar to point to an email account outside of the domain being transferred. A Gmail or Yahoo! email account is perfect for this purpose.
4. Create the email forwarding records at ZoneEdit.
5. Request a zone transfer through GoDaddy.
6. Follow through on the zone transfer messages sent to the contact email on file at the original registrar.
7. Eventually the new name server information will propagate through DNS and outside parties will be able to contact you again.
As an added bonus, GoDaddy automatically performs a one year renewal for transferred domains. Since bejtlich.net was about to expire, I got a "free" renewal (although the transfer fee is basically the same as a new domain registration fee). If you're wondering how I handle email for taosecurity.com, I let the company hosting www.taosecurity.com, Niuhi.com, advertise MX records and run the domain's mail servers.
Of course, if I weren't a Comcast cable modem subscriber worried about seeing port 25 TCP blocked, I might operate my own email servers. I looked into DSL through SpeakEasy but only IDSL was available. Impressed by SpeakEasy's customer service and the prospect of static IPs, I readied myself for the high cost and low bandwidth. Eventually the IDSL plan fell through due to "no facilities available in the ILEC" -- after, of course, I had already bought an IDSL modem on eBay!
Review of Malware Posted
"One of the impressive aspects of this book is the degree to which it is "future-proofed." Ed looks at current threats like worms, viruses, trojans, and user- and kernel-mode rootkits, like any author might. He then takes malicious software to the next level, from the kernel to BIOS and finally to CPU microcode. These BIOS- and microcode-level attacks are still largely theoretical (aside from BIOS-destroying code), at least as far as the public knows. When the world sees these threats emerge, "Malware" will be waiting to explain their capabilities."
I'd like to add a few Web sites to the many Ed mentions in his book. jesusmolina.com and microcodes.sf.net are good references for information on CPU microcode issues.
Wednesday, June 09, 2004
Sguil 0.4.0, Snort 2.1.3, Barnyard 0.2.0 Installation Guide Published
Monday, June 07, 2004
Review of Anti-Spam Tool Kit Posted
"I've never been interested in viruses, worms, or spam. All three represent the lowest end of malware, with spam occupying a particularly disdainful place in the computer security hierarchy. I wasn't very excited when a review copy of "Anti-Spam Tool Kit" (ASTK) arrived in the mail, but I found myself drawn in by the value of the content and tools it described. I highly recommend anyone tasked with fighting spam read ASTK."
Update: Paul Wolfe sent a nice email regarding my review. I recommend if you have comments on ASTK you visit the ASTK book site at www.vorpalmedia.com. Tell him what you'd like to see in a second edition or comments on the first edition.
Friday, June 04, 2004
Report on Compatible Devices in FreeBSD
Here is what dmesg reports when I attach the CF reader (with CF card inserted) to the USB port on my laptop:
umass0: SanDisk ImageMate 8 in 1, rev 2.00/91.39, addr 2
GEOM: create disk da0 dp=0xc3a81450
da0 at umass-sim0 bus 0 target 0 lun 0
Removable Direct Access SCSI-0 device
da0: 1.000MB/s transfers
da0: 245MB (501760 512 byte sectors: 64H 32S/T 245C)
GEOM: create disk da1 dp=0xc3ab2850
da1 at umass-sim0 bus 0 target 0 lun 1
Removable Direct Access SCSI-0 device
da1: 1.000MB/s transfers
da1: Attempt to query device size failed: NOT READY, Medium not present
You see the CF card is present on device da0, but devices da1 and up aren't ready as there's nothing inserted in those slots.
Using the device for storage is simple:
orr:/home/richard$ sudo mount -t msdos /dev/da0s1 /floppy
orr:/home/richard$ ls /floppy/
orr:/home/richard$ df -h
Filesystem Size Used Avail Capacity Mounted on
/dev/ad0s2a 5.8G 3.3G 2.0G 62% /
devfs 1.0K 1.0K 0B 100% /dev
/dev/ad0s2d 1.9G 1.2G 589M 68% /home
/dev/ad0s2f 739M 17M 662M 3% /tmp
/dev/ad0s2e 4.4G 135M 3.9G 3% /var
linprocfs 4.0K 4.0K 0B 100% /usr/compat/linux/proc
neely:/usr/ports 12G 8.1G 2.5G 76% /usr/ports
/dev/da0s1 244M 8.0K 244M 0% /floppy
I tried the CF reader in a machine with ehci support compiled in to the kernel, since it has USB 2.0 ports built-in. I got errors saying "usb3: unrecoverable error, controller".
As I mentioned the Adaptec DuoConnect earlier, here is how it appears in dmesg when attached:
Although USB 2.0 doesn't work with this adapter, FireWire appears to be supported. I'm not the only person who has experience with this NEC chipset and USB 2.0 (see this thread.) I bought a Plextor 708UF external DVD burner, which offers USB 2.0 and FireWire support. Here is how it appears when connected to the Adaptec DuoConnect:
cardbus1: Resource not specified in CIS: id=10, size=800
cardbus1: Resource not specified in CIS: id=14, size=4000
mem 0x88000000-0x88003fff,0x88004000-0x88 0047ff irq 11 at device 0.0 on cardbus1
fwohci0: OHCI version 1.10 (ROM=1)
fwohci0: No. of Isochronous channel is 4.
fwohci0: EUI64 08:00:28:56:02:00:49:8a
fwohci0: Phy 1394a available S400, 3 ports.
fwohci0: Link S400, max_rec 2048 bytes.
on fwohci0
on firewire0
if_fwe0: Fake Ethernet address: 0a:00:28:00:49:8a
on firewire0
fwohci0: Initiate bus reset
fwohci0: BUS reset
fwohci0: node_id=0xc000ffc0, gen=1, CYCLEMASTER mode
firewire0: 1 nodes, maxhop <= 0, cable IRM = 0 (me)
firewire0: bus manager 0 (me)
cardbus1: Resource not specified in CIS: id=10, size=1000
mem 0x88000000-0x88000fff irq 11 at device 0.4 on cardbus1
usb1: OHCI version 0.0
usb1: unsupported OHCI revision
ohci0: USB init failed
device_probe_and_attach: ohci0 attach returned 5
cardbus1: Resource not specified in CIS: id=10, size=1000
mem 0x88000000-0x88000fff irq 11 at device 0.5 on cardbus1
usb1: OHCI version 15.15, legacy support
usb1: unsupported OHCI revision
ohci0: USB init failed
device_probe_and_attach: ohci0 attach returned 5
cardbus1: Resource not specified in CIS: id=10, size=100
at device 0.6 (no driver attached)
fwohci0: BUS reset
fwohci0: node_id=0xc000ffc1, gen=3, CYCLEMASTER mode
firewire0: 2 nodes, maxhop <= 1, cable IRM = 1 (me)
firewire0: bus manager 1 (me)
fwohci0: BUS reset
fwohci0: node_id=0xc000ffc1, gen=4, CYCLEMASTER mode
firewire0: 2 nodes, maxhop <= 1, cable IRM = 1 (me)
firewire0: bus manager 1 (me)
firewire0: New S400 device ID:00d0a910023005cd
GEOM: create disk cd0 dp=0xc4220e00
cd0 at sbp0 bus 0 target 0 lun 0
Removable CD-ROM SCSI-0 device
cd0: 50.000MB/s transfers
cd0: Attempt to query device size failed: NOT READY, Medium not present - tray closed
Notice the "1.06" in the output. That is the drive's firmware version. If I need to update it, I can use PXUpdate, as explained here.
Since this DuoConnect supports FireWire so well, maybe I should have bought a SanDisk Ultra Firewire ImageMate Reader (CDW sells them for $42). If I only wanted to use the CF card with my laptop, I could have also purchased a SanDisk PC Card Adapter .
I'm making this blog entry using a USB 200M 10/100 NIC. While I can't boot with it attached, once I insert it into my USB port it appears like this to dmesg:
axe0: Linksys product 0x2226, rev 2.00/0.01, addr 2
axe0: Ethernet address: 00:10:60:25:a4:1a
on axe0
on miibus1
rlphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto
It's easy to configure it:
orr:/home/richard$ sudo ifconfig axe0 inet 192.168.2.5 netmask 255.255.255.0 up
orr:/home/richard$ sudo route add default 192.168.2.1
add net default: gateway 192.168.2.1
orr:/home/richard$ ping www.google.com
PING www.google.akadns.net (22.214.171.124): 56 data bytes
64 bytes from 188.8.131.52: icmp_seq=0 ttl=240 time=23.568 ms
Since USB 1.1 "Full speed" supports 12 Mbps, I can't make full utilization of a 100 Mbps link. Since this NIC connects to a wireless 802.11b bridge, which eventually connects to a cable modem, the NIC isn't the bottleneck. USB 2.0 "High speed" supports 480 Mbps, and IEEE 1394a ("FireWire 400") supports 400 Mbps.
Thursday, June 03, 2004
Fixing Troublesome Port Upgrades
drury# portupgrade -varp
---> Upgrade of devel/libbonobo started at: Thu, 03 Jun 2004 15:43:31 -0400
---> Upgrading 'libbonobo-2.6.0' to 'libbonobo-2.6.2' (devel/libbonobo)
---> Build of devel/libbonobo started at: Thu, 03 Jun 2004 15:43:31 -0400
---> Building '/usr/ports/devel/libbonobo'
===> Cleaning for libiconv-1.9.1_3
===> Cleaning for ORBit2-2.10.2
===> Configuring for libbonobo-2.6.2
checking for a BSD-compatible install... /usr/bin/install -c -o root -g wheel
checking whether build environment is sane... yes
checking for gawk... no
checking for mawk... no
checking for nawk... nawk
checking whether gmake sets $(MAKE)... yes
checking whether to enable maintainer-specific portions of Makefiles... no
checking for perl... /usr/bin/perl
configure: error: XML::Parser perl module is required for intltool
===> Script "configure" failed unexpectedly.
Please report the problem to firstname.lastname@example.com [maintainer]
and attach
the "/usr/ports/devel/libbonobo/work/libbonobo-2.6.2/config.log" including
the output of the failure of your make command. Also, it might be
a good idea to provide an overview of all packages installed on your
system (e.g. an `ls /var/db/pkg`).
*** Error code 1
Stop in /usr/ports/devel/libbonobo.
I found a thread with a similar problem. I also found an error, so I tried the following solution. I told portupgrade to upgrade the p5-XML-Parser port, which intltool complained about above. By using the -f switch I forced the reinstallation of the p5-XML-Parser port, and the -r switch told portupgrade to upgrade ports depending on p5-XML-Parser. This resulted in reinstallation of intltool and
drury# portupgrade -r -f p5-XML-Parser
---> Reinstalling 'p5-XML-Parser-2.34_1' (textproc/p5-XML-Parser)
---> Building '/usr/ports/textproc/p5-XML-Parser'
===> Cleaning for perl-5.8.4
tar: lib/perl5/site_perl/5.6.1/mach/XML/Parser/LWPExternEnt.pl:
Cannot stat: No such file or directory
tar: Error exit delayed from previous errors
pkg_create: make_dist: tar command failed with code 512
---> Uninstalling the old version
---> Deinstalling 'p5-XML-Parser-2.34_1'
pkg_delete: package 'p5-XML-Parser-2.34_1' is
required by these other packages and may not be deinstalled
(but I'll delete it anyway):
pkg_delete: file '/usr/local/lib/perl5/5.6.1/man/man3/XML::Parser.3.gz'
really exist
pkg_delete: file '/usr/local/lib/perl5/5.6.1/man/man3/XML::Parser::Expat.3.gz'
doesn't really exist
pkg_delete: file '/usr/local/lib/perl5/5.6.1/man/man3/XML::Parser::Style::Debug.
doesn't really exist
Installing /usr/local/lib/perl5/5.8.4/man/man3/XML::Parser::Style::Stream.3
Writing /usr/local/lib/perl5/site_perl/5.8.4/mach/auto/XML/Parser/.packlist
===> Compressing manual pages for p5-XML-Parser-2.34_1
===> Registering installation for p5-XML-Parser-2.34_1
===> Cleaning for perl-5.8.4
===> Cleaning for expat-1.95.7
===> Cleaning for p5-XML-Parser-2.34_1
---> Cleaning out obsolete shared libraries
[Updating the pkgdb
in /var/db/pkg ... - 196 packages found
(-0 +1) . done]
---> Reinstalling 'intltool-0.30_1' (textproc/intltool)
---> Building '/usr/ports/textproc/intltool'
===> Cleaning for libiconv-1.9.1_3
When this was done I upgraded libbonobo independently:
drury# portupgrade -v libbonobo
---> Session started at: Thu, 03 Jun 2004 16:31:27 -0400
---> Upgrade of devel/libbonobo started at: Thu, 03 Jun 2004 16:31:28 -0400
---> Upgrading 'libbonobo-2.6.0' to 'libbonobo-2.6.2' (devel/libbonobo)
---> Build of devel/libbonobo started at: Thu, 03 Jun 2004 16:31:28 -0400
---> Building '/usr/ports/devel/libbonobo'
===> Cleaning for libiconv-1.9.1_3
===> Cleaning for ORBit2-2.10.2
===> Cleaning for bison-1.75_2
===> Cleaning for gettext-0.13.1_1
===> Cleaning for glib-2.4.1_1
===> Cleaning for gmake-3.80_2
===> Cleaning for libIDL-0.8.3_2
===> Cleaning for m4-1.4_1
===> Cleaning for pkgconfig-0.15.0_1
===> Cleaning for popt-1.6.4_2
===> Cleaning for perl-5.8.4
===> Cleaning for python-2.3.4
===> Cleaning for intltool-0.30_1
===> Cleaning for libxml2-2.6.9
===> Cleaning for p5-XML-Parser-2.34_1
===> Cleaning for libbonobo-2.6.2
===> Extracting for libbonobo-2.6.2
That took care of the earlier problems and updated the port.
Review of Anti-Hacker Tool Kit, 2nd Ed Posted
"I reviewed the first edition "Anti-Hacker Tool Kit" (AHT:1E) in August 2002. This second edition (AHT:2E) follows only 18 months after the original was published. I don't believe enough time has passed to warrant an update, even though tools can evolve quickly. In certain aspects the book suffers from a lack of updates from AHT:1E author Keith Jones, who found the publisher's demands onerous. Nevertheless, AHT:2E is a must-buy if you didn't read AHT:1E."
Wednesday, June 02, 2004
Good News from Snort Land
The second good piece of news is the appearance of Sguil in several publications and presentations. First, Marty Roesch's AUSCERT 204 presentation (.pdf) includes Sguil along with ACID as two consoles for Snort. Sguil also appears in two new books, Syngress' Snort 2.1 and O'Reilly's Network Security Hacks. Both books spend most of their time explaining how to install older versions of Sguil, but it's the thought that counts.
Now that Snort 2.1.3 has been released, I plan to upgrade my Sguil for FreeBSD installation guide to use the new Snort, plus Barnyard 0.2.0, Sguil 0.4.0, MySQL 4.0.20, and other updated supporting applications.
Review of Hacking Exposed: Windows 2003 Posted
"HE:W03 is still the best book available if you want to learn how to assess and compromise Windows servers using publicly available tools. It will not teach original exploitation techniques like coding exploits, although this is usually unnecessary when admins deploy stock servers with blank administrator passwords. The authors are experts when it comes to performing pen tests of Windows targets, even though they are unapologetic Windows fans. (Page 195 bears the quote "command-line brain damage of Linux.") Their bias is also apparent as they question the applicability of the word "monopoly" to Microsoft (a legal fact); this isn't surprising given the authors' employers. Their bias also colors their judgment in the introduction, where they propose that security is a zero sum game between security and usability. Attitudes like that can no longer cover for Microsoft's security lapses."


text:
The idea of Open Galleries project is very simple, build and maintain an on-line photography archive available for everyone for free.
If you wish to contribute either by sharing your photos with us or by giving us ideas to make the site better, dont hesitate and email us! Same applies if you need larger versions of our photos - most of our original fotos have larger resolutions, somewhere between 5 and 10 MegaPixels.
If you happen to publish our photos on-line consider including a link back to www.OpenGalleries.org. With this simple gesture you would be helping us in the task of spreading the word about the site. Thanks so much :)
As to copyrights it couldnt be simpler, all the photos published in Open Galleries are 100% free! And yes, by free we mean free as in free beer, no tricks and no small letters! In other words, we grant everyone a non-exclusive free license to download, modify and reproduce any photo from our galleries.


text:
This was published 7 years ago
Take the train to find real Aussies, says Rush
IF YOU want to know what it means to be Australian, just hop on the train, says Australian of the Year Geoffrey Rush.
Speaking at an Australia Day event on Friday, Rush said he regularly marvelled at the eclectic crowd he shares his train rides with.
''I get some strong sense of our multi-dimensional character everyday just sitting on the train as I commute,'' he said.
''On that train, we all quietly have so much in common - we are all texting someone else who's not on that train.''
The Oscar winner said he was reminded of the diverse Australian character every time he was dropped into the mix at Melbourne's Flinders Street Station.
At a blustery MCG, and with fires raging in parts of the state, Rush chose to recite Dorothea Mackellar's famous poem My Country to express what he thought it meant to be Australian.
As if on cue, the winds picked up and turned the sporting arena into a temporary turbine just as the acclaimed Australian thespian said the iconic, ''I love a sunburnt country, a land of sweeping plains'' line.
Hosting the event, National Australia Day Council chairman Adam Gilchrist said the national day gave Australians the chance to reflect on the country's shared achievements.
''Once a year we have an extraordinary opportunity as Australians to celebrate the good things that we share and to reflect on the past,'' he said.
Australia Day ambassador and celebrity chef Elizabeth Chong said despite being raised in ''two worlds'', she was equally proud of her Chinese and Australian heritage.
''My father introduced the dim sim to the mass market, so that's a real Australian icon,'' she said.


text:
Hey GCS! You guys have done alotta 58, 59, 60, 61, 63 etc reissues,..but strangely 1964 models seem to have been left out.. Many believe 64 was one of the best years for many models before they changed.. The 64 ES-335's and SG standards are highly regarded and sought after, but you guys have yet to reproduce them. Seems like it would be logical to seek out and recreate them unless there is some unknown restriction on doing them next.... So hows about it?.. You did the limited Crossroads 335 but that really didnt count.. No 64 SG's that I have ever heard of..
Whats been the upshot when this has come up? Curious minds want to know..


text:
McCloud, Carol is the author of 'Fill a Bucket: A Guide to Daily Happiness for the Young Child', published 2009 under ISBN 9781933916439 and ISBN 1933916435.[read more]
You can find lots of answers to common customer questions in our FAQs
View a detailed breakdown of our shipping prices
Learn about our return policy
Still need help? Feel free to contact us
View college textbooks by subject
and top textbooks for college
With our dedicated customer support team, 30-day no-questions-asked return policy, and our price match guarantee, you can rest easy knowing that we're doing everything we can to save you time, money, and stress.


text:
Earlham students who meet the requirements of each individual program as outlined on program information sheets are eligible to apply. Each program has its own set of criteria, which may include a language requirement or specific course requirement. Students may only apply to one program at a time.
Students must be in good academic status with the College and making satisfactory academic progress toward graduation requirements (see Curriculum Guide) to apply. Students who are on academic probation are ineligible to apply to or to participate in off-campus programs.
Students must be in good standing with the College. Students who are on disciplinary probation are ineligible to apply or to participate in off-campus programs.
Students who are on a Medical Leave of Absence from the College and who are interested in an off-campus study program should have a healthy and academically successful semester after the MLOA and prior to application and/or approval for off-campus study.
Application materials for Earlham off-campus semester programs are available in the Center for Global Education, 132 Bolling Center, and online. Applications consist of several components, including a four year plan and form signed by the Academic Advisor, a recommendation form completed by a faculty member, a set of essays to be completed by the applicant, a form signed by the Student Life Office, an application form, student agreement and essays to be completed by the student. Students may only apply for one program at a time.
Completed applications are due in the Center for Global Education by 5:00 on the application deadline. Deadlines are posted in the CGE, on the CGE website, and in Today @ Earlham.
Criteria for selection include but may not be limited to, the following:
A selection committee composed typically of the Faculty Leader(s), past program participants, and a representative from the CGE reviews the application materials. In addition to the application materials, an interview is also an important component of the selection process.
The Center for Global Education may consult with relevant college personnel for advice concerning, but not limited to, serious medical or emotional problems, violations of acceptable community behavior such as alcohol or drug abuse, threats of physical harm, damage or destruction of property, or sexual assault.
No student is guaranteed acceptance to any specific program. Programs are subject to capacity limitations and other admissions criteria.
After the selection of students has been made, the Center for Global Education will send a letter to all applicants informing them of the results. In some cases, students may be placed on a waitlist. If there is a withdrawal from the program, waitlisted applicants may be reconsidered.
A student who has not been selected may appeal the decision. For an appeal to be considered, the student must be in good standing with the College and eligible to participate. The appeal must be in the form of a letter and should be submitted to the Director of the Center for Global Education. The Center for Global Education will inform the student of the results of the appeal. Results of all appeals are final.
The Center for Global Education informs students of the results of the selection process in a formal letter sent to the student's campus mailbox. Faculty may inform students after the formal letter from the CGE has been sent. Students are informed of the Conditions of Acceptance in the acceptance letter. Participation in the program is contingent upon:
Failure to meet all of the above the conditions may result in a student being disenrolled from a program.
Earlham semester programs cost the same as tuition, room and board, and fees on campus. Students are required to have a 19-meal plan on an off-campus program. Students are responsible for travel costs to and from the program site, for costs of independent travel, for books and materials, for passport, visa and health costs, and for personal expenses.
Students will be billed on the regular Earlham billing cycle.
Participation in the program is voluntary, but students agree to participate in the program and cooperate with Earlham College, the Faculty Leader, and the group in all aspects of the program.
Students who withdraw from the program should notify CGE immediately in writing. Students who withdraw from the program, or who do not meet acceptance policies and cannot participate, will be required to compensate the College for expenses already committed on their behalf.
Participation in this 1-credit course is required for enrollment in an Earlham off-campus program. This 7-week course will be scheduled during the second half of the semester and includes three joint sessions with all programs. The remaining class sessions will be held with individual groups, including one all-day session. This course is designed to prepare participants for the cross-cultural experience. Earlham students will receive 1 semester hour credit (OFFC124). There is no charge for the credit. During the preparation course, students will be provided with a Program Handbook with important information. Parents/guardians will also receive the Handbook. Students who do not complete all class sessions may be disenrolled from the off-campus program.
Upon returning to campus after participating in an Earlham off-campus program, students are required to enroll in this 1-credit, 7-week course. CCE Post will guide students in processing and analyzing their off-campus experiences, and it will help students to think about ways to build upon and integrate those experiences into their future and career plans. There is no charge for this credit.
All students on Earlham off-campus programs are required to have medical insurance that covers them when they are outside of the United States. In addition to personal health insurance coverage, Earlham provides students and staff on Earlham off-campus programs with travel insurance through AIG Assistance Services. Earlham also provides all students on our programs with the International Student ID card sponsored by STA Travel, which provides supplemental travel insurance coverage when traveling outside the country.
The Faculty Leader, in consultation with the Center for Global Education at Earlham, has the authority to establish expectations necessary for the operation of the program either prior to the off-campus experience or during the off-campus experience. Should the Faculty Leader or Director of the Center for Global Education decide that a student must be terminated from the program, that decision will be final. Expectations include:
Active participation in the Cross-Cultural Explorations Pre course; satisfactory academic work; making satisfactory academic progress toward graduation; ability to meet the financial obligations of the program and the College; willingness to be a responsible and cooperative group member; conformity to program rules and expectations; upholding laws and regulations of the area; good health that promotes effective participation; disclosure of material information requested by the program; and appropriate conduct in the host community or host country. Conduct that is potentially dangerous to the student or to others, such as the use or possession of illegal drugs or excessive alcohol consumption, may result in termination from the program. Serious physical or mental health issues that hinder the student's ability to participate successfully may also result in termination from the program. Students who are dismissed from a program or who leave a program early will receive no credit for the semester.
The Center for Global Education and the Faculty Leader or Resident Director will work together to coordinate a student's return trip and to coordinate information on the Earlham campus.
Participation in an off-campus semester program involves risks not found in study at the College. These may include, but are not limited to: risk involved in traveling to and within and returning from the program site; political, legal, social and economic conditions; different standards of design, safety and maintenance of buildings, public places and conveyances; local medical and weather conditions. Students assume responsibility for their actions and well being at all times: prior to the program, during the program, during the independent periods, and following the program. It is the responsibility of the student to consult with the United States Consulate and other appropriate agencies and authorities regarding the advisability of travel to other areas in the region if traveling overseas. Prior to departure for the program, students are asked to register with their national embassy in the country in which they will study. Students must accept these risks and responsibilities.
Students are required to arrive at the program site by the date specified. Students are expected to complete the program and remain at the program site until the specified departure date. Students who arrive prior to or depart after the scheduled program dates are responsible for their own arrangements and costs.
Students are required to be fulltime students throughout the program and will be enrolled in all of the courses offered on the Earlham off-campus program. Independent studies, audits, the Credit/No Credit option and variable credit are not permitted. Credit is awarded only as indicated on the course schedule.
Grades from Earlham off-campus programs will be included on the Earlham transcript and will be calculated into the grade point average. Students must complete the entire semester program on-site in order to receive any academic credit.
Students are required to obey the conduct requirements of the individual program. Students are required to be in good physical, mental and emotional health to complete the program.
Students who participate in Earlham off-campus programs are required to be up to date on all vaccines and inoculations listed as needed for their specific program. There will be no exceptions to this policy for philosophic or religious reasons.
Students are responsible for their expenses during the independent travel period.
Students who are responsible for breakage or damage in the living situations or in the classroom setting will be charged for the cost of repair or replacement. Students who lose host family or other keys pertaining to the program will be charged for replacement and other associated costs.
Students are expected to complete a program evaluation before returning from the program as well as after returning to campus.
Earlham reserves the right to terminate or alter a program at any time and for any reason, without prior notice. Every attempt will be made to keep students apprised of these changes as they arise.
Student Eligibility
Application Process
Selection Criteria
Student Selection Process
Student Acceptance Process
Program Deposit
Program Cost and Billing
Student Withdrawal
Cross-Cultural Explorations Pre
Cross-Cultural Explorations Post
Program Dismissal
Risks and Responsibilities
Arrival and Departure
Courses, Academic Credit and Grades
Student Conduct and Health
Independent Travel
Breakage, Damage and Loss of Items
Program Evaluation
Program Changes