Friday, 22 April 2011

Freedom House Report

UK: Worst of a Good Lot

Sponsored by the United Nations Democracy Fund (UNDEF), Freedom House just published the report Freedom On The Net 2011.

The good news: UK narrowly escapes relegation from the first division, retaining its Internet freedom status designation of "Free" (up to 30 points) with a nail biting 25 bad boys - up from 2009's (adjusted) total of 23 strikes. Only Italy and South Africa, at 26 points each, fare worse in this division.

Trajectory: Slight Decline

The full league tables are here:

http://www.freedomhouse.org/images/File/FotN/MainScoreTable.pdf

The most worrying aspect, for user rights activists anyway, emerges when these scores are analysed by the three broad UNDEF categories: obstacles to access, limits on content, and more disturbingly than those, violations of user rights.

1: Obstacles to Access

The first category assesses barriers to access, both infrastructural and economic; governmental blocking of apps and/or tech; and control over access providers. Clearly there is some room for mitigation in this category, as not all of a network's shortcomings are necessarily planned to be such. The UK however makes no capital of this mitigation, scoring but a single point here - the best performance in fact among all of the (now 37) nations covered by this year's report.

2: Limits on Content

Next the survey considers "content limits" - all forms of censorship, including website filtering and blocking, content manipulation, and the availability, diversity and usage of digital media for social and political activism and news. Here we find the UK scraping its arse along the bottom of the channel, tying with Italy on 8 points, only South Africa worse on 9.

The Internet Watch Foundation comes under particular and extensive criticism for its persistent technical incompetence, absence of clarity and transparency in its blocking and removal criteria and actions, its inadequate appeals process, and lack of any judicial (or even governmental) oversight.

3: Violations of User Rights

That just leaves legal protections, restrictions and prosecutions, surveillance, privacy, imprisonment, and harassment including physical attacks. No surprises here, with the UK emphatically at the bottom of the division on 16 points (second worst is Italy on 12).

The disastrous Digital Economy Act is highlighted, although the interim conclusion on that score states "In a positive development, the newly elected coalition government has promised to review and repeal a number of laws that negatively affect online free expression and privacy." As we have now seen this fail to happen, there must be doubt over the UK's overall "Free" status today.

Conclusions

Internet freedom in the UK is measurably deteriorating year by year, as evidenced by the decline in the "free" status reported by successive Freedom House biennial surveys. The country specific report provides the details:

http://www.freedomhouse.org/images/File/UK2011.pdf

Many of these reasons have already been well publicised, for example:
  • The expansive restrictions of English libel law are identified as having "...a significant chilling effect on both content producers and ISPs."
  • Further high profile cases, illustrating the frequently ass like nature of the law, are included; such as freedom to tweet your frustration about airport closures through the medium of mad parody, and police sanctioning of cybercafe snooping by proprietors.
It's hard to escape the conclusion that we have already seen the UK's final days at the top table of Internet freedom.
0 comments Tags: , , ,

Ravish Revisited

New Artwork!

Having a great Easter holiday right now, driving around mostly at random. Yesterday saw a day trip to the Lake District, stopping off at Windermere, grabbing an alfresco at the Wateredge Inn. More about that later, maybe...

Day before was a lazy local sightseeing trip of New Lanark and the Tinto hills. That's when we found this lovely old pavilion. Now admit it, if you rounded a random corner to find such a distinguished, beautiful brickwork black board, you'd screech to a halt for a proper pic, and use it as artwork for your new single.

Well, we got there first. And while the super limited mini-vinylesque edition might already be sold out, you can still help yourself to the free MP3 download here:
1: Ravish
2: The Drummer's Hashpipe
3: The Devil's Pot Pipe

Artwork: Front Back
0 comments Tags:

Friday, 8 April 2011

Penultimate Retrochamps

Futuristic Retro Champions
The Captain's Rest, Glasgow
8 April 2011

On iTunes: Love and Lemonade

Never would have thought it possible, simultaneously to be so very sad, yet so happy. Certainly not after just that single pint of fresh orange and lemonade! But the happiness comes as standard with FRC, about whose contagious brand of emotronic happy hardcore I've written before. It comes from their performance, their open and unapologetic optimism, bright melodies and infinite smiling.

Happiness comes too from stellar songwriting, which above all else about them, so deserves to be cherished. Pleasure comes from their sheer quality of vocal harmony, arrangement, execution and production. From ingenious lyrics that create empathy, joy and sublimation. The absolute nailing of the sound they're after, with the biggest, bossest Black & Decker nail bloody gun. So nailed that sometimes you will misfile it. This can lead to hallucinations.

For example last year, on first hearing their mighty single May The Forth, I recall thinking aye - that was really well bloody good. But later the same day, the chorus still in my head as I happened to put the song on again, stupid brain said wow, didn't realise they did covers - but that sure was one fantastic classic. Shut up, stupid brain! You're out of your depth. You've pulled this trick on me before, telling me the music from that Comet ad was another legendary 80s dance anthem, when actually it was just Badly Drawn Boy's All Possibilities (2002).

Hey I Thought This Was About FRC -
You Said Something About Sadness?

Ah yes, the sadness. Having known for this past half-year, that tonight's show would be their last ever appearance in Glasgow; tomorrow's in Edinburgh's Wee Red Bar, their last anywhere. It was a sign of the greatest affection that this loyal knot of fans, as the band took the stage tonight and a smiling Sita began "Oh well, here we are then, this is it", reacted with one voice: boo.

This warm welcome seemed entirely expected, and they brushed it off instantly. Seconds later, all were dancing to Epic New Song. Swiftly followed by Hi!, the first song they ever recorded. Oooh, meta - Retrochamps get nostalgic! A beaming Fergus Weir joined them on stage, providing chant vocals in Let's Make Out.

The gentle Isn't It Lovely showed another side of the band, who continued to inject variety into the night with everyone taking a turn at lead vocals. When Sita steps up to the mic, every inch the pop star, she owns it. Yet from Harry's showcase Speak To Me, through Carla's riotous DIY Love Song to Ceal's vocal debut Uh Oh (No Show) when she asks politely for a little more volume on her mic "just for this one song", the singing duties are passed round with that generosity, that freedom from ego, so often found in art school and music college bands, and so rarely elsewhere. Harry and Ceal even swapped guitar and bass duties toward the end.

The (New Order? Ladytron?)-styled gem You Make My Heart exhibits again that time warping magic, paradoxically at once both retro classic and brightly original. As for the peerless Jenna - like I said, Sita simply owns. She actually made eye contact with me as together we sang one of their funniest lines, "But you're so tall, and I'm Pieraccini!"

Packed into that tiny cellar, we sang all their words back to them. Poor Linda, squeezed in even closer to the deafening PA than I during May The Forth, sought in vain any conscious hint of irony as certain fans in the... mature category, not quite pulling box shapes like others half their age and size, would belt out - Watching you dance / has given me / a second chance to feel young again...

The one band member not accorded equal respect with everyone else was their beleaguered "one trick" drum machine, who showed some signs of giving out early on. Our fault, quipped Sita, running him five years on that one set of batteries. At the end of the night, I knew how he felt.

Setlist: Epic New Song, Hi!, Let's Make Out, Speak To Me, Strawberries And Vodka Shots, Count To Ten, Uh Oh (No Show), DIY Lovesong, Isn't It Lovely?, May the Forth, Jenna, You Make My Heart.

Band Wiki

Though on the night we did catch FRC's full set, we were as usual irredeemably late, missing out on the decks of Manda Rin and most of Little Eskimos. This was partly due to our driver (=me) mentally relocating The Captain's Rest, first to Bath Street, then even less helpfully to St Vincent Street, before finally giving up entirely and heading off randomly - not to mention fortunately - in the direction of Great Western Road.*

When we arrived, Carla's brother Murray Easton on the door recognised me as the band's shadow lurking, unofficial Wikipedia guy. And he must have told; for after the show, when I asked Sita to autograph my new copy of the 2CD Love And Lemonade, she mentioned that Wiki in the signing [pic]. Later too Carla and her boyfriend tried to say hello, while Linda and I raved back at them (in my case a little hoarsely) about the night's performance. Murray having left with his marker pen, I was unable to collect Carla's autograph. Desolation! We might just have to take a run through to Edinburgh tonight...

On the other hand, these perfectly retro mini-vinyl style CDs hid a beautiful sealed note from "Casio Carla" (actually she drives a big Yamaha) which, given the super-limited edition of just 75 copies, might have to do instead until we meet again. No you can't see it, it's mine. Murray did let slip a few details about the new band the girls are planning soon to form, but I'm keeping shtum about that too, at least until there's an official announcement. Their level of talent and originality is just shocking; it can't happen too soon. And that goes for you too, Harry Weeks!

More photos from the gig: https://picasaweb.google.com/johnmkerr/FRCcaptainsrestApr82011# by Linda Kerr.
Free to use under the Creative Commons Attribution-ShareAlike 3.0 Unported licence.

* Wow, eight adverbs counting "first". Candidate for worst sentence ever written!

[Update: 9 Apr 2011]

Ultimate Retrochamps: The Disbanding

Ten o'clock on a soft Glasgow April evening. Forty miles to the east, FRC play the final tumultuous chord of their ultimate show (our last ever show ever!), and Saturday night curfew sounds in Edinburgh's Wee Red Bar. Meanwhile back here, forty miles in the west, a sad duty calls. Wikipedia won't update itself:
FRCs are were...
Current Members...
2006 - present 2011...
Farewell, you Futuristic Retro Champions. When you quit, you were still - in the words of Manda Rin - the best new band in Scotland.

[Update: 12 Apr 2011]

Check out Murray's account of that whole weekend: http://musicinglasgow.blogspot.com/2011/04/futuristic-retro-champions-last-weekend.html.
0 comments Tags:

Wednesday, 6 April 2011

Simple Regex #3: A Failure Case

No Back Tracking

I was processing a number of Visual Studio files. A large-ish number of C# solution, project, and source files. Looking for any obsolete (or otherwise redundant) .cs file which wasn't included in a .csproj - or worse, any .csproj that wasn't explicitly built by a .sln. Now, some of these projects referred to files not in the directory subtree of the project file itself. Also, some such references employed relative paths.

For example, if the project file at

d:\project\client\startup.csproj
refers to the source file at

d:\project\engine\utils.cs
then it's likely to do so using two dots; i.e., under the guise of

..\engine\utils.cs
Obviously, appending this relative path to the client directory path

d:\project\client\
yields a perfectly serviceable, though not optimal, source file path:

d:\project\client\..\engine\utils.cs
Trouble is, my earlier directory traversal, building up the dictionary of source files, created the entry for this file using the "key":

d:\project\engine\utils.cs
So in order to normalize keys, I needed to remove the \client\.. portion of the calculated path, making these two identical. Sounds like an ideal job for a wee bit of simple Regex, no? Just remove all instances of a backslash, followed by a bunch of non-backslash characters (the redundant directory name), followed by another backslash and two periods:
return Regex.Replace(input, @"\\[^\\]+\\\.\.", string.Empty); // Bug!
No!

I puzzled for a little while over why the output of this function still contained embedded \..\, before finally adding some debug code and discovering the answer.

Before:

d:\project\client\forms\..\..\version.cs
After:

d:\project\client\..\version.cs
Why hasn't the above code removed \client\.. from this path? Because \client\.. wasn't in the original input string. When it does appear, the Regex.Replace operation (having just removed \forms\..) has already moved beyond that position in processing the input string. And it does not backtrack. Can't afford to, that would be mayhem. Imagine it trying to replace "x" by "xx" with backtracking.

~(∀x)(x is a nail)

I could work around the bug, say by detecting whether any change has been made to the input string, and if so (or rather, while so) re-running the operation. That's clearly inefficient. No, the best thing to do here is accept I've selected the wrong tool for the job - a conclusion you'll reach fairly often with Regex!

Here finally is the smart approach to this problem:
return System.IO.Path.GetFullPath(input); // Fixed.
5 comments Tags: ,

Friday, 1 April 2011

Tweets - March 2011










0 comments

Thursday, 31 March 2011

SEHOP

Structured Exception Handler Overwrite Protection

A timely reminder from somewhere near the middle of the new Microsoft SDL Progress Report (1.8MB pdf, including lots of lovely graphs):
Certain types of vulnerabilities can allow an attacker to make use of an exploitation technique known as a Structured Exception Handler Overwrite (SEH overwrite). This technique involves corrupting a data structure that is used when handling exceptional conditions that may occur while a program is running. The act of corrupting this data structure can enable the attacker to execute code from anywhere in memory. This technique is mitigated by SEHOP, which checks to ensure that the integrity of the data structures used for handling exceptions is intact. This new invariant makes it possible to detect the corruption that occurs when an exploit uses the SEH overwrite technique and is ultimately what makes it possible to break exploits that make use of it. SEHOP is a relatively new mitigation technology and is expected to become a requirement in future versions of the SDL.
Windows Vista SP1, 7, Server 2008 and 2008 R2 introduced support for SEHOP as a runtime feature, helping protect applications regardless of whether they were compiled using previously available mitigations such as the /SAFESEH option.

By default this protection is enabled on Windows Server SKUs (Srv08/R2) and disabled on Client SKUs (Vista SP1/2, Windows 7). If you're running one of these clients, clicking on the Microsoft Fix it graphic above will enable SEHOP for all applications.


"If you cannot enable SEHOP for all applications we strongly recommend enabling SEHOP for all internet facing applications, such as your preferred browser and mail client."
- Matt Miller, MSEC Science
0 comments Tags:

Wednesday, 30 March 2011

First Day O' Security Follow Up

Security Theater

The most cited criticism of the (first) Day O' Security material seems to have been lack of the expected real world examples of specific vulnerabilities, threats, mitigations and attacks:
  • Better concrete examples – ideally from our own code base if possible!
  • Not enough real world examples.
  • No code related examples (I know it’s more about the broad topics, but some specifics would have been nice).
  • Would have liked concrete, how-to examples on security, i.e. how-to do authentication, how-to techniques on securing the transport, how stuff works in our domain etc.
  • No real life exploiting of security [stories], i.e. Gary McKinnon probably used X method or Google got hacked one time because of X.
  • Would have been good to hear about real world examples of specific attacks.
Fear not gentle readers, we'll soon be getting to all that fascinating stuff. Meanwhile it's clear you deserve an explanation: why did we deviate from that more obviously crowd pleasing agenda?

In his book Beyond Fear: Thinking about Security in an Uncertain World, Bruce Schneier coined the term Security Theater, describing countermeasures intended to provide the feeling of improved security, while doing little or nothing to actually improve it - or even making matters worse. This often takes the form of trying to prevent the most recent successful attack. Political pressures, like media hype and misinformation operating on an invariably poorly informed electorate, cause the adoption of the bad syllogism:
  • Something must be done!
  • This is something!
  • Therefore, this must be done!
The consequences of security theater can range from Internet banking services that time out after seconds of inactivity, preventing you from getting any business done; to huge and vulnerable lines of people waiting in airport security, nicely kettled and immeasurably easier to bomb than previously. Meanwhile the bad guys - with the possible exception of only the very best, most successful suicide bombers - rather than resting on the laurels of their most recent success, are concentrating on their next, least expected attack.

The First Thing About Security

Whether in the arena of terror or the field of data processing, the antidote to the populist security theater mentality is concentration on holistic core principles. Airport security is that service sector's very last line of defence against the dangerous and deranged, but successful detection and capture there signals little more than failure of the intelligence-led policing intended (required) to guard against public atrocities in general. Effort, money and resources are almost invariably better spent when targeted at the latter strategy.

So too with computer security. The great majority of past exploits, however ingenious and heroically evil, are solved and patched; at least in the sense that solutions and patches are available to potential targets. Hearing about these exploits is fun, much like reading a good detective or espionage novel.

Very shortly before our first Day O' Security, the schedule was changed from an all-day session to two half-day presentations of the same material (intended to allow more people access to the limited number of PCs, which in the event went unused). In excising the populist examples of black hat ingenuity in favour of the higher priority core concepts of vocabulary, taxonomy, data flows, trust boundaries, threat modelling and attack surfaces, I veered decidedly and deliberately away from the security theater approach of finding then papering over the cracks in the plaster. By way of compensation, other received comments appear to acknowledge that humorous content did not necessarily suffer as a result.

The Second Thing

I mentioned above that high profile examples still have their place, and their time is coming. Meanwhile if you want a sample of the kind of thing planned for Day 2, take a look at Part 2 of this Google Code University slide deck on Web Security:

(Hat tip: Brum Brum)

An accompaniment to the book Foundations of Security: What Every Programmer Needs To Know, these ppt slides are CC licensed just like the Microsoft SDL materials used in Day 1, so they may be retained for use in Day 2. Or it might be completely different; you'll just have to come along to find out.
0 comments Tags:
Subscribe to: Posts (Atom)