The Quiet Earth

... that which can be adequately explained by stupidity.

Hanlon's Razor

Konkret: der Fall der verlorenen Kreditkartendaten der Berliner Landesbank wurde durch zwei Kurierfahrer verursacht, die Christstollen haben wollten und daher einfach zwei Pakete austauschten...

Ohne Worte.

Freiburg - Konzerte & Festivals - Alternative & Indie - Konzerte & Festivals - Pop & Rock - Konzerte & Festivals - Elektronische Musik

Wie erwartet: intimes Ambiente. Ein kleines, aber sehr feines Konzert mit den alten Gassenhauern und den neuen Stücken von der Smallest Acts of Kindness-Platte. Das Preis-/Leistungsverhältnis war gelungen (knappe 20 €uronen für 2h Konzert). Endlich mal wieder ein Konzert, endlich mal wieder heiser

Nächstes Mal wieder

Mein Beitrag zu Anne Clark - Ich bin aeble - auf Qype

It's no secret: Anti-Spam configuration can be hazardous to your email traffic. If the spamfilters generate too many false positives your email transmission will suffer. This is a major problem in B2B configurations and can bite you out of the blue.

I've had this problem in the past, when the company I was working for was justifiably listed on an RBL. And I had it again, now - only this time I am reasonably sure that the system is a) configured tightly enough not to be usable as an open relay and b) not being used for sending out marketing or other possibly spam-alike emails.

Nevertheless, the system was listed with a commercial anti-spam appliance vendor in their RBLs (which are "reputation based" - meaning, they have a set of criteria that can give you a certain (read: bad) reputation). The only explanation I have for this is that said company has caught backscatter from our system and classified that as spam. If you don't know what Backscatter is: that's bounces sent to innocent people that were listed in the From: address of Spam.

The danger with those commercial anti-spam appliances is the multiplication factor: if you happen to end up as a false positive with those companies, you may lose contact with not only one customer, but with several.

There are several solutions to this:

1. Don't send out error reports for undeliverable emails. Can only be done if the system does not receive mails at all


2. Monitor RBLs with your monitoring solution. For Nagios there are RBL checks and I'm sure for other tools as well. The only problem: how do you make sure you're monitoring all (relevant) RBLs? And you will probably not be able to monitor the commercial services as they make a profit out of their services.

How do you cope with these problems? What are your ideas?

Any help appreciated!

A customer system needed to be upgraded and for several reasons it was supposed to be moved from Windows server to Linux (more on that another time). The server was supposed to be moved from one IP range to another as we are moving from our old Provider Aggregatable (PA) IP addresses to our "new" Provider Indepedent (PI) addresses.

I set the system up and it was supposed to be a hard cutover on one day. It quickly turned out that this was not feasible (again, for several reasons, e.g. the amount of data to copy over was too big). So, finally, it was decided that the cutover was to be smooth: the majority of data was rsync'ed over from Windows in the days before the cutover date, then the rest on the cutover day. The SSL certificate was to be copied over on day X and the new server running Linux should take over the IP address of the old (Windows) server. As the system was now multihomed we needed to cope with asymmetric routing. First off, we thought it should be possible to hide all incoming traffic to the old IP addresses behind the internal IP address of the firewall - but it turned out our product does not allow for that.



The solution to this is policy-based routing: if the packet goes out on Interface_new, a different routing decision needs to be taken than when it would go out Interface_old. Fortunately, Linux does allow for this with the iproute2 package: you can have several routing tables glued together with a routing policy, i.e. a set of rules that controls the selection of the routing table. If a rule matches and a route is selected from a routing table the packet gets routed according to this route. If there is no matching route the rule traversal continues.

In our setup this means, that all packets from IP_PI-Space should get routed to the PI-Space gateway whereas all packets from IP_PA-Space should get routed to the PA-Space gateway. Currently, the default gateway is the PA-Space one, so we don't have to do much.

In Debian/Ubuntu syntax, the network is then setup through /etc/network/interfaces with a stanza like the following:

auto eth0

iface eth0 inet static

        address   A.B.C.D

        netmask  255.255.255.240

        network   A.B.C.128

        broadcast A.B.C.143

        dns-nameservers some.dns.serv.er

        gateway A.B.C.129

And for the Interface in the PI address space, the stanza looks like this:

auto eth1

iface eth1 inet static

        address   V.W.X.Y

        netmask  255.255.255.240

        network   V.W.X.128

        broadcast V.W.X.143

        dns-nameservers some.dns.serv.er

        post-up ip rule add from V.W.X.Y table PI-Space

        post-up ip route add default via V.W.X.129 table PI-Space

The two post-up lines are the magick in here: the first adds a rule to the routing policy that, for all traffic originating from the PI space interface, a lookup should be performed in routing table PI-Space. Then, we add a second default route to that very same routing table. Now, whenever a packet goes out Interface eth1, the kernel checks if there is a matching route in routing table PI-Space. As we have a default route, this will always match and the packet gets routed to the gateway in our PI space.
Obviously, all other traffic originates on eth0 so the "normal" routing table will be used, thus this traffic will go out via the gateway residing in the PA address space.

loose ends

Actually, the kernel does not check a routing table named "PI-Space". It will use a numerical identifier that is mapped in /etc/iproute2/rt_tables like this:

#

# reserved values

#

255     local

254     main

253     default

0       unspec

#

# local

#

#1      inr.ruhep

100     PI-Space

Hinweis in eigener Sache: Im Zusammenhang mit unserem kurz bevorstehenden Umzug habe ich eine Latte Bücher abzugeben, die ich nicht mehr umziehen werde. Die gesamte Liste liegt unter Bücherliste. Bei Interesse bitte eine Email oder Nachricht im IRC. Ansonsten fliegen die Bücher ins Altpapier. Und ja, da blutet mein Herz.

Und immer wenn du denkst, es geht nicht mehr (schlimmer), kommt irgendjemand, der dir das Gegenteil beweist. Na super. Heute morgen finde ich in meiner geschäftlichen Inbox diesen Spam:

Sehr geehrter Herr Eble,

vor Kurzem haben wir mit einem jungen Team JobLeads gelauncht. JobLeads ist eine "By Invitation only"-Karriereplattform, die sich speziell an hoch qualifizierte Fach- und Führungskräfte richtet. Top-Unternehmen schreiben bei JobLeads ihre Stellenangebote aus und versehen diese mit Prämien zwischen € 2.000 und € 20.000 für die erfolgreiche Empfehlung von Kandidaten.

Um den Anforderungen an eine exklusive Karriereplattform gerecht zu werden, gehen wir bei der Auswahl unserer Mitglieder sehr selektiv vor. JobLeads-Mitglieder haben an führenden Universitäten im In- und Ausland studiert und sind nun in verantwortungsvollen Positionen tätig. Als Absolvent der Universitaet Freiburg gehören auch Sie zu diesem Personenkreis und wir möchten Ihnen anbieten, die Vorteile von JobLeads zu nutzen (die Mitgliedschaft ist und bleibt natürlich kostenlos).

Als Mitglied hat man exklusiven Zugang zu Top-Stellenangeboten und die Möglichkeit, die ausgeschriebenen Positionen an Freunde zu empfehlen. Kommt es aufgrund einer Empfehlung zu einer Einstellung, erhält man die Prämie. Selbstverständlich kann man sich auch auf interessante Positionen bewerben. JobLeads macht es so möglich, immer über spannende Stellenangebote von attraktiven Unternehmen informiert zu bleiben, Freunden interessante Jobs zu empfehlen und nebenbei noch Geld zu verdienen.

Falls Sie Interesse haben, JobLeads-Mitglied zu werden, können Sie sich über den unten stehenden Link registrieren. Falls nicht, wünschen wir Ihnen auf Ihrem Karriereweg weiterhin viel Erfolg.

https://www.jobleads.de/user_introduction_invitation.php?aid=XXXX



Viele Grüße aus Hamburg

Ihr JobLeads-Team

Das zeugt ja schon mal aus mehreren Gründen von äh... fehlender Überlegung. Erstens: woher haben die meine Geschäftsadresse? Mit der gehe ich nicht gerade hausieren. Zweitens: es ist Spam. Ich habe keine Geschäftsbeziehungen mit diesem ominösen Unternehmen noch habe ich Interesse daran, von denen meine Inbox gefüllt zu bekommen. Drittens: schlechte Datenquelle - ich bin kein Alumnus der ALU. Ich war da zwar mal eine Weile eingeschrieben, aber ich habe nicht abgeschlossen dort. Viertens (und damit kommen wir zu den technischen Seiten des ganzen Braindeaths): es gibt keine funktionierende Abuse-Adresse für jobleads.de. Fünftens: dünnes Gefasel auf der Webseite, irgendwo ist "Recruiting 2.0" erwähnt (meine Güte, dieser 2.0-Hype ist doch schon wieder vorbei!).

Ich spare mir jetzt irgendwelche offensichtlichen Auslassungen über Investmentbanker. Man soll ja nicht eine ganze Berufsgruppe über einen Kamm scheren.

Nichtsdestotrotz muss man derartigen Machenschaften gleich entsprechend einen Riegel vorschieben:

Hallo,

Ich habe diesen Spam von Euch in meiner geschäftlichen Inbox gefunden. Nicht genug damit, daß Ihr damit eindeutig gegen existierende Gesetze verstößt, zeigt ihr dazu noch

1. eine erstaunliche Insensibilität (hallo? Jobmarkt-Angebote an geschäftliche Adressen? Geht's noch?)


2. eine erstaunliche Inkompetenz was Marketing in Zeiten des Internet bedeutet (Spam ist die beste Antiwerbung, die ihr hättet machen können)

Eine rechtliche Aufarbeitung dieser Email spare ich mir - diesmal. Nichtsdestotrotz beanspruche ich nach §19 Bundesdatenschutzgesetz Auskunft darüber:

1. welche Daten Ihr über mich gespeichert habt


2. wo ihr diese Daten her habt


3. an wen Ihr diese Daten weitegegeben habt bzw. weiterzugeben gedenkt

Ich gebe Euch bis Freitag, den 7.12.2007, 17:00 Zeit, dieses Auskunftersuchen zu beantworten. Verstreicht diese Frist ohne Antwort, werde ich rechtliche Schritte einleiten.

Darüber hinaus untersage ich jedwede Weitergabe oder Verarbeitung der gespeicherten Daten, soweit sie mich betreffen.

Axel Eble

Die Karriere-Bibel sieht das JobLeads-Angebot übrigens etwas neutraler.

Well, it's been on my mind for quite a while to set up some sort of security meeting in the area.

It should have something to do with security and I want to learn something through it as well.

Over at JollyOrc I got intrigued by the idea of a barcamp and, what can I say: the three items seem to match up nicely.

We've been over the issue of security metrics time and time again in many different places and in many different company - without any meaningful result so far. I think it's time for a get-together and a discussion about what metrics make sense in what context.

The format of a BarCamp seems to be ideally suited for exactly that: a get-together of like-minded people with different backgrounds working on the same topic.

I'm sure the location could be provided, maybe even by my company.

So flickr had a hiccup yesterday. Well, truth be told, it was a major problem on their side: the image caches ran amok and delivered the wrong pics - not a few of them a bit on the more adult oriented side (as a sidenote, this proves what we all knew anyway: The Internet Is All About Porn). To the emotional outcry from lotsa lotsa users came the fact that the problem was not resolved by restarting the flaky cache server(s) but instead resurfaced once again. So finally, after quite a few hours of downtime (and I bet beet red engineers working overtime to find the bug and fix it) the system is back up.

So that's the exposition, which just about gives you an idea of the dimension of this thingy. It didn't? Well, then let me summarize: It Was BIG. However, flickr not only took down their site but pointed to their blog - in which Eric Costello did keep the users informed (if only tersely, but this is better than just a few lame marketing lines stating that all is beautiful and the system is just being enhanced yaddayaddayadda). When it was apparent that flickr would solve the problem he sat down and wrote a decent explanation of the problem - in a way to satisfy both non-technical users and the somewhat tech-savvy ones. He explains the issue without emotional overtures nor does he play it down:

To be clear, we regard this as a serious problem, but it is something that goes away as soon as we restart the malfunctioning servers (tonight we found that the servers were going insane again shortly after restarting, but we have isolated the problem and believe we have a permanent fix).

And finally, he concludes with:

We shamefacedly apologize for the inconvenience and the scare. We understand that it probably seems very, very strange and we know that many people got the impression that their photos were lost forever. But they should all be back now, safe and sound. And everyone who works on Flickr's engineering and technical operations teams are working double time to ensure that it never happens again. Thanks for your understanding and patience!

Folks, this is one of the best pieces of crisis management I have ever seen! It states the problem; it states the solution; it takes the blame where necessary and it gives a promise to the future. Now, if we could set this as mandatory teaching for all companies worldwide I would feel so much better.

The German District Attorney of Halle has urged the Credit Card Industry to screen all 20-22 million German credit cards for transactions along some criteria - without having an initial suspicion of any criminal behaviour. Any such screening and searching is only legal through a warrant. Now there are two immediate scandals obvious:

1. the District Attorney had no warrant whatsoever, but they threatened the credit card companies that non-compliance would be illegal and punishable


2. the credit card companies' lawyers obviously didn't care to think this would be illegal and complied.

It almost comes as no surprise that the Police Union says that illegal means in investigations are fine to get results.

What it was all about? Child pornography. Which, according to German Law, is about in the same category as Wilful Damage to Property (which would almost be a joke in itself if it wasn't so sad). The screening of the 20 million German credit cards yielded 322 suspects.

Udo Vetter wants to have a court state if the District Attorney's action was legal or not.

I'm wondering what our current government will try next.