Ex Bibliotheca

The life and times of Zack Weinberg.

Thursday, 26 June 2003

# 5:10 AM

bloody weather

I'm sitting on the roof of my apartment building, writing this entry on my laptop, thanks to the magic of WiFi. It's a beautiful evening. The sun has gone down, but there's enough city glow to see my surroundings. I can't see the keyboard, but (as I was surprised to discover some years ago) I don't need to. It's comfortably cool and breezy.

Now why am I sitting on the roof, you may wonder? Well, because it's bloody hot in the apartment. When I checked the weather forecast this afternoon, they were reporting a current shade temperature of 92°F. (Compare to forecast peak of 80° for the day.) It's cooled down outside but the apartment has yet to catch up — this with all the windows open and the door too, and several of the outer doors to the building blocked open so that air will circulate in the hallway. It'll probably be tolerable in another hour or so.

silly things to do with wet clothes and polythene

Fortunately I managed to get the weekly trip to the laundromat in before it was too hot to be moving around. I skipped the drying phase, figuring that it was hot enough I could just set up the little folding rack I have and save some energy, and maybe get a poor man's swamp cooler effect in the apartment to boot. This plan went off with only one hitch, which was, I had too many wet clothes for the rack. Well, there's a clothesline on the roof ... that is, there used to be a clothesline on the roof. Not anymore.

After a moment of staring in disbelief at the place where it used to be, I started looking around for alternatives. Whereupon my eyes fell on the skylight ... the skylight which, by the way, contributes significantly to the heat burden in the building. It was already obvious at this point that it was going to be too hot today. The skylight is about as big as my bed, and by coincidence I had some sheets in the wash today (these sheets). I've been wishing I could throw a tarp over the skylight for some time ... why not the sheets, and the other clothes? Well, the obvious reason is that the skylight isn't all that clean, and one would like to be able to use the clothes without washing them again afterward. Fortunately, in my mighty Closet of Stuff I Bought Ages Ago for No Good Reason That I Can Remember, there is a roll of polythene house-painter's dropcloth. (I have some vague memory of meaning to re-varnish some chairs...) So I put that over the skylight, and then I put the sheets over the dropcloth, and then I laid out the remaining clothes on the sheets.

This worked quite well as far as getting the clothes dry. I cannot tell whether it made any significant difference to the interior temperature of the building. I am tempted to leave the sheets up there; the weather is predicted to continue too bloody hot for at least another two days, I have more sheets for the bed, and every little bit probably helps.

obligatory harry potter 5 review

Thanks to Sumana for lending me the book. I am pickier than I was, and no longer wish to buy these in hardcover.

I like Order of the Phoenix better than Goblet of Fire, but not quite so much as Prisoner of Azkaban. The main reason for this is that I spent most of the book wanting to smack Harry a good one. This is not bad characterization; he's fifteen years old, people tend to be irritating at that age. Furthermore he is being yanked around by the adults ... not unlike he has been for most of his life, but now he is displaying a tendency not to put up with it anymore.

In several places I felt Ms. Rowling overreached her skills a bit, but that is probably a good sign for her future career; better be a bit too ambitious than never try to stretch oneself. And she seems to have the hang of writing long books a bit better. OotP is slightly longer than GoF, but unlike that one it doesn't read like it would have been better for some ruthless trimming.

I think that's about all I can say without going into spoiler territory.

Tuesday, 17 June 2003

# 12:50 AM

Leonard proposes TV shows destined to be cult classics. My own humble contribution is called No User Serviceable Parts, and features ordinary folks taking apart things which they really shouldn't have. This is not entirely unlike Leonard's own show, but I wouldn't be cruel; it would be more of a thriller. Like this:

MARVEL as our guest dismantles a DLT cartridge to find out why it is making a hideous rattling sound when used!
SHUDDER as he discovers just how many springs are inside!
WILL he be able to put it back together again?
WILL it work afterward?
WILL the rattling noise go away?
FIND OUT on the next exciting episode of "No User Serviceable Parts"!

Monday, 16 June 2003

# 4:30 PM

cracks in the wall

Very interesting Washington Post profile today of a gentleman named Rand Beers who resigned from the National Security Council's counterterrorism division two months ago ... and is now working as national security adviser for Democratic presidential candidate John Kerry.

(From Talking Points Memo.)

# 1:50 AM

walking around

Went up to Telegraph for lunch today. There's a new place called Slurp Noodle House, which has yummy spicy noodle soup for cheap. In the restaurant was a six-year-old girl demanding to use the email function of her mother's cell phone. This Younger Generation is Hot Stuff, as a character in a P.G. Wodehouse story might say.

schwag

And then I went to Amoeba and got more music:

Warren Zevon (self-titled). Adam turned me on to this guy last month. I don't think this particular album is quite as good as Mr. Bad Example which is the other one I have, but then, it's also a lot older.
They Might Be Giants, Dial-A-Song; this is a two-CD collection from the past twenty years, including lots of stuff off their older albums that I don't have.
Barenaked Ladies, Stunt. BNL are a Canadian humor-pop band after the fashion of Moxy Früvous. Haven't listened to this one yet.
The Band, Jubilation. The Band dates to 1958, but is perhaps best known for the period 1968–1975. Unfortunately, Amoeba didn't have anything from then; this album was recorded just five years ago. Having just listened to it while writing this entry, it's good music anyway.

redesigning wep

So there's this thing called Wi-Fi that's all the rage right now in the high tech community. The basic concept is to run TCP/IP over short-range radio in the 2.4GHz band. It's popular for much the same reason cell phones are popular; you can take your laptop down to the local coffee shop and surf the 'net from there, assuming they've installed an "access point." Also, it's fast; the current tech (802.11b) runs at 5-10Mbps which is competitive with Ethernet and faster than your typical DSL or cable modem line.

Out of the box, a Wi-Fi access point will typically be happy to talk to anyone who brings a transceiver in range. Also, all transmissions are in cleartext. Neither of these things is ideal. There is a protocol called WEP (Wired Equivalent Privacy) that tries to rectify both. Unfortunately it doesn't work, for three reasons:

It supports only one authentication scheme: knowledge of an 128-bit shared secret key. (The WEP key should not be confused with the "network name" or "community string", which is just to distinguish two different access points with overlapping ranges.) There are several incompatible schemes for converting a memorable passphrase into a secret key, which of course means that if a transceiver and an access point use different ones they can't talk to each other. Fortunately most systems allow you to enter the secret key directly, but now you're stuck trying to remember a thirty-two-digit hexadecimal number.
It can't provide privacy or integrity guarantees without also restricting who can use an access point (nor can it do the converse, but that is rarely if ever desirable).
The encryption scheme is internally flawed, such that an eavesdropper can recover the secret key by examining about 6,000,000 packets (which amounts to a few hours' traffic on a network in continuous use).

The 802.11 committee of the IEEE is working on revisions, but I can't resist having a go at it myself. Let Alice be an access point — that is, a relay between wired and wireless networks — and Bob a leaf node that wishes to establish a connection to the net via Alice. Alice periodically (probably about once a second) broadcasts an invitation packet, which carries a time stamp, Alice's community string, a list of all the ciphers Alice supports, and a list of all the authentication methods Alice will accept. This goes out in cleartext; Bob can pick it up with no special effort. Bob must at this point determine whether he supports one of the same ciphers as Alice, and whether he can authenticate himself to Alice. This may involve user interaction. Assume there is no problem meeting either hurdle.

Bob and Alice have previously agreed (which is to say, the number is part of the protocol specification) on the modulus g for a Diffie-Hellman exchange or a similar no-prior-knowledge key exchange algorithm. Bob sends an acceptance packet to Alice which echoes the time stamp of the most recent invitation packet he saw, and carries his half of the key exchange, plus an indication of which cipher and authenticator he would like to use (selected from the supported set). Bob does not transmit authentication information at this point. Alice responds to the acceptance with an acknowledgement which carries her half of the key exchange. Alice and Bob now have a shared secret.

If Alice is willing to talk to Bob without further authentication, Bob can now transmit a DHCP configuration request, encrypted using the chosen cipher and secret, and receive an IP address. Note that Alice will not respond to DHCP requests transmitted in cleartext, or, indeed, to any cleartext packet other than an acceptance. Link layer encryption is not optional. However, if Alice requires that Bob authenticate himself, the acknowledgement packet will also carry an encrypted authentication challenge. Bob must then respond to the challenge before he can request an IP address; this may require user interaction, so the timeout on this phase should be much longer than the timeouts for the other phases. Any mutually agreeable authentication algorithm can be used at this point.

This specification decouples authentication from integrity/privacy guarantees. An "internet cafe" can provide its customers with free network access safe from eavesdropping, but not have to tell them the secret WEP key. A corporate wireless LAN, by contrast, can use the same mechanism to authenticate network access that's already being used for computer access, and get strong integrity guarantees to boot.

I am assuming that, given the existence of a shared session key, there exists an algorithm for encrypting packets which isn't vulnerable to passive attacks the way WEP is. Allowing the cipher to be negotiated ensures that if a flaw is found, users can switch to a better cipher. I am also assuming that, because this is a broadcast communication channel, one does not need to worry about a "man in the middle" attack on Diffie-Hellman. A hypothetical eavesdropper can see all the traffic between Alice and Bob, but will not be able to modify packets in transit, so the attack should not succeed.

Authenticating Alice to Bob is a concern. A malicious access point could eavesdrop on, or modify, all the traffic passing through it. This is unavoidable; network routers by definition have this capability. It's easier to set up a malicious access point than a malicious wired router, though. The mechanism for authenticating Alice to Bob is easy — just have Bob transmit a challenge of his own along with the response to Alice's challenge — working out a sane policy is much harder. I don't have any good ideas. Use of end-to-end, session layer encryption wherever possible is of course recommended.

Thursday, 12 June 2003

# 5:20 AM

traffic gripe

At 9:30 pm on a weekday I expect to be able to plonk my car in the left lane of Interstate 880 and maintain a minimum speed of seventy-five miles an hour, all the way from San Jose to Oakland. What were all you slowpokes doing puttering along at the speed limit?

Tuesday, 10 June 2003

# 5:10 AM

Directly on coming back from Montreal I was laid low for a week by a vicious cold. Serves me right for going somewhere with a different virus population, I suppose. Mostly better now.

On Monday I went to the Cartoon Art Museum to see their "Hate Mail" exhibit. This profiled a number of newspaper comic strips that have caused controversy, and the reader response. Doonesbury, of course, and Bloom County, but &mdash For Better Or For Worse?! Sure enough.

A couple random links for you tonight: Purportal is a gateway to all sorts of urban-legend and other hoax debunking sites. Bushwhack PAC displays some sign of a political opposition developing in the USA, which would be a nice thing to have.

Monday, 2 June 2003

# 6 AM

Why yes, I did just splat an entire week's worth of entries into the blog all at once, why do you ask?

Have caught up with all my email. Bed now.

Sunday, 1 June 2003

# 6 AM

And, for the third and last time, up far too early to catch a plane. It is apparently now U.S. policy to make you go through customs and immigration before leaving the country you're coming from, which is a bit obnoxious; on the other hand, it does get that out of the way at the beginning of the trip.

Sitting in Minneapolis, decided to dig through the Debian package list to see if I could find an MTA for disconnected operation. Sure enough, masqmail is what you want. But it's a bit late to know that now, and in any case it is unlikely that a precompiled package for Red Hat 6.2 can be found.

I've been working off and on all trip, on an enhancement to Python to permit multi-statement anonymous blocks. The language has anonymous functions already but they're limited to a single expression, rather like Fortran statement functions. It's deeply disappointing to report that this is a lot harder than I thought; my attempts to date have done nothing but introduce nasty grammar ambiguities. (A fair chunk of the difficulty is that Python uses its own idiosyncratic parser generator which is poorly documented and doesn't give helpful diagnostics. I can write down in English what I want; explaining it to the machine is harder.)

Got home around 3PM (yay airport shuttles!) and have approximately 3,000 email messages to slog through.