backdoors in cryptography

Bruce Schneierin his blog about a possible backdoor in Dual_EC_DRBG. As I'm no security expert its difficult/impossible to follow all security discussions. I don't have the time and the knowledge.

One commenter maid a good point:
most of the programmers don't have crypto background and will just get the algorithm, test cases and go on implementing it
Probably the only thing I'm able to do about this is to use only a hand full of security programs and select very carefully one of the possible algorithm they provide.

But what is with the programs I have to use e.g. bank access. Are I'm now getting paranoid?

write my own firefox plugin

As I don't use/like iTunes I download podcast directly from the RSS feed or the web page. Using Save Link As ... of the browser doesn't really work if you download a bulk of podcasts at the same time. So far I copy links by hand into a file and throw this at wget. This works fine. But to optimize this I would like to be able to add the link directly from firefox to the download file.

For this I need write my own plugin. I found the start point on how to write a firefox plugin on lifehacker some time ago.

This are the steps I used to write my plugin. In the lifehacker article and the referenced links you get the details.

create a new profile and set (about:config)
javascript.options.showInConsole = true
javascript.options.strict = true

not found:
nglayout.debug.disable_xul_cache = true
browser.dom.window.dump.enabled = true

install extensions:
JavaScript Debugger
Console
Chrome List
Firebug

Download the example from Mozilla knowledge base as a starting point.
install.rdf: increase the em:maxVersion to the firefox version used
overlay.xul: add the entry for your own context menu entry

  <popup id="contentAreaContextMenu"> 
         <menuitem id="yb-context-tagLink"
          insertafter="context-bookmarklink"
              label="This is my right click"
              class="menuitem-iconic"
             oncommand="HelloWorld.onContextCommand(event);"/>
  </popup>

overlay.js: add the function to be called from the context menu

  onContextCommand: function()
  {
 var file = Components.classes["@mozilla.org/file/local;1"]
                      .createInstance(Components.interfaces.nsILocalFile);
 file.initWithPath("/tmp/getPodcast");

 var foStream = Components.classes["@mozilla.org/network/file-output-stream;1"]
                          .createInstance(Components.interfaces.nsIFileOutputStream);

 foStream.init(file, 0x02 | 0x08 | 0x10, 0666, 0); // write, create if not exists, append
 foStream.write(gContextMenu.linkURL+"\n", gContextMenu.linkURL.length+1);
 foStream.close();
  }

The defined functions are part of an arry initialisation. So don't forget the comma as I did the first time.

Examples on file I/O is on firefox code snippets. Adding an entry to the context menu and getting the URL is from the del.icio.us extension.

bittorrent and dht

So far I used Enhanced CTorrent. This client is a cli tool and runs fine on the NSLU2. A few weeks ago I tired to download a torrent but the tracker was never found. I asked a friend if the is able to download the torrent with Azureus. He was able to download the torrent. Therefor I checked the features of Azureus and ctorrent. Dht (distributed hash table) caught my attention.

The only client I found that supports dht and is able to run on the NSLU2 is rtorrent. The dht support is so far not part of the official distribution. A patch to add dht is provided by Josef Drexler.

First download the patch wget http://tk.ttdpatch.net/~jdrexler/dht/dht.diff to see what revision of rtorrent you need. The first time I downloaded the wrong revision as the web page was not updated. Download with svn co -r 987 svn://rakshasa.no/libtorrent/trunk the revision the patch was created from. Or check with svn info if the already downloaded revision is the correct one.

Start with libtorrent:

• ./autogen.sh


• ./configure


• nice -n 19 make


• make check


• sudo make install

After this do the same steps for rtorrent. If all works fine apply the patch (patch -p0 < dht.diff in trunk) and build libtorrent and rtorrent again.

add to .rtorrent.rc:

• dht = auto


• dht_port = forwarded port

umount: /mnt/backup: device is busy

Could not umount my external USB hard disk. The last time this happened was about a year ago. The paper I used to write down the solution was not around. Ok I could not find the note. Therefore I had to search the net again to find the command to display who is still using the device.

I should start to write down this kind of solutions on my web site. This will result not only in one place to search but also accessible from work and friends.

This block could also be the right place to collect the answers during I try to find the solution. After the problem is solved and I know all steps needed I is quickly transfered onto my web site.

Oh - the answer is lsof.