I recently played around with the possibilities of fuzzing. It's a simple way to find bugs in applications.

What you do: You have some application that parses some kind of file format. You create lots (thousands) of files which have small errors. The simplest approach is to just change random bits. If the app crashes, you've found a bug, it's quite likely that it's a security relevant one. This is especially crucial for apps like mail scanners (antivirus), but pretty much works for every app that parses foreign input. It works especially well on uncommon file formats, because their code is often not well maintained.

My fuzzing tool of choice is zzuf.

I am impressed and a bit shocked how easy it is to find crashers and potential overflows in common, security relevant applications. My last discovery was a crasher in the chm parser of clamav.

Recently I was asked by a friend for a linux tool to extract ressources from windows exe files, especially icons. He used a windows tool in wine till then.

I said that this shouldn't be so hard and already started writing my own parser (I came to the point where I could extract headers and content separately), when I found that there already is an appropriate tool called wrestool. It's part of the icoutils package.

wrestool -o . -x filename.exe
will extract all ressources (icons, cursors etc.) to the current directory.

Seems with the latest versions of webkit-gtk and midori, a long-standing crasher-bug got fixed and it now allows you to run the browser-test ACID3.

I just bumped the webkit-gtk ebuild in Gentoo to the latest snapshot.

ACID3 is a test for the standards compliance of modern web browsers. I wrote about ACID2 some years ago.

There are two tools out there for Linux to put Garmin maps (which you can convert from OpenStreetMap Data) on devices, sendmap (proprietary) and qlandkarte (free). Sadly, both don't support my device (Garmin Quest), so I had to find an alternative solution. This should also work with other garmin devices.

After some playing around, I managed to get it running with MapSource on wine. I've used wine 1.1.0 on Gentoo, if you have problems, be sure to get a recent wine version.

Steps to do:

• Download MapSource_6137.exe from the Garmin webpage.
• Use 7-Zip to unpack the exe to some directory: 7z x MapSource_6137.exe
• Install MAIN.msi: wine start MAIN.msi
• Install MapSource: wine Setup.exe
• Get one of the MapSource Installers from here and install it: wine Setup_OSM-Germany-2008-06-11.exe
• wine doesn't support usb, so you need the garmin_gps module. If it's installed on your system, it should load automatically after attaching your device and switching it on.
• You should now have a device ttyUSB0, which you need to symlink as com1 for wine: ln -s /dev/ttyUSB0 ~/.wine/dosdevices/com1
• Run MapSource: wine ~/.wine/drive_c/MapSource/MapSource.exe
• Go to Settings -> Transfer, there you can select a serial port. Select COM1.
• Click the map selection tool from the buttons and select an area.
• Select Transfer -> Transfer to device. If everything went fine, it'll detect your garmin device attached to the serial port and you can start your upload.

I couldn't believe it, but afterwards I had routable OpenStreetMap maps on my garmin.

Today I played around a bit with the stuff done by the Wii homebrew/hacking community, which is far more advanced than I had expected.

I had the game Twilight Princess borrowed by a friend. For those who don't know, using this game you can run homebrew software on the Wii without the need of a modchip.

The way this works is that first you install a modified savegame for Twilight Princess, afterwards you can install the Homebrew Channel. The Homebrew Channel will stay in the main Wii Menu and you'll be able to run various stuff from there. While looking around the various webpages covering the topic, I found that wiibrew.org is a good place to find documentation and links to the appropriate projects. So look there for the details.

The gc-linux project (originally porting linux to the gamecube) has a simple Linux image available.

A warning: Nintendo released a new firmware that stops this method to work, so if you wanna have fun, don't update your Wii. And the obvious warning: Everything you do is at your own risk.

Update: Seems the Firmware update is no longer a problem.

Phoronix has just published an article about the development of xorg and they have a statistics of contributors from Distributions.

I'm listed there on the Gentoo part with 0.01 % contributions to Xorg. Yay!

Zum Thema Rapid Prototyping und dessen möglicherweise gravierenden gesellschaftlichen Auswirkungen las ich das erste mal in einen Text der Zukunftswerkstatt Jena, der im sehr lesenswerten Büchlein »Herrschaftsfrei Wirtschaften« veröffentlicht wurde (welches es auch komplett zum Download gibt).

Aber der Reihe nach: In der Debatte um freie Software, speziell in eher politisierten Kreisen (Stichworte sind hier etwa Ökonux oder das Keimform-Blog), wird des öfteren die Frage aufgeworfen, ob die Art und Weise, wie freie Software produziert wird, nicht als Modell für gesellschaftliches Wirtschaften insgesamt herhalten kann. Dabei wird oft der Begriff »Keimform« aus der Wertkritik gebraucht, der etwas bezeichnet, was zwar im bestehenden Kapitalismus und dessen Kontext stattfindet, aber erste Züge anderer Strukturen aufweist.

Nun stellt sich naiverweise erstmal die Herausforderung, dass immaterielle Güter (Software, Musik, Text) mit vernachlässigbarem Aufwand kopiert werden können, insofern die Adaption der Prinzipien freier Software hier nahe liegt (bestes Beispiel die Wikipedia), im Gegensatz dazu natürlich materielle Güter hier herausfallen, weil sie immer noch einen vergleichsweise großen Produktionsaufwand pro Stück besitzen.

Die Science-Fiction-lastig anmutende Frage »Lässt sich das ändern?« bringt uns nun zurück zum Thema Rapid Prototyping. Damit werden Verfahren bezeichnet, komplett automatisiert Gegenstände zu erschaffen, im einfachsten Beispiel etwa die (schon länger technisch machbaren) 3D-Drucker, die Kunststoffgebilde nach Computervorbild erschaffen können. Weiter gedacht könnten derartige Gerätschaften, wenn sie mit unterschiedlichen Materialien arbeiten, auch zur Produktion komplexerer Geräte genutzt werden.

Das Ziel, was sich vor einigen Jahren der Wissenschaftler Adrian Bowyer setzte, lautet nun: Eine Maschine, welche in der Lage ist, sich selbst neu zu erschaffen. Sozusagen vergleichbar mit dem Schritt, als der erste Compiler lernte, sich selbst zu übersetzen.

Heute vermeldet Golem, dass es erstmals gelungen ist, einen sogenannten RepRap dazu zu bringen, sich selbst zu reproduzieren. Von der Gesellschaft freier Güter mögen wir sicher noch ein Stück entfernt sein, sollte der RepRap allerdings tatsächlich das leisten, was seine Erfinder vermeldeten, sind wir ihr möglicherweise ein gutes Stück näher.

Achja: Der RepRap steht mit der GPL selbstverständlich unter einer freien Lizenz.

Ein schönes Spielzeug habe ich heute geschenkt bekommen.

Sometimes in the past I had the wish to produce some simple videos, e. g. from political actions. Though I was looking for some free software solutions for video editing.

I asked around but it seemed that most people didn't use free solutions. I never did any video editing before, so I had no comparison on what proprietary tools are able to do. My requirements where not that advanced, basically I wanted to be able to cut some videos together, fade them in and out, add some text over them. Beside, I wanted to be able to display images for some seconds.

I knew of three free video editing tools for linux, Kino, PiTiVi and Cinelerra. Kino and PiTiVi are quite simple to use, they have an intuitive interface. But I soon came to the conclusion that they are far too limited in features. So Cinelerra is left.

Cinelerra is not a simple tool, it's interface is not intuitive. So this was keeping me away from using it for a long time. But the good news is, Cinelerra has all the features I wanted and can do much more. As I said above, I don't have any experience with commercial tools, but I think Cinelerra can do pretty much everything one will need when doing professional video editing.

To learn how to use Cinelerra, there are some great video tutorials at the_source. It's a (CC-by licensed) video show about free software and video stuff and they did four Cinelerra tutorials in their show. You should at least watch the first three and try the stuff out between the tutorials, but that will give you the basic knowledge to get started with Cinelerra.

So, the first Cinelerra-produced video by me should be available here within the next days.

Beside, I just bumped the Cinelerra package in Gentoo, so emerge it and have fun.

Today and tomorrow, we're presenting the OpenStreetMap-project at the Open Source Expo (or OpenExpo) in Karlsruhe.

I made some pictures, more will follow. Sadly, we didn't get a talk slot for OpenStreetMap.

One of the missing features in jabber most commercial instant messaging systems have are small games one can easily play over them. Till now, because just yesterday, gajim got support for Tic Tac Toe over jabber.

Which reminds me tic tac toe was one of the first »programming projects« I did in the past, some day I'll have to dig out the sources and publish them. My next wish would be something like tetrinet over jabber.

Gajim-svn ebuild is in my overlay at http://svn.hboeck.de/overlay/.

I own this Canon IXUS 50 camera for more than two years now. It's a fine device, but it has some small lacking features where I often asked myself if this could be enhanced with a new firmware.

Until recently, when I read about the CHDK project: It's a kind of firmware enhancements for Canon cameras. It doesn't fully replace the real firmware, but adds additional stuff (I must say I don't fully understand what they do). And now they have an experimental port for the SD400, which is built into my cam.

The first big killerfeature one will notice is that the cam now has a battery monitor, which is the most obvious lacking feature of the original firmware.

One more thing I always would've liked for my cam is a better video compression. The video quality is quite good, but the cam just can do mjpeg, which leads to big files and limits your maximum video size to about 20 minutes. It seems CHDK has some better compression video mode, but I'll have to dig deeper into it. Beside, I can now record raw images. So there's lot's of cool stuff to play with.

In the instant messaging world, encryption is a bit of a problem. There is no single standard that all clients share, mostly two methods of encryption are out there: pgp over jabber (as defined in the xmpp standard) and otr.

Most clients only support either otr (pidgin, adium) or pgp (gajim, psi), for a long time I was looking for a solution where both methods work. psi has otr-patches, but they didn't work when I tried them. kopete also has an otr-plugin, but I've not tested that yet.

Today I found that there is an otr-branch of gajim, which is my everyday client, so this would be great. As you can see on the picture, it seems to work on a connection with an ICQ user using pidgin.

I've created some ebuilds in my overlay (the code is stored in bazaar, I've copied the bzr eclass from the desktop effects overlay):

svn co https://svn.hboeck.de/overlay

Today I asked myself if I can ping an IDN host.

My default ping (iputils on linux) couldn't do it, but I found some patches out there, e.g. from Fedora. Thanks to SpanKY, we now also have IDN-enabled ping in Gentoo (he used a modified patch).

Today heise security brought a news that a growing number of old wordpress installations get's misused by spammers to improve their pagerank. I've more or less waited for something like that, because it's quite obvious: If you have an automated mechanism to use security holes in a popular web application, you can search for them with a search engine (google, the mighty hacktool) and usually it's quite trivial to detect both application and version.

This isn't a wordpress-thing only, this can happen to pretty much every widespread web application. Wordpress had a lot of security issues recently and is very widespread, so it's an obvious choice. But other incidents like this will follow and future ones probably will affect more different web applications.

The conclusion is quite simple: If you're installing a web application yourself, you are responsible for it! You need to look for security updates and you need to install them, else you might be responsible for spammers actions. And there's no »nobody is interested in my little blog«-excuse, as these are not attacks against an individual page, but mass attacks.

For administrators, I wrote a little tool a while back, where I had such incidents in mind: freewvs, it checks locally on the filesystem for web applications and knows about vulnerabilities, so it'll tell you which web applications need updates. It already detects a whole bunch of apps, while more is always better and if you'd like to help, I'd gladly accept patches for more applications (the format is quite simple).

With it, server administrators can check the webroots of thier users and nag them if they have outdated cruft laying around.