Linux

A big problem with web security in the past was that it was impossible to have https-hosts with more than one certificate per IP. This is due to the protocol design of https, which needs to establish an ssl-connection with the certificate before the hostname is transferred.

There is a solution though, called Server Name Indication (SNI) and part of TLS. Strange enough, client compatibility isn't that much of a problem. Firefox, Opera and IE already support it in their current versions, konqueror will with kde4, I've no information when it'll hit safari. Oh, and I haven't testet w3m, lynx, links and wget yet, but if you want, feel free to add your experiences to the comments :-)

The problem was that until some weeks ago, openssl didn't support SNI, apachen mod_ssl didn't, lighttpd didn't. Only GnuTLS, but mod_gnutls is considered unstable by it's authors. With OpenSSL 0.9.8f, TLS Extensions and with them SNI landet in openssl, apache still needs patches.

We've now implemented SNI on schokokeks.org, which you can test:
https://www.schokokeks.org/
https://www.hboeck.de/
https://www.fabian-fingerle.de/

If your browser supports SNI, you should see different certificates, all on the same IP. All certs are cacert-signed, they also have a Wiki page from the VhostTaskForce for SNI and alternative solutions.

I know you've been waiting far too long for that. Now that Compiz and Compiz Fusion 0.6 are out, I've added them to portage.

The background: Compiz and Beryl, the two famous 3D-composite/windowmanagers for Linux, have merged forces. Main Compiz still resides in the package x11-wm/compiz, many additional plugins and tools are fetched in by the x11-wm/compiz-fusion metapackage.

The ebuilds are all based on the xeffects overlay, with some cleanup by me.

Happy window-wobbling!

One of the biggest threats in computer security today are web applications. There's a vast number of issues found in popular web apps, mostly cross site scripting, cross site request forgery and sql injection. For a long time I had the idea of a tool scanning through webroots and looking for popular web applications, comparing them with a database of their latest security issues. In the past weeks, I finaly managed to get some code done.

It's a quite simple python-script (don't cry about the source quality, I haven't done real coding for ages), together with a database of some popular applications. I'm looking forward to hear feedback. The usage is simple, just do something like this:
freewvs /home/joe/websites/foo /home/guest/websites/bar
Typical output looks like this:
WebsiteBaker 2.4.3 (2.6.5) CVE-2007-0527 /home/hanno/freewvs/test/websitebaker
Drupal 5.1 (5.3) CVE-2007-5416 /home/hanno/freewvs/test/drupal
PhpWebGallery 1.5.1 () CVE-2007-5012 /home/hanno/freewvs/test/phpwebgallery
Mostly self explaining. The found app at the beginning, the version where the issue was fixed in brackets, the CVE-ID (or some other vulnerability id, in doubt an URL) and the path.

The biggest work to do is probably to get more applications added to the database and to keep the database updated. It's format is pretty self-explaining, so I'm waiting for your patches.

Get it here: http://source.schokokeks.org/freewvs/

Today I found a note about the movie The Codebreakers. It's a free-licensed (cc-by-sa) documentary about free software in development countries.

It brings up different examples about successful usage of free software in different parts of the world. Worth watching.

Recently, I did a bit of »modding« to my homeserver (an old P30 laptop, you may know that if you're regularly reading this blog).

I removed the case, which enabled me to remove some unneeded hardware to save energy. The touchpad, the internal modem and the front LEDs could easily be disconnected. The soundcard and the wireless card could also be removed, but they'll stay. The wlan will become a FreiFunk-node (stupid question: what's the english term for freifunk?). The soundcard makes it a perfect webradio player (and, for their mini-size, the quality of the speakers is quite acceptable).

Beside, the whole system now runs from a memory stick. A HD is still attached, but not used on normal operations. It tended to spin up without a reason, till I noticed that I still had smartd running. Now, the nice thing is, this device is now completely silent as long as I don't use the HD. Even if I run compile processes, the processor fan doesn't run. Seems that enough fresh air is sufficient to cool a Pentium M.

Another attractive feature is that I have three freely usable acpi-buttons, plus the three normal LEDs (caps, num, scroll). 3 LEDs, that makes 8 different LED-status combinations. My plan is now to use the three buttons, have 8 pre-programmed webradio channels and use one button for start/stop, one for switching channels. One is still left for creative purposes, volume control would be obvious, but that doesn't make much sense with one button. An idea would be to use the wlan-button and find a way to disable it's ability to switch the wlan-card on/off (at least a simple/hacky approach would be setting it back on as soon as it's switched off).
But that's not implemented yet, so don't ask for it. I'll publish it as soon as I've done that.