MUNG

Apple Boot Camp

2006-04-10T14:05:00.000-07:00

Now I know it's been almost a week since the official release of this software, but it isn't until now that I have come to fully understand and appreciate the ripple in the pond.
Boot Camp goes beyond any emulation software available on the Macintosh and Allows the Intel Mac User to install natively Windows XP 2nd Edition on their hard drive on a separate partition. The install process although warned to be very hard and is provided with a .pdf file with step by step instructions as the process could be potentially fatal (Erasing your whole hard drive).
Although this task may seem daunting (either finding a legitimate copy of XP or Installing or both) the one thing that is most challenging is accepting the fact that XP can run on a Mac. For a Mac Fan it's very difficult to accept the login sound and the cheesy hills background. However, what was most pleasing was that we could now play the video games in which we had once been denied. Although I saw first hand how the drivers can be a bit flaky I can be only optimistic as to what the future holds for apple and the overall effect this will have on the PC community.

http://www.apple.com/macosx/bootcamp/

New Server.

2006-03-28T09:23:00.000-08:00

IMG_0840
Originally uploaded by zeusfaber.

This is the new server that my brother and I bought. (more pics on Flickr) Dell PowerEdge 2550: 2GB of ECC RAM, 4 x 18GB SCSI drives and two Pentium 3 1GHz processors. Pretty sweet box.

Watch out Google, we are coming for ya!!

Update to my Homeland Security Post

2006-03-26T07:38:00.000-08:00

Here is a good example of what I was talking about: "Terrorist 007, Exposed". Here's an excerpt:

In one instance, Irhabi posted a 20-page message titled "Seminar on Hacking Websites," to the Ekhlas forum. It provided detailed information on the art of hacking, listing dozens of vulnerable Web sites to which one could upload shared media. Irhabi used this strategy himself, uploading data to a Web site run by the state of Arkansas, and then to another run by George Washington University. This stunt led many experts to believe -- erroneously -- that Irhabi was based in the United States.

Irhabi used countless other Web sites as free hosts for material that the jihadists needed to upload and share. In addition to these sites, Irhabi provided techniques for discovering server vulnerabilities, in the event that his suggested sites became secure. In this way, jihadists could use third-party hosts to disseminate propaganda so that they did not have to risk using their own web space and, more importantly, their own money.

Trust me, it's not going to get any better.

Department of Homeland Security

2006-03-16T08:15:00.000-08:00

My rant for the week:

If this doesn't cook your noodle I'm not sure what will. Read: DHS Gets Another F in Computer Security.

The Department of Homeland Security, which is charged with setting the government's cyber security agenda, earned a grade of F for the third straight year from the House Government Reform Committee.

This is not a good situation. I think about this...If you wanted to cause irreputable harm to the US without touching our soil or air space, how would you do it? Attack the government and corporate computer systems. Don't think for a second that terrorist groups and countries alike have not started preparing for just that. I don't want to sound fanatical but this could be the types of things we see in the next wave of terrorism and for that matter warfare in general. Luckily this will likely lead to no innocents dying, but may lead to the demise of corporate and government assets and privacy.

The worst part about this is that the people that run the government and the people who elect them are not aware of this notion of computer security. These are likely the same people that have a post-it note on their monitor with their password on it. Change of this type will have to come from the bottom, young people that are computer knowledgable eventually growing up and running this country and it's businesses. Sadly, I doubt that we have that much time before the cyber version of 9/11 happens.

Define:Mung

2006-03-08T18:43:00.000-08:00

For those of us whom have seen too much South Park and think Mung is some perverted word I give you the actual definition in this "Blogs" context.

Wikipedia Definition of Mung

Easy Vinyl to MP3 Conversion.

2006-02-10T17:54:00.000-08:00

This one is easy and if you have some old (and new) records like I do you may want to check it out.

---------

Checklist:

* Record Player w/ RCA Jacks or something that can be converted to the headphone mini jack (male). If you haven't seen one before:

* RCA (female) to mini converter (male). Should look like this:

* Computer with sound card with line-in jack. Looks like this:

* Records. Like this one:

* Download and install Audacity (free, open source and works on linux, windows and mac)

* Download and install a WAV to MP3 converter like Lame (Multiplatform) or CDex (Windows).

---------

Now plug the mini jack into the sound card's line-in jack.

Open Audacity.

Play the wax.

Hit the record button in Audacity.

Soon you should see some activity in Audacity. If you don't it may be a configuration issue or you don't have the cable plugged in the right jack.

Do a short recording and then listen to it using Audacity. Make a note of the volume of bass and etc. If it sounds crappy when the beat hits then you may need to lower the recording volume. I use 0.4 as my recording volume. But depending on the record player and sound card yours may be different.

Now record an entire song. You will notice the end of the song by the lack of activity in Audacity. Hit stop.

Now you can export the song as WAV.

At this point you can either convert it to MP3 or burn it to a CD to listen to.

On linux I use command line based Lame to convert WAV files to MP3. In Windows CDex is really good.

The command I use is: 'lame -b 224 name.wav name.mp3' this will get you an mp3 at 224 bit rate.

Thats it! Your done. Acutally not, if you have a few records to do, it does take a while.

Windows Users Prepare for Updates.

2006-02-10T17:50:00.000-08:00

Seven updates in total.

Lots of updates.
More

New IPod Video - First Impressions.

2006-01-25T10:24:00.000-08:00

IMG_0768
Originally uploaded by zeusfaber.

I decided to sell the IPod Photo to Silent Dan and got the new video version.

It's pretty sweet. The first thing you notice is how thin it is, much thiner than the old models. The video is surprisingly clear and vivid. Additionaly, the larger screen is only a half inch bigger but it feels twice as big as the old version. The battery lasts over three episodes of Lost. around 2.5 - 3 hrs. Listening to music is lasts much longer.

Cool stuff.

WMF Exploit. Update #2.

2005-12-29T13:15:00.000-08:00

More on this delightful exploit, from the horses ... mouth.

http://www.microsoft.com/technet/security/advisory/912840.mspx

Snort sigs if you're interested:

Bleeding Snort Sigs

IRC Channel.

2005-12-28T22:03:00.000-08:00

If you do the whole IRC thing (idle or otherwise) check out: irc.duffsnetwork.org channel #MUNG. It's where all the cool kids be. Also, DuFFs is coming back from the dead. So be on the look out for the website and the IRC server to fill out. Give 'em some support.

DuFFs

WMF Exploit. Update #1.

2005-12-28T17:32:00.000-08:00

A workaround just in case:

http://sunbeltblog.blogspot.com/2005/12/workaround-for-wmf-exploit.html
http://blogs.washingtonpost.com/securityfix/2005/12/exploit_release.html

WMF Exploit.

2005-12-28T13:06:00.000-08:00

There is a really bad Windows exploit floating around the net, so be very carefull when attempted to download anything with a WMF file extension. Or just get a Mac or run *nix. :)

Info:

http://www.frsirt.com/english/advisories/2005/3086
http://isc.sans.org/diary.php?storyid=975 (includes link to video of it happening)
http://isc.sans.org/diary.php?storyid=972
http://www.f-secure.com/weblog/archives/archive-122005.html#00000753
http://www.f-secure.com/weblog/archives/archive-122005.html#00000752

If you are interested in learning hands on about how it works it's available through the Metasploit Framework on my server aerial.mine.nu. Email me: joe at 621 dot org for a SSH account.

Info:

http://metasploit.com/projects/Framework/exploits.html#ie_xp_pfv_metafile

Routing Protocol Comparison.

2005-12-19T18:41:00.000-08:00

Here is a paper I wrote a while back on routing protocols, their job and different qualities.

Routing Protocols: A Comparative Analysis

I hope you enjoy.

New Toy.

2005-12-18T21:43:00.000-08:00

img_0710
Originally uploaded by zeusfaber.

With some of the early Christmas money I received I got this beast. It's a Pioneer portable XM radio. It's pretty sweet. I will post more about it later once I get the entire lowdown on it and hopefully find some hacks for it. Ahhrrrrr, I'm a pirate matey.

Quicktime 7 w/o iTunes

2005-12-15T18:20:00.000-08:00

Many a day do I have to help those in need upgrading to Quicktime 7 for viewing presentations, and def trailers and so forth. However, Apple makes it very difficult to find the "standalone" installer unless you do some detective work or simply google it. So as it come as a relief to many of my friends and colleagues, I present to you the Quicktime 7 installer w/o itunes.

Direct Link
Web Page
19.1 mb's

Rename file script.

2005-12-12T15:24:00.000-08:00

This might come in handy for some of you Unix/Linux people out there. It adds a string to the name of a file before the file extension. Great for renaming tons of files in a similar manner. There is probably a better way to do it but this works well for me.

echo "Enter Name Addition: "
read newadd

for file in *
do
filename=`echo $file | awk 'BEGIN {RS="."} {print $0}'`
filename2=`echo $filename | awk '{print $1}'`
newname=`echo $file | sed -e 's/'"$filename2"'/'"$filename2-$newadd"'/g'`
mv $file $newname
done

JVM Performance Comparison.

2005-12-07T23:23:00.000-08:00

Java is everywhere these days, cell phones, servers and our desktops all use it to some extent. One thing a lot of people over look is the JVM and its effects on performance of your applications. While for small devices and desktops the choice is limited, usually either proprietary or Sun, servers have more flexability. Two of the most popular across all uses and platforms are Sun "Hot Spot" and BEA JRockit. Here I put these two head to head, while my tests are not all encompasing I think they will give a rough idea about how these two run in a "normal developer desktop" environment. The desktop and server tests I performed focused on memory footprint. The compilation test I ran focuses on CPU usage.

Test Box:
AMD Athlon XP 3000+ (400 FSB)
1GB PC3200 SDRAM
MSI nForce 2 400 Ultra Motherboard
Western Digital 80GB SE Hard Drive
Debian Sarge (Unstable) Kernel 2.6.14

Desktop Tests:

Azureus Bittorrent Client 2.3.0.6
* No torrents running

Eclipse IDE 3.1.1 Build M20050929-0840
* One project open with 3 Java sources

Server Test:

Atlassian Confluence 2.0.1 Build 321 (standalone)
* Uses Tomcat 4.1.27
* One user, two spaces created

Compilation Test:

Java Performance Test 1.0
* http://www.jole.fi/JavaPerformanceTest/
* Runs a Ant Build
* Apache Ant 1.6.2

_________________________________________

Sun Java "HotSpot"

java version "1.5.0_06"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_06-b05)
Java HotSpot(TM) Client VM (build 1.5.0_06-b05, mixed mode, sharing)

Azureus:

Memory:
Virtual (Swap + Res): 369m Resident (Code + Data): 54m Shared: 23m

Eclipse IDE:

Memory:
508m 94m 30m

Confluence:

Memory:
488m 190m 19m

Java Performance Test 1.0

Build Time: 20 Seconds

_________________________________________

BEA JRockit

Version:
java version "1.5.0_03"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_03-b07)
BEA JRockit(R) (build dra-45238-20050523-2008-linux-ia32, R25.2.0-28)

Azureus:

Memory:
Virtual (Swap + Res): 202m Resident (Code + Data): 74m Shared: 6692k

Eclipse:

Memory:
366m 135m 6880k

Confluence:

Memory:
364m 224m 1748k

Java Performance Test 1.0

Build Time: 24 seconds

_________________________________________

Conclusion:

It seems that in the memory usage department JRockit comes out fairly far ahead, but for the more CPU intensive compilation test Sun has a lead. As I said before this not by any means an all inclusive test, just more of an example of the system footprint I experienced. In all cases there are more things at work than just the JVM. The code, application server, CPU (AMD, Intel, x86, x86-64), even down to the version of Ant will all make a difference in these numbers.

More info:
J2EE Application Server Comparison

BEA vs. Sun JVM Article

A Sun Engineer's Blog and Comparison

Oscarbot, The Cool Aim Virus

2005-12-06T00:34:00.000-08:00

Being in College there are bound to be plenty of people who contract a virus or two.
But nothing as cool as the "Check This Out" Virus
It's a pretty neatly devised trojan that writes a script for each aim user account logged on the computer that sends random messages (They are sent without your knowledge) with a link tag that spreads the same virus around and around.
The main virus or trojan, "conime.exe" sends information back to it's host which may include email addresses, passwords, or other private information. Many Aim Accounts have been hijacked and taken over because of this sly little virus.

Now if you want to get rid of this pest update your McAfee or Symantec Definitions.
Although these sites give you convenient instructions on how to remove the virus I found a much easier way to do this thanks to a fellow named Jay. He made a simple program that searches for the most common forms of the virus and then quarantines them to the desktop and cleans out your registry and aim scripts.

Here is the awesome website that provides the link for download and simple instructions.
So next time you see the words "Check out This Pic" on aim make sure not to click it as you'll probably be getting a virus and not your girlfriends hawt pix.

New MUNG Authors.

2005-11-30T18:37:00.000-08:00

Welcome to the MUNG team:

Mantis (Programming)
Launchpad (Gaming)
Randy (Novell, Apple)
Patch (Engineering)

Removing KDE from Debian Sarge install.

2005-11-23T22:59:00.000-08:00

If you chose "Desktop" when installing Sarge from a net install CD it installs both Gnome and KDE. I'm not a KDE fan. Here is a list of most if not all the packages you need to remove to clean it off your system.

apt-get remove kde...

Aerial Mine Services.

2005-11-23T20:13:00.000-08:00

The Aerial Mine is now open. If you would like access to the following services (including free web hosting):

HTTP
HTTPS
SSH
SFTP
Nessus w/ SSL
Ruby on Rails

I can make you an account. Just email joe@621.org with your info.

Additionally, I am looking for a few nerds to add to this blog. If you would like to post here about anything tech and interesting, contact me. You just need to have a blogger account and knowledge in any, but not limited to the following areas:

system administration
programming
linux/unix
windows
electronics

I would expect at least one post per week as far as commitment goes.

Google Integration.

2005-11-22T13:14:00.000-08:00

Picture 2
Originally uploaded by zeusfaber.

Google is an interesting company. They seem to have there hand in everything, including seemingly unrelated areas. They have a larger plan in mind and I can't wait to see it unfold. I think they are planning a "one stop" approach for anything internet related. You can go to Google for search, instant messaging, advertising, email and more. As you can see in the pic (upper right corner), they just integrated the email user accounts to the search engine. You can setup a personallized search homepage and etc. This is the same username you use with instant messenging too. One username for all their services.

More Google tid bits.

Zimbra.

2005-11-18T16:04:00.000-08:00

Zimbra is a new open source mail server that aims at replacing MS Exchange. It is written in AJAX (Asynchronous JavaScript language and XML), which is a mouthfull. It allows you to "mouseover", drag and drop and etc in your web browser. Pretty cool. The Zimbra interface uses all of these types of features. It's worth taking a look at. An online demo is available here.

More Ruby on Rails.

2005-11-15T08:02:00.000-08:00

I've been working on this stuff both at work and at home (last night til 3am). After I left work last night Craig (my boss) got it working with Apache2 and FastCGI, earlier in the evening we got it running on Lighttpd with FastCGI. Upon arrival at home I started work on my box to see if I could get it up and running, and did!

It is really simple and not very usefull yet, check it out:

Ruby on Rails on Apache2 Running FastCGI

(If it doesn't work it is probably because I'm working on something. Sorry.)

Here's what I did:

Installed ruby, rails, fastcgi (mod_apache), fastcgi ruby libraries, apache2 with apt-get
Loaded modules for fastcgi and rewrite
Changed the configs (below)
*It's a good plan to get it running with normal cgi first, then switch to fcgi.

Here is what my configs looked like:

Virtual Host File
Ruby .htaccess File

My 'dispatch.fcgi' had these active lines:

require File.dirname(__FILE__) + "/../config/environment"
require 'fcgi_handler'

RailsFCGIHandler.process!

I think that is about it. It seems easy now, but it was pretty frustrating last night, it felt the stars have to be aligned for it work. Anyway, once you create an app you it *should* work and you should be on your way.

Cell Microprocessor.

2005-11-13T21:29:00.000-08:00

A lot has been said about the Cell chip from the big dogs IBM, Sony and Toshiba. And I'm not going to say anything new, but if you haven't heard or read anything about it this is a quick run down.

If you don't know, it's the new chip for the Playstation 3 and it's about as unique as they come. It's a interesting multi-core CPU but not really in the regular sense (think, AMD and Intel). It has a general purpose "controller" core based on the Power architecture (used in Apple machines) called the PPE (Power Processor Element). Additionally, it has eight SPE's (Synergistic Processing Elements) these are "simple" specialized CPU's that do the bulk of the work. They do the work in succession. One will finish and move the product along to the next SPE and so on. Both the PPE and each SPE have their own caches also. And according to IBM the CPU will be running at 4Ghz!

Connecting the CPU to the memory is the new Rambus XDRcontroller (memory bus) and FlexIO (system bus) interconnects that will provide over 25 and 76 GB/s of bandwidth respectively.

Thats a lot processor and IO... Consider the benefits for Playstation type uses of this processor. Graphics are floating point calculations. The floating point ability on this CPU will be huge. It will be much like the video cards used in todays gaming computers but multi-core and less specific (not just used for graphics). In the end it should be a nice blend of specific use and generic processing that should make the PS3 pretty awesome.

Needless to say this going to be a sweet architecture. I think we will see more of a trend to this style of design in porcessors. Moving away from the single core, monolithic style processors we all use today. To single processor multi-core chips that have cheap and easy "co-processor" cores controlled by a one multi-use core. Spreading the load among more CPU's is the name of the game. We are already seeing this happening in both the Intel and AMD camps. The Pentium D and the Athlon X2 are the beginnings of what will be a big change in CPU's.

Moreover, I think we will also see a trend toward more specialized CPU's, ones that are made for a specific purpose or at least that can handle generic use but have a specific slant to them.

For instance, 5 years from now when you buy a PC to connect to your TV and home stereo that machine will have a CPU honed to that sort of purpose. Instead of the CPU being completely generic and avgerage at everything, including stuff you won't be using it with, it will have a job it is really good at and below avgerage on everything else. Why use a Swiss Army knife to cut a tree down when you could use a chainsaw. Other than the performace advantages, a driving force to this style of CPU design is the cost. It is finially getting to the point where is it affordable to manufacture single or similar use CPU's.

Regardless of what I think, the new Playstation is using the CPU and I looks to be if nothing else a pretty interesting design.

"But you don't have to take my word for it." ~Reading Rainbow

More info:

ArsTechnica Part #1
ArsTechnica Part #2
IBM Journal Research and Development

mod_security for Apache.

2005-11-13T17:28:00.000-08:00

Something I have screwing around with lately is mod_security and I have to say I like it. It adds a lot of usefull features to Apache such as extended logging and filtering. I especially like the filtering. You can even set it up to block URLs that could be a security risk. Based on word matching like this:

SecFilter "!php"

or pattern matching :

SecFilter "<[[:space:]]>*script"

or even SQL like this:

SecFilter "delete[.*]from[[:spce:]]*"

It's possilbe to filter out stuff you don't want to, so use discretion when creating them. Used properly this can be a really nice tool. There is much more to mod_security than said here. If you run a Apache web server you should check it out.

Once set up, use Nikto to run a vulneribility scan against your machine. See how it goes, I would expect it do better under those conditions.

More info can be found here:
mod_security
Nikto

Laptop Hard Drive.

2005-11-13T17:19:00.000-08:00

My IBM's laptop woke me up this morning around 6. Cause: The hard drive was in the process of failing. Woo hoo!

Sony Rootkit.

2005-11-12T10:20:00.000-08:00

Prehaps the start of a new trend in DRM...corporate rootkits. It looks like Sony is backing off though.

More info:

Slashdot
CNet FAQ
Slashdot 2
F-Secure

Friendly Reminder: Don't forget that we have 'fair use' with the products we purchase and don't let your rights fall to corporate bullying.

Skype on Debian.

2005-11-11T10:32:00.000-08:00

Skype is a great tool. The Skype developers are tools. They can't seem to fix the Debian packages in their repository or website, even after many complaints in their forums. At any rate, I fixed the package. It shouldn't have the dependency problems that the old one did.

It can be found here:

Skype-1.2.0.18

If this site or package doesn't work, blame me. Sorry for any speed issues, I'm hosting it on DSL.

Ruby on Rails.

2005-11-11T09:47:00.000-08:00

Tons of hype surrounding this new development platform. After working with the last couple nights, I have to say it's pretty sweet. The platform takes care of a lot of work and configuration for you. It creates the directory structure/framework for you.

Suppose, you want to connect it to a DB, all you have to do is tell it where the DB is localed (localhost, etc) and the username and password. Done. It figures out which DB you want based on the name and the name of the controllers and etc you created. It even knows the difference between plurals. Name the DB 'rabbits', name the project 'rabbit', it knows that they are one in the same and syncs them.

The system as a whole has few lines of code. I only had to write a few to create some decent features. Pretty interesting stuff.

Want to check out more?

Video
Starting Guide

First Post

2005-11-11T09:37:00.000-08:00

Here is my new tech only blog. Woo hoo!