Archive

Archive for November 29th, 2009

OpenID enabled

November 29th, 2009 No comments

I wanted to use my website as an OpenID authentication source (I’m pretty sure I have OpenID through other public service providers, such as Yahoo! and LiveJournal, but no one with an ounce of sense should be relying on third party providers for his identity), and as usual the easiest way to do it was to install a WordPress plugin.

Incidentally, the plugin also provides for visitors to authenticate themselves using their OpenID from elsewhere (the website URL when you enter comment is the same URL that can be used for OpenID), so that’s for your use, if you please—practically, there’s no real difference; all comments are held for moderation anyway (how else would I squelch dissent in my little paradise?), and is not your self-described nick proof enough of your identity? But in any case, I just wanted to get on some bandwagon and the OpenID bandwagon seems to be a … convenient one.

Oh, BTW, for those of you who hesitated on making an account, well, now you actually can’t make an account without a valid OpenID. Don’t you wish you had done it earlier?

Categories: Uncategorized Tags: ,

Calmail leaks IP addresses!

November 29th, 2009 No comments

For regular visitors of my blog from UCB, here’s an early holiday Christmas present to you: Calmail leaks IP addresses! Here’s a quick demonstration (I’ve seen similar headers on emails from friends and colleagues, but I didn’t want to expose their info; I’ve redacted some info here as I didn’t want to expose my … secret email server scheme, or my real username for Calmail):

Return-path: xxxx...@visitor3.berkeley.edu
Envelope-to: bkp...@xxxxxx.xxx
Delivery-date: Sun, 29 Nov 2009 01:32:12 -0800
Received: from visitor3.berkeley.edu ([128.32.124.159])
        by helen.byungkyupark.com with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32)
        (Exim 4.69)
        (envelope-from <xxxx...@visitor3.berkeley.edu>)
        id 1NEg8a-0000jX-J7
        for bkp...@xxxxxx.xxx; Sun, 29 Nov 2009 01:32:12 -0800
Received: from xxxxxxx by visitor3.Berkeley.EDU with local (Exim 4.69)
        (envelope-from <xxxx...@visitor3.berkeley.edu>)
        id 1NEg8a-0001rk-4v
        for bkp...@xxxxxx.xxx; Sun, 29 Nov 2009 01:32:12 -0800
Received: from smtp-out1.berkeley.edu ([128.32.61.106])
        by visitor3.Berkeley.EDU with esmtp (Exim 4.69)
        (envelope-from <xxxx...@berkeley.edu>)
        id 1NEg8a-0001rW-2q
        for bkp...@byungkyupark.com; Sun, 29 Nov 2009 01:32:12 -0800
Received: from arsenic.calmail ([192.168.1.2] helo=calmail.berkeley.edu)
        by fe2.calmail with esmtpsa (TLSv1:AES256-SHA:256)
        (Exim 4.69)
        (auth plain:xxxx...@berkeley.edu)
        (envelope-from <xxxx...@berkeley.edu>)
        id 1NEg8T-0000qs-8R
        for bkp...@byungkyupark.com; Sun, 29 Nov 2009 01:32:06 -0800
MIME-Version: 1.0
Received: from visitor3.Berkeley.EDU [128.32.124.159]
        with HTTP/1.1 (POST); Sun, 29 Nov 2009 01:32:05 -0800
Date: Sun, 29 Nov 2009 01:32:05 -0800
From: "Byung Kyu Park, BA" <xxxx...@berkeley.edu>
To: bkp...@byungkyupark.com
Subject: This will demonstrate how Calmail leaks IP addresses
Message-ID: <7272...@berkeley.edu>
X-Sender: xxxx...@berkeley.edu
User-Agent: RoundCube Webmail/0.3-RC1.UCB3
Content-Type: multipart/alternative;
        boundary="=_ad4b95d1d25a334cada12ae4c3335783"

Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="UTF-8"

And this email was composed on the RoundCube webmail client.

Andrew

You will see that the detailed email header (which most email clients hide, but there is always an option to show full headers) reveals the IP from which I was accessing Calmail’s webmail interface (no, I’m not in the lab right now; but I am proxying through one of my servers, because I consider my current IP address a confidential, personal, private information). Similar headers show if you use SMTP protocol or if you use the other webmail.

I am not entirely sure if this is a feature or bug—embedding IP information in headers will help with legitimate activities of law enforcement authorities, as well as illegitimate (is there any other kind?) squelching of dissenting voices—so I haven’t reported it to abu...@berkeley.edu or, I don’t know, h...@berkeley.edu? secu...@berkeley.edu?

In any case, now that you know, now you can avoid using Calmail—if you value your privacy.

Ironically, GMail may be one of the most secure email system to use, as far as privacy goes, because headers from GMail is fairly clean from any private information. Or, I guess if you are like me, you run a computer server at work, on which you run a bunch of things like websites and email servers so whose IP address isn’t exactly a state secret. You can proxy everything through that server (like I did here) or run your mail clients and what-not on that server.

No matter what you do, just remember: when you send an email through Calmail, you announce to your recipient what your IP address is at that moment. Don’t send that email if you are not comfortable with that.

Categories: security, tech Tags: , , ,

Why I am comforted by flawed computer models

November 29th, 2009 No comments

Because if they were as right as climatologists pretend, we would be doomed:

“[Garrett discovered that] Throughout history, a simple physical constant… links global energy use to the world’s accumulated economic productivity, adjusted for inflation. So it isn’t necessary to consider population growth and standard of living in predicting society’s future energy consumption and resulting carbon dioxide emissions. … ‘I’m not an economist, and I am approaching the economy as a physics problem,’ Garrett says. ‘I end up with a global economic growth model different than they have.’ Garrett treats civilization like a ‘heat engine’ that ‘consumes energy and does “work” in the form of economic production, which then spurs it to consume more energy,’ he says. That constant is 9.7 (plus or minus 0.3) milliwatts per inflation-adjusted 1990 dollar. So if you look at economic and energy production at any specific time in history, ‘each inflation-adjusted 1990 dollar would be supported by 9.7 milliwatts of primary energy consumption,’ Garrett says. … Perhaps the most provocative implication of Garrett’s theory is that conserving energy doesn’t reduce energy use, but spurs economic growth and more energy use.”

I trust estimates like this far better. If you can estimate how much energy, i.e. electricity, is used by humanity as a whole and enter some assumptions about how much of it is generated from fossil fuels, then you can get a lower limit on carbon emissions from that alone fairly quickly (if you want to cut the work, you can assume Carnot efficiency for some ballpark estimates of heat reservoir temperatures; it won’t be off by more than a factor of 2). And until that assumption about what fraction of energy comes from burning off carbon breaks down (perhaps by acceptance of nuclear power, or what some people are trying to call “terrestrial power”), this is one calculation that will not depend on models and will stay true within (rather large) margin of error.

Oh, boy. How glad I am that our climate is a nonlinear, chaotic system. Thankfully, doubling CO2 content of atmosphere does not lead to doubling global temperature. There isn’t even a linear relationship, as last 10 years might demonstrate. There definitely isn’t an exponential relationship—Thank God!

If one is a really serious advocate of these “climate change” theories, there is only one way he can be consistent (and not be a hypocritical political hack like Gore): (1) stop eating meat, as methane from cows is another greenhouse gas; and (2) start really pushing for more nuclear power plants everywhere—nuclear waste isn’t that big of an issue; we can recycle fuels until they run out of radioactive isotopes (… if we weren’t so hung up on non-proliferation, since recycling fuel is one way to build one type of atomic bomb). “Renewable energy” like solar and wind are all good, but they can only provide so much fraction of our grid power (let’s say, 50%) because they are not very reliable, and the rest have to come from somewhere: and the only viable long term option (at least until space travel and colonization becomes a reality) is nuclear power.

This is one problem (in fact, one among many, excluding Gore’s finances) that buying carbon offsets will not solve.

Update: Oh, and there’s always the Unabomber route, too. Although I have to say that as much as his anarchist manifesto appeals to me as far as it extols the virtues of a free man, I am not sure if I want to live in Mr. Kaczynski’s paradise: in his ideal society, if you could call it that, we are still trapped on this world—with no future for humanity beyond this little planet.

Update: This is exactly what I mean. Even if the hydrodynamics of climate were perfectly understood, numerical models can get us only so far—especially when the underlying system is nonlinear and chaotic. Blind faith in climatologists’ models is just as bad as blind faith in numerology or some sort of Bible code.

Who will make the world safe for encryption?

November 29th, 2009 1 comment

With the first programmable quantum computer realized the day may come when Shor’s algorithm can be implemented with some accuracy:

“A team at NIST (the National Institute of Standards and Technology) used berylium ions, lasers and electrodes to develop a quantum system that performed 160 randomly chosen routines. Other quantum systems to date have only been able to perform single, prescribed tasks. Other researchers say the system could be scaled up. ‘The researchers ran each program 900 times. On average, the quantum computer operated accurately 79 percent of the time, the team reported in their paper.’”

I might be alone in this, but I fear the day when quantum computers become practical—much more than the day when the Singularity emerges; I have at least a sense of anticipation for the latter and it will represent a progress, an evolution of sorts. In contrast, all the uses for a quantum computer I know are evil—just like the atomic bomb and the hydrogen bomb. There is never a peaceful reason to enrich uranium more than 10%, and there is never a moral reason for a quantum computer to work more than 1% (or some other low number) of the time.

Will some other breakthrough make encryption—specifically, cheap and affordable encryption; for the wealthy and powerful, there is always OTP—available to the masses again, once quantum computers inevitably make public key encryptions (SSL and PGP, for the two big ones in use widely today) unusable except as children’s playthings?