Get Adobe Flash player

Monthly Archives: February 2009

New downloads section

I just added a download section where I’ll be adding various utilities and libraries I’ve written or will write in the course of things. Right now I’m working on a new project “Black Friar” (there is a link up, but no content there yet), and as part of that I needed to use the unix file program / libmagic to identify file types. Alas file / libmagic are written in C and only provide a python binding. I went ahead and hammered out a Java Native Interface (JNI) wrapper for the library and wrote a small (very small, as in one class) library to allow libmagic’s functions to be used in java.

The download includes compiled versions of the libmagic library and the jni file for linux. I did not compile a windows one because I don’t have a windows environment currently setup for compiling c, but the source code is included and can be used to generate such. The library is released under the LGPL whose text is included:

JFileMagic 1.0 - 308.25 KB

Users are the weakest link

Not a week goes by without some new problem surfacing in day to day communication security. The newest stems from a black hat talk by Moxie Marlinspike of thoughtcrime.org. This attack is not sky-is-falling immediate action required bad, but is instead of the depressingly preventable variety. Moxie’s new attack is actually quite elegant and has a retro vibe to it in exploiting the most vulnerable link in any security chain: the user.

His setup for the attack examines website design as it relates to SSL security. He observes users do not type HTTPS, but rather encounter it from HTTP such as login boxes which post to HTTPS urls. Separating the feedback mechanisms into positive and negative, he also notes triggering the positive mechanisms (little locks, changing colored address bars, etc) is not so bad while triggering negative mechanisms (invalid security certificate, problem encountered with the website’s certificate etc) are game killers.

Continue reading

You Are Not a Scientist

Paul Ohm, an associate professor at the University of Colorado Law School, opened a new blog segment called “You Are Not a Lawyer (YANL)” with an opening salvo targeting “computer scientists and other technically minded people.” It was a nice touch to lump computer scientists with anyone possessing a tivo. Tit for tat, in this critique of his post I will title mine “You Are Not a Scientist (YANS)” in an attempt to dissuade lawyers and other legally minded people of the implied assertion that just because it is so, it should be accepted.

Continue reading