The skroutz system

First of all the classification and the evaluation done by skroutz is peculiar.  The are in the eshop business and probably they are protecting their customers, in the sense, that they have to verify whether  one is a legit customer of a shop or not (the actual verification is. I am not sure how well this work (I am pretty sure that things might turn bad) but so far in my experience no censorship has happened in order for a shop (their customer) to be protected.

How to evaluate the presales “engineering”?

This is a tough one. There are some obvious metrics (ie no damaged goods, no used goods, solid handling, and timeframe keeping). I have all those years huge amounts of experience on all fields (torn books from amazon due to incorrect handling, etc) but all in all I don’t have to say much about my critique on these shops. Some where delayed more than they should, but all arrived in excellent condition.

The Rant

For the only shop (I won’t name it of course) that I had bad experiences is the one that went off the time frame, they indicated in their site. I didn’t mind waiting a few days more (I waited ~15 business days) or less, the items I ordered were not high priority. What irritated me the most was the fact that every now and then those people were calling me in my cellular phone, to state the fuckin’ obvious: “Your shipment is going to be delayed, we are really really really sorry… blablabla“. Why didn’t they sent me an(some) email(s) instead? Why did they wasted precious communication resources instead of sending me an email? Why did they waste my time (they were calling business hours) in meaningless conversations? 

Some times I wonder what kind of business policy is that. I really do adore the shops that are quiet and call only in ultra emergencies (ie a Greek online book store once called me to tell me that the book I ordered is going to be reprinted with some updated info and whether I would like to order that instead the one I had ordered. - I REALLY APPRECIATED THAT CALL! I Love protoporia.gr)

Final thoughts

It is not good customer relationships to call me every second day. Good customer relationships are to have the goods in time and in order. please keep that in mind. The best virus -they say- is the one that gets the job done, while you have never heard of. IMHO this quote applies almost everywhere.

 Note that this is NOT COMPLETE NOR CORRECT.  I WILL UPDATE AGAIN, STAY TUNED.

• First of all download airocrack-ng and airos sdk.
• also download openssl, it will come handy (probably)
• if you have downloaded debian packaged airos sdk  and you don’t have debian derived distro, then unpack it using the following:
  • ar vx toolchain-mips-ls_0.1-1.deb (this is based on what I downloaded, check yours)
  • untargz the output (this is usually the large archive) : tar -zxvf data.tar.gz
  • update PATH environment variable to use mips compiler instead of the system’s (that is IF your distro comes with a compiler) export PATH=~/ubnt/opt/toolchain/mips_ls/bin/:$PATH (this is for my directory structure update yours accordingly)
• untargz airocrack distribution: tar -zxvf aircrack-ng-1.1.tar.gz (update accordingly)
• change directory to the newly created aircrack-ng-1.1: cd aircrack-ng-1.1
• execute there TOOL_PREFIX=mips-elf-linux-gnu- CFLAGS=”-O2 -march=24kc -EL -static -s” make if you are lucky and the so called airos SDK is a true SDK everything will compile normally

I am pretty sure it won’t.

SIDENOTE: Dear ubiquity toolchain developers: SDK MEANS SOFTWARE DEVELOPMENT KIT. THIS MEANS THAT IT SHOULD CONTAIN THE WHOLE FUCKIN’ LIST OF LIBRARIES THAT ARE NEEDED TO BUILD EXECUTABLES ON TOP OF AIRoS. NOT JUST A FUCKIN’ COMPILER FFS… This is a good time to go and download the codesourcery toolchain as mentioned in the beginning.

•  Due to these morons we need to probably build openssl, and statically link against airocrack-ng (duuuuuhhhh…)
• download openssl untar and enter directory
• edit Configure and add the following line somewhere in the middle of the definitions: (this is simply SAD)
  • “nanostation”, “mips-linux-gnu-gcc:-mabi=32  -DTERMIO -O3 -g -Wall -s -EL::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)”,
• ./Configure nanostation
• edit Makefile (with the following):
  • AR= mips-linux-ar $(ARFLAGS) r
  • RANLIB= mips-linux-ranlib
  • NM= mips-linux-nm
  • MAKEDEPPROG= mips-linux-gcc
• make (yeah right using the jobserver (ie -j5) is not a good idea…)
• and then compile and statically link againstour own ssl from airocrack.

Now it is the time to setup nfs in your host linux (there we are going to store the airodump capture, and from there we will launch airodump) [example tutorial].

• edit /etc/export and add something like:
  • /data/nanostation/ 10.140.4.0/255.255.255.0(async,rw,no_subtree_check)
• (re)start nfs server
• login to nanostation and mount it:
  • mkdir /tmp/lala
  • mount 10.140.4.1:/data/nanostation /tmp/lala
• execute airodump from there
  • cd /tmp/lala
  • ./airodump with your favorite options

Please do not try to crack anything from within the nanostation. You will waste precious machine cycles Instead do it from the host. Make good usage of the nfs man!

So to get back to my lurking; Some months ago, I hanged out after being benefited in a gentoo related room,  when a person who wishes to remain anonymous joined. It didn’t took long until he seeked for help/support, so I helped him. It was a bit unfortunate that I spent more than 3 hours in his case but after those long 3 hours he was good to go. He asked me for my mail, and reluctantly I gave it to him. At the end of December I received an even more peculiar email which can be concluded into the following “Best Wishes what’s your t-shirt size, and where do you live?”. After a couple of mails which reminded me of the exotic nature of the person’s case, and that made me confident that he is neither from Nigeria nor a scummer a I send those information.

After a while and much to my surprise a package arrived from cafepress. It contained an analog clock and a T-shirt with a Gentoo insignia, along with some other advertising stuff from cafepress. I searched the box for information about the box’ origin and all I found is a receipt containing the text “Happy new year with Gentoo :D”

I wrote this post for two reasons.

• After dealing with online communities for more  than a decade in one form or another, I’ve never came across any such behavior, so I wanted to share with you. The few people that I discussed about this in the past few days, after the package delivery were also amazed and considered this an extraordinary behavior. What is actually came out of those discussions was that such actions are highly motivational, and a good example to follow in our online affairs.
• The other is to express my gratitude to M.K. that bought and sent those.

Thank you dude

(more…)

Port knocking is a mechanism of opening ports on a firewall. from the outside (the hotzone) by generating a connection attempt on a set of some closed ports. Once the correct sequence of connection attempts is received, the firewall rules are modified to allow the host which sent the connection attempts to connect over specific port.

(more…)

]]> http://blogs.pwmn.net/korkakak/2011/01/03/to-port-knock-or-not-to-port-knock/feed http://blogs.pwmn.net/korkakak/2010/12/31/which-comes-first-the-libc-or-the-compiler http://blogs.pwmn.net/korkakak/2010/12/31/which-comes-first-the-libc-or-the-compiler#comments Fri, 31 Dec 2010 11:52:02 +0000 korki http://blogs.pwmn.net/korkakak/2010/12/31/which-comes-first-the-libc-or-the-compiler Obviously this is a synthetic question,

merely mimicking the known (recently resolved) dilemma “which came first, the chicken or the egg?“. The use of present tense is on purpose in order to set the stage in the current time. Of course this is not a paradox from the Godel’s incompleteness theorem (Any formal system that is interesting enough to formulate its own consistency can prove its own consistency iff it is inconsistent), yet it could be formulated into a formal system since compilers and their output can be deterministic. A compiler can be described mathematically as a FSM, or even as a Turing machine (I am not saying it is easy to implement it though), so it would be trivial to prove that a C compiler is Turing complete (a language, a compile etc is said to be Turing complete if and only if such system can simulate any single-taped Turing machine - Some people of course argue whether this is something useful, or even good practice, but we are not interested in that… yet) if it supports the ANSI C standard. So after building a consistent formal system we can create actual, inconsistency paradoxes not like “Can we have a compiler of language X written in X” (if you have such questions read this really nice article) but like … well I just haven’t thought about it thoroughly but I can paraphrase a paradox we learned in CEID (unfortunately in Greek) “Is the set {Turing machines which provably halt on every input} enumerable or non-enumerable?” just replace Turing Machine with compiler in this set

Ok boring… Just tell me which came first

(more…)

It is sometime since I last wrote, and since then, wikileaks (an international non-profit organization that publishes submissions of private, secret, and classified media) came forward with hundreds of thousands of secret documents (the so called cablegate) that confirm the opinion that US embassies around the globe work as US intelligence local charters. This is not of course the biggest news of all. It seems that in view of a possible bankgate threat against major bank (it is rumored that this bank is the Bank Of America) many financial institutions have withdrawn its financial support and froze wikileaks banking accounts with no explanation at all.  So a valid question is whether a financial institution can take such measures, without prior court order. I always thought that the international banking system, was designed in such way that no organization could do such a thing without a court order (or since 9/11 just a indication of a terrorism threat) . I guess that expressing those in public make me a terrorist too (more…)

In zentyal, the default configuration of squid (and most of the parts that zentyal is auto selecting) is not privacy aware. For instance it sets by default the X-Forwarded-For headers which is pointless to share with outsiders, let alone malicious users.

So in order to disable this addition to your HTTP requests we have to go to /etc/squid/squid.conf and there add at the bottom of the file the tag : forwarded_for transparent. I choose transparent and not delete since delete imposes extra overhead to the proxy server. If you must though use delete, it removes entries added by other local proxies.

(more…)

1) your app doesn’t play because the morons at Arobas aka the guitar-pro developers, didn’t QA their product for AMD64 (this includes also EMT64 - and in general can be referred as x86_64 problem). HOW frakin hard is it to build against a 64bit system? Do you expect people to pay 60Euros and spend 1/2 - 1 - 2 or 6 hours* just to (re)install a non 64bit linux OS in order to use your product? How arrogant are you?

2) Ok after the flamethrower back to our business. In order to use guitar pro it is probably a good idea to create a separate use in order to run it (If these people can’t cross build then who knows how many security issues exist in their product).

(more…)

we waited for a parcel to arrive at work for 7 days, six of which it was stuck at the customs office! It took the parcel, 1 day to travel half the world (from Memphis to Athens) and then it was stuck for six days in the lockers of the most bureaucratic services of the Greek authorities.

Is bureaucracy a sign of corruption? Is, waiting for a parcel of necessary items, for six days acceptable? The parcel, in fedex times, could do 3 times round the globe, instead of lying into a dusty drawer/bench while waiting, to be inspected…

(more…)