БэФ블로그

Here are a few things I did in 2022, in no particular order:

• I love drawing and sketching. In order to refine certain aspects or skills, I started the first few lessons of the free and rather popular online course Drawabox.
• Different languages and cultures have always been one of my hobby topics of interest, so I learned Devanagari, the Hindi writing system, and a few words and phrases in Hindi. I may never need this, but it was intriguing anyway.
• The Internet™ suggested that instead of using a standard, ordinary, flat keyboard as input device, typing on a mechanical keyboard can be much more satisfying and in turn enhance creativity. So I bought a mechanical Keyboard, the Keychron K6 (ISO), disassembled the thing, lubricated every switch, installed sound dampening foam and ended up with a pretty satisfying keyboard experience. Take a look here.
• Also keyboard related, I wanted to see if or how my typing speed can be improved, so I trained on 10fastfingers and Monkeytype with different keyboards and different languages. The result is a rather steady 95 wpm average for German language input with the occasional wpm count over 100, and 87 wpm average for English language input. For reference, professional typists type at speeds of 43 to 80 wpm. Flat keyboards, such as the Apple magic keyboard, tend to be better for speed than mechanical keyboards. My overall improvement was negligibly somewhere in the range of 5 wpm.
• I read a lot about self-reflection and how to relieve stress, solve social problems and overall live a happy life in general. One book in particular stands out as easy recommendation: "The courage to be disliked" by Ichiro Kishimi and Fumitake Koga (2013). In their book, a young scholar and an experienced philosopher argue about different perspectives on how to solve social problems, based on concepts of Alfred Adler.
• In the age of AI based image generation, I made a habit of generating silly monsters among other things, as seen here.
• The Corona pandemic has somewhat leveled out where I live, so in 2022 I was able to re-start doing numerous online and in-person trainings about Web-Security and Secure Coding.
• Just for the fun of it and to stay on top of my game, I solved a few HTB challenges, which is somewhat like the solo puzzle version of CTF. Similarly PortSwigger Labs can be highly recommended as well.
• After probably more than 20 years, I listen to DnB again. Here are some highlights. I find that listening to DnB makes exciting tasks even more exciting.
• Due to family time constraints I cannot attend Aikido trainings at the moment, so I started doing the "7 minute workout" on occasion. It turns out that it helps me concentrate and be overall more relaxed and attentive throughout the day.

Using the keyboard has always been my main interface to computers. When I first started using our 286 back in the early 1990s, which I shared with my older brother, the computer booted into a command prompt and that was it. We had a fairly solid German style keyboard with clearly audible click sounds. So naturally my first attempts at typing were based on a QWERTZ keyboard layout, which was perfectly suitable for me, until I dove into programming a few years later.

The thing with programming languages is that most of them require special characters to be used fairly often, e.g. curly braces {} and brackets [] in C, backslash \, at-sign @, pipe | and others. These characters are accessible via the Alt-Gr or Right-Alt key on German keyboards in combination with the upper right digit row - 7, 8, 9, 0 - which in my opinion is not the most comfortable finger position for the right hand. The programming languages I chose at the time were based on the English language anyway - e.g. Pascal with 'begin', 'end', 'procedure' etc. - so I switched to US keyboard layout, at least for programming tasks. Most special characters are easily accessible using either one of the Shift keys plus a number key or one of the non-alphanumeric keys. I remember that by switching the layout alone, programming instantly became more fun due to less strain on the right hand.

After years of using both German and US layouts I was quite comfortable typing without looking at the keys and at least for command line input and programming tasks my typing speed slightly exceeded the average. But since I never formally learned ten finger touch typing it was more of a 7 to 8 finger usage. There was definitely room for improvement.

In April 2004 mostly out of curiosity and to refresh my mind I decided to try the US Dvorak keyboard layout as seen above. There are numerous alternative layouts like the rather popular Neo2, but the Dvorak layout dates back to 1936 and has since been implemented in a vast number of old and new computer systems. That means even when I encounter some strange old Spark station clone or whatever ancient computer system is still functional, there is likely a Dvorak layout option available. The Dvorak layout was invented to be more ergonomic than QWERTY when entering English words and therefore decrease stress on fingers and increase typing speed. These claims are somewhat controversial and were never scientifically proven. But personally I found it tremendously easier to relearn an entire keyboard layout rather than trying to fix my QWERTY habits. This argument is not for everyone, but since I am mostly using my own computer and I do not have to share my keyboard with anyone, the step to change the layout entirely fit perfectly to my needs. Also, the fact that I was already familiar with the US layout helped a lot, because all keys on US Dvorak layout are just rearranged from US layout. That means all the special characters behind the number keys remain exactly the same and all special character keys still have the same Shift/non-Shift assignment despite being located somewhere else on the keyboard.

The other thing that is generally somewhere else on Mac keyboards vs PC keyboards is the entry of German umlauts and French accents unless you are using the respective local keyboard layout. Mac has the umlaut character - Alt-u - followed by the vowel and accents are entered in a similar fashion. On PCs there are numerous methods to access language specific characters, but let's just say, it's complicated. I usually stick to using the Mac for writing non-English texts. If I have to enter German text on rare occasions on Windows, I tend to switch the layout using Alt-Shift for umlauts and then switch back to Dvorak. Eventually I would probably use US Dvorak International layout, which gives access to umlauts via Alt-Gr.

In order to initially learn finger placement and start typing at reasonable speeds, I used a tool called DvorakNG. I suppose there are equivalent online tools nowadays. While learning, some keys turned out to be too far away for my hands while resting and I would rather have my hands rest comfortably than constantly move up and down the rows. So my ten finger system is slightly more personalised when it comes to upper left and upper right keys, that are ordinarily entered using the little finger, but I am using the ring finger instead. As far as I can tell, this slight change has had no impact on my typing speed.

The change from QWERTY to Dvorak took me about two or three weeks in order to regain my former typing speed back in 2004. But was it worth it? Definitely. Apart from typing a lot more accurately, typing Dvorak helped me a lot to not think about typing itself but rather thinking about the content, the problem at hand or entire sentences that magically flow into the keyboard. Would I recommend that journey to anyone? Probably not. The switch helped me personally to be more efficient. But you can be equally efficient without switching. My original reason for switching was that I am generally curious about many things and by learning a new skill I can refresh my brain in a potentially very useful and practical way, which turned out to be correct even now, 18 years later.

Among other interesting things, the Berlin Underground has vending machines for sweets at some stations. One summer morning a few years ago, I went on a trip, deeply focused on my mobile browser, when I got a message on my phone: "Please rate this vending machine here...". How? What? Why? There was no machine nearby, or was there? And how did it know to send that text to me? It turned out to be a (now obsolete) feature called "Google Nearby". A Bluetooth Low Energy (BLE) beacon in the vicinity can announce an ID, that can automatically be resolved to a message and URL via Google. Well, naturally I wanted one of these beacons to play around and announce my own twisted message to fellow travellers. So I went online and found the Eddystone Bluetooth Low Energy beacon fairly cheap on Aliexpress. Aliexpress is a huge Amazon-like competitor in non-western world countries, that delivers world wide. I bought the Eddystone and waited, waited some more and finally the package arrived a few weeks later. The Eddystone came with no manual or description whatsoever and the internet was not very helpful when it came to this particular device. So I contacted the seller and complained (quite rudely in retrospect) that the item did not work as expected. The answer included a binary-only APK file for Android, that may or may not be able to program the Eddystone. I never came around to executing this untrusted code. But I bought another few BLE beacons from somewhere else, that actually worked pretty well out of the box. During the following two or three years I kept broadcasting funny messages via BLE wherever I went and every once in a while someone actually clicked on my link. That was that. End of story.

Half a year after the eddy stone experiment, I ordered another item. I know, that was risky, but a couple of weeks later exactly no parcel arrived, so the seller reimbursed me without problems. Seeing that my experience this far was unsatisfying, I left it at that.

It was three years later, when I was looking to find noise cancelling headphones for a lot less than 300 Euros. The best of the best at the time were Sony XM3 (~ 300 EUR), Some Bose Headphones (~ 350 EUR) and Sennheiser PCXsomething (~ 200 EUR). The rest was not worth mentioning - at least that is what the Internet suggested. That's when I rediscovered Aliexpress and other Chinese online shops, and there are a few - Gearbest, Banggood and Aliexpress seemed enough to explore for now. Gearbest, as the name suggests, actually has the best gear, but most of the time not the best prices, so I kept it for comparison, not for ordering anything. Banggood seems to have really low prices, but not as much selection as Ali, so I kept Banggood for comparison only as well.

After finding a couple of headphone brands nobody ever heard of, I looked at reviews and an entirely new world of youtube product review videos opened up to me. I had no idea that that is a thing now. Unboxing videos, yes (even though I never got their appeal), but review videos. You should check it out right now. There are people buying amazon returns in huge quantities while having fun. There are high end audiophile people reviewing very bad headphones. But underneath it all, it is somehow possible to form an opinion about these formerly unknown brands. So I went ahead, bought a pair and don't regret it. They are superb and last forever with one charge - for ~80 EUR and uncountable hours of "youtube research". Thank you internet. (BTW. I got the Edifier W828NB.)

Most other orders I have made since then came through without anything remarkable to say about them, but there are some exceptions:

• Really cheap 50W LED lights for the office: These things have a CE certification, but they get really really hot, so I ordered a couple of radiator plates, too, in order to prevent a fire hazard.
• Some electronic component: It got held back at the customs office. A letter from the local postal service kindly offered to take care of the matter for about 30 EUR service fee, so I rather went to the customs office myself, only to hear, that as a company with a valid EORI number, you can take care of everything via email. Ok. Good to know.
• Android tablets (for work): Apparently the seller sent very low quality tablets with really bad chipsets instead of the ones described in the order. I tried, I really tried to talk to the seller. First I took a few photos of the bootloader in chinese characters - no problem thanks to Google Lens, which translated for me on the spot. But the seller demanded videos. So I took a video of the very same bootloader and uploaded it to the seller chat, but the seller preferred to watch the video on youtube. So I uploaded the video to youtube, only to receive a message, that this is the tablet currently sold and not an old version as I suspected. With Aliexpress there can only be a formal dispute opened within 15 days after receiving the goods, so I opened up such a dispute at the last minute, followed by the seller begging me to close the dispute. Aliexpress as the mediator set an appropriate refund amount for the tablet, but I had to provide further evidence to get more. So I made yet another video, uploaded the video to youtube and their dispute platform. A few days later the issue was settled with the mediator's help. Ok. Moving on.
• Some other electronic component: This one order was cancelled by myself. The cancellation had to be confirmed by the seller, but it all went well.
• Android Tablet Covers: This seller contacted me after ordering, that he might loose his job, because incidentally the shipping cost was not included, so I should buy a void item to cover the shipping cost. This must be a scam, and that is what I wrote to the seller. For some reason the items have not arrived yet.
• A camera: Yes. Surprisingly there are high quality goods on Aliexpress. I did not expect much, but this is one of the best cameras I have ever owned, a Yi M1 with two exchangeable MFT lenses. I must say, wow. At a price lower than 150 EUR at a sale this camera can easily compete with professional high-end >500EUR cameras. It is fast, easy to learn, easy to use, there is current software available for the camera and for the lenses as well. The image quality is stunning both in dark and in bright environments. So far I only went with Canon as my go-to camera brand, but this camera may just break that habit.
• Portable Bluetooth speaker: Well, it was supposed to be a stereo speaker and all I got was mono. But other than that, this little <10 EUR gadget can easily keep up with any of the brand name products and has been fun to use around the house so far.
• A few USB cables: One can never have enough USB cables. But apparently my phone requires an extra 0.5mm plug length to fit in properly, so all of 184 cents got wasted. Too bad.
• A USB-C cable, that was broken: The seller wanted a video of the cable "not working". So I uploaded such a video to youtube, but seller insisted on receiving the video via email. I received a refund a few days later - most of it anyway, since USD/EUR currency conversion is in flux and Paypal kept a few cents for the transaction, too. I won't prepare videos for all the damaged items it the future, but just to check if it actually works and how the seller handles complaints, it was worth trying it out.
• Cheap storage bag for electronic components: Well, it stinks. After a couple of days on the radiator, it still stinks a bit, but hopefully that will be a matter of waiting it out.
• Experiment: A banggood order: It looked like the item was still available, but once ordered it was out of stock. The friendly customer support chat was successfully able to quote their default "out-of-stock" guideline, but I may cancel at any time. A few days later - after contacting the customer support again - it turned out, that my address field with more than 30 characters is too long for the carrier. Still waiting to this day. I do not understand this platform.

Lessons learned? Let's see.

• The concept of Aliexpress is a marketplace for numerous sellers, just like third-party sellers on Amazon.
• Prices on the mobile app are sometimes lower than via desktop browser, so I usually fill up the shopping cart on the desktop and start the order on the mobile browser, at least with Aliexpress. The shopping cart is very similar to another wish list and for each order specific items from the shopping cart can be selected individually. banggood on the other hand has separate shopping carts for each session, which I found to be not very user friendly.
• Under the hood the Aliexpress Mobile App became a Progressive Web App (PWA) in 2016, one of the first at that scale, which I find pretty impressive. There are games, shows, recommendations, and lots of possibilities to interact with buyers and other sellers. Providing feedback including photos is encouraged by getting coins and status points, which may or may not result in getting coupons to save minuscule amounts of money. Personally I tend to keep out of too many distractions in favor of my real life, but it was really fun playing around with all the little app add-ons once or twice.
• When ordering lots of little things, each new package in the mailbox is another nice surprise for the day. It feels a bit like opening Christmas presets, but all year.
• Delivery time usually ranges from 4 to 6 weeks, sometimes even more, sometimes less. Packages usually come with a tracking number in order to see shipment progress. Letter size parcels are usually not trackable. I think having such a long delivery time calms down the everyday life nicely.
• Getting a commercial invoice with accurate numbers for tax purposes is a matter of chance. You can try, but the default is not to get a proper invoice. In fact, there are a couple of businesses that specialize in creating Aliexpress invoices, for a fee of course.
• Returning items is impossible. Return fees are never paid for and most items are worth less than it would cost to return them.

At last, a few numbers:

• 75% of all orders completed successfully.
• 9% of items were defective.
• 13% of items were either wrong or the product description did not match the product.
• 3% were not delivered or got lost in transit.

All in all it has been a fun trip to explore the foreign B2C market. If you ever need something that may or may not work properly, that is of unspecified quality and arrives some time within the next couple of weeks, there you go. For personal use this may be ok. For my professional use cases, I'd prefer next-day delivery, quality control, hassle free returns and proper invoices instead.

tl;dr Fake PGP keys cannot be removed from public key servers, but they can be uploaded by anyone. In a business context this may lead to technical problems and awkward first business contacts. Why not write a postcard instead?

Problem PGP key servers serve as directories for PGP keys. Unfortunately it is hard to remove keys once they are uploaded. And anyone can upload any key, even their own fake version of keys associated with arbitrary email addresses. Wikipedia puts it this way: "This leads to an accumulation of old fossil public keys that never go away, a form of "keyserver plaque"." So, there is no way for the legitimate user of an email address to revoke or remove keys not actually generated by that user. There is no server side email validation. There is no enforced expiration on keys. And there is no usable web of trust. The original idea was that keys signed by other keys will eventually lead to a trust chain, but that turned out to be a privacy nightmare.

The real problem Suppose someone uploaded a fake key with your company's contact email address 'contact@your-company.foo'. Unfortunately some potential customers don't check the validity of such a key. As long as the key server finds a matching key, that key is just used to encrypt emails to your company. And of course in the eyes of a customer it is supposedly your fault that such a key exists in the first place and was not revoked properly. Having a business relationship start with a technical problem is not a good start. You have to reply asking for another copy of the email encrypted with a proper key. The customer has to delete the invalid key and import the new key, which can be time consuming for non-technically versed people. Finally the initial email is sent again with the 'friendly' reminder that some key server is 'still' serving an old key. So, in my opinion the problem is a social problem, but I try to find technical solutions anyway.

Not working solutions

• WKD - Web Key Directory. This is the new and fancy way to download keys directly from a web server associated with the email address. But customers and their standard email client won't use it unless it is supported and switched on by default.
• Put the real key on your company website. Customers don't care. They will just assume, that the key file is identical to the fake key served by the key server.
• Sign the fake key with a 'do not use' warning message attached, as suggested here. Of course anyone could do that and potentially invalidate all keys using this method.
• Switch to S/MIME. This solution won't solve the problem with PGP key servers.
• Communicate unencrypted. This may actually be a working solution for "the real problem", that starting a business relationship with technical difficulties appears to be suboptimal. You could also use the telephone or a postcard or a bicycle courier instead of email.

Working technical solutions (practical and impractical)

• Set up an auto-responder for encrypted emails without known encryption keys. Let the customer deal with the fast response that they chose the wrong key and point them to the real key or alternative methods of contacting the office.
• Extend all key servers to validate email addresses. This is what the PGP Global Directory has been doing.
• Let key servers reject keys without reasonable expiration date, e.g. 2 or 4 years in the future. This will not solve a targeted attack, but at least gets rid of unmaintained old keys without expiration date.
• Require keys to be uploaded again after a while. Same as above.
• Extend client software to prefer keys in order, first manually imported keys, then keys downloaded via WKD, then keys with expiration date, then other keys.
• Disable the use of legacy key servers by default in your client configuration.

Conclusion In my opinion the legacy PGP key server infrastructure does more harm than good by not providing email verification or any kind of removal option. The optimal scenario would be for a first time contact to retrieve the PGP key in person from a trusted source. The next best thing is implemented with Web-Key-Directory (WKD). Why anyone is still 'trusting' (to some degree) arbitrary keys from public key servers is a conundrum to me. But people doing that are exactly the customers in need for professional IT consulting, so it is counterproductive to put the blame on them.

• Gesagt: "Der Parkplatz ist weg!" Gemeint: Der Parkplatz ist bereits belegt.
• Gesagt: "Es gibt keine Gabeln mehr!" Gemeint: Es sind bereits alle verfügbaren Gabeln eingedeckt und es wird noch mindestens eine weitere Gabel benötigt.
• Gesagt: "Oh nein, ich habe etwas vergessen!" Gemeint: Mir fiel gerade etwas ein, an das ich mich früher erinnern wollte.
• Gesagt: "Die Kleidung ist warm!" Gemeint: Die Kleidung hält warm.
• Gesagt: "Der Karton ist leer!" Nicht gemeint: Im Karton herrscht ein Vakuum.
• Gesagt: "Wir gehen über die Ampel!" Gemeint: Wir gehen an der Ampel über die Straße.

"Der Kunde steht im Mittelpunkt: Ich möchte Anforderungen und Kundenwünsche möglichst effizient umsetzen, damit der Kunde zufrieden ist."

Das ist eine These, die ich so oder so ähnlich von agilen Entwicklern und Teamleitern hörte, also von den untersten Ebenen der Hierarchie großer Unternehmen. Und ja, ich halte Kundenzufriedenheit auch für ein erstrebenswertes Ziel.

Konkurrierend dazu steht erstmal der wirtschaftliche Aspekt, sowie Innovation. Bei einer Entwicklungsstrategie, die primär auf Kundenwünsche eingeht, ist die Innovation vom Kunden getrieben. Konkrete Vorschläge zur Nachbesserung und Implementierungsdetails hängen von der Kreativität des Kunden ab. Diese Strategie passt zur Eingangsthese.

Das andere Extrem wäre die komplette Freiheit, die Software nach eigenen Vorstellungen zu entwickeln. Sehr konkrete Kundenwünsche werden zwar berücksichtigt, aber stehen nicht im Fokus der Entwicklung. Das Ergebnis enthält erfrischend neue Elemente, die dem Stand der Technik entsprechen. Auch hier kann der Kunde zufrieden sein, obwohl seine Wünsche sehr kreativ interpretiert wurden.

Betriebswirtschaftlich gesehen soll der Kunde gut bezahlen und langfristig Kunde bleiben. Von Monopolstellungen abgesehen kann das Ziel durch beide Innovationsstrategien erreicht werden, wahrscheinlich auch nur durch beide Strategien in sinnvoller Mischung. Kundenzufriedenheit führt zu langfristiger Bindung. Gute und innovative Produkte führen zu Weiterempfehlungen. Alle sind glücklich.

Fazit: Als Berater sehe ich die Entwicklungsabteilungen vieler Firmen. Nur wenige davon, die eine gewisse Größe erreicht haben - so um die 100 Entwickler - erhalten sich eine Firmenkultur der erfrischenden Kreativität und wagen es Neues und Unerprobtes auszuprobieren. "Mut zu eigenen Ideen" möchte ich der Eingangsthese entgegenstellen. Teamleiter, Produktmanager, Projektleiter und Geschäftsführung sollten sich der beiden extremen Innovationsstrategien bewusst sein und den richtigen Mittelweg finden.

Wie vielen Kunden wurde mir von der Telekom ISDN gekündigt. Die neue VoIP-Telefonie funktioniert am Telekom-Router Speedport W724V ironischerweise erstmal nur mit Analog- und DECT-Telefon.

Zum Anschluss eigener VoIP-Telefone gibt es nun mehrere Möglichkeiten:

1. VoIP-Telefon anstatt der Telefonie-Funktion des Routers - siehe hier: Die Registrierung geht direkt über tel.t-online.de mit dem Email-Benutzernamen und Passwort.

2. Smartphone: Die HomeTalk App der Telekom erlaubt einen gleichzeitigen Betrieb von Telefonie über Router und über die App. Off-Topic: Über die Qualität der App sage ich nur die Schlagworte Absturzgefahr und Klingelton aus den 90ern.

3. Die HomeTalk-App bietet eine SIP-Logging-Funktion, über die Zugangsdaten für die Konfiguration eines eigenen VoIP-Telefons abgelesen werden können, nämlich: Registrierung an tel.t-online.de mit User +49xxxx (eigene Telefonnummer mit +49) und Auth-Username anonymous@t-online.de. Das Passwort kann leer bleiben oder zufällig gewählt werden, z.B. ein Leerzeichen. Der STUN-Server stun.t-online.de ist optional.

Option 3 funktioniert potentiell auch über ein VPN. Warum Option 3 schlecht dokumentiert ist, bleibt ein Rätsel. Vielleicht sollen so die eigenen VoIP-Telefone verkauft werden.

Nachtrag, 26. April 2015: Die angepriesene "HD-Sprachqualität" verwendet den Codec G.722. Es lohnt sich also das VoIP-Telefon so einzustellen, dass bevorzugt G.722 verwendet wird, danach PCMA aka. aLaw aka. G.711a. Das häufig voreingestellte µLaw ist eher in den USA, Japan und anderen Ländern der Standard.

• 2 Jahre sind einfach zu lang.

• Man muss vor Vertragsabschluss wissen, wie oft und wie lange man wohin telefoniert, um den besten Tarif zu treffen.

• Datenvolumen gilt nur pro Tag oder Monat. Wenn man an einem Tag versehentlich 5 GB aufbraucht, ist die Bandbreite für den Rest des Monats unbenutzbar. Dabei wurde im Rest des Jahres praktisch kein Volumen gebraucht. Wenn ich das nur vorher gewusst hätte.

• Auslandsroaming ist absurd teuer. Auch für eingehende Gespräche. SMS und Daten genauso.

• 5 Megabyte (in Worten: fünf) sind einfach nicht mehr Zeitgemäß für Datenvolumen (im Ausland) im Jahr 2014. Auch nicht 25 oder 50.

• Überhaupt ist mir unklar, warum es eine Begrenzung für Datenvolumen und/oder Bandbreite geben muss. Die Technik steht da rum. Selbst wenn ich für deren Nutzung zahlen wollte, gäbe es keinen passenden "Tarif" für mich.

• Warum Dienste für die Ausnahme aus dem Datenvolumen zahlen dürfen halte ich für eine Verzerrung der Realität. "Das Internet"™ ist damit effektiv "Das freie (inklusive) Internet" bestehend aus wenigen Webseiten/Diensten von Großkonzernen und "Das freie Internet", zu dem wir alle Zugang haben, aber dafür bitteschön extra zahlen sollen. WTF!? Frau Merkel.

• VoIP-Dienste und eine zufällige weitere Auswahl von Diensten oder Daten ist nicht erlaubt und wird per QoS gedrosselt. Mein VPN zählt anscheinend auch dazu - zumindest manchmal.

• Eine technische Störungsmeldung scheint unmöglich zu sein.

Fazit: Bei einem Betrag zwischen 50 und 100 EUR pro Monat erwarte ich einfach mehr, als mir geboten wird. (Anbieterunabhängig)

A few months back, when the Heartbleed bug bugged everyone, I tried to find the reason for one particular server still being vulnerable despite being updated. It turned out, that Apache loaded a manually installed SPDY library with statically linked OpenSSL library. After that incident I wanted to find all other files added to the system by hand.

I wrote this little script, and then I found a neat little debian package Cruft that performs exactly that task (written in shell, but ok).

You probably know the common ini file format with [sections] and key=value pairs, e.g.

But sometimes, the ini file describes very similar sections, such as:

In order to eliminate this redundancy, qmon's ini-file parser defines macros inspired by C++ style #defines:

This kind of macro preprocessor is used in the qmon monitoring system to simplify the task of configuring the same check over and over again for each host to be monitored.

For reasons™ I needed my own setup of a temporary and anonymous email server. All it needed to do is accept all incoming emails and store them in a database. To be on the safe side, only the smallest subset of RFC 5321 and not too much unnecessary program logic were implemented. As a result, less than 300 lines of erlang code are able to receive emails just fine.

Check out tmpmail on github.

Interesting observation: A few hours after starting the server, the first scanners started spamming or rather probing. The first few emails received contained a correct 'Received' header that would ordinarily have been inserted by the receiving end. Two months later four distinct To/From combinations send probes on a regular basis from different IPs. I guess this is botnet related. Never mind.

The actual purpose of this exercise was to be able to receive emails from software during a security audit, e.g. password recovery, registration confirmation, newsletters, status emails. For short-term analysis I prefer the python-script mailsink, but tmpmail is best suitable for long-term tests and provides permanent storage.

For years I have been using Nagios and later Icinga for monitoring my few servers and services. However working the setup did not fit perfectly. What I needed was:

• monitoring for very few servers (2-3)
• live check for very few services (10-20)
• easy and straight forward configuration via terminal
• set the time/interval for each check
• directly define a command to be executed for each check
• nice web overview without too much fuzz about it and not much of an attack surface
• XMPP notifications
• nagios plugin compatibility

What I can live without: - host groups - notification groups - complicated and extensive configuration - logging - remote check execution - a daemon

Even though there are many (many many many) monitoring solutions available, most are packed with features not needed here and rather difficult to deactivate. So I decided to write a simple and slim alternative: QMON.

Das großartige Große ist hervorragend. Das mittelartige Mittel ist unscheinbar. Das kleinartige Kleine ist zurueckragend.

Good evening. For years - specifically since 2005 - the eventphone crew has been using the rather versatile software PBX Asterisk. It provides flexible scripting support, SIP trunking, mISDN and many more features desperately needed for our telephony setup. At first we connected the 4400 (proprietary PBX) to Asterisk 1.2 via mISDN1 and Cologne Chip E2 - that was around WTH 2005. For some reason, Asterisk had to be started within a 'while true' loop at the hacker event. I wonder why. As the years passed, mISDN (Linux kernel ISDN driver) and Asterisk's chan_misdn module were taking turns to being incompatible with each other. One time we happened to observe audio bit calculation errors increasing with each ISDN channel used. With 2 channels the error may not even be heard, but we had 30. Lucky for us there has always been a suitable combination of mISDN, chan_misdn and Asterisk, which worked for us. Then, a few years later Jolly renamed isdn4linux to LCR (Linux Call Router) with heavy enhancements. And LCR comes with its own Asterisk channel module chan_lcr. At the same time Asterisk's chan_misdn stopped being maintained. So we switched to the slightly more complicated but surprisingly stable setup 4400--LCR--asterisk. Although, during hacker events, the 'while true' was still in place. This year, LCR added SIP support. And the 29c3 is near. I will only add this much to the rumour mill: PoC-Apps have already been updated.

Zehn Verhaltensweisen, die mir speziell in Firmen kontraproduktiv erscheinen

1. Backup ist gut. Unverschlüsseltes Backup in der Cloud ist unverschlüsselt und in der Cloud! (Das gilt auch für den bei Apple gespeicherten Crypto-Key für deine Festplattenverschlüsselung unter MacOSX-Lion.)
2. Passwörter sind vielzählig vorhanden, für viele Online-Dienste, jeder mit seinem eigenen Passwort. Das ist umständlich, deshalb merkt man sich lieber nur ein Passwort für einen Online-Passwort-Storage-Service. Was kann da schon schief gehen?
3. Passwörter an sich nerven schon total, gerade in Kombination mit Nazi-Passwortrichtlinien: Mindestens dreiundneunzig Zeichen, mindestens jedes zweite Zeichen ein Symbol, Sonderzeichen, eine Zahl oder eine koreanische Silbe. Das Passwort muss gefühlt alle paar Tage geändert werden, aber nicht einem der letzten 1000 Passwörter ähneln und darf kein Palindrom sein. Ich persönlich nehme den Kosenamen der Katze des imaginären Nachbarn, der als Kryptologe seinen Herzschlagtakt und die Farbtemperatur der Mikrowelle mit einbezieht.
4. Biometrisches Login ist auch keine Lösung. Ich hänge an meinen Fingern und Augen.
5. Die feine Linie zwischen Internet und Intranet - in dieser Richtung - besteht aus einem Passwort, natürlich. Ein paar Vorschläge: '123456', 'Password', 'iloveyou', 'princes', 'qwerty'
6. Auch im Intranet vertrauen Webbrowser X509-Zertifikaten, die plötzlich von anderen CAs ausgestellt wurden, denen der Browser auch vertraut. Das ändert sich sicher bald - hoffentlich - wahrscheinlich - sehr bald. In der Zwischenzeit, sollten private Schlüssel nicht auf 0-8-15-Routern, Kühlschränken, Smartphones oder Microcontrollern erzeugt werden, damit der Nachbar - der alte Kryptologe - nicht zufällig den selben privaten Schlüssel generiert.
7. Skype und Java-Plugin*. Need I say more? -- * die zwei Produkte stehen hier stellvertretend für beliebige Software. Beides wird irgendwie gebraucht (?). Beides kann mehr, als es soll.
8. Interne Firmenkommunikation läuft natürlich über ICQ, Facebook, $IM-Dienst, denn das funktioniert auch privat und ist einfach zu bedienen.
9. Es gibt sinnvolle und betriebssystemübergreifende Dateiverschlüsselungssoftware. Die Windows-Only-Software AyCrypt gehört nicht dazu. (Name von der Redaktion geändert)
10. Festplattenverschlüsselung sollte nicht per Hotline abgeschaltet werden können.