Holidays & Utopia

Oct. 23rd, 2014 20:53
genusshrike: Joanne from The Quiet Earth looking supremely unimpressed (bitch please)
[personal profile] genusshrike
I am back from my holiday in Port Chalmers, where I stayed with Ms Bird and her GF. And had a lovely time. It turns out what I really want in a holiday is to hang out on the beach and look at cool rocks and read and watch classy TV shows like Pokemon (not that much Pokemon).

Now I am back home and I don't have to go back to work till next Tuesday. Yay!


Season 1 of Utopia )

Israeli politics

Oct. 23rd, 2014 10:55
hagar_972: woman with a laptop at a rocky shore looking at the ocean (Default)
[personal profile] hagar_972
*sigh* The riots in J-m haven't really died down since summer - the light rail is being stoned daily, among other things - and they took a sharp uptick after yesterday's events. It's pretty much an Actual Intifada in J-m, and though the police has been doing pretty good at keeping the flames low, I don't think this one's going back in the bottle.

Meanwhile, Bennet is threatening to quit the coalition (and take the government apart) if Netanyahu stops building in East Jerusalem.

Linux Container Security

Oct. 23rd, 2014 08:44
[personal profile] mjg59
First, read these slides. Done? Good.

Hypervisors present a smaller attack surface than containers. This is somewhat mitigated in containers by using seccomp, selinux and restricting capabilities in order to reduce the number of kernel entry points that untrusted code can touch, but even so there is simply a greater quantity of privileged code available to untrusted apps in a container environment when compared to a hypervisor environment[1].

Does this mean containers provide reduced security? That's an arguable point. In the event of a new kernel vulnerability, container-based deployments merely need to upgrade the kernel on the host and restart all the containers. Full VMs need to upgrade the kernel in each individual image, which takes longer and may be delayed due to the additional disruption. In the event of a flaw in some remotely accessible code running in your image, an attacker's ability to cause further damage may be restricted by the existing seccomp and capabilities configuration in a container. They may be able to escalate to a more privileged user in a full VM.

I'm not really compelled by either of these arguments. Both argue that the security of your container is improved, but in almost all cases exploiting these vulnerabilities would require that an attacker already be able to run arbitrary code in your container. Many container deployments are task-specific rather than running a full system, and in that case your attacker is already able to compromise pretty much everything within the container. The argument's stronger in the Virtual Private Server case, but there you're trading that off against losing some other security features - sure, you're deploying seccomp, but you can't use selinux inside your container, because the policy isn't per-namespace[2].

So that seems like kind of a wash - there's maybe marginal increases in practical security for certain kinds of deployment, and perhaps marginal decreases for others. We end up coming back to the attack surface, and it seems inevitable that that's always going to be larger in container environments. The question is, does it matter? If the larger attack surface still only results in one more vulnerability per thousand years, you probably don't care. The aim isn't to get containers to the same level of security as hypervisors, it's to get them close enough that the difference doesn't matter.

I don't think we're there yet. Searching the kernel for bugs triggered by Trinity shows plenty of cases where the kernel screws up from unprivileged input[3]. A sufficiently strong seccomp policy plus tight restrictions on the ability of a container to touch /proc, /sys and /dev helps a lot here, but it's not full coverage. The presentation I linked to at the top of this post suggests using the grsec patches - these will tend to mitigate several (but not all) kernel vulnerabilities, but there's tradeoffs in (a) ease of management (having to build your own kernels) and (b) performance (several of the grsec options reduce performance).

But this isn't intended as a complaint. Or, rather, it is, just not about security. I suspect containers can be made sufficiently secure that the attack surface size doesn't matter. But who's going to do that work? As mentioned, modern container deployment tools make use of a number of kernel security features. But there's been something of a dearth of contributions from the companies who sell container-based services. Meaningful work here would include things like:

  • Strong auditing and aggressive fuzzing of containers under realistic configurations
  • Support for meaningful nesting of Linux Security Modules in namespaces
  • Introspection of container state and (more difficult) the host OS itself in order to identify compromises

These aren't easy jobs, but they're important, and I'm hoping that the lack of obvious development in areas like this is merely a symptom of the youth of the technology rather than a lack of meaningful desire to make things better. But until things improve, it's going to be far too easy to write containers off as a "convenient, cheap, secure: choose two" tradeoff. That's not a winning strategy.

[1] Companies using hypervisors! Audit your qemu setup to ensure that you're not providing more emulated hardware than necessary to your guests. If you're using KVM, ensure that you're using sVirt (either selinux or apparmor backed) in order to restrict qemu's privileges.
[2] There's apparently some support for loading per-namespace Apparmor policies, but that means that the process is no longer confined by the sVirt policy
[3] To be fair, last time I ran Trinity under Docker under a VM, it ended up killing my host. Glass houses, etc.

(no subject)

Oct. 23rd, 2014 09:32
oursin: Brush the Wandering Hedgehog by the fire (Default)
[personal profile] oursin
Happy birthday, [personal profile] chalcedony_cat, [personal profile] diony, and [personal profile] em_h!

Children's Books on Death

Oct. 23rd, 2014 01:15
ysabetwordsmith: Cartoon of me in Wordsmith persona (Default)
[personal profile] ysabetwordsmith
Here are some children's books about death. This season is a good time to open a topic that everyone needs to know about, in ways that are not too scary.

One of my favorites is The Hobbit. It's not primarily about death, but it has a lot of very thoughtful ideas about mortality and the utter foolishness of war. Among my best-loved bits is the parting between Thorin and Bilbo:

"Farewell, good thief," he said. "I go now to the halls of waiting to sit beside my fathers, until the world is renewed. Since I leave now all gold and silver, and go where it is of little worth, I wish to part in friendship from you, and I would take back my words and deeds at the Gate."

"There is more in you of good than you know, child of the kindly West. Some courage and some wisdom, blended in measure. If more of us valued food and cheer and song above hoarded gold, it would be a merrier world. But sad or merry, I must leave it now. Farewell!"

-- Thorin Oakenshield in The Hobbit by J.R.R. Tolkien

muccamukk: Rose half hiding behind her scarf, looking hopeful.Text: "Pretty please?" (DW: Please?)
[personal profile] muccamukk in [community profile] femslashex
Could everyone please check the e-mails on all their accounts? We still have one assignment that has been posted to the community but not linked to the recipient (as well as other issues). Mods have tried leaving comments on the work and e-mailing the listed contact info, but have not heard back. If it's possible that this is your sock using an e-mail you don't regularly check, could you look it up and get back to us? Alternately, check for comments on your posted assignment.

Thank you for your time.

Otherwise, fest is on schedule, and we're still expecting it to open Friday at 5pm (PDT).

More Elementary

Oct. 23rd, 2014 16:48
kerravonsen: "Are you challenging my ingenuity?" (ingenuity)
[personal profile] kerravonsen
It's interesting to compare Elementary and Sherlock; they are both good, but both quite different. Sherlock is basically AU fanfic set in the modern day; that is, it takes the characters and the plots and translates them into a universe where they take place in the modern day; some of the plots closer than others, but the characters very close to the spirit of the original; not just Holmes and Watson, but Le Strade, Mrs Hudson, Mycroft, Moriarty, Irene Adler...
Elementary, by contrast, is much more of an "inspired by"; it takes the original concept of a brilliant observant detective and his doctor sidekick, and runs with it into uncharted territory. In that way, it's much more of its own show, and needs to be judged on its own merits, not on its merits as Sherlock Holmes fanfic. That makes the two shows quite different beasties.

I've now seen six episodes of Elementary, and am still enjoying it: intriguing mysteries mixed well with good characterisation; I love how both Watson and Holmes make insightful observations about the other, observations that can be painful in their accuracy. As I said, good characterisation.
Alas (alas?) now that I've seen six episodes and sat back and thought a little, it has happened: I have discerned patterns in the plots, and thus they may well end up becoming more predictable.
spoilers will be MURDERED )
Still, I don't think that will prevent me from enjoying it.

On the magic of cities

Oct. 23rd, 2014 06:00
[syndicated profile] terriwindling_feed

Posted by Terri Windling

The New Yorker, 1925

In response to a post last week, Raquel Somatra wrote:

"I lived on a mountain in North Carolina for six months with no car. The nearest grocery store was 1.5 miles away. Down the mountain, over several hills, through a dark tunnel, passed the old hotel that still has a sign that says 'now with color TV!'... People always think it must have been such a horrific time, to walk to the store once or twice a week and carry home groceries. But I loved it.....There is something about motion and pilgrimage that magically and deeply connects us to ourselves, to our insides, and to the earth. I think I got to know that landscape more in six months than locals who had lived their whole lives there. I knew where you could find pairs of bunnies in the spring, where the robins liked to feast along the ends of the roads, where wild roses grew, that tiny, wild pansies grew everywhere, fairy flowers hidden in the grasses. What else is there than connection to the land, ourselves, and each other? We must do this slowly -- I agree with Rebecca [Solnit]. Our minds move as slow as our feet, there can be no other way.

"p.s. I was thrilled to find that here in Brooklyn, I make a similar journey with groceries. There aren't mountains and pansies, but there are wondrous sights and people, a train, and much, much walking."

The post below comes out of thoughts prompted by Raquel's comment, and I want to begin by acknowledging that debt.

The New Yorker

Despite the bucolic nature of this blog, written as it is from the English countryside, I think the words of the various writers quoted in these pages -- attesting to the importance of "land" and "place" -- are useful reminders to all of us, no matter where we live, that our aim should be to fully live wherever it is we find ourselves. As Mary Oliver tell us in beautiful poems that repeatedly enjoin us to pay attention, living a creative life is not just about the novels or paintings we produce (let alone manage to publish or sell), it's about living in a state of openness and attention -- beginning  with the ground on which we stand: its flora, folklore, mythology, history, its weather patterns and daily rhythms, and the lives of those with whom we share with, human and nonhuman alike.  This is as true, I believe, for city, town, and suburb dwellers as it is for me here, in rural Devon.

The "Urban Fantasy" field, back when it began in the 1980s and '90s -- when the term referred to works by writers like Charles de Lint, Emma Bull, Francesca Lia Block and Neil Gaiman, not paranormal romance and detective stories --  had at its heart a metaphorical search for wonder and natural (rather than supernatural) magic in city settings. These writers were asserting that one needn't travel to imaginary lands, the medieval past, or even to the countryside to find a magical (dare I say "spiritual"?) connection to place: it was available to all...yes, even at the heart of the beast: the big, noisy, crowded, diverse, dangerous, exciting modern city. (And remember that these writers began working in the '80s, when urban decline rendered many cities far less appealing than they are today.) Charles' Newford, Emma's Minneapolis, Francesca's Los Angeles, and Neil's London are cities in which the mythopoeic history of the land has re-asserted itself. The human protagonists of their books are those who hunger, in one way or another, to find that connection...and then to use it in concert with the unique gifts that cities alone can offer.

The New Yorker, 2014 & 2006

As Raquel says in her post script above, a city traversed on foot can be just as creatively inspiring as a woodland path or shoreline trail, at least for those open to its rhythms; for those who are paying attention. The following passage on urban walking comes from Rebecca Solnit's Wanderlust: A History of Walking, which devotes several chapters to the subject. To me, as a former New Yorker, this description of "city magic" rings absolutely true:

"There is a subtle state most urban walkers know, a sort of basking in solitude -- a dark solitude punctuated with encounters as the night sky is punctuated with stars -- one is altogether outside society, so solitude has a sensible geographical explanation, and there is a kind of communion with the nonhuman. In the city, one is alone because the world is made up of strangers, and to be a stranger surrounded by strangers, to walk along silently bearing one's secrets and imagining those of the people one passes, is among the starkest of luxuries. This uncharted identity with its illimitable possibilities is one of the distinctive qualities of urban living, a liberatory state for those who come to emancipate themselves from family and community expectation, to experiment with subculture and identity. It is an observer's state, cool, withdrawn, with senses sharpened, a good state for anybody who needs to reflect or create. In small doses, melancholy, alienation, and introspection are among life's most refined pleasures.

"Not long ago I heard the singer and poet Patti Smith answer a radio interviewer's questions about what she did to prepare for her performances onstage with, 'I would roam the streets for a few hours.' With that brief comment, she summoned up her own outlaw romanticism and the way such walking might toughen and sharpen the sensibility, wrap one in an isolation out of which might come songs fierce enough, words sharp enough, to break that musing silence. Probably roaming the streets didn't work so well in a lot of American cities, where the hotel was moated by a parking lot surrounded by six-lane roads without sidewalks, but she spoke as a New Yorker.

The New Yorker

"Speaking as a Londoner, Virginia Woolf described anonymity as a fine and desirable thing, in her 1930 essay 'Street Haunting.' Daughter of the great alpinist Leslie Stephen, she had once declared to a friend, 'How could I think mountains and climbing romantic? Wasn't I brought up with alpenstocks in my nursery and a raised map of the Alps, showing every peak my father had climbed? Of course, London and the marshes are the places I like best.' Woolf wrote of the confining oppression of one's own identity, of the way the objects in one's home 'enforce the memories of our experience.' And so she set out to buy a pencil in a city where safety and propriety were no longer considerations for a no-longer-young woman on a winter evening [as they had been previously], and in recounting -- or inventing -- her journey, wrote one of the great essays on urban walking."

You can read Woolf's brilliant essay here.

Georgia O'keeffe

Detail from New York Street With Moon by Georgia O'KeefeArt above: Covers from my favorite magazine, The New Yorker, 1925-2014 (I maintain a print subscription here in Devon), and the glorious New York paintings of Georgia O'Keeffe (1887-1986). I highly recommend Patti Smith's book Just Kids, a memoir of her youth in New York with Robert Mapplethorpe -- as well as works by all of the fine writers mentioned above. Previous posts related to this subject are here and here.

Ah Me, Life.

Oct. 23rd, 2014 16:13
splodgenoodles: (Default)
[personal profile] splodgenoodles
Here I am having one of those afternoons I crave, in which there are no demands or great stressors, and my health is steady enough, so theoretically I should be able to engage in a few things I *wish* to do.

Man, having choice over what one does with one's time is really quite burdensome, isn't it? I'm useless without a to-do list, useless without a deadline.

And this is in spite of the fact that these days I do have quite a stable(but realistic) daily plan that requires little mental effort and keeps me presentable.

Promises, promises

Oct. 22nd, 2014 23:33
pinesandmaples: Text only; reads "Not everything will be okay, but some things will." (art: everything)
[personal profile] pinesandmaples
A) I am job hunting in serious ways. This is scary and serious and awesome.

B) I do not exist on LinkedIn. Do I need to exist on LinkedIn?

C) Do you know of an amazing job for someone with fundraising, volunteer management, logistics, and event management experience? How about a position focused on worship and the work of sacred spaces? No geographic limits.
taiga13: by jackshoemaker (Little Red Riding Hood)
[personal profile] taiga13 in [community profile] poetry
 Here is consequence, folding its wings
on the fence. Here are your chances. After years
of moving whatever you do
from one place to another in the manner
that constitutes your work, you have to admit
you know what you think. About tonight
not so much fallen as struggling to its feet, gorgeous
in spite of what it's done to you. All
is forgiven. The loneliness composed on the road, after hours,
off-shift, out of it, or left behind, the vindictive
clairvoyance of local law enforcement, protracted
incidents represented by lacunae in your resume,
strategic negotiations pursuant to the project
of getting the fuck out of there, or making
the best of being stuck where you were,
in those rooms now creaking in a forest of outlived rooms
recalled as eras are recalled, their outmoded fixtures
and period costumes, motes afloat
in parallelograms of windowlight. Who are you?
What of you persists? Your life is built on intervals
the way a chord is, on changes that alter you
by thirds, by fifths, in silences the progression climbs
to where each song ends, and the next begins.

There's analysis of the poem here.

Q&A silliness

Oct. 23rd, 2014 00:15
thnidu: Oh, noes! (LJ icon) You are in a maze of twisty little LJ entries (check one): All different \ All alike. lj:redaxe (mazeoftwistylittleljentries)
[personal profile] thnidu
I enjoy reading Quora and answering questions in areas I'm knowledgeable about, but sometimes ...


I'm a billionaire IT entrepreneur, and I have secret information that makes me certain an alien base is present on the Moon, threatening the very existence of humankind.

However, after checking with my connections in the US government, it is clear to me they won't believe my proofs and they may even try to stop me. They may believe that I'm a lunatic.

In such situation, what should I do to actually destroy the danger? Let's say I can leverage about 25 billion dollars. My deadline is 5 years from now on.

Extremely detailed, apparently serious answer:
With $25 billion, you have many options that would allow you to pursue your mission without interference from the U.S. government. However, here's how I'd go about it.

First, invest a minimum of $75k into Brazil to obtain residency. Boom. You're now a permanent resident of Brazil and protected by a sovereign government, one that has a developed space agency ...


$11.774 billion

Hey, we're still in the black! Plenty of breathing room in case my estimates were way off (probably), or if you want to build more weapons platforms for maximum alien destruction ($1.8 billion each, to include launches).

As for the mission specifics, I think you could get your LRO built and to the Moon 3 years from starting out. This should give you plenty of time to collect data on the base and work out your attack plan.

After that, I'm guessing that your weapons will be ready about 4 years from starting out, with each taking several months to assemble in orbit. From there, it only takes four days to get to the moon, so you should be able to get your kinetic strike weapons in place within the 5 year window - but it will be tight, especially if you launch/assemble additional platforms.

My answer:

A very good sfnal answer:
Psychohistoric evidences say that this base will disappear sooner or later, as it doesn't exist at the time the Second Foundation is established. Although there exists a theoretical possibility it was you who cleared the Moon, the probability is small (bayesian psychohistorical algorithms give it 0.00001%)

[syndicated profile] zarhooie_tumblr_feed





Also one time he was supposed to write a violin and piano duet, and he wrote the violin part, but he didn’t really feel like writing the piano part, or was too lazy etc. When the concert came up (he played the piano while a fiend played the violin) he set up a blank piece of paper (so people would think he was reading music) and improvised. After the concert he wrote it down so it could be published

okay i’ve reblogged this before but can we just give a shoutout to the orchestra that had to sightread the overture to an audience at the premiere of an opera

la la la...

Oct. 23rd, 2014 17:01
china_shop: text icon that says "age shall not weary her, nor custom stale her infinite squee" (age shall not weary her)
[personal profile] china_shop
Having visitors this weekend, but taking a break from cleaning to say:

- Flat 3 is a New Zealand webseries about three women flatting together in Auckland. Funny, well-scripted and -characterised. Episodes are mostly ~7 min long.

- The Boxtrolls was beeeyewtiful.

- Kim Sam Soooooooooon!

Prompt for 2014-10-23

Oct. 23rd, 2014 11:47
sacredporn: Kris Allen icon made by Sacred Porn (Default)
[personal profile] sacredporn in [community profile] dailyprompt
Today's prompt is "I will trade my life for his".


piranha: stylized white figure lifting a red barbell with weights (Default)
renaissance poisson

July 2014

6789 101112

Most Popular Tags

Expand Cut Tags

No cut tags