certificate transparency

I went to a certificate transparency hack day at google london.

Dodgy x509 host certs really annoy me - they were a hassle when I worked on globus where we pretty much have out free host certs without any checking, to anyone who asked.

An achievable goal seemed to be to get a nagios plugin to check for certificates issued against a given hostname. I sort of have that working, with both OK/CRITICAL and a graph:

For now, the plugin is looking for certificates with the substring google in the subject name - there are plenty of such certificates in the log

When new certificates are discovered, they count as suspicious: they appear in red on the graph and the nagios notification system sends me an email. When an administrator (i.e. me) approves of the certs (by running an appropriate script), they turn into OK certificates and go green on the graph.

The underlying python code I'm using has a terribly slow ASN.1 parser, and so is only getting through a few hundred of the 2 million certs in the log every minute (see the blue line on the graph) - in a few days time hopefully it will have caught up. At least gives a pretty graph over time. In real life I'd expect a much smaller number of green certificates and hardly any/zero red certificates, as a flat line over time.

My original intention was to use this for matching domain names, but someone pointed out that it could be used to matching eg. trademark names anywhere in a certificate for some anti-phising detection.

Plenty of flaws:

• doesn't check certificate alternate names (subjAltName)
• doesn't check domain names at all
• doesn't check consistency of data coming from the log server
• doesn't deal with multiple log servers
• doesn't deal with multiple domain name probes efficiently (eg by caching or sharing download/ASN.1 decoding between domain names) - this is perhaps better implemented by using Nagios's passive plugin interface where a monitor could push interesting results (for various domains) into Nagios, rather than the present active/polling style (whichI chose because its easy to do)
• doesn't deal with unknown certificate extensions (at the moment, it ignores them which I think is sometimes the wrong behaviour - if the extension is one that authorises the use of new names (such as subjAltName does...)
• its fairly synchonous which is a bad thing for nagios probes - spending 2 days to verify the initial log is not good for a probe that should take less than 10s

Timesort

Standing at bar. Older gentleman comments how when he gets new missed calls appearing way down the missed calls list. conversation continues. After a while comments that SMSes also appear way down the list. Eventually I jokingly comment "is your clock set wrong?" to while he replies "yes- is that what's causing it?"

Mostly I find that interesting because it seems an unbelievably obvious problem if you've grown up immersed in computers, but isn't if you have different abstractions: post doesn't stack up on your doormat in the order of the clocks in your house; it stacks up in the order that normal time flows.

STV with restoration of eliminated candidates

STV eliminates candidates (and transfers their votes) until someone hits quota and win a seat. Then that winner's leftover votes are redistributed according to the next preference on those vote papers, and the process is repeated until there are no seats left to win.

One of the complaints about STV is that someone who is no ones first choice can get eliminated, even when it might turn out that they would get many second choice votes later on.

What happens if, after eliminating candidates enough times for someone to win, then in the next round those candidates are put back into the race, so can receive next-preference transfers?

It seems to make the counting process more complicated, but if you're doing this electronically, not devastatingly so. It puts candidates back in to receive transfers even if they weren't good enough to stay in the first round election.

What led me to wonder about this is some previous musing about proportional representation in the hereditary peers bit of the House of Lords, which is a bit like a stretched-out-over-time system that puts candidates back in for each seat.

shift+break

At school we had lots of BBC Micros. When I was near the start of school, these were very new indeed and almost none of the teachers or classroom helpers knew how to use them.

When you turned it on, you got a beep and a relatively unfriendly command prompt along the lines of: Acorn MOS >

To load and run the default program off a removable disk, they had a shortcut key combination: press shift+break to get that behaviour.

Easy, right? Except very few people understood instructions along the lines of "press shift and break together" to mean "depress shift and keep it depressed. Press and release Break quickly as if typing a letter. Release Shift".

So instead, minutes of pressing shift and break together, trying really hard to get them at the same time, would ensue at the start of each session until accidentally shift got pressed before the break.

ping error

Got this while pinging Google DNS from my mifi:

64 bytes from 8.8.8.8: icmp_req=302 ttl=50 time=2095 ms
64 bytes from 8.8.8.8: icmp_req=303 ttl=50 time=2107 ms
wrong data byte #52 should be 0x34 but was 0x45
#8      8 9 a b c d e f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27
#40     28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 45 0 0 54
64 bytes from 8.8.8.8: icmp_req=305 ttl=50 time=2127 ms
64 bytes from 8.8.8.8: icmp_req=316 ttl=50 time=11091 ms
64 bytes from 8.8.8.8: icmp_req=317 ttl=50 time=10083 ms

Interesting to me that i) ping is doing more checking than I thought, and ii) there are link layers around that corrupt data (rather than drop packets) in reality not just theory.

Proportional Representation in the hereditary peers section of the House of Lords

The (UK) House of Lords has 15 seats elected by the approximately 800 hereditary peers, with a lifetime appointment.

As elections only happen on a seat by seat basis as they become vacant, for example through death; and never through general elections, many electoral systems cannot apply. The present system used is AV/IRV (single seat STV).

I'm not particularly interested in reform of the way this particular bit of the House of Lords, but I started wondering how one would achieve proportional representation in such a system: where you have seats where candidates are elected for life and do not stand for re-election.

To start with, why do I think there wouldn't be PR in the system described above? Because each seat is elected individually, by the same set of electors, so whichever power bloc was dominant in those electors would win every election. (so very similar to the problem of using First-Past-The-Post in House of Commons elections). Potentially 49% of electors could form a power bloc but end up with no representation. That doesn't seem to happen too much in the lords, though - the by-elections that have taken place seem to return a few different parties, but the turnout is low (50%) and so you only need 150 of the 800 potential votes to get a seat.

Because the seats are elected one at a time, many existing PR systems can't work. But I have been pondering if such systems could be adapted to this lifetime appointment, one seat at a time model.

Some PR systems (STV and Reweighted Range Voting) operate basically as:

• Everyone starts with a vote worth 1.
• A round happens, in which a single seat is filled. Any vote which was not used to elect that seat keeps its present value. Any vote which was used to elect that seat is reweighted to a lesser value so that it will have less impact in the next round; and ranking/choice information for that elected candidate is removed from each ballot.
• Rounds are repeated until there are no free seats.

(Some other systems, such as CPO-STV, are not round-based and so not amenable to this treatment)

My idea for adapting any voting system which has that form into the Lords model is as follows:

• Everyone starts with a vote worth 1, at the initial election of the first members.
• In the initial election of first members, one round will happen for each seat (so 15 rounds)
• Subsequently only one round will happen at one time, as a seat becomes vacant.
• When a ballot is reduced in strength by a particular amount, because it was used to elect a candidate, then that reduction is recorded against the seat (so in the Lords case, 15 seats x 800 electors = 12000 numbers)
• When a by-election happens, voters are given the new choice of candidates, but retain their weakened vote strengths from the previous round (previous by-election) except that any vote fractions recorded against the now vacant seat are added onto the vote strength of each voter.
• This procedure continues forever, one round per vacant seat.

I haven't done any mathematical analysis of this. But it feels like it might give proportionality: two distinct power blocs A and B should end up with seats in proportion to their relative strengths. When an A seat comes up for election, it will release a bunch of votes to the A-bloc voters and they can elect a replacement, if 30 years later they're still in the same bloc.

How would you add this into the present system where the 15 seats are already elected? Give everyone a vote worth 1 and start as if the next by-election is the first. As time passes, more and more seats will be elected with this method until (assuming each lords is mortal) all the seats are elected this way.

It needs to store a lot of information between elections: the product of the number of seats and the number of electors. This is feasible in the above case because only about 12000 numbers need be managed. It does not seem so easy when the electorate is an entire population.

In the lords case, there are almost no new electors: the set of hereditary titles is basically fixed and vote strengths can be attached to those titles rather than to the individual with that title at any one time. In the case of changing membership, new members must be given an initial voting strength. Giving them an initial strength of 1 would mean that new members would be more powerful than existing members in their initial vote. Another approach would be to encumber their votes against the existing seats based on some kind of average so that their vote strength is released over time.

(modified with a few more notes on 2013-07-31) (modified with CPO-STV reference on 2013-08-12)

mailinator-like service for QA

We're testing email based registration validation on a project. We started by using mailinator but a few times this has failed apparently because screen-scraping an ever-evolving AJAX UI is not particularly stable.

I decided to hack something up using my trusty old linux toolset.

Make a user account, maildump.

Get sendmail running.

Turn on FEATURE(`virtusertable`) in sendmail.mc

Add @maildump.example.com maildump

Set up an apach2 virtual host to ~maildump/web/

.procmailrc:

:0
/home/maildump/process.sh

process.sh:

#!/bin/bash

FN=$(mktemp)

cat > $FN

TARGET=$(cat $FN | formail -z -x "To: " | sed 's/[^0-9a-zA-Z\@\.\-]/X/g' )

chmod a+r $FN

mv $FN /home/maildump/web/$TARGET.html
exit 0

Now I wonder what security holes this has.

5 layer NAT

in a hotel I'm staying in, looks like NAT 5 layers deep... (yes they could be just routed with a final single NAT layer...)

 1. 192.168.99.1                                                      0.0%     6    1.2  15.4   1.1  84.9  34.1
 2. 192.168.20.1                                                      0.0%     6    2.4  36.4   2.3 206.1  83.1
 3. 192.168.1.1                                                       0.0%     6    3.8  28.7   2.9 154.5  61.6
 4. 192.168.10.254                                                    0.0%     6   86.7 107.1  77.9 195.2  43.9
 5. 192.168.219.250                                                   0.0%     6   28.2  56.0  27.2 141.7  46.8
 6. 195.14.158.85                                                    16.7%     6   26.6  55.1  26.6 115.7  35.0
 7. 195.14.158.145                                                   25.0%     5   31.1  33.7  30.9  39.1   4.7

Nominet .uk proposals again...

Nominet are proposing a second consulation on their wacky plan to open up second level domains in .uk - so I could have hawaga.org.uk or cqx.uk (assuming someone didn't get there first).

They talk now about owners of existing *.*.uk domains being given first dibs.

One of my concerns is that it fragments the UK namespace - there is already a "default zone" of co.uk and so that makes me wonder if (in the long term) co.uk should be abandoned entirely, and in the mean time, the co.uk and second level uk should be the same: one registration fee gives the same name registered in both zones. If you have the .co.uk, you get the .uk. If you don't have the .co.uk, you don't get the .uk.

That at least gives a bit of an easier user explanation "a .uk is the same as .co.uk used to be"; though its still loads of technical work on the site side for people who want such domains.

And it still destroys the history of having decent information about what kind of entity you are interacting with.

game theory

We played a new wide game with our Scouts.
Each kid in a team got a number written on their hand. To take someone prisoner, you needed to have a bigger number than them, either yourself or in total as a group of captors.
One group, C, cheated and increased several of their members numbers to 8, the maximum.
However, that backfired when we made the final score for each team be the number of points of their prisoners - team C had made its members so valuable compared to everyone else that another team, B, with just three team C prisoners scored more than everyone else.
It was satisfying that punishment for cheating was built into the rules.