Category Archives: Allgemeines / Meinungen

Hinweise (und Auffangbecken) zu diesem Blog und persönliche Meinungen des Betreibers

New year – new operative system for desktops and laptops?

Posted on by

Some readers have noticed that I seldom write in this blog – at least compared to certain periods before 2023. One reason for this has been and is: Linux – in my case Opensuse Leap 15.x – has just worked well for me up to this very day. Small glitches, but on average Leap 15 and its subversions have always fulfilled my needs and requirements. (Another reason is that after retirement, I got more interested in math, physics, ML and politics.)

However, I also have to say that my private needs have become very limited. Significantly fewer server components due to a removal of LAMP/Postgre-SQL/JS/JQuery and Kolab stacks and keeping only a minimum of LDAP services. Only some virtualization for server-based mail services. Actually, I have become a desktop user, sometimes using a Python/CUDA stack for local Machine Learning experiments. Aside of mail services, my own servers have become simple data containers. And the few requirements some remaining customers of my wife have with respect to their web-installations do not require full-fledged development stacks.

Now, as a pure desktop user, I am approaching a point (EOL of Leap 15.6) at which I seriously have to decide whether I should turn to Opensuse Leap 16 or move to a completely different distribution as Debian.

The reason is that Leap 16 comes with a lot of fundamental changes and a significant reduction of supported application packages. A new installer (Agama), no Yast any longer, the container-based ALP-system mixed with RPMs, confusion about immutability and BTRFS, Myrlyn as an interface to package management, SE-Linux instead of Apparmor, no support for older Nvidia cards, Agama installer (according to some users) not fully working with Luks and LVM, … Well, what I read smells like a bunch of potential problems.

Regarding ALP and containers, I have used some applications like Blender for a long while now with Snap and/or Flatpak – and was always shocked about the additional disk space requirements. So, I am very skeptical regarding this aspect. It may be suited for Cloud based services – but for local installations in an environment with a mixture of desktop systems and small servers? The question is whether and in which form ALP affects small file server installations.

Aside of ALP, what is my present strategy regarding my desktops and laptops?

I will give Leap 16 a chance. As a fist step, I will install it freshly on an external USB disks for my various systems and see what the installation leads to. I will start with a mutable version for desktop usage. One objective is to install Leap 16 with multiple partitions, all encrypted with LUKS and, of course, using LVM. For desktop systems with relatively new Nvidia cards I expect full support (including CUDA).

As for an old Optimus laptop which has an Nvidia card that requires the version 470 Nvidia drivers, I will probably have to accept that its card is no longer supported. So, I will have to see how far one gets on such a system with the Nouveau driver and a Noveau-adapted version of prime-select. I hope that Blender runs with reasonable performance even on these systems. If everything works as expected, I will start with an upgrade of the existing 15.6 installations on desktops and laptops.

If I, however, run into serious trouble, I will definitely switch to Debian. Debian is my preferred alternative, based on very good experiences with Debian on servers and Kali Linux on KVM virtualized desktops.

The decision to keep Leap or not may depend on the kind of system and their age.

I will report about my experiences during February. So, stay tuned …

MS, the present attack on central MS systems – and the Bundeswehr

Posted on by

Some days ago I set up a list of questions regarding the Bundeswehr Leak of last week. During my discussion I touched the question that the BWI had praised its rollout of MS-based email-systems and Sharepoint platforms in large scale within the BW after Oct., 2021. Ironically I asked the question how the CCC would comment on this implementation of “notoriously insecure systems”.

Well, we do not need to ask the CCC any more. Yesterday, MS itself and the press informed the public once again that central key systems of Microsoft in the US are under attack. Probably a Russian hacker group is responsible. Actually, the present hacker activities continue and escalate an attack that already started in November 2023. It seems to be a fact that information gathered from core and central email systems is now abused systematically. Apparently, these emails have been stolen from executives and security staff. See also the article in the Washington Post about this topic.

You find more information at the following resources:

https://edition.cnn.com/ 2024/03/08/ tech/ microsoft-russia-hack/ index.html

https://abcnews.go.com/ International/ microsoft-russian-state-backed-hack-update/story ?id=107927553

https://www.reuters.com/ technology/ cybersecurity/ microsoft-says-cyber-threat-actor-has-been-able-access-internal-systems-2024-03-08/

https://www.washingtonpost.com/ technology/ 2024/03/08/ microsoft-hack-email-russia/

I hope that responsible managers at the BMVg or BWI read some of these information channels, too. And take notice of the comments of security officers of Sentinel One and CrowdStrike cited in the articles. And afterward reevaluate whether the broad rollout of MS-systems in the Bundeswehr really is a success story.

 

After the Bundeswehr Leak and the explanation of the Minister of Defense – some more questions …

Posted on by

Today I heard the explanation of the German Minister of Defense regarding the probable cause of the leak of last Friday. What I understood was:

  • WebEx is hosted in a special variant (WebEx BWI) on servers of the Bundeswehr.
  • Clear rules are in place, but were not followed. One participant attended the WebEx session via telephone.
  • Systems were not compromised.

Are these explanations sufficient? Do they cover all concerns described in my previous post
“Some simple questions after the Bundeswehr Leak …”
on this topic?

In my opinion some questions remained open:

  • Why and by whom was the WebEx session set up such that a participant could access it via telephone at all? With a zero-trust and MLS-based session this should have been excluded …
  • Did the participants get an invitation with an option that offered an access to the session via telephone? If yes: Who sent this information via which channels? Is it excluded that already the invitation was accessible to foreign powers?
  • Why did nobody check by which devices and communication channels the participants were attending the session? At the beginning and during the session? Why did a log- and intrusion system not react?
  • Why did none of the other participants react to the fact that the poor guy in Singapore talked over telephone? Despite the clear rules in place …
  • How did the eavesdropping happen? Were the telephone lines of the hotel tapped? Or did the participant use a wireless headset with Bluetooth?

So, if it was a human failure it may have happened due to mistakes and unawareness on multiple sides – on the side of IT-administrators responsible for the session setup, on the side of the person which sent the respective invitation, on the side of the participant who did not use a BWI- or SINA-device to access the session.

Well, and I would say that when a session running through servers of the Bundeswehr was overheard by Russia, at least the session was compromised. And if someone can access an audio-session, which is enabled by and via a Bundeswehr server and which is intended to be secure, via an open telephone line then something is severely wrong in the overall security measures.

So, my dear Minister, as a concerned citizen I still do not sleep well. More explanations have to follow …

 

Some simple questions after the Bundeswehr Leak ….

Posted on by

I am following the present discussion about the leak of a communication between some generals of the German Air Defense from abroad. It really feels extremely embarrassing that the Russians could overhear a communication of high-ranked German army officers. And I do not know how to answer questions of retired Norwegian IT-specialists (of my age) here in the north of Europe … With German troops participating right now in huge Nato maneuvers in northern Norway. And believe me I have often criticized my Norwegian friends for a lack of IT-security awareness, in particular regarding the use of Microsoft and Zoom. And now this disaster in my home country …

From my point of view establishing a formal Untersuchungsausschuss (investigation committee) of the German parliament is only one of the necessary steps required to clarify what has happened. But it is an important one, together with internal and technical investigations within the Bundeswehr.

In this post I want to ask some simple questions which, in my opinion, should be answered. Any IT-guy having worked with or for public governmental institutions in Europe could ask them. None of the links I give below is classified.

Why WebEx at all?

The first point in all the TV and newspaper discussions is that there seems to be no doubt that the communication is authentic and that WebEx was used. Now, anyone with a basic idea about information security would ask the following question:

Why for heavens sake did the German officers use Webex at all? A product of Cisco, i.e. of a commercial US company? With published security problems during the Corona years? Why does the German military not have its own security protocols and measures in place?

Well, we and the US are allies, but … Yeah, but, … and Trump on the horizon.

It is a German company, “Secunet”, who has developed mobile systems (SINA workstations) compliant with for NATO certifications on different levels of security. See e.g.:
https://www.secunet.com/ loesungen/ sina-workstation-s
https://www.ia.nato.int/ niapc/ Product/ SINA-Workstation-S_730
https://www.bundeswehr-journal.de/2020/mehr-als-6000-geraete-sina-workstation-s-fuer-die-bundeswehr/
https://www.secunet.com/ueber-uns/presse/artikel/sicheres-mobiles-arbeiten-bwi-beschafft-sina-workstations-s-fuer-die-bundeswehr
https://www.secunet.com/ueber-uns/presse/artikel/secunet-beliefert-die-bundeswehr-mit-sina-sicherheitstechnologie-fuer-schnelle-eingreiftruppe-der-nato

These systems were bought by the Bundeswehr in relatively large quantities.

So, my first two open question are:

  • Why was WebEx used at all? Did the generals not have SINA-workstations available? If they had not, why not?
  • Under what conditions is the usage of WebEx regarded secure by the the responsible IT-specialists of the Bundeswehr?

Actually, the answer to the second question may not be independent of the answer to the first one … as WebEx may be hosted on servers of the Bundeswehr.

Addendum, 05.03.2024: Another point which comes up during TV discussions is that some “experts” say there is reason to believe that the WebEx-session was set up without any end-to-end-encryption. This is really implausible. What is more plausible is that the session was set up with standard encryption and Cisco’s standard management of encryption keys. And maybe – due to mistakes – with allowance for some participants to use a telephone. Making the session insecure again …

A success message of the BWI of 2021 regarding the rollout of Cisco’s WebEx in the Bundeswehr

What did we read in 2021 as a success message regarding the digitalization of the German defense and public institutions?

” … Zusammen und in Echtzeit an Dokumenten arbeiten, E-Mails austauschen, gemeinsame Termine planen, Webkonferenzen mit und ohne Video abhalten, chatten und telefonieren – wenn alle Services komplett ausgerollt sind, ermöglicht Groupware Bw dies auf einer einheitlichen technischen Plattform und über alle zivilen und militärischen Bereiche hinweg. Die BWI startete am 1. Oktober den Rollout mit den Produkten Cisco Jabber und Webex. In einem zweiten Schritt werden im kommenden Jahr auch die Services E-Mail und Enterprise Content Management mit Microsoft Outlook und SharePoint ausgerollt.”

See: https://www.bwi.de/ magazin /artikel/ groupware-bw-bei-der-bundeswehr-perfekt-vernetzt-von-chat-bis-videokonferenz

Even without translation the combination of tools praised here would make a security aware person more than nervous. And one can only hope that the introduction of these systems only concerns the civil sector of the Bundeswehr. If not, well, … just ask the CCC what they would think of it.

Continue reading →

Eine Schande für den Standort Deutschland – Chefredakteur von Welt und Nachrichtenkanälen stellt “Wissenschaft” in Frage

Posted on by

Mal wieder ein Thema außerhalb von Linux. Aber als ausgebildeter Physiker und früherer professioneller IT-Berater kann ich meinen deutschen Lesern das Folgende nicht ersparen. Ein Erlebnis am gestrigen Abend regt mich nach wie vor zu sehr auf. U.a. weil ich mir selbst als Rentner zunehmend Sorgen um den Standort Deutschland mache.

Gestern Abend haben meine (norwegische) Frau und ich uns zunächst eine skandinavisch-amerikanische Dokumentation im schwedischen Fernsehen über den verheerenden Einfluss von Evangelikalen und Kreationisten auf die US-Politik angesehen. Viele der dort vorgestellten Leute leugnen ja öffentlich wissenschaftliche Erkenntnisse und sind Anhänger von sog. “alternativen Fakten”. Da lehnt man sich als aufgeklärter Europäer gerne zurück und denkt: Kann bei uns nicht in diesem Umfang passieren. Wissenschaftsfeinde und Klimawandel-Leugner findet man höchstens im Umfeld der überwiegend rechtsextremen AFD und deren Wählerschaft.

Danach sahen wir uns in der ARD eine Ausgabe von Maischberger an und wurden direkt eines Besseren belehrt. Da saß ein entrückt und arrogant wirkender Stefan Aust am Diskussionstisch und erklärte gegen Ende der Sendung den Klimawandel und entsprechende Maßnahmen schlicht für Unsinn. Auf Rückfrage erklärt er ferner explizit, dass er Wissenschaft (offenbar grundsätzlich) in Frage stelle.

Ich dachte zunächst, ich höre nicht richtig.

Das alles übrigens nach einem ersten Teil der Sendung, die von Austs Forderung nach Verhandlungen von Amerika mit Putin zur Ukraine – über die Regierung der Ukraine hinweg – geprägt wurde. (Addendum, 16.02.2024: Vielleicht fängt auch ein Aust nach der Ermordung von Navalny mal an, tiefer darüber nachzudenken, mit welchen Menschen man sinnvoll verhandeln kann …)

Nun ist dieser Mann nicht irgendwer. Er war über lange Jahre Herausgeber des Spiegel (meine Generation erinnert sich auch an einen noch wilderen Aust vor der Zeit beim Spiegel, als er dezidiert linke Themen für seinen journalistischen Aufstieg nutzte). Heute ist er Herausgeber der Welt und Chefredakteur bei den politisch konservativen bis rechten Medienkanälen der “Welt 24 Gruppe”. (Ein echter Wendehals, dieser Aust!) Die genannten Nachrichtenkanäle sind in vielen Basispaketen für das Fernsehen enthalten (u.a. bei Vodafone). Zudem auch im Ausland, z.B. in Norwegen und Schweden. Die Reichweite dieser Medien und Ihres Chefredakteurs ist entsprechend groß.

Tja, so weit ist es also gekommen in Deutschland. Ich habe beide genannten Sendungen im Ausland gesehen. Die bei uns anwesenden Norweger, die gut Deutsch verstehen, mussten auch erstmal schlucken und rieben sich ungläubig die Augen. Was für eine Schande für den Forschungs- und Industriestandort Deutschland! Was für ein unmögliches Bild von Deutschland wird durch solche Auftritte führender deutscher Redakteure kreiert. Ich warte schon auf die süffisanten Kommentare von weiteren norwegischen Freunden, die die Entwicklungen in Deutschland aufmerksam verfolgen.

Leute, wir waren mal das Land der Dichter, Denker und Wissenschaft. Aber bei solchen Meinungsmachern wie Hrn. Aust ist es kein Wunder, dass wir in Deutschland in allen relevanten Zukunftstechnologien zurückfallen. Und das der Wert von Wissenschaft von Demokratiefeinden in Frage gestellt wird …

Wer Wissenschaft grundsätzlich in Frage stellt, darf sich ferner nicht wundern, wenn er und die von ihm mitgelenkten Medien in den Verdacht geraten, “alternative Fakten” zu glauben und zu verbreiten. Die Aufsichtsgremien der genannten Mediengruppe sollte sich mal fragen, was für Menschen in der Rolle von Chefredakteuren sie der deutschen Bevölkerung eigentlich zumuten wollen. Ich halte mich für wertkonservativ – aber Welt, N24 etc. werden durch Leute wie Aust zur “No Go and No Trust Area”.

Und bei Kritik an Verantwortlichen für Fake News in Amerika sollten wir uns etwas zurückhalten und zunächst vor unserer eigenen Haustüre in Deutschland das Kehren anfangen.