innismir.net

I am a big fan of Prelude IDS to correlate reports from my honeypot/nepenthes/snort setup at my house. One of the things that was quite repetitive was finding the locations of IPs. So, I sat down and coded up a patch that grafted GeoIP onto Prelude’s Prewikka web interface. After a bit of effort figuring out Python and the template engine, I ended up with this:

Of course, my patch doesn’t blur out the names like the screenshot, but it does add the spiffy little flags to show you what countries are attacking you.

You will need:

• A working GeoIP installation
• The GeoIP Python module
• A set of flag icons in PNG format. I recommend FamFamFam’s icons
• My patch
• Prewikka 0.9.14 source tree.

The GeoIP libraries are available from the link above. Installing them is pretty straightforward. Once that is done, untar the Prewikka tarball and apply the patch for Prewikka in the source directory. Then install as normal.

Unzip the flags archive somewhere on your system. Move the contents “png” directory to your web root under the folder “/images/flags”. You may need to make an adjustment to your Apache installation if Prewikka is running in the root web directory like I had to. I made an alias in my Apache configuration pointing /images/ back over to /var/www/images.

Alias /images/ /var/www/images/

With any luck, it should work. As always, your mileage may vary.

Share and enjoy!

Stacy Thayer, one of the Security Twits that I follow, posted a blog entry regarding an encounter she had with some neanderthal at RSA 2008. Quite frankly, it made me shake my head. The idea of judging someone’s knowledge based on their body parts is far too common in some technical circles, and what drives me nuts is that it often happens to people who tout the “hacker ethic”.

As a brief side, the Hacker Ethic was a term coined by Steven Levy in his excellent book Hackers: Heroes of the Computer Revolution (If you haven’t read this book and are involved in IT, click the link and order it. Now. Go ahead, we’ll wait. Back? Cool.). One of the key points that I always feel is one of the great equalizers in computers is the fact that people are often accepted by their knowledge, rather then their position or their alphabet soup after their name. (However, they are not mutually exclusive)

HACKERS SHOULD BE JUDGED BY THEIR HACKING, NOT BOGUS CRITERIA
SUCH AS DEGREES, AGE, RACE, OR POSITION.

The ready acceptance of twelve-year-old Peter Deutsch in the TX-0 community (though not by non-hacker graduate students) was a good example. Likewise, people who trotted in with seemingly impressive credentials were not taken seriously until they proved themselves at the console of a computer. This meritocratic trait was not necessarily rooted in the inherent goodness of hacker hearts–it was mainly that hackers cared less about someone’s superficial characteristics than they did about his potential to advance the general state of hacking, to create new programs to
admire, to talk about that new feature in the system.

This is often a very common theme technical circles. Unless, of course, you seem to of the female persuasion at which point it seems to be thrown out the window. I really experienced this in college. The handful of women in our classes were leered at, harassed, and generally made uncomfortable by some of our more “vocal” geeks who probably thought that it was some part of the mating ritual. To be 100% honest, I was dismissive of some of them until I came to the conclusion they could hold their own. Since then, I’ve had the pleasure to meet and work with some talented women, some of who can kick my ass technically.

The computer industry is very male dominated. Conferences have booth babes and the likes of Vanna Vinyl, which I’m sure doesn’t encourage women to get involved in the field. However, shouldn’t people who subscribe to the hacker ethic start equally applying it equally to both sexes?

Also, since we’re on the topic:

Talented Women in Computers who’s weblogs I read, and so should you:

• Jennifer Jabbusch – http://securityuncorked.squarespace.com/
• Jennifer Leggio – http://mediaphyter.wordpress.com/
• Stacy Thayer – http://www.stacythayer.com/

So, like other hard core political junkies, I was watching the election results of the Iowa Caucus last night trying to get the latest results. I went to surf around 8:45PM EST, looking to get the results trickling in.

The Iowa Democratic Party website was zippy, automatically updating, and from what I can tell, AJAXified.

The Iowa Republican Party website… Well… Not so much.

Apparently my fellow political junkies flooded the Iowa GOP website off the tubes. I’m seeing some more frazzled SysAdmin who thought “Hmmm! Two T1s and a server should be find for my flash heavy, graphically intensive website!” and then cowering when hundreds of thousands of users descended onto his or her server.

Meanwhile, the Iowa Democratic website had the foresight to realize how many people will be clamoring to get to the data. They put a streamlined results page on, and moved it to Amazon’s S3 service which saw our requests and laughed as we made hardly a dent in their bandwidth. I think someone reads Jeff Atwood.

The end result is that I was on the Iowa Democratic Website almost all night, and had to turn to other sources to get the GOP results. Way to go guys.