Serendipitous altruism

By now you are probably already participating in the fireworks triggered by the leak of a secret court order requiring Verizon to hand over all call data to the NSA. Mass surveillance was a well known threat – but now we have proof that the USA do it… Will that be the wake-up call for increased political awareness ? I’m not holding my breath…

US Senators don’t seem to have realized the extent of public outrage – witness comments such as “This is nothing particularly new… Every member of the United States Senate has been advised of this”… Mass surveillance ? Yes we can ! All that would not have happened if Obama had been elected.

Anyway, a couple of months ago, Frank La Rue, the United Nations Special Rapporteur on Freedom of Expression and Opinion, has reported  to the UN Human Rights Council, making a connection between surveillance and free expression. It establishes the principle that countries that engage in bulk, warrantless Internet surveillance are violating their human rights obligations to ensure freedom of expression. Was that report prescient ? Is it part of a new trend at the UN ? Here are a few choice morsels from the conclusions of this extensive piece of research:

79. States cannot ensure that individuals are able to freely seek and receive information or express themselves without respecting, protecting and promoting their right to privacy. Privacy and freedom of expression are interlinked and mutually dependent; an infringement upon one can be both the cause and consequence of an infringement upon the other.

80. In order to meet their human rights obligations, States must ensure that the rights to freedom of expression and privacy are at the heart of their communications surveillance frameworks.

81. Communications surveillance should be regarded as a highly intrusive act that potentially interferes with the rights to freedom of expression and privacy and threatens the foundations of a democratic society.

Clear enough for y’all ? The report was in no way aiming at the US of A but today’s revelations makes it difficult to read it without thinking about them…

Mass surveillance is like searching every single home in the whole country because some of them might hide something illegal. With such massive indiscriminate intrusion in private lives,  secrecy isn’t kept to avoid “tipping off the target” – it is about avoiding legitimate public outrage at misguided actions outside of any effective control, that undermine the very foundations of what we strive for.

I fixed the comments form today – it had been inoperative for two months. Thanks to Loïc for reporting the malfunction – fixing a problem is usually not difficult as long as someone reports it… If you like the software you use, reporting problems is an easy and doubly self-gratifying way to give back : good bug reports are  not only valuable contributions for altruistic reasons, they are also  rewarded by improvements !

Anyway, this is yet another lesson in keeping WordPress plugins up to date – or maybe a hint that more WordPress plugins really should be packaged in my favorite distribution…

Reading about Anne Lauvergeon’s current work at a recently set-up government innovation think tank, I stumbled upon this quote of hers:

«  Je pense que la grande révolution que l’on vit en ce moment, c’est celle des “data”. [..]  Prenons le cas de l’assurance : le décryptage de l’ADN pour 100 euros fait que, dans quinze ans, vous serez peut- être assurés en fonction de vos risques génétiques. »

Let’s translate that in English :

«  I think that “data” is the great revolution we are currently living. [..] Take the case of insurance : ADN decoding for € 100 means that, in fifteen years, your insurance will be tailored to your genetic risks. »

If this makes your stomach churn, you are not alone – upon reading it I was aghast : not only because an opinion leader entertains such unethical thoughts, but also because someone in charge of recommending a national industrial policy shows ignorance of how illegal genetic discrimination already is.

For an overview of how legislation protects the European citizens against genetic discrimination, you may take a look at “Genetic Testing – Patients’ rights, insurance and employment A survey of regulations in the European Union” – research published by the European Commission. Here is the “Genetics and Insurance” section of the chapter describing the situation in France :

In 1994, the Law n. 94-653 on respect for the human body introduced new provisions on genetic testing and DNA identification into the French Civil Code. According to article 16-10, the genetic study of the characteristics of a person may be undertaken only for medical purposes or for scientific research.

The Code of Public Health affirms this principle but adds that genetic tests can only be realized “in the patient’s interest”(Art L. 145-15-1). This necessarily excludes every genetic test contrary to the patient’s interest. Consequently genetic testing for the purpose of the conclusion of an insurance contract is prohibited.

Article 25 of Chapter III on the identification of persons and their genetic characteristics by genetic examination reads as follows: it is not allowed to carry out genetic examinations on the characteristics of persons other than for reasons of medical or scientific research or in cases provided by law. The consent of the person involved is needed before examinations are carried out, except in case of medical necessity.

The use of information about an individual which has been obtained by studying his genetic characteristics other than for medical purposes for scientific research is punishable with one year’s imprisonment and a fine of 15.000 Euro (article 226-26 Penal Code).

French bioethics legislation specifically prohibits access by any third party, notably employers and insurance companies, to information held in databanks and makes it illegal for them to ask individuals to provide such information.

While this seems to prohibit insurers from using genetic tests for underwriting purposes, it does not prevent insurers from obtaining genetic-test information from medical files. Under public pressure, however, in 1994 the French Federation of Insurers imposed a moratorium on its members. This moratorium implies that insurers may not take the results of genetic characteristics (unfavourable or favourable test results) of a candidate insured into account even if the candidate insured offered the information by himself. Initially the moratorium was adopted for five years, which coincides with the 5-year period upon expiry of which the law n. 94-653 of July 29, 1994 was to revised. In 1999 the insurers have extended the moratorium for another five years, i.e. until the year 2004. The underlying idea of the moratorium is that the experimental character of the genetic information prohibits to use it for purposes such as insurance contracts. This implies that insurers may not ask questions related to genetic tests and their results in risk questionnaires. Moreover, insurers may not ask the candidate insured to undergo genetic tests or to give them the results of previous tests.

The Universal Sickness Cover Act (CMU) ( Loi n°99-641 du 27 Juillet 1999 portant création d’une couverture maladie universelle. Lois et Décrets 99, 28 Juillet 1999.) in particular Section 5 entitled “Social and health modernization” states that any use of genetic testing by complementary insurance and health insurance bodies is prohibited. According to article 62 of the Act, such bodies “may not take account of the results of a genetic study of the characteristics of a person requesting the benefit of supplementary health cover, even if those results are provided by himself or herself. Moreover they may not ask any question relating to genetic tests and the results thereof, nor ask for anyone to undergo genetic testing prior to arranging a contract providing supplementary health cover and for the entire duration thereof”.

The paper I got this information from is ten years old – but no fundamental legislative change has occurred since then. Unless something really terrible happens in French politics, genetic discrimination in insurance will still be illegal in fifteen years – and if I have any say, it will be even more illegal.

Remember “Liberté – Egalité – Fraternité” – the “Fraternité” bit implies a degree of solidarity that won’t allow genetic discrimination. We will remain watchful.

Somebody please tell Anne Lauvergeon !

Let’s not hastily accuse John Broder of dishonesty – he might just be biased toward usage patterns unfamiliar to users of other car brands. Here is the clue…

This morning, Stéphane declared his puzzlement at a “CALIBRATING: DRIVE IN CIRCLES” display on the dashboard of the Chevrolet he was driving :

Yes, you may also frown at his use of electronic distractions while driving.

Anyway, this new feature in American cars explains why John Broder drove his test-drive Tesla in circles for a while in that parking lot…

I wonder why this has not been mentioned before.

Chrome isolates the content of each domain’s tabs in a separate process – which lets the user manage each of them with the operating system’s native process management tools. Firefox does not – so when it starts hogging 100% CPU, users are clueless.

Among the usual suspects is Flash, but Flash is innocent on my workstation’s Iceweasel : I entirely removed any Flash interpreter from it and I am now clean from this filth.

Next in the suspect row is misbehaving Javascript, unless you are my friend Lerouge and surf with NoScript buttoned-up. But how to identify it ?

As I expected, the answer was awaiting me among debugging tools – but it took longer than I estimated because it laid in the misleadingly named Javascript Deobfuscator extension… It does deobfuscate somewhat but as a commenter suggested it should really be named Javascript Execution Monitor because its major value addition is actually telling you what runs and when.

In the Javascript Deobfuscator dialog’s second tab, watch the “Number of calls” field – that is all you need. It is not a direct measure of CPU usage, but a close enough proxy : find the function with a runaway number of calls and you will likely have caught the culprit.

And that’s it – Iceweasel’s CPU usage is back to near zero, where it belongs. In my case, among the ocean of open tabs in on my virtual desktop’s many open windows, the culprit was this page to whose incompetence I grant some Pagerank as a token of appreciation for having led me to discover a solution to this problem !

Now, what I would love the Javascript Execution MonitorDeobfuscator to acquire is a list of the top call rates, by page and by script – updated every second. Make that a separate extension and call it the Javascript Execution Monitor !

Article 322-6-1 of the French Code Pénal punishes with one year in prison and a 15000€ fine “the diffusion by any mean of manufacturing processes for destructive devices made from explosive, nuclear, biological or chemical substances or any product intended for domestic, industrial or agricultural use“.

So in France, Cryptome can’t publish this very common and very public US military field manual, a textfiles.com mirror in France is illegal because it contains this, description of a chemical reaction on the MIT’s site would be repressed  and Wikipedia’s legal team better excise this section of the Nitroglycerin article from any HTTP response bound to France.

And someone once again forgot that censoring information locally does not work.

But wait – there is more stupidity… The punishment is tripled (three years in prison and a 45000€ fine) if the information has been published “to an undefined audience on a public electronic communication network“. Why isn’t there a specific punishment for posting on a billboard too ? Once again, in yet another country, the use of electronic tools is an aggravating circumstance. As electronics pervade our whole lives, isn’t that entirely anachronistic ?

Well – as long as Tor, I2P & al. keep working…

By the way, that law makes an exception for professional use – so if you are acting as an agent of a duly accredited terrorist enterprise, rest assured it does not apply to you !

Sorry, you can’t geocode anymore – the word ‘geocode’ is a trademark owned by Geocode, Inc. of Alexandria, Virginia, USA. So please find another English word for the process of finding an address’s geographical position.

This isn’t even trademark bullying – trademark bullying looks sane in comparison to such blatant appropriation of the English language. I find myself wondering why Openstreetmap is yielding to it. Is a cease & desist letter all it takes ?

Choosing one’s battles carefully is a good reason for restraint – even squashing frivolous lawsuits costs money (thus making justice inegalitarian – but I digress) and even with money it requires technical knowledge, patience and zeal, as this USPTO report to congress shows. But I find such trolling so disgusting that I’m inclined to impulsively forgo short-term financial rationality for holy sword wielding, against the advice of calmer minds.

Precautionary appeasement measures may be best to protect one’s material interests in the strictest sense and in the short term. But while the wisdom of precaution before rash reaction may be acknowledged, does one really want to project the image of a mark that can be easily pushed around ? Is that in one’s best interests ? And in Openstreetmap’s case, are those the actions that best foster the spirit embodied by a project whose members have a strong interest in protecting the commons ?

Rousing up a crusade might actually be the rational choice against intellectual property trolls – costly in the short term but rational in the long term. Only in an organized fashion though – the targets of such bullying behaviour stand no chance if they revolt alone – unless they are, like Newegg, financially powerful enough to fight back or if they are members of some intellectual property mutually assured destruction cartel (I’m conflating patents and trademarks, which are very different domains – but they have trolling plagues in common). Even a fairly large project such as Openstreetmap is a soft target that can’t sustainably fight alone.

So sheep banding together to stand their ground and defend the public domain against predators is the only realistic option. The only downside is that we are going to make lawyers rich… We’ll have to live with that and mitigate the bad feelings by favoring intellectual-property lawyers with values favourable to the protection of the public interest. Now, how do the targets of intellectual property trolls connect each other to pool their resources ?

Meanwhile, the verb ‘to geocode’ remains generic English language word and I’ll stand by that even if a US court decides otherwise. Silly fight ? Yes – I have absolutely no skill whatsoever in choosing my battles, but unending masses of people like me is what it will take to wear down intellectual property trolls.

[This post motivated by a strange lack of FISAA awareness around me]

You will certainly be relieved to learn that US government agencies do not spy clandestinely on the data you entrust to Google, Facebook & co.

So stop wondering about dark conspiracies : there are none.

The bad news is that they do it legally instead. Yes – US government agencies can legally access any data stored by non-American citizens at USA-based hosting companies. No warrant required – they can basically help themselves with your data anytime they please and that is entirely legal.

Brazen, isn’t it ? It is called FISAA – for more details, take a look at this European Parliament report. And by the way, I believe that some strong reaction from the European Union has been long overdue.

The silver lining is that European hosts are making good business with everyone who won’t host their data in the USA anymore !

Koaci.com (usually not a bad source in Côte d’Ivoire) reports having learned from Malian military sources that two French helicopters formerly based in Burkina Faso have struck Islamist positions in Konna and Douentza during the night of Thursday to Friday, letting the Malian forces take back some of the lost ground.

An Eurocopter Tigre illustrates the article, but there is no reason to believe that Tigres are currently deployed around Mali.

I have attempted to find out the type of the two helicopters mentioned by Koaci.com, but I found no current information. That said, Algérie1.com mentioned last September that two Gazelles, arrived in a military base near Ouagadougou last September, to be assembled on site after shipping disassembled for more discretion. In October, Le Parisien confirmed the presence of two French Gazelles in Burkina. So odds are that those are the two that struck last night.

If they were Gazelle, which variant ? In Libya, even with NVG, Gazelles with a 20mm gun have soon been sidelined in reserve aboard Tonnerre and Mistral : most of the Gazelle missions have been performed by the HOT variant with the Viviane infrared sights – 425 HOT missiles have been shot in Libya. I would guess that given a similar environment, the same mode of operation has been adopted in Mali – so let’s say that at least one of the two is a Gazelle Viviane.

Côte d’Ivoire, Libya, Mali… The old Gazelles still follow an impressive tempo ! ALAT does not seem in a hurry to retire them.

In Mali anyway, rugged and mature platforms such as the Gazelle are much better suited to the light expeditionary logistical support available locally – the precious Tiger might be able to sleep rough, but I’ll believe it when I see it.

Update 20130111 18:48 – @AbouDjaffar guesses the mystery helos are Tigre. I stand by my Gazelle bet… We’ll know sooner or later !

Update 20130112 12:13 – Opex360 confirms that strikes have occured yesterday at 16:00, performed by 4ème Régiment d’Hélicoptères des Forces spéciales (RHFS) with Gazelles (HOT and 20mm)… So I guessed right !

/set rant_mode on

A digit is a numeral from 0 to 9 – so the French translation is “un chiffre”. Surprisingly, I find myself having to add that the French translation of “a digit” is not “un doigt” – you may use your fingers for counting, but in the end it is all about numbers not body parts.

Therefore the proper translation of “digital” in French is “numérique” – the French word “digital” describes something related to fingers. A digital device may be finger operated, but its digital nature is related to binary processing… The presence of a keyboard is accessory.

Increasingly, I find my compatriots using “digital” to qualify anything run by computing devices without having to mention them by name – because computers, data processing, electronics and such drab technicalities are uncool compared to the glittering glitz of mass-marketable trinkets. I resent this lamentable technophobic trend but, if you want to indulge in such decadence, please at least use the proper French word.

From now on you’ll know that any French person caught saying “digital” instead of “numérique” spectacularly exposes his ignorance – you know who they are and you are welcome to anonymously report them in this article’s comments (with links to incriminating tweets for bonus ignominy).

I obviously don’t mind people using English. I don’t even mind loan words – they are part of how a language evolves. But I do object to mindless namespace pollution: using loan words does not exempt from semantic coherence.

Call me pedant if you want, but if you attempt to degrade our essential communication tools you’ll find me on your path and I’ll be angry !

Today is IPv6 party time so let’s celebrate with a blog post !

Reliable IPV6 connectivity is no longer just nice to have – it is a necessity. If your Internet access provider still does not offer proper native IPv6 connectivity, your next best choice is to use an IPv4 tunnel to an IPv6 point of presence. It works and on the client side it only requires this sort of declaration in /etc/network/interfaces :

auto ipv6-tunnel-he
  iface ipv6-tunnel-he inet6 v4tunnel
  address 2001:170:1f12:425::2
  netmask 64
  endpoint 216.66.84.42
  gateway 2001:170:1f12:425::1

Of course, the same sort of configuration is required at the other endpoint – which means that, among other parameters, you must inform the IPv6 tunnel server of the IPv4 address of the client endpoint. Hurricane Electric, my tunnel broker lets me do that manually through its web interface – which is fine for a static configuration done once, but inadequate if your Internet access provider won’t supply you with a static IPv4 address. By the way, even if, after a few weeks of use, you believe you have a static address, you might just have a dynamic address with a rather long DHCP lease…

But Hurricane Electric also provides a primitive HTTP API that lets you inform the tunnel broker of IPv4 address changes – that is all we need to do it automatically every time our Internet access goes up. Adding this wget command to the uplink configuration stanza in /etc/network/interfaces does the trick :

auto eth3
iface eth3 inet dhcp
  up wget -O /dev/null https://USERNAME:PASSWORD@ipv4.tunnelbroker.net/ipv4_end.php?tid=34764

That’s it – you now can count on IPv6 connectivity, even after a dynamic IPv4 address change.

And after you are done, go test your IPv6 configuration and your IPv6 throughput !

How dare Fortnum & Mason call Sir Nigel’s Vintage Orange Marmalade “thick cut” ? This effete excuse for a preserve may barely contain ten weak bits of chewy peel in each pot. Give me Wilkin & Sons Tiptree ‘tawny’ : proper English orange marmalade with actual thick cuts ! Signed : yours truly – Disgusted of Tunbridge Wells.

I just wanted to create an Apache virtual host responding to queries only over IPv6. That should have been most trivial considering that I had already been running a dual-stacked server, with all services accessible over both IPv4 and IPv6.

Following the established IPv4 practice, I set upon configuring the virtual host to respond only to queries directed to a specific IPv6 address. That is done by inserting the address in the opening of the VirtualHost stanza : <VirtualHost [2001:470:1f13:a4a::1]:80> – same as an IPv4 configuration, but with brackets around the address. It is simple and after adding an AAAA record for the name of the virtual host, it works as expected.

I should rather say it works even better than expected : all sub-domains of the second-level domain I’m using for this virtual host are now serving the same content that the new IPv6-only virtual host is supposed to serve… Ungood – cue SMS and mail from pissed-off users and a speedy rollback of the changes; the joys of cowboy administration in a tiny community-run host with no testing environment. As usual, I am not the first user to fall into the trap. Why Apache behaves that way with an IPv6-only virtual host is beyond my comprehension for now.

Leaving aside the horrible name-based hack proposed by a participant in the Sixxs thread, the solution is to give each IPv6-only virtual host his own IPv6 address. Since this server has been allocated a /64 subnet yielding him 18,446,744,073,709,551,616 addresses, that’s quite doable, especially since I can trivially get a /48 in case I need 1,208,925,819,614,629,174,706,176 more addresses. Remember when you had to fill triplicate forms and fight a host of mounted trolls to justify the use of just one extra IPv4 address ? Yes – another good reason to love IPv6 !

So let’s add an extra IPv6 address to this host – another trivial task : just create an aliased interface, like :

auto eth0:0
    iface eth0:0 inet6 static
    address 2001:470:1f13:a4a::1
    netmask 64
    gateway 2001:470:1f12:a4a::2

The result :

SIOCSIFFLAGS: Cannot assign requested address
Failed to bring up eth0:0.

This is not what we wanted… You may have done it dozens of time in IPv4, but in IPv6 your luck has ran out.

Stop the hair pulling right now : this unexpected behavior is bug – this one documented in Ubuntu, but I confirm it is also valid on my mongrel Debian system. Thanks to Ronny Roethof for pointing me in the right direction !

The solution : declare the additional address in a post-up command of the main IPv6 interface (and don’t forget to add the post-down command to kee things clean) :

auto he-ipv6
iface he-ipv6 inet6 v4tunnel
    address 2001:470:1f12:a4a::2
    netmask 64
    endpoint 216.66.84.42
    local 212.85.152.17
    gateway 2001:470:1f12:a4a::1
    ttl 64
    post-up ip -f inet6 addr add 2001:470:1f13:a4a::1 dev he-ipv6
    pre-down ip -f inet6 addr del 2001:470:1f13:a4a::1 dev he-ipv6

And now the IPv6-only virtual hosts serves as designed and the other virtual hosts are not disturbed. The world is peaceful and harmonious again – except maybe for that ugly post-up declaration in lieu of declaring an aliased interface the way the Unix gods intended.

All that just for creating an IPv6 virtual host… Systems administration or sleep ? Systems administration is more fun !

The French interior minister Claude Gueant has decided to launch a viral marketing campaign to spread the notoriety of https://copwatchnord-idf.org, a sousveillance commune attempting to enforce police accountability. Displaying a cunning knowledge of mass communications, he let a court order the whole site made inaccessible; thus drawing the ire of free speech activists and ensuring excellent conditions for a nice Streisand Effect. Even before the court order has been implemented there are already a wealth of alternative ways to access the site’s content – among others I2P, ED2K, Bittorrent and a nicely growing list of mirrors including one on this site (IPv6 only – let’s promote IPv6 while we are at it) which will stay up until I get a court order to take it down or police pressure I can’t handle. Funniest thing is that I haven’t even read the content of the site.

I could have mirrored it anonymously, but civil disobedience doesn’t carry much of a message if you are not ready to do it in your own name: provoking a debate is the whole point of my involvement.

What triggered the French Copwatch case is the site’s naming of law enforcement officers, in infraction of French law regulating the collection, storage, and use of personal data. There are also claims of slander and libel, but those are not worthy of discussion – the targeting of individuals is the meat of the case brought forth by police unions.

It may surprise you but I agree with the police unions : naming law enforcement officers and systematically exposing their personal data in a manner making them personally more vulnerable to public anger is bad.

So why am I misbehaving by mirroring https://copwatchnord-idf.org on my host ? To have you talk about it. This is about ensuring that no one wants to publish something like Copwatch anymore. Even if law enforcement manages to stomp all the Web ants, technologies such as Tor hidden services and I2P guarantee that there is no way to eradicate information anymore – only to make it more difficult for the non technophile public to reach. So if we don’t want sites like Copwatch, it is the cause that must be attacked – Copwatch is only the symptom of some deeper disease.

In the French republic, law enforcement has a monopoly on legitimate violence, which is a good thing. In addition, law enforcement has powerful surveillance tools – those have never been as powerful as they are now, and their power is still growing. As the popular saying goes : “with great power comes great responsibility” – law enforcement is fine but only if it is accountable. Copwatch’s efforts may be misguided, but they illustrate a growing frustration from those involved in police violence and faced with police impunity: where to turn to for accountability when facing staggering power asymmetry ? They answer by starting an arms race between censor and watchers. No good will come out of that – we must make peace now : accept that censorship is pointless and imagine alternatives that guarantee that cases of illegitimate police violence are treated fairly – or even better, that they don’t happen.

A fight between the people and its own law enforcement is a losing proposition for every party involved – don’t do it ! Instead, make sure that institutional and individual acts of violence are easily documented and brought to court. Law enforcement is viable only if the people trusts its officers, but the relationship between the people and law enforcement is increasingly broken… Can we fix that ?

To make law enforcement officers accountable for their individual acts of violence, data must be collected from witnesses. But how to do it without naming them and exposing their personal data in a manner making them personally more vulnerable to public anger ? My proposal is to make prominent personal identifier displays part of what a law enforcement officer must feature to act legitimately as such. This identifier must point to the individual while keeping him anonymous. It must be displayed large enough to be readable through photography. This is only a single technical proposition, but the general idea to be pushed is for the police to be put under surveillance by the citizens who can easily gather enough information for  proper judiciary proceedings while protecting the individuals involved from extra-judiciary threats.

With a culture of accountability in place and enough eyes over the police, sites such as Copwatch would be pointless… Everybody wins. Don’t fear the sunshine and let’s talk about solutions !

You loved the Windup Girl ? Ship Breaker, also by Paolo Bacigalupi will sorely disappoint you. Where the Windup Girl provides a complex weave of intrigue in a lavishly set environment, Ship Breaker’s scenario is merely linear with a classic collision course in a dark but unexciting dystopian world. It reads fast, but even so it is barely worth your time. It does manage to entertain, so pick it up if you need some easy airport literature – but be warned that the entire creative content of this book would merely have filled a couple chapters of the much denser Windup Girl.

Whether you like Alvin Toffler or not, he is a visionary with exceptional acuity, and this quote cited by John Perry Barlow was no exception to his outstanding output :

“Freedom of expression is no longer a political nicety, but a precondition for economic competitiveness” – Alvin Toffler

I had never encountered it, so I wondered about where it first appeared. Not finding anything on the Web besides reproductions of the quote blindly attributing it to Alvin Toffler, I asked John Perry Barlow who promptly solved the mystery : “He said this to me in an interview I did of them in 1997” – no wonder I couldn’t find it.

Thanks John – I updated Alvin Toffler’s Wikiquote page.

And let’s hope someone tells my employer that freedom of expression is good for business !