Author Archives: simon

Buggy IMAP authentication on Nokia 6233

Posted on by

I bought a Nokia 6233 yesterday, because I lost my Nokia N80 a few days ago. One of its important features besides 3G and Bluetooth, for me, is the ability to read e-mail. Unfortunately, the devices has some serious problems with non-cleartext authentication in IMAP. What is strange is that SMTP authentication using CRAM-MD5 and DIGEST-MD5 works fine. Actually, there is more strangeness to it than this… Continue reading Buggy IMAP authentication on Nokia 6233→

Jobo Giga Vu Pro Evolution 80GB

Posted on by

I bought a new toy yesterday, altough its silly name almost made me go for the Epson P-5000 instead. Quick testing seem to suggest that the device lives up to its promises, although there is room for improvements in the user interface.

Jobo Giga Vu Pro Evolution

One of my reasons of buying it was for the device to serve as my MP3 server in the office. Alas, the MP3 player is not very advanced. You just select directories, and press play. Crude as it may be, it appears to work.

What was interesting was that the manual says the device includes software released under the GPL, available upon request. Today I sent an e-mail to support@jobo.com to ask for the code. It would be nice if I could ssh into this box and run mpg123 manually. I’ll blog about my progress on that.

Anyway, the machine has some interesting specs:

  • AMD Au1200 MIPS processor at 400MHz
  • 128 MB DDR-SDRAM
  • 32 MB Flash Rom
  • 3.7″ VGA Screen
  • 80 GB Hard Disk
  • 2*miniUSB
  • Audio+TV out
  • VGA/DVI output (cable not included…)

TLS-AUTHZ Patent Concerns

Posted on by

I’ve implemented tls-authz in GnuTLS but there has been a long discussion of the patent situation for that technology on the IETF list. A few days ago there was a new IPR Disclosure with a patent license for this technology:

https://datatracker.ietf.org/public/ipr_detail_show.cgi?&ipr_id=833

I evaluated this license from a free software perspective, here is my writeup:

http://article.gmane.org/gmane.ietf.general/24690

Boycott scan.coverity.com!

Posted on by

Coverity is a tool to find security problems in code through static analysis. I’m sure it is a fine tool. There is a company behind it, Coverity Inc., and they run the tool on free software. A service like that seems like a good thing. Alas, the details of how scan.coverity.com imply that it is a bad idea for free software supporters to use the service. Here are the mistakes they made:

  1. There is no notification to the project maintainer that they found problems in the code.
  2. The problems they have found are not available publicly. (This _may_ be desirable, in case the problems they find are exploitable.)
  3. They require that any maintainer who wish to review the problems enter into a license agreement with Coverity, Inc. The license is very biased, and all the advantages are with the company, and none with the developer. Further, they can change the license at any time, and you are (presumably) forced to follow it anyway. (Read below for a copy of the license.)

This sends the message that the site is just advertisement for their commercial proprietary products and services. Possibly it could be even worse, it can be seen as a bargaining a’la “Your software is insecure, agree to our evil license and we’ll tell you how to fix it”.

Therefor I suggest that all free software maintainers boycott the scan.coverity.com service until they get their act together.

A reasonable way to change their service to something more acceptable, and potentially even turn it into a positive contribution to the community, would be to send the list of problems to the official bug maintainer address of each project.
Continue reading Boycott scan.coverity.com!→