Thursday, March 3, 2005

the geek returns

A few people have noted that my blogging has taken a decided down turn recently, due to my gamer side taking precedence. I have noted that when I start to game I pretty much stop everything else in my life and game, well I am happy to say that my gaming side has now been satiated and its back to feeding the geek :)

Well I just got back from fosdem which was good fun. It was my first event like that, even though I have been fairly active in the whole free software scene for some years. It was quite interesting, I got see some good presentations from various OSS luminaries including Martin Roesch from snort, Alan Cox of kernel fame (man if my saying of beard = experience was every true, AC is living proof of it!), and Alisdair kergon who wrote the device-mapper. Actually I had an interesting conversation with Alisdair about my pet project of building encryption end to end for a box, I have some more ideas that I will persue further on that front. I also had the chance to meet some people from Disciplina networks, namely Till and m0n, which was actually really enjoyable. As a result of meeting Till, I spent the majority of my time hanging out with the KDE crowd (in particular the german SAP linux lab crowd) which was an interesting insight into how a large project like that actually functions. I finally met some more people like myself who consider their "hobbies" to be the most important things in their lives, I don't know that I would consider ONE thing as important as some of the KDE crowd do, but definitely the concept of learning new things constantly is the most important thing to me. I had an interesting chat with Scott Wheeler, a KDE dev guy who is involved in a concept of desktop searching, which is more then just the typical index everything on the desktop and reference it. The concept he has fleshed out involves relationships about data and categorising them and storing the relationships and then performing a google like search based on that. Some kewl stuff.
One of the bigger dissappointments about FOSDEM was the gentoo stuff. I went there with high hopes about meeting people from the gentoo dev side as there was a LOT of gentoo activity going on. Unfortunately once I was there I realised for the first time why gentoo has such a bad reputation with the rest of the community. Gentoo seems to have attracted ALL the wannabee kiddies and has almost no really respectable people championing it, or at least in Europe. Now that is probably a little unfair, but the presentations that I went to were invariably given by 18-22 year olds, which is fine in itself, but these kids couldn't give decent speeches! One of the main portage devs' gave a speech to a room full of people, about 200, which was meant to go for an hour. It lasted 25 painful minutes, where you couldn't hear him clearly, he mumbled, constantly looked at the door (which naturally had people going in and out constantly, you got the impression he took it as a personal insult everytime someone walked in late) and pitched his whole presentation at the wrong level. It was so bad I came close to telling him to shut up and giving it myself. Still my belief in gentoo remains, but man do we need to do something about our reputation!
Went to another conference yesterday in downtown London for sourcefire which looks like an unreal product. Again it was Martin Roesch who gave most of the presentation, and I really like some of his ideas. Basically what is settin g sourcefire apart from a normal snort setup is that he combines the IDS with a passive device that just gathers information about the network ( and does it remarkably well), by correlating the data we can filter out typical snort alerts like an IIS exploit against an apache server. For the first time the IDS knows more about the network then the attacker AND its updated real time. Combine this with close tie ins to firewalls etc and you have a really amazing setup. I will be looking to persue this further at work.

3 comments:

  1. hmn ... very interesting, will have to get over there sometime, hey --koro

    p.s. linux.conf.au coming up, giving a talk on open-source java, should be cool.

    ReplyDelete
  2. Source Fire’s "3D" idea is interesting, the reclassification of IDS events based on context gathered by RNA does defiantly reduce workloads on what is always a very labor-intensive task (IDS monitoring). SF is a lot more than snort with a pretty GUI and is really starting to mature. You can even have it integrate with a your IT / Security policy so as to alert when unauthorized systems (like OSX on a win 2000 network) plug into the network

    ReplyDelete
  3. [...] en of mine. Aside from playing with new toys (much fun) I have been getting on top of some interesting technologies at work. In particular I have been designing and testing our IDS implementation. I have als [...]

    ReplyDelete