[ Site Index] [ Linux Index] [ Feedback ]
Big Brother's Big Iron
Today is October the first. Something not many people know is that newsstand magazines get written and put together one or two months before they appear in the shops; it takes time to write a couple of hundred pages of editorial content, lay out several hundred more pages of advertising, and then print a couple of hundred thousand copies. (At one kilogram per copy, that's a couple of hundred tons of paper: enough to fill five to ten articulated lorries, never mind the many gallons of ink ... get the picture, yet?)
Anyway, you can take this article -- like all Shopper columns -- to be a time capsule in miniature. A blast from the plast. And, written less than a month after the events of September 11th, 2001, you can probably guess what I'm going to say.
Hopefully you'll be wrong.
Right now a lot of people are running around screaming about the need for new security restrictions to save us all from the evils of international terrorism. As it happens, I think they're quite right; the events of that ghastly day are something that must never happen again. But people don't always respond sensibly in a crisis, and this one is no exception. Some of the security proposals coming out of the British and American governments are, frankly, terrifying; in fact the cure may be worse than the disease. I don't mean to belittle the tragedy, but responding to it by destroying the core values of western civilization (values such as freedom of speech and association, privacy, the right to a fair trial, freedom of movement, and so on) seems counter-productive.
Let's take a look at the current proposal to introduce a national identity card in the UK. Surveys show that roughly 70% of the population support this proposal, and indeed, it's not immediately obvious why it's harmful. (It's even less obvious why I should be writing about it in a Linux column, but please bear with me ...)
Last time the UK had an identity card, it was introduced during wartime and abolished in 1951 at the request of the police; the reason was that the power of the police to challenge anybody to produce one was causing widespread resentment and lack of respect for the law. I've seen one of those 1951- vintage ID cards and it's quite impressive; a piece of khaki-coloured cardboard with copperplate handwritten details and official stamps all over it. No photograph, no fingerprints ... such an identity card is useless for the key function of an identity card, which is to prove that the bearer is indeed the person they claim to be.
We are told that the new identity card scheme will, thanks to the wonders of technology, include biometric data -- fingerprints, retinal scans, genetic fingerprint -- so that the bearer's identity can be authenticated. But what does this mean?
This is actually close to the core dilemma of computer security: how to prove that someone is who they say they are. An identity card doesn't get us around it; all it does is associate some biometric data with a name and address that someone who created the card believed in. To be effective, such cards must be trusted -- they need to be digitally signed by a strong encryption mechanism that is resistant to cryptanalysis, so that we can verify the identity of whoever issued the card -- to ensure that it isn't a forgery. But the government is, at the same time, discussing mandatory key escrow for encryption keys -- and the big problem with key escrow is that it lets someone else use your digital signature! The only mechanism that can make an ID card unforgeable is simultaneously being undermined by the government in the same legislative process.
The situation is no better when we examine the uses of an ID card. If a digitally-signed biometric authentication token (call it an ID card) is available, it can be used for many purposes. Want to drive a car? This lets the police prove that you were arrested for driving under the influence, and not simply borrowing your big brother's driving license. By the same token, it lets the DSS prove that you've only collected one benefit payment. But lets look at some more sinister uses. A biometric ID is the perfect thing for governing access to trusted computer systems -- or for verifying that the person who is reading this e-book or playing this downloaded MP3 is indeed the person who purchased it. The temptation to use ID cards to enforce draconian copyright or access restrictions will be immense, and because readers must be cheap for the system to work at all, attempts will be made to do so. Again: the banking industry would love a secure, unstealable replacement for your credit card, the flawed and insecure descendant of a scheme dreamed up in the innocent trust-the-computer world of the 1950's.
Here's a nasty scenario: imagine a world in which you can't watch cable or satellite TV without putting your ID card in the decoder box's card slot to prove that you're the licensed user of the TV set. A world in which you can't read an e-book (much less copy bits of it under the fair use rules!) without authenticating your identity to some publisher's computers, which will be gathering information about your reading habits (and reading speed) which in turn will be sold to the highest bidder. A world in which you can't do anything anonymously because anonymity has been abolished, for good or for ill. A world, incidentally, in which you can't use Linux because you might be able to compile some software on it which hasn't been digitally signed by someone trusted by the government not to sign software that can be used for hacking, a "terrorist crime" within the meaning of the anti-terrorist bill being debated by Congress as I write (and the like of which will crop up in the UK, soon enough).
Will this help stop terrorist outrages?
In a word, no. There must exist a mechanism to allow foreigners entering the UK or the EU to obtain a new ID card -- this stands to reason. And at the point of entry, someone -- some underpaid, bored Customs officer -- must certify that the person with the following genetic fingerprint is, well, who they say they are. Or who the crumpled passport from Bolivia or Malaysia says they are. A chain of trust -- just like the one used by PGP -- is implicit in any authentication system, and every authentication system is vulnerable at the point of entry. This system will not stop terrorists with suitcases full of flight manuals from arriving from nations with dubious (or bribeable) security bureaux; they'll just go through channels and obtain a valid ID card like everybody else. What this authentication token will do is strip us -- the law-abiding majority -- of our privacy, while providing us with a false sense of security. (Oh, and it'll make life absolute hell for the majority of illegal immigrants who came here because they wanted to work for a living somewhere where there's a minimum wage and police cells don't come with en-suite torture chambers. Whether this is a good thing or a bad thing depends on your politics, but it sure as hell doesn't qualify as "getting tough on terrorism".)
There are some other remarkably stupid proposals on the table right now; proposals that are there because they represent some government bureaucracy's vested interests, a committee-led bid for power, rather than a realistic attempt to deal with the problem at hand. For example, the FBI is pushing for mandatory key escrow technologies -- the Clipper chip, which we thought was dead and buried at the crossroads with a stake through its heart in 1998. If they get it, the FBI and NSA will be able to read encrypted messages prepared using those cyphers. Which would be great, except Al-Quaeda doesn't use encryption or the internet for organising their atrocities -- they use human couriers sworn to die rather than disclose the messages they carry. Meanwhile, the history of cryptanalysis shows us that if you build a back door into a cypher, people will use it -- and not just the people it was built for. If escrow technologies are mandated for financial transactions, the odds are high that the government keys will be leaked to organised crime: it's just too tempting a target! If you can get someone's keys, you can authenticate yourself as them -- opening the doors to a form of identity theft that is so watertight that it'd hold up in court.
And then there's the Congressional anti-terrorism bill being debated this week, that makes hacking a terrorist crime. Punishable by mandatory life imprisonment, no less. Now, while crashing airliners into the World Trade Center arguably deserves this level of deterrence, what on earth are they thinking about with this hacking clause? Does defacing a website warrant a life sentence without parole? Most people would argue that it doesn't: if this law goes through it means that anyone who defaces a web page is no longer deterred from more serious offenses by the threat of a more serious punishment, because they're already liable for the high jump. Nobody appears to have told the Congressmen about the old saying, "might as well be hanged for a sheep as for a lamb", or about the distressing history of English penal theory in the eighteenth century (when the threshold for a hanging was the theft of two shillings -- in today's terms, about twenty quid). Then, the law was so draconian and punishment so appalling, that most crimes went unreported. Even worse, the more serious criminals stopped at nothing: why refrain from rape and murder when even a little pickpocketing is enough to put your neck in a noose?
The answer isn't draconian punishment for trivial offenses. The answer isn't a mandatory authentication scheme that can be spoofed at the port of entry but that strips us of our privacy. The answer isn't to ban nail files on flights (have these people never heard of karate?). The real answer probably has a lot to do with reducing the perceived benefits of terrorism (for whichever groups are contemplating it). And that is a political problem, not a procedural one, which is why all these legislative measures amount to nothing more than grasping at straws in an attempt to be seen to be Doing Something.
Camera fun
My pal Sandy is a photographer. This means that he's usually found weighed down with huge crates containing diffusers, flashes, tripods, the trusty Bronica, and a ton of spare rolls of three inch high black and white film. In contrast, I'm a crap photographer. This means that I'm usually weighed down by a pocket-sized snappy little gadget with a CCD and a memory card in it, with which to cut people's heads in half, prove that all cats and dogs are green-eyed demons, and in general subsidize the activities of the disk drive manufacturing industry.
How do digital cameras get on with Linux?
The answer seems to be, surprisingly well -- for the most part.
The main problem with digital cameras is the proliferation of standards. In addition to the built-in memory all cameras come with (typically enough to hold from one to eight snaps), they may use Compact Flash, Smartmedia, Sony Memory Stick, or Secure Digital memory cards as storage. They may save their images as TIFFs, JPEGs, or in some weird proprietary format. They may connect to a PC or Mac via Serial or USB (in exotic cases, by Firewire) cable. And they all seem to come with weird proprietary communications software, just to make things difficult.
A secondary problem is the lack of a unified source of information. There's a HOWTO on connecting Kodak cameras, and some info on, for example, the Sony DSC-S50: but there's no general HOWTO or FAQ for connecting digital cameras to Linux systems. So here's a whistle-stop tour of your options.
In my experience, the simplest solution to getting snaps off a camera and onto your Linux box is to buy a camera that uses Compact Flash (CF) media or SmartMedia cards. CF is a shrunk-in-the-wash version of the older PCMCIA card format common to laptops; you can buy a cheap carrier that lets you plug a CF card straight into your laptop's PCMCIA slot, or a slightly more expensive PCMCIA drive for desktop PCs. You can also buy carriers for SmartMedia cards that make them look like a floppy disk to your PC. And then there are USB card readers that take one or both types of memory. In all cases, the trick is to mount the filesystem on the card -- they're almost always vanilla, old-fashioned MSDOS filesystems -- and just copy the files across. When you insert a CF card in a carrier into a laptop with the Linux PCMCIA system, it shows up as an extra IDE hard disk drive; so you can mount it by typing a magical incantation like:
mount -t vfat /dev/hdg1 /mnt
(Assuming, of course, that your kernel decides that you've inserted /dev/hdg, as opposed to /dev/hde -- it can get a bit confused if you keep inserting/ejecting CF cards, so the best thing to do is to type "dmesg", read the recent kernel debug messages, and figure out which device the kernel thought you were inserting from context.)
USB card readers are the next most convenient option, and the best for users with SmartMedia cards (due to being ever so slightly faster than a floppy disk drive at i/o). If you have a 2.4 series kernel you're in luck; you may need to type "insmod usb-storage" as root (to ensure that the USB mass storage driver is available) but in principle the USB manager should auto-detect and auto-load everything when you plug your USB card creader module in. You can confirm it's attached by using the graphical "usbview" program, which shows you the state of devices on your USB chain. When you insert a CF or SmartMedia card, the computer should beep -- and when you examine the kernel messages using dmesg you'll see something about a new SCSI device. This is because the USB system presents mass storage devices to the kernel via a fake SCSI interface; you therefore mount the new "SCSI disk" to get at the contents:
mount -t vfat /dev/sda1 /mnt
Once you've got the filesystem mounted, you'll need to figure out the directory structure on it. Some cameras don't mess around with subdirectories, but others (Kodak, for example) seem to stash all sorts of stuff (like scratch files for the camera's OS configuration) in weird places.
Can you dink with your camera using a serial or USB cable? The answer is a qualified yes. Some Linux tools exist that let you preview thumbnails, download snaps, clean out the cameras memory, or do other things. These depend on the camera vendors having released information about their particular device, and on someone having implemented support; thus, only the most popular makes are available, and the newest cameras probably aren't going to work for a while.
As an example of this, I use a Kodak DC3200 camera. This is about a year old and is no longer made -- it has been superseded by the DC3400 (with a USB-based docking station). gPhoto 0.43, bundled as standard with SuSE Linux 7.2 and other current distributions) doesn't have a driver specifically for the DC3200; however, Kodak use different versions of the same operating system in most of their cameras. I fired up gPhoto, plugged my camera into the first serial interface (COM1: to a Windows person, /dev/ttyS0 to a Linux head like me), and told gPhoto it was talking to the most recent Kodak camera it supports -- a DC280. Miracle of miracles, it worked: a bunch of thumbnails appeared, and I was able to download images and delete them from the camera via serial cable even though the camera in question is unsupported.
gPhoto isn't a miracle cure, but it works well for some cameras and its plugin-based architecture makes it relatively easy to add new ones. You can also find a full list of supported cameras. One drawback is that the current version it is aimed at serial connections; however, the new gPhoto 2 system separates the drivers from the graphical interface, with KDE and GNOME (and other) front ends planned, and adds support for some USB connected cameras. In general, the USB cameras show up as a connected mass storage device -- support is still limited. And one manufacturer is conspicuous by their absence: Sony, vendors of beautifully designed but overly-proprietary hardware, seem to have an active policy of trying to impede the development of open source interfaces to their kit, to the point where I would strongly recommend against buying a Sony digital camera if you plan to run Linux.
In addition to gPhoto, a secondary system for communicating with digital cameras is SANE (Scanner Access Now Easy). SANE was designed for interfacing to scanners, but a number of drivers for digital cameras are available -- along with more exotic stuff like the Polaroid digital microscope camera or Connectix QuickCam webcam.
Despite having gone on about gPhoto and SANE, I'd still like to say that in my experience the best way to deal with a digital camera is to use a CF card and periodically whack the thing into a USB reader or PCMCIA carrier, mount the filesystem, and move everything onto your hard disk. It's way faster than a serial cable, and doesn't involve messing around looking for a supported camera driver. The main headache this involves is finding an application to organise your thumbnails. In this field, two not-exactly-free programs seem to reign; the excellent xv image viewer, and Compupic. Xv is an ancient UNIX stalwart, an image viewer and mogrifier that has a highly useful "visual schnauzer" mode that provides browsable directory thumbnails. Photodex Compupic is a Linux port of a closed-source Windows program, designed specifically for organising large bodies of digital photographs. (In addition to these specialist tools, both the Nautilus and Konqueror file managers both have image preview capabilities -- but they don't have the other image manipulation features.)
[ Site Index] [ Linux Index] [ Feedback ]