A security lesson learned

Before deciding to leave the default password on a WiFi router unchanged (to avoid the hassle of remember the password later), be *extremely* sure the router's administration web server is only available from the wired interface.

Marginal Revolution

I must be the last Internet user to notice, but [Marginal Revolution](http://www.marginalrevolution.com/) rocks.

Notes from DeepSec 2007

While attending [DeepSec 2007](https://deepsec.net/), I was making notes of the most interesting/surprising information presented. I hope they are useful; if you want more, slides from the presentations might be available on [wiki.deepsec.net](http://wiki.deepsec.net/index.php/DeepSec_2007).

A Brno restaurant recommendation

If there are any restaurants that deserve being advertised to the whole internet like this, [Piccolo mondo](http://www.piccolomondo.cz/piccolo/index.php) in Brno is definitely one of them. The food both tastes and looks amazing, the service is great, and the prices are quite acceptable.

Frustrated with KDE

While I was testing Fedora's development tree, preparing for Fedora 8, I have experimented a bit with KDE. Like 6 months before, I liked what I saw: a lot of not extremely important, but very convenient features (like a clock that can show time in multiple time zones, audio player with global keyboard shortcuts, a calendar that has sane defaults and scrolling behavior—unlike Evolution). Most of the applications have overwhelming option dialogs, but I'm sure the time investment would have paid of.

On the other hand—again, like 6 months ago—the applications I use most crashed several times within a single evening. Sigh.

Ludwig von Mises on Marxian ideology

Wow, this must be the most direct criticism of Marxism and its focus on the "proletarian class" I have seen in a long time. Let me quote the closing paragraph of the chapter:

> The essence of Marxian philosophy is this: We are right because we are
the spokesmen of the rising proletarian class. Discursive reasoning cannot
invalidate our teachings, for they are inspired by the supreme power that
determines the destiny of mankind. Our adversaries are wrong because they
lack the intuition that guides our minds. It is, of course, not their fault that
on account of their class affiliation they are not equipped with the genuine
proletarian logic and are blinded by ideologies. The unfathomable decrees
of history that have elected us have doomed them. The future is ours.

You can read the rest in
Human Action
(a [3MB PDF](http://www.mises.org/humanaction/pdf/humanaction.pdf) is available), pages 76--82.

SELinux Loadable Policy Modules

A new SELinux feature which makes local SELinux policy adjustments much easier was not easy to notice
among all the complaints that SELinux is hard to use.

The `audit2allow` tool should be well-known by now:
given a snippet of the audit log, it outputs policy rules to allow all operations that are are currently prohibited.
The user is expected to add the rules to the (large) policy, recompile the policy and load it.
Finding the "right" place in the policy is not always obvious, though, and a future update of the `selinux-policy`
package might overwrite the modifications.

Now there is an alternative, very convenient especially when trying to extend the policy to handle a new daemon:
Run

> `audit2allow -M` modulename `-i` audit_log_file

This will create a binary loadable module modulename`.pp` that can be quickly loaded by

> `semodule -i` modulename`.pp`

or unloaded using

> `semodule -r` modulename

The `audit2allow` command also creates modulename`.te`, a plain-text representation of the module,
which can be edited and compiled to create a changed binary loadable module, or used as a basis for
patches to the default SELinux policy.