A friend of mine sent out a call for help in formulating a disaster recovery plan (DRP) for our company in the event of a zombie outbreak.
The following is my response. This is very much an embryonic document; it needs a lot of work and I would welcome any contributions.
When planning for a zombie attack it's important to have both strategic
and tactical plans.
Strategically we should consider survival, containment, eradication and
neutralization.
Survival is the primary strategy. A zombie outbreak is a direct and
imminent threat to the life of every human being, and the only way to
contend with the threat is to survive.
Containment may be an effective strategy for outbreaks involving smaller
numbers of the undead. Containment should be pursued over eradication
if at all possible because it gives the survivors the opportunity to
scrutinize and learn from the afflicted. Containment will make identification
of the nature of the affliction much easier.
Neutralization and eradication are secondary strategies to survival.
It may be that a given outbreak can be neutralized, mitigating the threat;
absent the possibility of neutralization or effective containment, eradication
is the only remaining option.
We need to have tactical plans in place for a variety of possible
threats. Zombie outbreaks are known to be caused by viruses and
possibly bacterial infections, occult sources, certain chemical
compounds, and extraterrestrial contacts (both sentient and
non-sentient). Each cause produces zombies with different
characteristics. Tactics for combating zombies produced through one
vector could be woefully ineffective against a different type of
zombie. Some zombie states can be reversed while others require
containment or eradication of all effected individuals.
Weapon-wise it would be a good idea to have ready access to both
high-impact firearms and durable melee weapons. Remember that to drop
any kind of zombie except an occult one it's necessary to destroy or
remove the brain, and by 'brain' we're not talking about the cerebrum
but the cerebellum. The cerebellum is only 10% of the human brain and
it's a lot harder to target it with a small-caliber firearm than one
would think. Shotguns are probably the best bet for a number of reasons
- they are not precision weapons, they have good slowing/stopping power
even if they don't remove the head, and they have a low incidence of
ricochets in closed areas. I think machetes, axes and shovels are ideal
for hand-to-hand combat, as are clubs, maces and of course cricket bats.
Food supplies need to be set up well in advance. We should all be
prepared to survive for an extended time on MREs. Local secure
cultivation of fresh produce would be a good idea unless the zombie
vector is biological, chemical or extraterrestrial, in which case the
food could become a vector for spreading the outbreak. We might want to
consider adding a closed hydroponic facility at each of our facilities.
Finally, I think that the emotional considerations of surviving a zombie
attack are often neglected. We should have trained mediators and
counselors available in all locations. The onset of paranoia and
depression can be just as lethal in a well-armed population as the
zombies themselves. And the grim reality is that at some point, each
survivor is almost guaranteed to come face-to-vacant face with the
reanimated corpse of a former loved one. The psychological damage that
such a confrontation may cause cannot be overstated. We all like to
think that we're tough enough to survive such an encounter, but even the
toughest survivor should be ready and willing to accept help and be
prepared for the need for emotional healing.
There’s probably a better way to do this. (If so, leave a comment!) However, I run a debian server for a small task and use the default MTA Exim for mail delivery of status updates to my main mail accounts. Usually I run Postfix or Sendmail. I even have to support Qmail on occasion. However Exim is unfamiliar territory for me — I’m an Exim n00b.
Recently I decided I wanted to remove the “frozen” messages seen by running the mailq command. For example:
I know they’ll be purged eventually, I just wanted to clear the queue for some quick testing I was performing. The documentation I found on-line mentioned running “exim -Mrm <id>” for each message id in the mailq output. Being lazy, I don’t want to run that each time — I want a simple one-line command to purge frozen messages. So, I wrote the following BASH script that parses the mailq output and executes the command for each message id:
for i in `mailq | awk '$6 ~ /^frozen$/ {print $3}'`; do exim -Mrm $i; done
Worked like a charm! Message queue emptied of frozen messages.
My girlfriend wanted to give me an awesome geek toy for Christmas this year. She ordered a USB Webcam Missile Launcher from x-tremegeek.com for me, which I have to say is a pretty darned awesome geek toy. Even now, I can imagine using it to drive invaders from my cubicle, guaranteeing the sovereignty of my personal space . . .
Alas, it is not to be.
When the toy arrived at her home, she opened it up and found not the USB Webcam Missile Launcher, but rather the USB Missile Launcher. No webcam. Which is still a cool toy, but it lacks the major feature of the webcam version, which is that it can be remotely controlled.
But the folks at x-tremegeek.com explained to her that the webcam version was on sale for the same price as the normal retail price of the non-webcam version, so this was an “appropriate substitution”. When she pointed out that they are, in fact, very different products, x-tremegeek.com said that she could return the thing that she did not order for a refund – minus a restocking fee. After several phone calls, she got them to waive the restocking fee. Since, you know, she was returning something that she didn’t order in the first place.
x-tremegeek.com has many things going for it as a company. It’s got an apt name, a great catalog of toys, and a decent web site. Unfortunately, their customer service is bollocks. When the zombies finally overrun my meager cubicle defenses, I will die cursing their name.
This is a hard post to write since it is absolutely embarrassing to me and may cause me to lose serious geek-cred. However, I hope this is a useful mea culpa for others’ benefit. This morning I spent a while revising a script that accepted external input which I borrowed (and modified) from someone else. The original script used the external input safely – my modifications made it a true security nightmare. Basically, the script took content from the Twitter API and rerouted it through Jabber (XMPP) protocol. My change also sent the content through email.
If I had used the built-in SMTP features of ruby this post would have been unnecessary. However, as I was in a hurry (the excuse of a scoundrel) I simply piped the output through BASH to the mail command via ruby’s system() function. Also, I took no precautions to escape the external input from being executed by BASH itself. System admins and top-notch developers are now crying with laughter.
Why did I do this? Besides being an idiot, I did this because this script was a “one-off” and not something I was paid to develop. I needed a feature and, in the spirit of a developer (not a system administrator or security professional), I looked for the path of least resistance. With the system() call I could use my knowledge of the Linux command-line to accomplish my task. Since the original script was written in ruby, a language I have not used much at all, previously, I was able to add my needed feature in minutes. A couple more minutes would be all that was necessary to find out how to use ruby itself to accomplish this result. Laziness won over thoroughness and correctness. Result: a *huge* security hole.
Here’s what prompted me to invest in learning to add this feature in the Right Way™: a friend of mine who is an überGeek realized that, based on a clue I gave out about my script’s performance, he could have his way with my server via Twitter. I was Twitter-pwn’ed. Here’s what he sent me (knowing I watch my tweets via this script):
After he sent these two tweets my script sent me an email with this:
-rw-r--r-- 1 root root 0 Dec 27 03:39 /tmp/test
Yes. BASH executed his tweet (!) and as ROOT! So, if someone had tweeted “@rjamestaylor $(rm -rf /)” my server would be a barren husk of hardware. Worse, someone could have used my script — via Twitter! — to setup privileged user accounts, send spam (though small), attack other systems, etc. Why root (or as my geek friends would ask, WHY IN GOD’S NAME “root”?)? Simple: I was in a hurry. Stupid.
Lesson: spending the little bit of extra time necessary to add features without violating security protocols is always worth it. Sure, I could have just bought some CodeOffsets to assuage my guilt, but it was actually better to (1) shut down my script until (2) I fixed the security issues.
Turns out adding net::smtp to a script in ruby is painless. Now I have my feature and no exciting side-effects from rushed, careless development. In fact, most security holes I encounter in others’ code is due to the same thing: rush to add features without a review of implications. Anytime one takes external input from a user or the Internet (or Twitter) one must sanitize the input from unintended effects. This goes for SQL injection (parameters, people!) as well as simple command expansion attacks, among many other possible vectors.
So, go ahead and tweet BASH-expandable tweets to me, my code is not just offset, it’s fixed.
Twitter List support has been out for a while now but the impact of this new feature may not be readily apparent to most Twitter users. Yet, Lists have already changed Twitter in dramatic ways that you really need to know about.
Twitter Lists are user-created groupings of other Twitter accounts. This is somewhat like the client-side groups provided by TweetDeck, Seesmic Desktop, FriendFeed and others but since it is built into Twitter itself the impact is far-reaching. The biggest difference between client-side groups and Twitter Lists is that lists are public. User can “follow” lists others set up, for example.
Here’s a quick rundown of how Twitter Lists work. A logged in user can create up to 20 Lists containing 500 users each. The name of the List is up to the user and usually suggests the common trait tying the users together in the mind of the List creator. The list creator is also able to provide a description of the list created. The list can be public (default) or private (seen only by the list creator). However, users added to a list can see which list they are on regardless of the public/private setting of the list itself. That means users on a private list know who has listed them and knows the name of the list that they are on. [ed: Thanks to several people who have corrected me - I agree, private lists are private to the list curator and are not seen by those listed. My apologies!]
@rjamestaylor home page with count of Lists
When I log into Twitter I can see that I’m currently listed on 89 Lists (see above). I can also see the Lists to which I’m subscribed on the right most column of my Twitter home page.
Lists @rjamestaylor created or follows
Let’s create a list! The screencast below demonstrates creating a new list, adding users to the list, viewing the list and deleting the list. (Tip – watch in full screen mode)
The most obvious benefit of using Twitter Lists is to reduce the clutter in your reviewing of users’ tweets. By segmenting users into lists the “noise” of all the twitter users you follow is drastically reduced. But the game changing value of Twitter Lists is more subtle: following lists others make of interesting users.
Making lists and checking them twice
Since anyone can make lists of any (non-blocking) Twitter users and share these lists with the Twitter public a new way of discovering interesting users has come to Twitter. The impact is this: those users with special knowledge of other Twitter users can group otherwise unidentifiable users into easy to find categories. For example, if you’re interested in venture capitalists, you may have tried to find those VCs on Twitter you know of or can find through searching Twitter profiles for their own self-description as a VC. Yet, you may miss some key VCs without special knowledge. Twitter @Scobleizer probably knows more VCs on Twitter than most and he has faithfully created a list of VCs on Twitter: @Scobleizer/venture-capitalists. Now you can easily follow the thoughts, activities and actions (including locations) of the top venture capitalists on Twitter. Needless to say, finding trends among VCs is significantly easier for all of us due to Twitter Lists.
Let’s take this a step further. Say you are interested in a particular company for reasons such as news reporting, competitive intelligence, investment research, employment research, or even to follow the tweets of your own employees. Previously, finding Twitter users from particular companies relied on the self-reporting of each user. Now those with special knowledge of a company’s staff can make their own lists. So an employee of a company may not realize they have been listed by others as part of their employer’s Twitter users. Impact? Your personal intention to separate business from personal life on Twitter is compromised. More over, those companies that make their own list of employees who tweet make it very easy for the public to learn about the culture, sayings and doings of their employees. By having a public list of employees whether self-made or made by others with special insight, researching a company has been simplified. PR departments may think they control the public perception of the internal nature of their companies but Twitter Lists has busted this wide open.
Previously a Twitter user may have been followed by a handful of others. Such a user may have been careful not to related themselves to their employer but by being listed as an employee of their company they have become a de facto spokesperson on their company’s behalf. This is why I believe Twitter Lists have changed everything about Twitter.
For example, say a company is going into a quiet period required by the SEC. Because of Twitter Lists employees that believe they are speaking independently and privately now may give critical information to investors through tweets like, “Wow – just met our new owners – great company! Can’t wait until I can talk about this!” As part of a List of employees this may be an improper disclosure. This is an extreme example, sure, but a real one that could have employment and legal consequences for the employee.
Example two: an airline is facing inquiries from the FAA over possible maintenance violations. An employee not knowingly aggregated with his employer due to being listed on “Airline-X-engineers” list tweets, “finally the chickens are coming home to roost. Shortcuts we’ve been forced to make are getting exposed.” Oops.
Example three: a utility company suffers a public-affecting outage. Many people are impacted. Phone lines are jammed, customers are hurting. An unwittingly listed employee tweets, “Nothing to do at work so we’re catching up on World of Warcraft.” How do you think customers would react when the PR department releases a statement that everyone is working hard to recover power to each customer? Perhaps the employee works in accounting for the utility and their department really is at a point when the workers are able to catch a break. Think customers will understand that an accountant isn’t going to be manning the cherry pickers? Ouch!
Rethinking Twitter in light of Lists
Twitter has changed, dramatically, with the introduction of Lists. As a long time Twitter user I see that the former semi-anonymity associated with tweeting was seriously compromised by Twitter Search and practically eliminated due to Twitter Lists. I believe we all need to rethink some previously held assumptions about Twitter.
Should I tweet at all?
Previously I encouraged everyone to use Twitter. However now more than ever we must realize that tweeting can affect our personal and professional lives. Those with any concern that their tweets could jeopardize their livelihood should seriously consider not tweeting at all.
Those who continue to tweet need to remember that much is on the line with each tweet. Deleting a tweet is not guaranteed to remove it from the Internet (see: Once Tweeted, Never Deleted). Remembering to ask, “is this hurtful? Is this helpful?” before tweeting is necessary now more than ever.
I’m listed as an employee of my employer, what should I do differently?
First, make sure to carefully follow SEC and company policies with each tweet. Not sure what those rules are? Better read step one above and find out before continuing to tweet.
Second, before tweeting make sure that your company’s customers are not suffering on Twitter. How? Search for your company’s name or brands on Twitter using Twitter search. If your customers are suffering try to reach out to help them or consider not tweeting until the issues are resolved.
Third, remember that your company will be judged in aggregate through the tweets of listed company employees. Proud that your company provides expertise to customers related to technology? How about including relevant links every once in a while, or offering up a simple tip related to some area of your own expertise? That will positively impact not only the public perception of your company but help show you personally are a contributing member of the company to others. Conversely, if your company sells vegan products as its main product offering, tweeting about hunting trips and company outings that include baby backed ribs may have a negative impact on the company and your employment.
If I’m listed without wanting to be, what can I do?
Above I show how to tell whether or not you appear on any lists — check that frequently if you are concerned about which lists you appear. Currently Twitter users can add anyone that is not blocking them to a public or private list of their own choosing. So if you do not want to be on a particular list I recommend first trying to contact the list curator to have you removed. If that does not work, the more extreme step of blocking the list maker will remove you from any list you on which you do not wish to appear. Blocking is considered extreme and even rude, so use this as a last resort.
I want to use this new, powerful research tool – how do I get started?
Due to my concern over the average Twitter user I’ve focused on the worrisome aspects of Lists in this blog post. I care that people not be surprised about the changes to Twitter due to Lists and that’s my main focus here. However, Lists are powerful for reading as well. The best place I’ve found to begin exploring Lists is a third-party website specializing in Lists: listorious.com. On Listorious the top lists and list makers are curated and made searchable. Spend some time there to find lists that interest you. Once you find interesting lists and follow them think of the lists you would like to create and start making your own. Do be polite and sensitive to others that you list. Blocking may be considered rude but adding people to a list they do not want to be on can be hazardous to them, personally.
CodeOffsets.com aims to assuage the guilt of programmers for bad coding practices by allowing offenders to contribute money towards quality open source projects. From their own webpage:
The Bad Code Offset provides a convenient and rational approach for balancing out the bad code we all have created at one time or another throughout our lifetime—even when [...]
Thanks everyone for reading along. I hope you’ve enjoyed reading these
tips as much as I’ve enjoyed writing them.
For the last installment, I wanted to share a very cool feature in VIM
that I am just beginning to learn how to use. VIM provides support for
Perl, Python and Ruby so that you can use these [...]
VIM’s got a lot of helpful commands that start with g. Not sure why g,
of all letters, but there you are.
One that I find really helpful when running through Apache
configurations is gf. If you put your cursor over the path to a file
and type:
gf
VIM will open up the file that’s under your cursor. [...]
We went over creating VIM macros in a previous tip. If you save your
macros to a file, you can have VIM run the macro against a file,
effectively creating a batch mode for executing VIM macros.
Let’s say that, for whatever reason, you want to convert a file to all
lower case. Create a file called [...]
VIM ships with a number of plugins, which are scripts that enhance VIM’s
basic functionality. You’ll find the plugins that shipped with your
copy of VIM in $VIMRUNTIME/plugin.
(Sub-tip: don’t know where VIM is installed? In vim, type “:echo
$VIMRUNTIME“.)
We talked about syntax highlighting in an earlier tip. Syntax
highlighting is great and it makes code more [...]
